@tea-agent/loop-agent 0.42.0-next.5 → 0.42.0-next.7

package/dist/workflows/dag/init-hybrid.js

@@ -26,7 +26,7 @@ import { CANONICAL_TASK_ID_PATTERN, getTaskPaths, loadTaskConfig } from "../../t
 import { materializeTaskReferenceDocs } from "../../task/source-references.js";
 import { observeTaskContract } from "../../task/contract/observe.js";
 import { extractRequirementFactsFromMarkdown } from "../../task/source-prepare/parse-intent.js";
-import { computeLedgerInputDigest, parseLedgerJson, recoverLedgerInputContract, } from "../../task/source-prepare/ledger.js";
+import { computeLedgerInputDigest, parseLedgerJson, recoverLedgerInputContract, validateRequirementLedger, } from "../../task/source-prepare/ledger.js";
 import { REQUIREMENT_LEDGER_FILE_NAME } from "../../task/contract/constants.js";
 import { dagHasWriterExecution } from "./task-contract-binding.js";
 import { DEFAULT_VERIFY_TIMEOUT_MS, resolveVerifyPreset, } from "../../executors/shell-verification.js";
@@ -1224,21 +1224,121 @@ function canonicalizeVerificationCommands(commands) {
 }
 function assertVerificationPlanPreflight(input) {
     const root = path.resolve(input.repoRoot);
+    const statuses = [];
     for (const command of input.commands) {
         const cwd = path.resolve(command.cwd);
         if (!isWithinRepo(root, cwd) || !existsSync(cwd)) {
             throw new Error(`verification preflight rejected cwd for ${command.label}: ${command.cwd}`);
         }
+        const vitestStatus = verifyVitestCommandPreflight({
+            command,
+            root,
+            taskConfig: input.taskConfig,
+        });
+        if (vitestStatus) {
+            statuses.push({ label: command.label, status: vitestStatus });
+            continue;
+        }
         const script = localScriptTarget(command);
-        if (!script)
+        if (!script) {
+            statuses.push({ label: command.label, status: "ok" });
             continue;
+        }
         const scriptPath = path.resolve(cwd, script);
-        if (existsSync(scriptPath))
+        if (existsSync(scriptPath)) {
+            statuses.push({ label: command.label, status: "ok" });
             continue;
+        }
         const writerMayCreate = input.taskConfig.allowedPaths.some((allowed) => pathMatchesPattern(script, allowed.replace(/^\.\//, "")));
         if (!writerMayCreate) {
             throw new Error(`verification preflight missing local script for ${command.label}: ${script}`);
         }
+        statuses.push({ label: command.label, status: "future-delivery-script" });
+    }
+    return statuses;
+}
+function verifyVitestCommandPreflight(input) {
+    const args = normalizeVerifyCommandArgs(input.command.args);
+    const vitestIndex = args.findIndex((arg) => path.basename(arg).replace(/\.(?:exe|cmd)$/i, "") === "vitest");
+    if (vitestIndex < 0)
+        return undefined;
+    const configArgIndex = args.findIndex((arg, index) => index > vitestIndex &&
+        (arg === "--config" || arg === "-c" || arg.startsWith("--config=")));
+    let configPath;
+    if (configArgIndex >= 0) {
+        const arg = args[configArgIndex];
+        configPath = arg.startsWith("--config=")
+            ? arg.slice("--config=".length)
+            : args[configArgIndex + 1];
+    }
+    const cwd = path.resolve(input.command.cwd);
+    const configAbsolute = configPath
+        ? path.resolve(cwd, configPath)
+        : findRootVitestConfig(input.root);
+    const configRelative = configAbsolute
+        ? path.relative(input.root, configAbsolute).replace(/\\/g, "/")
+        : undefined;
+    if (configAbsolute && !existsSync(configAbsolute)) {
+        const writerMayCreate = Boolean(configRelative &&
+            input.taskConfig.allowedPaths.some((allowed) => pathMatchesPattern(configRelative, allowed.replace(/^\.\//, ""))));
+        if (!writerMayCreate) {
+            throw new Error(`verification preflight missing Vitest config for ${input.command.label}: ${configRelative ?? configPath}`);
+        }
+    }
+    const targetPaths = vitestTargetPaths(args.slice(vitestIndex + 1));
+    if (targetPaths.length === 0)
+        return "ok";
+    const inheritedConfig = !configPath && configAbsolute && existsSync(configAbsolute);
+    if (inheritedConfig && vitestConfigExcludesDogfood(configAbsolute, targetPaths)) {
+        throw new Error(`verification preflight Vitest target ${targetPaths.join(", ")} is excluded by ${path.relative(input.root, configAbsolute).replace(/\\/g, "/")}`);
+    }
+    const futureTargets = targetPaths.filter((target) => {
+        const absolute = path.resolve(cwd, target);
+        if (existsSync(absolute))
+            return false;
+        return !input.taskConfig.allowedPaths.some((allowed) => pathMatchesPattern(target, allowed.replace(/^\.\//, "")));
+    });
+    if (futureTargets.length > 0) {
+        throw new Error(`verification preflight missing Vitest target for ${input.command.label}: ${futureTargets.join(", ")}`);
+    }
+    const missingAllowedTargets = targetPaths.filter((target) => !existsSync(path.resolve(cwd, target)));
+    return missingAllowedTargets.length > 0 ? "future-test-target" : "ok";
+}
+function findRootVitestConfig(root) {
+    for (const name of ["vitest.config.ts", "vitest.config.js", "vitest.config.mjs", "vitest.config.cjs"]) {
+        const candidate = path.join(root, name);
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return undefined;
+}
+function vitestTargetPaths(args) {
+    const targets = [];
+    let afterRun = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "run" || arg === "related") {
+            afterRun = true;
+            continue;
+        }
+        if (!afterRun || arg.startsWith("-")) {
+            if ((arg === "--config" || arg === "-c" || arg === "--reporter") && !arg.includes("="))
+                index += 1;
+            continue;
+        }
+        targets.push(arg);
+    }
+    return targets.filter((target) => target.includes("/") || /\.(?:test|spec)\.[^/]+$/.test(target));
+}
+function vitestConfigExcludesDogfood(configPath, targets) {
+    if (!targets.some((target) => target.replace(/\\/g, "/").startsWith("dogfood/")))
+        return false;
+    try {
+        const text = readFileSync(configPath, "utf8");
+        return /exclude\s*:[\s\S]{0,500}dogfood\/\*\*/.test(text);
+    }
+    catch {
+        return false;
     }
 }
 function isWithinRepo(root, candidate) {
@@ -1307,10 +1407,11 @@ function buildVerifyEvidence(input) {
         selectionReasons: selectedCommands?.map((command) => input.phase === "intermediate" && isFullSuiteVerifyCommand(command)
             ? `${command.label}: deferred-heavy`
             : `${command.label}: kept`) ?? [],
-        preflight: selectedCommands?.map((command) => ({
-            label: command.label,
-            status: "ok",
-        })) ?? [],
+        preflight: input.preflight ??
+            (selectedCommands?.map((command) => ({
+                label: command.label,
+                status: "ok",
+            })) ?? []),
         commandTimeoutMs: input.commandTimeoutMs,
         totalTimeoutBudgetMs: commandCount * input.commandTimeoutMs,
         finalFullRequired: input.finalFullRequired,
@@ -1499,6 +1600,8 @@ function extractExplicitRequirementIds(requirementMarkdown, ...fallbackMarkdown)
             : markdown;
         for (const match of source.matchAll(/\b(?:REQ|BR|AC)-[A-Z0-9]+(?:-[A-Z0-9]+)*\b/gi)) {
             const id = match[0].toUpperCase();
+            if (isPlaceholderRequirementId(id))
+                continue;
             if (!seen.has(id)) {
                 seen.add(id);
                 ids.push(id);
@@ -1528,6 +1631,8 @@ function extractSectionRequirementIds(sectionMarkdown) {
     const seen = new Set();
     for (const match of sectionMarkdown.matchAll(/\b(?:REQ|BR|AC)-[A-Z0-9]+(?:-[A-Z0-9]+)*\b/gi)) {
         const id = match[0].toUpperCase();
+        if (isPlaceholderRequirementId(id))
+            continue;
         if (!seen.has(id)) {
             seen.add(id);
             ids.push(id);
@@ -1535,6 +1640,9 @@ function extractSectionRequirementIds(sectionMarkdown) {
     }
     return ids;
 }
+function isPlaceholderRequirementId(id) {
+    return /(?:^|-)X{2,}$/.test(id);
+}
 /**
  * Prefer TaskSpec-scoped acceptance refs from the derived 需求.md section when
  * present. Full Feature acceptance.yaml may list sibling ACs that this task is
@@ -1613,21 +1721,14 @@ function buildDagSourceBinding(sources, taskKind) {
     const ledgerBinding = loadPersistedFrontendSourceBindingLedger(sources);
     if (!ledgerBinding)
         return base;
-    // AC-002 / AC-HARD-002：物化 REQ-SRC-* canonical id 确定性并入 v2 requirementIds。
-    // 生成型 REQ-SRC-* id 无法从 markdown 文本导出（必须来自持久化 ledger），此处
-    // 在 required requirement ids 侧确定性注入，确保 prewrite missing-requirement-ids
-    // 不误伤（不要求文本可导出）也不漏检（物化 id 必须被契约覆盖）。
-    const materializedRequirementIds = Object.keys(ledgerBinding.requirementToFragments)
-        .filter((id) => /^REQ-SRC-/.test(id) && !base.requirementIds.includes(id))
-        .sort();
+    // v2 is ledger-owned: the persisted canonical set is the only requirement
+    // identity source. In particular, explanatory AC-XXX mentions from a
+    // materialized reference document must not leak in beside ledger ids.
