@tea-agent/loop-agent 0.43.0-next.18 → 0.43.0-next.19

package/dist/executors/pi-executor.js

@@ -1023,7 +1023,74 @@ export function shouldRetryWithFallback(stderr, stdout) {
         stdout,
         timedOut: false,
     });
-    return ["quota", "rate-limit", "unavailable", "network"].includes(category);
+    return [
+        "quota",
+        "rate-limit",
+        "unavailable",
+        "upstream-unavailable",
+        "network",
+    ].includes(category);
+}
+/**
+ * Provider/transport failure text, with model-authored content excluded.
+ *
+ * The captured stdout is a JSONL session transcript: it carries assistant text,
+ * tool arguments and saved findings verbatim. Matching provider vocabulary
+ * against that whole stream let model content drive the verdict (smoke r28: the
+ * reviewer's own finding id `FDR-R28-UNAUTHORIZED-APP-CSS` was read as an auth
+ * failure, which is not retryable, so a completed review was reported as a node
+ * error). Only error-shaped channels may classify a transport failure:
+ * stderr, error events, and the error fields of a message record.
+ */
+export function extractProviderFailureText(stdout) {
+    const parts = [];
+    for (const rawLine of stdout.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line)
+            continue;
+        if (!line.startsWith("{")) {
+            // Non-JSON child output (warnings, CLI errors) is not model-authored.
+            parts.push(line);
+            continue;
+        }
+        let record;
+        try {
+            const parsed = JSON.parse(line);
+            if (!isRecord(parsed))
+                continue;
+            record = parsed;
+        }
+        catch {
+            // An unparseable line may be truncated model content: skip it.
+            continue;
+        }
+        const type = typeof record.type === "string" ? record.type : "";
+        const isErrorEvent = type === "error" || type === "agent_error" || type.endsWith("_error");
+        const errorMessage = typeof record.errorMessage === "string" ? record.errorMessage : "";
+        const errorField = record.error;
+        const message = isRecord(record.message) ? record.message : undefined;
+        const messageErrorMessage = typeof message?.errorMessage === "string" ? message.errorMessage : "";
+        const messageErrored = message?.stopReason === "error";
+        if (!isErrorEvent &&
+            !errorMessage &&
+            errorField === undefined &&
+            !messageErrorMessage) {
+            continue;
+        }
+        parts.push([type, errorMessage, messageErrorMessage, messageErrored ? "stopReason error" : ""]
+            .filter(Boolean)
+            .join(" "));
+        if (typeof errorField === "string") {
+            parts.push(errorField);
+        }
+        else if (isRecord(errorField)) {
+            parts.push(["message", "errorMessage", "reason", "code", "status", "type"]
+                .map((key) => (errorField[key] === undefined ? "" : String(errorField[key])))
+                .filter(Boolean)
+                .join(" "));
+        }
+    }
+    return parts.join("\n");
 }
 export function classifyPiFailure(input) {
     if (input.exitCode === 0 && input.assistantText.trim())
@@ -1034,7 +1101,9 @@ export function classifyPiFailure(input) {
         return "timeout";
     if (input.outputTooLarge)
         return "output-too-large";
-    const combined = `${input.stderr}\n${input.stdout}`.toLowerCase();
+    // Provider/transport verdicts read error-shaped channels only; the raw stdout
+    // stream embeds assistant text, tool arguments and findings verbatim.
+    const combined = `${input.stderr}\n${extractProviderFailureText(input.stdout)}`.toLowerCase();
     // Context overflow (400 request-too-large / context window exceeded).
     // Must be detected BEFORE the generic rate-limit/quota phrases: an overflow
     // error often contains "too many tokens" / "maximum context" which would
@@ -1052,8 +1121,21 @@ export function classifyPiFailure(input) {
         return "rate-limit";
     if (/quota|usage limit|reached[^\n.]{0,60}limit|5\s*小时|5小时|insufficient_quota|billing/.test(combined))
         return "quota";
-    if (/\bunauthorized\b|\bhttp\s*40[13]\b|invalid api key|authentication (?:failed|required|error)|auth(?:entication)? failed/.test(combined))
+    // Error words must stand alone: the captured stream also contains
+    // model-authored identifiers, and smoke r28 lost a whole run because the
+    // reviewer's own finding id `FDR-R28-UNAUTHORIZED-APP-CSS` matched a bare
+    // `\bunauthorized\b`, turning a retryable empty-output into a terminal
+    // `auth`. Identifier delimiters (`-`/`_`/alphanumerics) disqualify a match.
+    if (/(?<![\w-])unauthorized(?![\w-])|\bhttp\s*40[13]\b|invalid api key|(?<![\w-])authentication (?:failed|required|error)(?![\w-])|(?<![\w-])auth(?:entication)? failed(?![\w-])/.test(combined))
         return "auth";
+    // Gateway reachability first: a 502/503 body means the provider was
+    // unreachable, not that the request lacked a capability. Reporting the
+    // generic category here previously let an upstream outage surface as the
+    // plan ladder's `unsupported-provider-capability`, which reads as a model
+    // capability mismatch and sent the incident diagnosis in the wrong
+    // direction (2026-09-11).
+    if (/\bhttp\s*50[23]\b|(?:^|\D)50[23](?:\D|$)|service temporarily unavailable|bad gateway|upstream (?:is )?(?:unavailable|down|unreachable)|网关(?:暂时)?不可用/.test(combined))
+        return "upstream-unavailable";
     if (/unknown provider|unknown model|(?:provider|model|service|gateway)\s+(?:is\s+)?unavailable|overloaded|at capacity|temporarily unavailable/.test(combined))
         return "unavailable";
     if (/network\s*(?:error|failure|issue|timeout|unreachable|reset|abort)|networkerror|connection (?:reset|error|refused|closed|timed\s*out)|request timed out|socket hang up|econn\w*|etimedout|fetch failed|dns (?:error|failure|lookup failed)/.test(combined))

package/dist/executors/pi-sdk-executor.js

@@ -322,6 +322,21 @@ async function createSdkSession(sdk, input, shared) {
         extensionToolExtras.push(...computeExtensionToolAllowlistExtras([{ name: SIFT_RETRIEVE_TOOL_NAME }], input.toolNames));
     }
     const sessionToolNames = [...input.toolNames, ...extensionToolExtras];
+    // Pre-session protocol self-check: createAgentSession silently drops a
+    // custom tool whose name is absent from this allowlist (the post-create
+    // mismatch check cannot see the omission either — expected and actual are
+    // both false). The model would then be prompted to call tools that do not
+    // exist and burn attempts discovering it (smoke r10/r14 class of failure),
+    // so fail before any model call, naming the dropped tools.
+    if (input.requireAllowlistedCustomTools && Array.isArray(input.customTools) && input.customTools.length > 0) {
+        const allowlist = new Set(sessionToolNames);
+        const dropped = input.customTools
+            .map((tool) => (isRecord(tool) && typeof tool.name === "string" ? tool.name : undefined))
+            .filter((name) => typeof name === "string" && !allowlist.has(name));
+        if (dropped.length > 0) {
+            throw new Error(`pi session custom tools would be silently dropped (absent from the activation allowlist): ${dropped.join(", ")}; allowlist: [${sessionToolNames.join(", ")}]`);
+        }
+    }
     if (input.requireWriterCustomTools) {
         if (!Array.isArray(input.customTools) || input.customTools.length === 0) {
             throw new Error("pi writer tool policy missing customTools; refusing to create uncontrolled writer session");
@@ -707,6 +722,9 @@ async function executeSingleSdkAttemptInternal(options) {
                 ? { customTools: writerCustomTools }
                 : {}),
             ...(requireWriterCustomTools ? { requireWriterCustomTools: true } : {}),
+            ...(options.writerToolPolicy?.requireAllowlistedCustomTools
+                ? { requireAllowlistedCustomTools: true }
+                : {}),
             ...(options.piExtensionPaths && options.piExtensionPaths.length > 0
                 ? { additionalExtensionPaths: options.piExtensionPaths }
                 : {}),