     return {
         schemaVersion: 2,
         taskId: base.taskId,
         sources: base.sources,
-        requirementIds: [
-            ...base.requirementIds,
-            ...materializedRequirementIds,
-        ],
+        requirementIds: ledgerBinding.requirementIds,
         ledgerPath: ledgerBinding.ledgerPath,
         ledgerSha256: ledgerBinding.ledgerSha256,
         inputDigest: ledgerBinding.inputDigest,
@@ -1644,15 +1745,19 @@ function buildDagSourceBinding(sources, taskKind) {
  */
 function loadPersistedFrontendSourceBindingLedger(sources) {
     const referenceDocs = (sources.referenceDocuments ?? []).filter((doc) => doc.markdown.trim().length > 0);
-    if (referenceDocs.length === 0)
-        return null;
+    const ledgerAbsolutePath = path.join(sources.taskDir, "source", REQUIREMENT_LEDGER_FILE_NAME);
+    // Text-created frontend tasks have no imported reference manifest. Their
+    // task-owned projected requirement is nevertheless a valid canonical source
+    // document and is persisted in the v2 ledger by source preparation. Keep it
+    // in the current-input map below instead of silently downgrading to v1.
     // 存在性守卫（保持既有 v1 回退行为）：派生视图无可抽取 requirement/acceptance
     // 引用时不要求持久化 ledger，直接回退 base binding。此守卫只用于"是否 ledger
     // 任务"判定，绝不参与 digest 键计算——键输入完全来自持久化 ledger 恢复。
     const guardFacts = extractRequirementFactsFromMarkdown(sources.requirementMarkdown);
-    if (guardFacts.acceptanceCriteria.length === 0)
+    if (guardFacts.acceptanceCriteria.length === 0 && referenceDocs.length > 0)
+        return null;
+    if (referenceDocs.length === 0 && !existsSync(ledgerAbsolutePath))
         return null;
-    const ledgerAbsolutePath = path.join(sources.taskDir, "source", REQUIREMENT_LEDGER_FILE_NAME);
     let raw;
     try {
         raw = readFileSync(ledgerAbsolutePath, "utf8");
@@ -1668,6 +1773,13 @@ function loadPersistedFrontendSourceBindingLedger(sources) {
     catch (error) {
         throw new Error(`SOURCE_FIDELITY_LEDGER_MISSING: persisted ${REQUIREMENT_LEDGER_FILE_NAME} is not a valid v1 ledger: ${error instanceof Error ? error.message : String(error)}`);
     }
+    const ledgerErrors = validateRequirementLedger(ledger);
+    if (ledgerErrors.length > 0) {
+        const first = ledgerErrors[0];
+        throw new Error(`${first.code}: persisted ${REQUIREMENT_LEDGER_FILE_NAME} is invalid; refusing to start a frontend DAG with incomplete source bindings (${ledgerErrors
+            .map((error) => error.message)
+            .join("; ")})`);
+    }
     // canonical 侧：ledger.canonicalRequirements 按 build 顺序原样保留输入 canonical
     // requirements（id/text 逐字节），过滤物化 REQ-SRC-*（AC-HARD-002 "物化不入键"）
     // 即精确恢复 digest 输入集；派生导航视图 需求.md 投影不参与键计算。
@@ -1686,6 +1798,13 @@ function loadPersistedFrontendSourceBindingLedger(sources) {
     for (const doc of referenceDocs) {
         currentByPath.set(toDagSourcePath(sources, doc.path), doc.markdown);
     }
+    if (referenceDocs.length === 0) {
+        currentByPath.set(toDagSourcePath(sources, sources.requirementPath), 
+        // applyTaskContract appends a derived `## Source ledger` navigation
+        // block after the ledger input has been hashed. Remove that block when
+        // reconstructing the canonical text digest.
+        sources.requirementMarkdown.replace(/\n## Source ledger\b[\s\S]*$/u, ""));
+    }
     const missingAuthoritativePaths = contract.sourcePaths.filter((sourcePath) => !currentByPath.has(sourcePath));
     if (missingAuthoritativePaths.length > 0) {
         throw new Error(`SOURCE_FIDELITY_LEDGER_STALE: persisted ${REQUIREMENT_LEDGER_FILE_NAME} was built from authoritative source documents no longer present (${missingAuthoritativePaths.join(", ")}); re-run task advance (intake) to rebuild the ledger`);
@@ -1713,6 +1832,7 @@ function loadPersistedFrontendSourceBindingLedger(sources) {
         ledgerPath: toDagSourcePath(sources, ledgerAbsolutePath),
         ledgerSha256,
         inputDigest: ledger.inputDigest,
+        requirementIds: ledger.canonicalRequirements.map((requirement) => requirement.id),
         requirementToFragments,
     };
 }
@@ -1845,6 +1965,7 @@ export async function loadTaskHybridSources(repoRoot, taskId) {
     const manifest = await loadHarnessManifest(repoRoot);
     const strategy = resolveDagVerifyStrategy(taskConfig);
     let verifyCommands;
+    let verificationPreflight = [];
     try {
         const adapter = await resolveAdapter(repoRoot);
         const preset = resolveVerifyPreset(taskConfig.verifyPreset, taskConfig);
@@ -1868,7 +1989,7 @@ export async function loadTaskHybridSources(repoRoot, taskId) {
             ...taskVerifyCommands(repoRoot, taskConfig),
             ...adapterFinal,
         ]);
-        assertVerificationPlanPreflight({
+        verificationPreflight = assertVerificationPlanPreflight({
             repoRoot,
             commands: [...intermediatePlan.commands, ...finalPlan.commands],
             taskConfig,
@@ -1911,6 +2032,7 @@ export async function loadTaskHybridSources(repoRoot, taskId) {
         enabledExecutors: resolveEnabledExecutors(manifest.executors),
         executorModelMatrix: resolveExecutorModelMatrices(manifest),
         verifyCommands,
+        verificationPreflight,
         sddEmbeddedSkills: await probeRepoLocalSddSkills(repoRoot),
         projectGovernancePresent: await discoverProjectGovernancePresence(repoRoot),
         ...(frontendShapeTransitionCapsule ? { autoloadedFrontendShapeTransitionCapsule: frontendShapeTransitionCapsule } : {}),
@@ -2004,6 +2126,7 @@ export function buildStandardHybridDagFromTask(sources) {
                         finalFullRequired: true,
                         commandTimeoutMs: DEFAULT_VERIFY_TIMEOUT_MS,
                         plan: finalVerifyPlan,
+                        preflight: sources.verificationPreflight,
                     }),
                     cwd: ".",
                     timeoutMs: DEFAULT_VERIFY_TIMEOUT_MS,
@@ -2331,6 +2454,7 @@ function buildFrontendMockVerifyNode(sources, implementId, readOnlyPaths, forbid
                 fallbackCommands: [],
                 commandTexts: commands,
                 commandTimeoutMs: DEFAULT_VERIFY_TIMEOUT_MS,
+                preflight: sources.verificationPreflight,
             }),
             cwd: ".",
             timeoutMs: DEFAULT_VERIFY_TIMEOUT_MS,
@@ -3043,6 +3167,7 @@ async function buildFrontendHybridDagFromTask(sources) {
         fallbackCommands: staticFallbackCommands,
         commandTexts: staticShellCommands,
         commandTimeoutMs: DEFAULT_VERIFY_TIMEOUT_MS,
+        preflight: sources.verificationPreflight,
     });
     const lintVerifyEvidence = lintShellCommands.length > 0
         ? buildVerifyEvidence({
@@ -3053,6 +3178,7 @@ async function buildFrontendHybridDagFromTask(sources) {
             fallbackCommands: [],
             commandTexts: lintShellCommands,
             commandTimeoutMs: DEFAULT_VERIFY_TIMEOUT_MS,
+            preflight: sources.verificationPreflight,
         })
         : undefined;
     const behaviorVerifyEvidence = buildVerifyEvidence({
@@ -3064,6 +3190,7 @@ async function buildFrontendHybridDagFromTask(sources) {
         commandTexts: behaviorShellCommands,
         finalFullRequired: true,
         commandTimeoutMs: DEFAULT_VERIFY_TIMEOUT_MS,
+        preflight: sources.verificationPreflight,
     });
     const mockVerifyTemplate = mockMode === "required" && hasMockVerifyCommands
         ? buildFrontendMockVerifyNode(frontendSources, implementId, readOnlyPaths, forbiddenPaths)
@@ -3227,7 +3354,7 @@ async function buildFrontendHybridDagFromTask(sources) {
                 subtask_prompt: [
                     "Inspect frontend code, routing, components, styles, package scripts, and tests.",
                     "Return code and design observations, existing reuse opportunities, and verification entry points.",
-                    "Report target surface and design evidence as facts (no fixed section title required): completeness, entrypoint, routeOrMount, implementationPaths, testPaths, dataSource, allowedPathConflicts, unresolvedPaths. Use repository-relative POSIX paths. A complete surface must name at least one proven entrypoint, implementation path, or test path and set unresolvedPaths to []; if any target ownership remains unknown, commit completeness=blocked with every unresolved path instead of guessing. implementationPaths and testPaths must name the existing files/directories that actually own the requested behavior; allowedPathConflicts must list every discovered path not covered by task allowedPaths, or [] when none exists.",