package/dist/executors/shell-executor.js

@@ -470,6 +470,54 @@ function parseCheckRepoSubcheckDurations(result) {
     }
     return durations;
 }
+/**
+ * Frozen-command evidence for the review node: which commandId/label/lane each
+ * executed command belongs to, its exit status, and the lint lane's status
+ * (explicitly `not-configured` when the task declares no lint commands).
+ *
+ * The review protocol requires exit evidence ("typecheck, build, and test are
+ * required successful final exits") while the verification trace only proves
+ * command/file/target binding, so this artifact is what makes that requirement
+ * satisfiable at all (smoke r31: the reviewer had to request changes for a
+ * check no context could support).
+ */
+export function buildFrontendVerificationEvidence(input) {
+    const directory = buildFrontendVerifyCommandDirectory({
+        staticLabels: input.bundle.staticEvidence?.commandLabels ?? [],
+        staticCommandTexts: input.bundle.staticEvidence?.commandTexts ?? [],
+        behaviorLabels: input.bundle.behaviorEvidence?.commandLabels ?? [],
+        behaviorCommandTexts: input.bundle.behaviorEvidence?.commandTexts ?? [],
+        mockLabels: input.bundle.mockEvidence?.commandLabels ?? [],
+        mockCommandTexts: input.bundle.mockEvidence?.commandTexts ?? [],
+        lintLabels: input.bundle.lintEvidence?.commandLabels ?? [],
+        lintCommandTexts: input.bundle.lintEvidence?.commandTexts ?? [],
+    });
+    const entryByCommand = new Map(directory.map((entry) => [entry.command.trim(), entry]));
+    return {
+        schemaVersion: 1,
+        schemaId: "frontend-verification-evidence-v1",
+        nodeId: input.nodeId,
+        runId: input.runId,
+        capturedAt: new Date().toISOString(),
+        allPassed: input.results.every((result) => result.ok),
+        lintStatus: input.lintStatus,
+        lintConfigured: input.lintConfigured,
+        commands: input.results.map((result, index) => {
+            const entry = entryByCommand.get(result.command.trim());
+            return {
+                index: index + 1,
+                commandId: entry?.commandId ?? null,
+                label: entry?.label ?? null,
+                lane: entry?.lane ?? null,
+                command: result.command,
+                ok: result.ok,
+                exitCode: result.exitCode,
+                failureCategory: result.failureCategory,
+                reused: result.reused === true,
+            };
+        }),
+    };
+}
 export function buildShellResultSummaryMarkdown(input) {
     const lines = [
         "# Shell execution summary",
@@ -1915,7 +1963,7 @@ async function executePipelineCommands(input, meta, overrideCommands) {
  * of inventing refs. */
 async function deriveUnresolvedVerificationEntrypointRefs(runDir, frozenCommandIds) {
     try {
-        const { restorePlanPatchFromCommittedFacts } = await import("../workflows/dag/frontend-shadow-dual-write.js");
+        const { restorePlanPatchFromCommittedFacts } = await import("../workflows/dag/frontend-implementation-contract.js");
         const records = await readTypedEventStoreFromJsonl(path.join(runDir, "frontend-plan-pi", "plan-typed-facts.jsonl"));
         const patch = restorePlanPatchFromCommittedFacts(records);
         const targets = patch
@@ -2127,6 +2175,27 @@ async function executeFrontendVerificationBundle(input, meta) {
         command: result.command,
         reused: result.reused === true,
     }));
+    // Auditable per-command evidence for the review node (smoke r31): the review
+    // protocol treats shell exit status as authoritative, but the review context
+    // only carried the verification trace's command/file/target *binding*
+    // status, so a reviewer could not confirm the frozen commands actually
+    // exited 0 and had to request changes for missing evidence. Written before
+    // either the failure or the success path returns.
+    const lintConfigured = (bundle.lintCommands?.length ?? 0) > 0;
+    await writeDagRunJsonArtifact(meta.runDir, "contracts/frontend-verification-evidence.json", buildFrontendVerificationEvidence({
+        nodeId: input.task.id,
+        runId: meta.runId,
+        bundle,
+        results,
+        // The review protocol's lint vocabulary is
+        // passed | baseline-debt | failed | unavailable; a task that declares
+        // no lint commands reports `unavailable` plus lintConfigured:false
+        // rather than inventing a value outside that catalog (smoke r33).
+        lintStatus: lintConfigured
+            ? (lintAssessment?.status ?? "unavailable")
+            : "unavailable",
+        lintConfigured,
+    }));
     // Lint baseline-debt is tolerated, so a lint-only failure must not become the