+                    "Report target surface and design evidence as facts (no fixed section title required): completeness, entrypoint, routeOrMount, implementationPaths, testPaths, dataSource, allowedPathConflicts, unresolvedPaths. Use repository-relative POSIX paths. A complete surface must name at least one target candidate and set unresolvedPaths to []; if any target ownership remains unknown, commit completeness=blocked with every unresolved path instead of guessing. Prefer existing files/directories when they exist. For a greenfield target explicitly pinned by the task source, future implementation/test paths are allowed, but every such path must be named by the source and runtime-enriched as sourceDeclared; do not invent paths merely because they fit allowedPaths. allowedPathConflicts must list every discovered path not covered by task allowedPaths, or [] when none exists.",
                     "Derive all file paths from this target workspace. Do not assume the project uses src/, test/, React, or the loop-agent repository layout.",
                     "Read-only: do not modify repository files.",
                     sourceContexts.scout,
@@ -3422,6 +3549,7 @@ async function buildFrontendHybridDagFromTask(sources) {
                 outputContract: "The implementation status is derived by the executor from mechanical facts (write-tool events, run delta, write guard, requirement coverage, focused-check), not from any IMPLEMENTATION_OUTCOME first line. Deliver a Markdown summary with Contract Ref (path/schema/hash), Changed Files, Requirements Implemented, UI States, Tests Changed, Verification Attempts, Deviations, and Residual Risks. Follow fixed stages: contract confirm → tests → component/state → API/Mock → focused checks → diff cleanup.",
                 subtask_prompt: [
                     "Implement against the validated run-owned Frontend Implementation Contract materialized by frontend-design-policy-shell (path/schema/hash) and authorized by frontend-writer-admission-shell. Do not rebuild the contract from Markdown alone.",
+                    "WRITER TOOL PROTOCOL (hard): the response text is not delivery. Never paste source code, test code, or full file contents into chat. After reading the canonical contract, make the first implementation change with the structured write/edit tool (one file per call); continue writing through those tools until the writeSet is complete. If a write/edit tool is unavailable, stop and report the blocked capability instead of drafting code in the response.",
                     "The canonical contract already contains the approved requirement, target-file, UI-state, verification, design, and Mock/API decisions. Do not re-open task sources, OpenSpec, AI workspace, plan/revision, or design-review prose, and do not repeat broad repository research. Inspect only contract target files and directly related local code needed to implement them.",
                     "Execute in fixed stages and report each in the delivery summary: (1) Contract confirm, (2) Tests sync, (3) Component/UI state implementation, (4) API/Mock wiring per contract.mockApi, (5) Focused checks behind frozen entrypoints only, (6) Diff cleanup.",
                     "Map every requirement id, expectedOutcome, interaction trigger/expectedBehavior, and applicable UI state from the contract to concrete files. Do not invent shell verification commands; only frozen static/behavior entrypoints will run.",
@@ -4243,7 +4371,11 @@ const stripBackticks=s=>s.split(bt).join('');
 const invalidReason=raw=>{const st=norm(raw);if(/^p[0-2]$/.test(st))return 'priority-only-module-stem';if(/^[a-f][a-f0-9]{6,63}$/.test(st))return 'opaque-hash-module-stem';if(st==='readme')return 'reserved-module-stem';if(!/^[a-z][a-z0-9_]*$/.test(st))return 'invalid-syntax';if(/^(?:be|tp|ac|req|br)[_-]/i.test(st))return 'case-like-module-stem';return null;};
 const valid=raw=>invalidReason(raw)===null;
 const rxRelLink=/\\[[^\\]]+\\]\\(\\.\\/([A-Za-z0-9_.-]+)\\.md\\)/g;
+const headingAlias={'\u6a21\u5757\u7d22\u5f15':'Module Index','\u8986\u76d6\u8303\u56f4':'Coverage Scope','\u8986\u76d6\u77e9\u9635':'Coverage Matrix','\u573a\u666f\u5206\u533a':'Scenario Partitions'};
 const allLines=readme.replace(/\\r\\n/g,'\\n').replace(/\\r/g,'\\n').split('\\n');
+let headingRepair=false;
+for(let i=0;i<allLines.length;i++){const alias=/^##\\s+(模块索引|覆盖范围|覆盖矩阵|场景分区)\\s*$/.exec(allLines[i].trim());if(alias){allLines[i]='## '+headingAlias[alias[1]];headingRepair=true;}}
+if(headingRepair)readme=allLines.join('\\n');
 const headings=[];for(let i=0;i<allLines.length;i++){if(allLines[i].trim()==='## Module Index')headings.push(i);}
 if(headings.length!==1){process.stderr.write((headings.length===0?'missing-module-index':'duplicate-module-index')+'; require exactly one exact ## Module Index section\\n');process.exit(2);}
 const start=headings[0]+1;let end=allLines.length;for(let i=start;i<allLines.length;i++){if(/^##\\s+\\S/.test(allLines[i].trim())){end=i;break;}}
@@ -4256,7 +4388,7 @@ const headerIndex=lines.findIndex(line=>{const row=cells(line);return expectedHe
 if(headerIndex<0){process.stderr.write('invalid-module-index-header: require exact business ownership and path columns\\n');process.exit(2);}
 const dataRows=lines.slice(headerIndex+2).map(cells).filter(row=>row.length>=8&&row[0]&&row[0]!=='Module Stem');
 const allowedSplit=new Set(['explicit-user-layout','primary-business-resource','independent-business-resource','output-budget']);
-const operationOwners=new Map();const canonicalSeen=new Set();const declaredModules=[];let planRepairApplied=false;
+const operationOwners=new Map();const canonicalSeen=new Set();const declaredModules=[];let planRepairApplied=headingRepair;
 for(const row of dataRows){
   const rawStem=String(row[0]||'').trim(),resource=String(row[1]||'').trim(),operations=String(row[2]||'').split(';').map(value=>value.trim()).filter(Boolean),split=String(row[5]||'').trim();
   const mdMatches=[...String(row[6]||'').matchAll(rxMdPath)];
@@ -4298,6 +4430,8 @@ if(planRepairApplied){
   const table=['| '+expectedHeader.join(' | ')+' |','|'+expectedHeader.map(()=>'---').join('|')+'|',...declaredModules.map(item=>'| '+[item.stem,item.businessResource,item.ownedOperations.join('; '),item.ownedRuleKeys.join('; '),item.caseIds.join('; '),item.splitReason,'['+item.stem+'](./'+item.stem+'.md) '+item.markdownPath,item.pytestPath].join(' | ')+' |')].join('\\n');
   readme=[...allLines.slice(0,headings[0]+1),table,...allLines.slice(end)].join('\\n');
   fs.writeFileSync(planPath,readme,'utf8');
+} else if(headingRepair){
+  fs.writeFileSync(planPath,readme,'utf8');
 }
 for(const [operation,owners] of operationOwners){if(owners.length>1&&!owners.every(owner=>owner.split==='explicit-user-layout'||owner.split==='output-budget')){process.stderr.write('overlapping-operation-modules: '+operation+' -> '+owners.map(owner=>owner.stem).join(',')+'; merge by business resource or use an authoritative explicit-user-layout\\n');process.exit(2);}}
 if(!strictLayout){
@@ -4315,7 +4449,34 @@ if(modules.length===0){process.stderr.write('empty-module-index: require at leas
 if(modules.length>8){process.stderr.write('excessive-module-count: '+modules.length+' > 8; merge by the smallest stable business resource/domain set\\n');process.exit(2);}
 const planReadPath=path.relative(process.cwd(),planPath).split(path.sep).join('/');
 const planSha256=crypto.createHash('sha256').update(readme).digest('hex');
-process.stdout.write(JSON.stringify({modules:modules.map(item=>({...item,planReadPath})),planReadPath,planSha256,moduleLayout:{schemaId:'backend-test-module-layout-facts-v1',source:strictLayout?'task-contract':'plan-derived',contractSha256:strictLayoutSha256,mode:strictLayout&&strictLayout.mode||'business-resource-layout',planRepairAttemptCount:planRepairApplied?1:0,planRepairOutcome:planRepairApplied?'changed':'not-required'}}));
+const slotTok=v=>String(v).trim().toUpperCase().replace(/[^A-Z0-9]+/g,'-').replace(/^-+|-+$/g,'');
+const partHead=[];for(let i=0;i<allLines.length;i++){if(allLines[i].trim()==='## Scenario Partitions')partHead.push(i);}
+if(partHead.length>1){process.stderr.write('duplicate-scenario-partitions; require at most one exact ## Scenario Partitions section\\n');process.exit(2);}
+const slotByModule=new Map(modules.map(m=>[m.stem,[]]));const unassigned=[];
+if(partHead.length===1){
+  const pStart=partHead[0]+1;let pEnd=allLines.length;for(let i=pStart;i<allLines.length;i++){if(/^##\\s+\\S/.test(allLines[i].trim())){pEnd=i;break;}}
+  const pLines=allLines.slice(pStart,pEnd).filter(l=>l.includes('|'));
+  const pCells=line=>line.split('|').slice(1,-1).map(v=>stripBackticks(v).trim());
+  const pHeader=['Partition ID','Operation','Axis','Domain','Required Slots','Expected by Slot','Bind Rule'];
+  const pH=pLines.findIndex(line=>pHeader.every((v,i)=>pCells(line)[i]===v));
+  if(pH<0){process.stderr.write('MISSING_PARTITION_TABLE: Scenario Partitions section has no canonical header row\\n');process.exit(2);}
+  const pRows=pLines.slice(pH+2).map(pCells).filter(r=>r.length>=7&&r[0]&&r[0]!=='Partition ID');
+  for(const row of pRows){
+    const pid=String(row[0]||'').trim(),op=String(row[1]||'').trim(),domain=String(row[3]||'').split(/[;,，；]/).map(v=>v.trim()).filter(Boolean),optional=/omit/i.test(String(row[4]||'')),bind=String(row[6]||'').trim();
+    const prefix=/^SP-[A-Z0-9][A-Z0-9._-]*$/i.test(pid)?('TP-'+pid.toUpperCase()):('TP-SP-'+slotTok(op)+'-'+slotTok(String(row[2]||'')));
+    const slotIds=[...domain.map(v=>prefix+'-'+slotTok(v)),...(optional?[prefix+'-OMITTED']:[]),prefix+'-NOT-IN-SET'];
+    const owners=modules.filter(m=>(m.ownedRuleKeys||[]).includes(bind)||(m.ownedOperations||[]).some(o=>String(o).replace(/\\s+/g,' ').toUpperCase()===op.replace(/\\s+/g,' ').toUpperCase()));
+    const uniqueOwners=[...new Set(owners.map(o=>o.stem))];
+    if(uniqueOwners.length===1){for(const id of slotIds)slotByModule.get(uniqueOwners[0]).push(id);}
+    else if(modules.length===1){for(const id of slotIds)slotByModule.get(modules[0].stem).push(id);}
+    else unassigned.push(...slotIds);
+  }
+}
+if(unassigned.length){process.stderr.write('unassigned-partition-slots: '+unassigned.join(',')+'\\n');process.exit(2);}
+const slotInventory={schemaId:'backend-test-scenario-partition-slots-v1',planSha256,modules:modules.map(m=>({stem:m.stem,requiredVariantSlots:[...new Set(slotByModule.get(m.stem)||[])]})),unassignedSlotIds:[]};
+fs.mkdirSync(path.join(runDir,'contracts'),{recursive:true});
+fs.writeFileSync(path.join(runDir,'contracts','backend-test-scenario-partition-slots.json'),JSON.stringify(slotInventory,null,2));
+process.stdout.write(JSON.stringify({modules:modules.map(item=>({...item,planReadPath,requiredVariantSlots:(slotInventory.modules.find(m=>m.stem===item.stem)||{requiredVariantSlots:[]}).requiredVariantSlots})),planReadPath,planSha256,moduleLayout:{schemaId:'backend-test-module-layout-facts-v1',source:strictLayout?'task-contract':'plan-derived',contractSha256:strictLayoutSha256,mode:strictLayout&&strictLayout.mode||'business-resource-layout',planRepairAttemptCount:planRepairApplied?1:0,planRepairOutcome:planRepairApplied?'changed':'not-required'},partitionSlots:slotInventory}));
 `;
     const encoded = deflateRawSync(Buffer.from(script, "utf8")).toString("base64");
     return `node -e "eval(require('zlib').inflateRawSync(Buffer.from('${encoded}','base64')).toString('utf8'))"`;
@@ -4896,9 +5057,9 @@ async function buildBackendTestHybridDag(sources) {
         subtask_prompt: [
             "This is a required plan-generation node. Read only the strict read set and return the complete Markdown plan in the assistant response. The runtime persists the response as a run-owned Harness artifact named generate-backend-md-plan-pi/plan.md. Do not write testcase/md/README.md or any project file; module case cards are written by downstream sharded nodes.",
             "Output budget protocol (hard, max output <=16K per turn): Never paste full Matrix, case bodies, or source text into assistant chat. README holds only Scope+Matrix+module index; never inline full case bodies. If a Completeness Gate / OUTPUT_LIMIT_RECOVERY retry is injected, continue only listed target paths.",
-            "Return the complete plan as plain Markdown. Do not emit JSON or code fences. The plan must contain the exact ## Coverage Scope, ## Coverage Matrix and ## Module Index sections required by the downstream manifest.",
+            "Return the complete plan as plain Markdown. Do not emit JSON or code fences. The plan must contain the exact English protocol headings ## Coverage Scope, ## Coverage Matrix, ## Scenario Partitions when applicable, and ## Module Index. Never translate those headings into 覆盖范围/覆盖矩阵/场景分区/模块索引.",
             "Read the upstream environment report only through the strict read set. Generate the Markdown-first backend test plan; it will be persisted under the current DAG run's Harness artifacts, not under testcase/md/.",
-            "Write human-readable content in Simplified Chinese by default. Keep English only for machine-readable IDs and technical literals such as Case/AC/REQ/BR IDs, HTTP methods, paths, field names, enum values, commands, filenames, code symbols and exact source citations.",
+            "Write human-readable content in Simplified Chinese by default. Keep English protocol literals exact: section headings, table headers, Partition IDs, TP IDs, Case IDs, HTTP methods, paths, field names, enum values, commands, filenames, code symbols and source citations. Never translate ## Module Index into ## 模块索引.",
             "Create the concise plan entry page: test objective, target/environment, isolation/cleanup, module summary and a linked case index table with Case ID, Chinese case name, scenario type, endpoint and expected status/result. Avoid repeating every case body in the plan artifact.",
             "Before the Coverage Matrix, write a mandatory machine-readable `## Coverage Scope` section in the plan artifact using exactly `| Field | Value |`, immediately followed by the separator row `|---|---|`, and these six unique rows: `Change Classification`, `Coverage Policy`, `Affected Operations`, `Affected Rule Keys`, `Regression Floor`, `Scope Evidence`. Always set `Change Classification` to `new-operation` and `Coverage Policy` to `full-contract`; do NOT reason about whether operations are new or existing. Cover all in-scope rules from the requirement document at full depth; treat the product requirement as the coverage baseline and use API contract evidence (fields/status/enum/boundary/format) to supplement scenario dimensions. Scope is limited to operations/rules the requirement document (or its referenced API contract) explicitly describes; do not expand to unrelated operations that the requirement does not mention. List affected operations exactly as `METHOD /path`, stable rule keys separated by semicolons, and precise source pointers as Scope Evidence.",
             "Coverage depth is full over the in-scope rules: fully cover every documented status, request/response field rule, requiredness, enum, boundary, format, auth and business state of each affected operation the requirement describes, but do not re-test unrelated operations the requirement does not mention. Inspect shared validator/helper/DTO/query builder evidence and expand Affected Operations when the same affected path can affect them; unresolved impact stays visible as GAP/CONFLICT.",
@@ -4914,7 +5075,7 @@ async function buildBackendTestHybridDag(sources) {
                 ]
                 : []),
             "Include exactly one `## Module Index` table with this exact header: `| Module Stem | Business Resource | Owned Operations | Owned Rule Keys | Case IDs | Split Reason | Markdown Path | Pytest Path |`. Use canonical relative links `[label](./<stem>.md)` inside the Markdown Path cell followed by the resolved `${layout.markdownDir}/<stem>.md` path. Split Reason is exactly one of `explicit-user-layout`, `primary-business-resource`, `independent-business-resource`, or `output-budget`. Group by stable business resource/domain, not by CRUD operation, AC, parameter/field axis, scenario type or regression purpose: one resource's list/detail/create/update/delete and its filters/response assertions/regression floor belong in one module. Multiple modules owning the same exact `METHOD /path` are forbidden unless every such row is `explicit-user-layout` from primary-requirement path pairs or has a documented `output-budget` proof. Keep the total module count at the smallest safe value and never exceed 8 modules. Name model-derived modules with stable lowercase business stems such as `health` or `resource_notes`; explicit-user-layout preserves the primary requirement filename stem even when it is more specific. Do not use priority-only stems `p0`, `p1` or `p2`; Priority belongs only in the Coverage Matrix. Pure hexadecimal/hash-like opaque stems and test-purpose-only stems are forbidden. Do not use Case-ID-like module filenames. The relative link target, Markdown Path, Pytest Path and downstream automation mapping must be one-to-one and exact; for model-derived modules the default pair remains `testcase/md/<module>.md` and `testcase/test_<module>.py`, while explicit-user-layout preserves the primary requirement paths. Do not hand-write a conflicting module count in prose; the Module Index row count is the only count truth.",