     // verification failure. A shared lint/static or lint/behavior command is
     // different: once reused by a non-lint lane, its failure belongs to that lane
@@ -2320,16 +2389,22 @@ async function readRunDirJson(runDir, relativePath) {
 }
 /** Committed typed review terminal kinds from the review node's typed event
  * store (AC-003: typed terminal tools are the only authoritative verdict). */
-async function collectReviewTerminalKinds(runDir, reviewNodeId) {
+export async function collectReviewTerminalKinds(runDir, reviewNodeId) {
     try {
         const records = await readTypedEventStoreFromJsonl(path.join(runDir, reviewNodeId, "review-typed-facts.jsonl"));
+        // The store also holds findings and scope checkpoints; only the verdict
+        // kinds decide "missing or ambiguous" (fail closed on 0 or 2+).
+        const terminalKinds = new Set([
+            "approve_review",
+            "request_review_changes",
+        ]);
         return records
             .filter((record) => record.phase === "committed")
             .map((record) => {
             const kind = record.fact.kind;
             return typeof kind === "string" ? kind : "";
         })
-            .filter((kind) => kind === "approve_review" || kind === "request_review_changes");
+            .filter((kind) => terminalKinds.has(kind));
     }
     catch {
         return [];
@@ -2339,16 +2414,24 @@ async function collectReviewTerminalKinds(runDir, reviewNodeId) {
  * event store (M8: the committed approve_design / request_design_changes fact
  * is the only authoritative verdict; the legacy first-line VERDICT text is
  * never read for writer admission). Fail-closed on a missing/unreadable store. */
-async function collectDesignTerminalKinds(runDir, designNodeId) {
+export async function collectDesignTerminalKinds(runDir, designNodeId) {
     try {
         const records = await readTypedEventStoreFromJsonl(path.join(runDir, designNodeId, "design-typed-facts.jsonl"));
+        // The store also holds findings and scope checkpoints; only the verdict
+        // kinds decide "missing or ambiguous" (fail closed on 0 or 2+). Without
+        // this filter any recorded finding makes admission read the committed
+        // verdict as ambiguous and blocks the writer (r11 decision-path smoke).
+        const terminalKinds = new Set([
+            "approve_design",
+            "request_design_changes",
+        ]);
         return records
             .filter((record) => record.phase === "committed")
             .map((record) => {
             const kind = record.fact.kind;
             return typeof kind === "string" ? kind : "";
         })
-            .filter((kind) => kind === "approve_design" || kind === "request_design_changes");
+            .filter((kind) => terminalKinds.has(kind));
     }
     catch {
         return [];
@@ -2511,7 +2594,7 @@ async function executeFrontendDesignPolicy(input, meta) {
         // M9a the plan node's assistantText is a pure Markdown narrative; the
         // compile authority is the committed plan ledger ⊕ runtime skeleton.
         // Fail closed on missing committed facts — never fall back to text.
-        const { readCommittedOriginFacts, checkCommittedOriginFacts } = await import("../workflows/dag/frontend-shadow-dual-write.js");
+        const { readCommittedOriginFacts, checkCommittedOriginFacts } = await import("../workflows/dag/frontend-committed-facts.js");
         // A+B (AC-001/003): fail-closed committed contract/scout typed facts.
         // Missing/uncommitted facts block here; never fall back to text parsing.
         const committedContractFacts = await readCommittedOriginFacts(meta.runDir, "frontend-contract-pi", "contract-typed-facts.jsonl");
@@ -2630,7 +2713,7 @@ async function executeFrontendDesignPolicy(input, meta) {
             });
         }
         // Byte freshness is necessary but not sufficient: require the same ledger
-        // semantic checks as the shadow prewrite gate before production writer
+        // semantic checks as the canonical admission policy before production writer
         // admission can be materialized.
         if (meta.spec.sourceBinding) {
             const ledgerCheck = await checkFrontendSourceFidelityLedger({
@@ -3016,6 +3099,8 @@ async function executeFrontendCloseout(input, meta) {
             coverageMatrix: verificationTargets.map((target, index) => ({
                 verificationTargetId: trace?.targets?.[index]?.id ?? `vt-${index}`,
                 status: target.status === "ok" ? "passed" : "failed",
+                evidence: trace?.targets?.[index]?.evidence ?? "unavailable",
+                behaviorCoverage: "unconfirmed",
             })),
             lintStatus: "unavailable",
             integrationFacts,