-            "Scenario Partitions (query/filter axes): for every affected GET/list operation, declare one row per enum or classification axis used for filtering (query/path parameters such as type/status/category). Add a mandatory machine-readable `## Scenario Partitions` section after the Coverage Matrix using exactly `| Partition ID | Operation | Axis | Domain | Required Slots | Expected by Slot | Bind Rule |` with the separator row. Partition ID is a stable `SP-<OPERATION>-<AXIS>` token; Domain must copy the legal values verbatim from the bound OpenAPI enum or requirement sentence (never guess), using bare semicolon-separated identifier values inside the single table cell (for example `ACTIVE; ARCHIVED`, with no Markdown backticks or prose); Required Slots must contain `each-value` and exactly one `not-in-set`, plus `omitted` only when the parameter is optional. Before returning, expand every declared partition into its complete deterministic exact slot ID set: one `TP-<Partition ID>-<VALUE-TOKEN>` per Domain value, `TP-<Partition ID>-OMITTED` only for an optional axis, and exactly one `TP-<Partition ID>-NOT-IN-SET`. Every expanded slot ID must appear verbatim in the binding Rule's `Required Test Points` cell and be assigned to concrete Case IDs in that same Coverage Matrix row; ordinary alias/family Test Points do not replace this inventory. Expected by Slot states the documented expectation per slot kind (`domain-value`, `default-behavior`, `empty-result`/`excluded-result` when documented, or `GAP` when the source does not document the complement expectation — never invent 空列表/400). POST/PUT body field-validation enums stay in the Coverage Matrix as `TP-<FIELD>-ENUM-*` and MUST NOT get a Scenario Partition row. Do not create partitions for axes without a documented legal-value domain. Only GET/list query or path parameters whose bound source documents a finite enum or classification set may become a Scenario Partition. Do not create partitions for free-form strings, primary keys, required-or-optional-only parameters, or boundary/format-only axes. If an axis has no finite legal-value domain, do not declare a Partition row and do not invent NOT-IN-SET cases. Cross-axis combinations stay as ONE nominal Case; never declare a cross-axis cartesian partition.",
+            "Scenario Partitions (query/filter axes): for every affected GET/list operation, declare one row per enum or classification axis used for filtering (query/path parameters such as type/status/category). Add a mandatory machine-readable `## Scenario Partitions` section after the Coverage Matrix using exactly `| Partition ID | Operation | Axis | Domain | Required Slots | Expected by Slot | Bind Rule |` with the separator row. Partition ID is a stable `SP-<OPERATION>-<AXIS>` token; Domain must copy the legal values verbatim from the bound OpenAPI enum or requirement sentence (never guess), using bare semicolon-separated identifier values inside the single table cell (for example `ACTIVE; ARCHIVED`, with no Markdown backticks or prose); Required Slots must contain `each-value` and exactly one `not-in-set`, plus `omitted` only when the parameter is optional. Before returning, expand every declared partition into its complete deterministic exact slot ID set: one `TP-<Partition ID>-<VALUE-TOKEN>` per Domain value, `TP-<Partition ID>-OMITTED` only for an optional axis, and exactly one `TP-<Partition ID>-NOT-IN-SET`. Every expanded slot ID must appear verbatim in the binding Rule's `Required Test Points` cell and be assigned to concrete Case IDs in that same Coverage Matrix row; ordinary alias/family Test Points do not replace this inventory. Scheme A: Case count may be smaller than the enum count, but every exact slot still needs an independent variant Test Point and pytest.param id; never use SINGLE/MULTIPLE aliases as coverage. Expected by Slot states the documented expectation per slot kind (`domain-value`, `default-behavior`, `empty-result`/`excluded-result` when documented, or `GAP` when the source does not document the complement expectation — never invent 空列表/400). POST/PUT body field-validation enums stay in the Coverage Matrix as `TP-<FIELD>-ENUM-*` and MUST NOT get a Scenario Partition row. Do not create partitions for axes without a documented legal-value domain. Only GET/list query or path parameters whose bound source documents a finite enum or classification set may become a Scenario Partition. Do not create partitions for free-form strings, primary keys, required-or-optional-only parameters, or boundary/format-only axes. If an axis has no finite legal-value domain, do not declare a Partition row and do not invent NOT-IN-SET cases. Cross-axis combinations stay as ONE nominal Case; never declare a cross-axis cartesian partition.",
             "Before finalizing README, calculate the predicted collected-item count as `sum(max(1, number of variant Test Points in each Case))`. If the task declares an item budget, the prediction must not exceed it. Reduce excess only by removing duplicate execution and converting same-request checkpoints to assertions; never drop required rules, boundaries, enums, operation-specific inputs, or business states. Record the prediction in README. Use only environment-supported fixtures/targets/isolation, record evidence gaps in Chinese, and do not emit JSON, pytest, or execute commands.",
             ...(sharedSetupPrompt ? [sharedSetupPrompt] : []),
             intake.boundedSourceContext,
@@ -4998,7 +5159,7 @@ async function buildBackendTestHybridDag(sources) {
                     'Write the module {{item.stem}} as readable case cards covering every in-scope rule/Test Point the README Coverage Matrix assigns to this module. Every case starts with `## BE-<MODULE>-<NNN>｜<中文用例名称>`. `<NNN>` is exactly three zero-padded digits (`001`, `002`, ...), never two digits (`01`), a bare number, or an alphabetic suffix such as `011A`. Every case must include `### 覆盖规则`, `### 测试点`, `### 场景类型`, `### 前置条件`, `### 操作步骤`, `### 预期结果`, and `### 自动化映射` Do not group cases under "## 测试类 ..." (or any h2 grouping) headings that force Cases down to h3; each Case must be a direct h2 (`##`), and its seven sections must be h3 (`###`) children of that Case. If you need to convey a pytest class, state it inside the Case\'s `### 自动化映射` instead. Forbidden: `## 测试类 X` then `### BE-PD-001` and `### 覆盖规则` at the same h3 level. Required: `## BE-PD-001` then `### 覆盖规则`.; `覆盖规则` and `测试点` must reference exact Matrix Rule Keys/Test Points. Add `测试目的`, `验收标准`, `需求依据`, and `测试数据` for readable evidence. The `验收标准` section must list the exact applicable `AC-...` IDs, and every explicit task AC must appear in at least one Case. Every automatable case explicitly names its target pytest script and exactly one primary symbol so traceability scans only that script/symbol. Evidence-only meta cases that exist solely for non-executable assertion/cross-cutting process evidence may declare `脚本：无` and `primary symbol：无` with empty `变体测试点`, and must not invent a business pytest item.',
                     "Name this module file with the exact frozen Module Index stem `{{item.stem}}` (filename `{{item.markdownPath}}`). Never reinterpret or rename an explicit-user-layout stem. Priority-only stems `p0`, `p1` and `p2` are forbidden and must never produce `p0.md` or `test_p0.py`. Pure hexadecimal/hash-like opaque stems such as `a401606` and `deadbeef` are also forbidden. Do not use Case-ID-like module filenames. For every automatable case, `自动化映射` must name exactly `{{item.pytestPath}}`, where the module stem is this Markdown filename without `.md`, lowercased, with non-alphanumeric characters replaced by underscores. Example: `health` → `testcase/test_health.py`; `resource_notes` → `testcase/test_resource_notes.py`. Never invent a different pytest path in Markdown than the module stem implies.",
                     "AUTOMATION_BINDING_FORMAT_V1 is a literal machine contract. Under every Case's `### 自动化映射`, write these independent lines exactly: `- 脚本：<path|无>`, `- primary symbol：<symbol|无>`, `- 变体测试点：<semicolon-separated TP IDs|无>`, `- 场景断言测试点：<semicolon-separated TP IDs|无>`, `- 横切证据测试点：<semicolon-separated TP IDs|无>`. TP IDs must be on the same line after the colon. Forbidden classification forms include `TP-X（变体测试点）`, `[变体测试点] TP-X`, `【变体测试点】：TP-X`, pipe-delimited annotations, tables, or nested TP lists. Before returning, verify that the Case `### 测试点` exact set equals the pairwise-disjoint union of the three canonical binding lines; do not add, remove, rename or duplicate a TP to make the format pass.",
-                    "Scenario Partition slots: when README declares `## Scenario Partitions`, every slot of each declared partition MUST appear in this module's Cases as exactly one variant Test Point with the deterministic ID `TP-<Partition ID>-<VALUE-TOKEN>` (each-value), `TP-<Partition ID>-OMITTED` (optional axis only) and exactly one `TP-<Partition ID>-NOT-IN-SET` complement slot with `intent=enum-invalid`. Example: Partition ID `SP-GET-API-RESOURCE-NOTES-STATUS` → `TP-SP-GET-API-RESOURCE-NOTES-STATUS-ACTIVE`. Slot IDs copy the declared Partition ID exactly; never drop the HTTP method, invent, merge, renumber or split slot IDs. Before returning, derive the complete exact slot set from every applicable Scenario Partitions row and verify that the module Cases declare and bind every slot assigned by the Coverage Matrix; ordinary alias Test Points do not satisfy a partition slot, and aggregate aliases such as `SINGLE`/`MULTIPLE` are forbidden. Prefer ONE Case per partition with a parameter table over duplicated Cases per value. The not-in-set slot value must be a concrete literal absent from the Domain (e.g. `UNKNOWN_TYPE`) and its expected result must come from the bound source — when Expected by Slot is GAP, the Case states the expectation as GAP evidence, never a guessed 空列表/400. Never create cross-axis combination variants beyond the single documented nominal.",
+                    "Scenario Partition slots: requiredVariantSlots for this module are `{{item.requiredVariantSlots}}`. Every listed ID MUST appear in this module's Cases as exactly one variant Test Point in both `### 测试点` and `变体测试点`. Slot IDs copy the declared Partition ID exactly; never drop the HTTP method, invent, merge, renumber or split slot IDs. Ordinary alias Test Points do not satisfy a partition slot, and aggregate aliases such as `SINGLE`/`MULTIPLE` are forbidden. Scheme A: one Case may carry many slots; do not create one Case per enum value just to match Case count. Prefer ONE Case per partition with a parameter table over duplicated Cases per value. The not-in-set slot value must be a concrete literal absent from the Domain (e.g. `UNKNOWN_TYPE`) and its expected result must come from the bound source — when Expected by Slot is GAP, the Case states the expectation as GAP evidence, never a guessed 空列表/400. Never create cross-axis combination variants beyond the single documented nominal.",
                     "For every variant Test Point, write its machine-checkable `场景意图: <TP-ID>; operation=...; target=...; intent=...` line inside that same Case body/自动化映射. Never collect Scenario Intent lines in a file-level appendix, implementation-details block, or another Case; local TP ownership is mandatory.",
                     "Every Case must keep at least one numbered executable line under `### 操作步骤`; a compact variant/result table may follow but must not replace the numbered action anchor. Keep numbered/bulleted independently assertable results under `### 预期结果`. The exact `### 操作步骤` and `### 预期结果` headings must remain present for every Case, including compact/table-based Cases; never compress later Cases by dropping required headings. Every result must name the observable HTTP status, response field/value, state transition or membership condition, never vague wording such as ‘符合预期’.",
                     "In every `自动化映射`, use exactly these machine-readable list labels: `脚本`, `primary symbol`, `变体测试点`, `场景断言测试点`, `横切证据测试点`, plus a deterministic payload contract. For operations without a request body write `Payload Contract: none`. Otherwise write `Payload Required Paths`, `Payload Allowed Paths`, and `Payload Enum` (write `none` when there is no enum); nested fields use dot paths such as `approver.name`. Each Case describes exactly one target request payload contract: put every payload label on its own list line, never concatenate multiple operations or setup POST/PUT contracts into one label line, and never repeat a `Payload Contract:` token inside explanatory prose/details after the machine-readable line. Values must come only from bound API/DTO evidence, never guesses. Each Test Point from `### 测试点` must appear in exactly one binding list, and every Test Point named in any binding list must also be declared in that Case's `### 测试点`; write `无` for an empty list. A variant Test Point is atomic: one exact endpoint/input/precondition/outcome row equals one exact pytest item and one exact TP ID. If a parameter table has five rows, declare five distinct variant TP IDs in Markdown; never declare one family TP and append row suffixes only in pytest. Classify as `variant` only when endpoint, request input, precondition business state, or expected outcome genuinely changes and therefore needs an independent pytest parameter item. Classify CRUD checkpoints, status/body/header/schema assertions and multiple checks over the same response/journey as `assertion`; classify shared HTTP logging/redaction/truncation evidence as `cross-cutting`. Never create a Test Point merely to parameterize a checkpoint. Every non-cross-cutting TP ID is owned by exactly one Case; when the same response/schema/error assertion is needed in different Cases, use distinct Case-specific TP IDs instead of reusing one assertion TP across Cases. Keep the script path identical to the module one-to-one path and declare exactly one primary symbol named with the canonical Case prefix, for example `BE-RN-003` → `test_BE_RN_003_<description>`; non-Case-prefixed primary symbols are forbidden because parameterized item association must remain deterministic. For evidence-only meta Cases with no executable business journey, write `脚本：无` and `primary symbol：无`, keep `变体测试点：无`, and place process evidence only in assertion/cross-cutting lists. If the bound contract only says an identifier is returned/present, do not declare a concrete identifier type. If a 404 Case needs a nonexistent path identifier but its syntax/type is unspecified, define a create-delete-derived valid identifier journey instead of an arbitrary UUID/text placeholder. For redaction scenarios, list sensitive header/field key names only. Never write any header-name-and-value pair, credential placeholder, fake token, anti-example, or other secret-shaped literal in Markdown; state only that a test-only value is supplied at runtime and omitted. Put implementation-only restrictions in a concise `<details>` block rather than dominating the main case flow. Use only environment-supported fixtures/targets/isolation, record evidence gaps in Chinese, and do not emit JSON, pytest, or execute commands.",
@@ -5043,7 +5204,7 @@ async function buildBackendTestHybridDag(sources) {
             "Correct testcase/md/** directly: add documented omissions, remove unsupported cases, preserve every frozen Module Index filename exactly (never rename an explicit-user-layout module; model-derived invalid stems must have been rejected before map expansion), normalize every Case ID to hyphen-separated module segments plus exactly three zero-padded digits (`BE-RESOURCE_NOTES-01` → `BE-RESOURCE-NOTES-001`; `BE-RN-011A` must be renumbered or merged) consistently across headings/index/mappings, fix automation mappings so each automatable case points at `testcase/test_<module>.py` derived from that module filename and declares exactly one primary symbol (evidence-only meta cases may keep `脚本/primary symbol=无` with empty variants), assign every Test Point exactly one of `变体测试点`/`场景断言测试点`/`横切证据测试点`, then perform an exact-set check: each Case's `### 测试点` set must equal (not merely contain) the union of those three binding lists; delete stale/legacy aliases and ensure every binding-list Test Point is present, expand every variant parameter row into its own atomic TP ID, make every non-cross-cutting TP Case-specific and owned by exactly one Case, require every primary symbol to start with the canonical Case prefix, ensure every explicit AC ID appears in an applicable Case `验收标准`, merge execution duplicates, improve navigation/tables/Chinese wording, or record gaps in Chinese. Remove every credential/header value, placeholder, fake token and anti-example from Markdown. Sensitive key names may remain only as a plain list; values must be described as runtime-only and omitted, with no colon/value pair or literal example anywhere, including details blocks and explanatory text. Keep Case IDs, AC/REQ/BR IDs, HTTP methods, paths, fields, enum values, filenames, code symbols and source citations as exact machine-readable identifiers; only normalize Case ID separator/sequence formatting as specified above. Recalculate predicted collected items as `sum(max(1, variant count per Case))`; when the task declares a budget, directly merge redundant journeys/reclassify same-request checkpoints until the prediction is within budget, while preserving all required coverage. The validator accepts Chinese and legacy English section aliases; retain or converge to the Chinese human-readable headings without losing structure.",
             "This is the single Markdown incremental synchronization round. Read every authoritative reference index entry whose role hints include acceptance-criteria, api-contract, data-contract or business-rule; do not rely on the derived PRD as a complete inventory. Preserve every explicit AC/REQ/BR ID, every documented HTTP/business error code, every DTO/JSON field, enum value, boundary, format, nested shape, transaction/state/idempotency/uniqueness/auth/tenant/cross-field rule. For each natural-language normative business rule preserved as required scope, include its exact source sentence without paraphrase together with source path and line/heading anchor so the deterministic ledger can verify quote/hash provenance. Ensure every Case declares exactly `Payload Contract: none` or the three labels `Payload Required Paths`, `Payload Allowed Paths`, and `Payload Enum`; every label must occupy its own machine-readable list line, and a Case must never concatenate target/setup operations or multiple `Payload Contract` tokens onto one line, and explanatory prose/details must not repeat any `Payload Contract:` token; never infer missing keys or enum values. A target GET/DELETE operation with no request body must remain `Payload Contract: none` even when its setup journey performs POST/PUT with a DTO; setup payloads never redefine the target Case payload contract. Add only missing Matrix rows/Test Points/Cases/assertions or repair exact drift; do not rewrite already-valid unrelated modules. Work gap-targeted: inspect source anchors and affected modules first, leave unrelated valid modules byte-stable, and return `already-satisfied` without restating the full suite when no gap exists.",
             "For affected API fields, use one valid nominal payload plus atomic required/missing/null/empty/wrong-type, every documented enum value plus bounded invalid classes, documented min-1/min/nominal/max/max+1, formats and nested object/array constraints. Do not generate a Cartesian product or invent undocumented constraints. Do not invent a concrete identifier type when the source only requires presence; for a missing-resource 404 path with unspecified identifier syntax/type, synchronize the Case to a create-delete-derived valid identifier journey rather than an arbitrary UUID/text placeholder.",
-            "Scenario Partitions synchronization: when the run-owned plan declares `## Scenario Partitions`, verify each declared partition's slots are fully materialized as variant Test Points with exact `TP-<Partition ID>-...` IDs (each-value per Domain value, OMITTED only for optional axes, exactly one NOT-IN-SET with intent=enum-invalid). Before returning, derive the complete exact slot set from every legal Scenario Partitions row and compare it with both the binding Coverage Matrix Rule's Required Test Points and the final Case `### 测试点`/`变体测试点` sets; directly add every missing exact slot to the already-assigned Case IDs; ordinary alias Test Points do not satisfy a partition slot, and aggregate aliases such as `SINGLE`/`MULTIPLE` are forbidden. Directly add missing slot rows/Cases. Record an illegal plan Partition row that has no source-backed finite domain as GAP/CONFLICT and remove only its derived `TP-SP-*` slots/Cases from target modules; never modify the immutable plan artifact. Never delete a legal source-backed partition or drop its complement slot to force coverage green. When the bound source does not document the complement expectation, keep the slot with GAP expected instead of guessing. Body-field validation enums (`TP-<FIELD>-ENUM-*`) are NOT partitions — do not add partition rows for them.",
+            "Scenario Partitions synchronization: when the run-owned plan declares `## Scenario Partitions`, verify each declared partition's slots are fully materialized as variant Test Points with exact `TP-<Partition ID>-...` IDs (each-value per Domain value, OMITTED only for optional axes, exactly one NOT-IN-SET with intent=enum-invalid). Before returning, derive the complete exact slot set from every legal Scenario Partitions row and compare it with both the binding Coverage Matrix Rule's Required Test Points and the final Case `### 测试点`/`变体测试点` sets; directly add every missing exact slot to the already-assigned Case IDs; ordinary alias Test Points do not satisfy a partition slot, and aggregate aliases such as `SINGLE`/`MULTIPLE` are forbidden. Scheme A: keep existing Case structure and add missing exact variant Test Points to already-assigned Cases instead of creating one Case per enum value. Directly add missing slot rows/Cases. Record an illegal plan Partition row that has no source-backed finite domain as GAP/CONFLICT and remove only its derived `TP-SP-*` slots/Cases from target modules; never modify the immutable plan artifact. Never delete a legal source-backed partition or drop its complement slot to force coverage green. When the bound source does not document the complement expectation, keep the slot with GAP expected instead of guessing. Body-field validation enums (`TP-<FIELD>-ENUM-*`) are NOT partitions — do not add partition rows for them.",
             "Before returning, verify that every explicit source AC/REQ/BR, error code and strong DTO field token appears in the run-owned plan or an applicable module Case. If a fact cannot be safely automated, retain it as GAP/CONFLICT with its exact source pointer instead of dropping it. Return already-satisfied only when no target file needs an incremental edit.",
             "Read only indexed source paths. Do not scan the repository, modify source/**, generate pytest, execute tests, or emit JSON.",
             ...(sharedSetupPrompt ? [sharedSetupPrompt] : []),
@@ -5153,7 +5314,7 @@ async function buildBackendTestHybridDag(sources) {
                     "Output budget protocol (hard, max output <=16K per turn): Write exactly the frozen `{{item.pytestPath}}`. Never paste full Python modules into assistant chat. Do not merge or split modules. Do not reduce params/assertions/skips to fit. If OUTPUT_LIMIT_RECOVERY is injected, continue only listed missing/broken scripts.",
                     "Align every variant pytest.param payload with the Markdown scenario intent (empty/missing/null/length/pattern/enum/wrong-type/nominal). Prefer literal payloads over Faker for intent-critical fields so pre-execution scenario-param checks can verify them. Hard contract: intent=enum-invalid MUST pass a concrete invalid value literal (string/number/boolean), never `_OMIT`/None/missing key; intent=missing/empty may use `_OMIT` or delete the key; intent=custom-literal:trim|whitespace-padded requires a leading/trailing whitespace string with non-empty trimmed content (all-whitespace belongs to empty/whitespace-only, not trim); intent=custom-literal:ACTIVE|ARCHIVED requires the exact enum string, never descriptive tokens like filter-active; intent=max/min/max+1 should pass a repeated-string length expression, a bare length number N, or a helper named _*_LEN{N} / _*_MAX_LENGTH / _*_OVER_LENGTH — never a bare 1 for oversize. Hard contract: request payload dicts may only contain DTO field keys from Payload Allowed Paths; never put expect/expected/echo_* helper keys inside the JSON body dict. Path/query/header identifiers and scenario-control metadata (including `id`, expected codes, and selector labels) must stay in separate pytest parameters and helper arguments; never merge them into a DTO patch or JSON body unless that exact path is allowed by the Markdown payload contract. Normalize the configured API base URL with `rstrip(\"/\")` (or equivalently join exactly one slash) before appending endpoint paths; generated requests must never contain a `//api/...` path. When the bound source documents a concrete non-secret local API URL, generated clients must use it as the fallback in `os.environ.get(\"API_BASE_URL\", \"<documented-url>\")`; do not require an otherwise-uninjected environment variable or fail setup solely because it is absent. Missing-field helpers must remove keys idempotently with `payload.pop(field, None)`, never `del payload[field]`, because optional fields may already be absent.",
                     "For every response contract that requires an object or pagination envelope, first assert that each envelope/data value is a dict and that required keys exist, then index fields and assert values. Never let an incidental KeyError or list/string TypeError stand in for the explicit response-shape contract failure.",
-                    'Ensure every automatable final Markdown Case ID in this module appears in exactly one primary pytest test function or pytest test class method region, using the exact `primary symbol` declared by Markdown. Skip evidence-only meta Cases that declare `脚本/primary symbol=无` with empty variants; do not invent a business pytest symbol for them. The symbol must start with `test_BE_<MODULE>_<NNN>_` so every parameterized collected item remains associated with its Case. Module-level functions and class-based pytest methods are both supported. Only `变体测试点` may use stable `pytest.param(..., id="TP-...")` IDs, and every atomic variant ID must appear exactly once with a genuine input/state/outcome change. Use a literal direct `pytest.param(..., id=...)` expression for every row; never hide or wrap it behind `_post_case`, `_put_case`, row-factory functions, comprehensions, generators, or dynamically returned parameter lists; do not use decorator-level `ids=[...]`, generated suffixes, or IDs that extend/shorten the exact Markdown TP. Do not parameterize `场景断言测试点` or `横切证据测试点`; execute all assertion checkpoints within the same business journey/item and use shared helpers for cross-cutting evidence. The primary symbol docstring must contain exact metadata lines `Case-ID: BE-...`, `Assertion-Test-Points: TP-...;TP-...` and `Cross-Cutting-Test-Points: TP-...;TP-...` (use `none` when empty). Implement request dictionaries so their direct and nested key paths and enum literals exactly satisfy the Case `Payload Required Paths`, `Payload Allowed Paths`, and `Payload Enum`; for `Payload Contract: none`, do not invent a JSON/body DTO. GET/DELETE setup journeys may create resources, but their setup DTO must not change the target operation\'s no-body payload contract. No Test Point may be invented, renamed, omitted or bound in two modes. The generated pytest collection shape must equal the Markdown prediction `sum(max(1, variant count per Case))`; keep it at or below the task\'s explicit budget by removing duplicate execution, never by collapsing multiple parameter rows under a coarse family TP. Assertions come only from 预期结果 and setup comes only from 前置条件/测试数据/自动化映射.',
+                    'Ensure every automatable final Markdown Case ID in this module appears in exactly one primary pytest test function or pytest test class method region, using the exact `primary symbol` declared by Markdown. Skip evidence-only meta Cases that declare `脚本/primary symbol=无` with empty variants; do not invent a business pytest symbol for them. The symbol must start with `test_BE_<MODULE>_<NNN>_` so every parameterized collected item remains associated with its Case. Module-level functions and class-based pytest methods are both supported. Only `变体测试点` may use stable `pytest.param(..., id="TP-...")` IDs, and every atomic variant ID must appear exactly once with a genuine input/state/outcome change. A Case with exactly one variant Test Point still needs one literal `pytest.param(..., id="TP-...")` row; never leave a single-variant Case as a bare function with the TP only in the docstring. Use a literal direct `pytest.param(..., id=...)` expression for every row; never hide or wrap it behind `_post_case`, `_put_case`, row-factory functions, comprehensions, generators, or dynamically returned parameter lists; do not use decorator-level `ids=[...]`, generated suffixes, or IDs that extend/shorten the exact Markdown TP. Do not parameterize `场景断言测试点` or `横切证据测试点`; execute all assertion checkpoints within the same business journey/item and use shared helpers for cross-cutting evidence. The primary symbol docstring must contain exact metadata lines `Case-ID: BE-...`, `Assertion-Test-Points: TP-...;TP-...` and `Cross-Cutting-Test-Points: TP-...;TP-...` (use `none` when empty). Implement request dictionaries so their direct and nested key paths and enum literals exactly satisfy the Case `Payload Required Paths`, `Payload Allowed Paths`, and `Payload Enum`; for `Payload Contract: none`, do not invent a JSON/body DTO. GET/list filters still declare query fields in those payload labels when the Case varies `params=`/`query=` keys. Python `True`/`False` may implement JSON/OpenAPI `true`/`false` query or body booleans. GET/DELETE setup journeys may create resources, but their setup DTO must not change the target operation\'s no-body payload contract. No Test Point may be invented, renamed, omitted or bound in two modes. The generated pytest collection shape must equal the Markdown prediction `sum(max(1, variant count per Case))`; keep it at or below the task\'s explicit budget by removing duplicate execution, never by collapsing multiple parameter rows under a coarse family TP. Assertions come only from 预期结果 and setup comes only from 前置条件/测试数据/自动化映射.',
                     "Name the generated pytest file so it corresponds one-to-one with its source Markdown module file: this module stem `{{item.stem}}` maps to exactly the frozen `{{item.pytestPath}}`. The <module> stem is the Markdown filename without the `.md` extension, lowercased and with non-alphanumeric characters replaced by underscores. For example, `resource_notes` → `testcase/test_resource_notes.py`, `health` → `testcase/test_health.py`. If Markdown automation mapping names a different path than this module stem path, still write the frozen manifest pytest path and do not invent prefixes. Never merge multiple Markdown modules into one pytest file, never split one module across several files, and never invent pytest filenames unrelated to the Markdown modules.",
                     "Scenario Partition slots: every `TP-<Partition ID>-...` variant Test Point declared by this module's Markdown MUST become exactly one literal direct `pytest.param(..., id=\"TP-<Partition ID>-...\")` row with the exact slot ID; the not-in-set slot passes a concrete literal absent from the documented Domain (e.g. `UNKNOWN_TYPE`) — never `_OMIT`, never a descriptive token. Never split one slot into multiple params or merge several slots under a family TP id. Slot filtering requests hit the documented list endpoint with the slot value as the query/path filter.",
                     "Keep this module self-contained: define module-local fixtures and helpers directly in `{{item.pytestPath}}`, so pytest discovers every fixture dependency without external plugin registration. The request log must include method, URL/path, and request parameters (query plus JSON/body/payload summary). The response log must include status code and response result (JSON/text/body summary), and both records must be visible in pytest stdout/stderr without changing assertions. Recursively redact sensitive values and apply bounded truncation before logging.",

package/dist/workflows/dag/node-execution.js

@@ -838,7 +838,7 @@ export function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFail
             "",
             "<retry_instruction>",
             "The previous Scout attempt did not commit a complete, runtime-evidenced target surface.",
-            "Search the repository only as needed to establish the real entrypoint, implementation ownership, and applicable test path. Commit record_target_surface with completeness=complete and unresolvedPaths=[] only after at least one named target has fresh runtime evidence. If ownership truly cannot be established, record completeness=blocked with each unresolved path; do not make Plan discover it.",
+            "Search the repository only as needed to establish the real entrypoint, implementation ownership, and applicable test path. Commit record_target_surface with completeness=complete and unresolvedPaths=[] only after at least one named target has fresh runtime evidence, unless the task source explicitly declares a greenfield target: in that case every future path must be source-declared by the runtime-enriched fact. If ownership truly cannot be established, record completeness=blocked with each unresolved path; do not make Plan discover it.",
             "</retry_instruction>",
         ].join("\n");
     }

package/dist/workflows/dag/prompt.js

@@ -19,6 +19,40 @@ const RERUN_FEEDBACK_ROLES = new Set([
     "verifier",
     "reviewer",
 ]);
+function globPatternToRegExp(pattern) {
+    const normalized = pattern.replace(/\\/g, "/");
+    let source = "";
+    for (let index = 0; index < normalized.length; index += 1) {
+        const char = normalized[index];
+        if (char === "*" && normalized[index + 1] === "*") {
+            source += ".*";
+            index += 1;
+        }
+        else if (char === "*") {
+            source += "[^/]*";
+        }
+        else {
+            source += char.replace(/[.*+?^${}()|[\\]\\]/g, "\\$&");
+        }
+    }
+    return new RegExp(`^${source}$`);
+}
+function readSetAllowsArtifactPath(task, artifactPath) {
+    const readSet = task.readSet ?? [];
+    if (readSet.length === 0)
+        return true;
+    const candidate = artifactPath.replace(/\\/g, "/");
+    const candidates = [candidate];
+    for (const marker of ["/.harness/", "/source/", "/testcase/"]) {
+        const index = candidate.indexOf(marker);
+        if (index >= 0)
+            candidates.push(candidate.slice(index + 1));
+    }
+    return readSet.some((pattern) => {
+        const regex = globPatternToRegExp(pattern);
+        return candidates.some((value) => regex.test(value));
+    });
+}
 function formatBulletList(items, emptyLabel) {
     if (!items || items.length === 0)
         return emptyLabel;
@@ -129,7 +163,7 @@ export function buildUpstreamContext(task, upstream, maxChars = MAX_UPSTREAM_CHA
                 : artifactKind === "assistant"
                     ? record.assistantArtifactPath
                     : undefined;
-            if (truncated && artifactPath) {
+            if (truncated && artifactPath && readSetAllowsArtifactPath(task, artifactPath)) {
                 section += formatUpstreamArtifactPointerMap(record, artifactKind === "stdout" ? "stdout" : "assistant");
             }
             else if (truncated && record.nodeRecordPath) {
@@ -205,7 +239,7 @@ export function buildUpstreamContext(task, upstream, maxChars = MAX_UPSTREAM_CHA
         if (consumedArtifactSection) {
             section += `\n\n${consumedArtifactSection}`;
         }
-        if (truncated && artifactPath) {
+        if (truncated && artifactPath && readSetAllowsArtifactPath(task, artifactPath)) {
             section += formatUpstreamArtifactPointerMap(record, artifactKind);
         }
         sections.push(section);

package/dist/workflows/dag/types.js

@@ -87,7 +87,7 @@ export const dagShellVerifyEvidenceSchema = z.object({
     preflight: z
         .array(z.object({
         label: z.string(),
-        status: z.enum(["ok", "future-delivery-script"]),
+        status: z.enum(["ok", "future-delivery-script", "future-test-target"]),
     }))
         .default([]),
     /** Effective timeout applied independently to each shell command. */