package/dist/shared/backend-dogfood-preflight.js

@@ -0,0 +1,47 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { buildControllerIdentityFromEntry, readBuildStamp } from "./package-metadata.js";
+export function sha256File(file) {
+    return `sha256:${createHash("sha256").update(readFileSync(file)).digest("hex")}`;
+}
+export function classifyBackendDogfoodProvenance(input) {
+    if (input.tarballPath)
+        return { kind: "local-tarball", version: input.identity.packageVersion, tarballSha256: sha256File(input.tarballPath) };
+    if (input.distTag)
+        return { kind: "published-npm", version: input.identity.packageVersion, distTag: input.distTag };
+    return { kind: "local-candidate", version: input.identity.packageVersion };
+}
+export function buildBackendDogfoodIdentityEvidence(input) {
+    const controller = buildControllerIdentityFromEntry({ requested: input.controllerEntry, entry: path.resolve(input.controllerEntry) });
+    if (!controller)
+        throw new Error("BACKEND_DOGFOOD_IDENTITY_UNRESOLVED");
+    const fingerprint = controller.packageFingerprint.value;
+    if (fingerprint !== input.expectedFingerprint)
+        throw new Error(`BACKEND_DOGFOOD_CONTROLLER_MISMATCH: expected ${input.expectedFingerprint}, got ${fingerprint}`);
+    const consoleIdentity = input.consoleHost
+        ? undefined
+        : buildControllerIdentityFromEntry({
+            requested: input.consoleControllerEntry ?? path.join(controller.packageRoot, "bin", "agent-worker.js"),
+            entry: input.consoleControllerEntry ?? path.join(controller.packageRoot, "bin", "agent-worker.js"),
+        });
+    if (!input.consoleHost && !consoleIdentity)
+        throw new Error("BACKEND_DOGFOOD_CONSOLE_IDENTITY_UNRESOLVED");
+    const consoleHost = {
+        packageName: String(input.consoleHost?.packageName ?? consoleIdentity?.packageName),
+        packageVersion: String(input.consoleHost?.packageVersion ?? consoleIdentity?.packageVersion),
+        packageFingerprint: String(input.consoleHost?.packageFingerprint ?? consoleIdentity?.packageFingerprint.value),
+    };
+    const expected = `${controller.packageName}@${controller.packageVersion}@${fingerprint}`;
+    const actual = `${consoleHost.packageName}@${consoleHost.packageVersion}@${consoleHost.packageFingerprint}`;
+    if (actual !== expected)
+        throw new Error(`BACKEND_DOGFOOD_CONSOLE_IDENTITY_MISMATCH: expected ${expected}, got ${actual}`);
+    return {
+        schemaVersion: 1,
+        controller,
+        provenance: classifyBackendDogfoodProvenance({ identity: controller, distTag: input.distTag, tarballPath: input.tarballPath }),
+        buildCommitSha: readBuildStamp(controller.packageRoot)?.gitSha ?? null,
+        consoleHost,
+        dagController: { packageName: controller.packageName, packageVersion: controller.packageVersion, packageFingerprint: fingerprint },
+    };
+}

package/dist/shared/dag-failure-category.js

@@ -59,6 +59,9 @@ const RAW_TO_NORMALIZED = {
     quota: "executor",
     "rate-limit": "executor",
     unavailable: "executor",
+    // Gateway reachability outage: still an executor-class failure, but named so
+    // reports do not read as a capability mismatch.
+    "upstream-unavailable": "executor",
     // Context window overflow (400 request-too-large): the session needs
     // compaction / fresh context before retrying — an executor-side
     // environment condition, not a plan-quality defect.

package/dist/shared/operator/capabilities.js

@@ -392,6 +392,147 @@ const COMMON_MUTATION_ERRORS = [
 ];
 export function buildOperatorCapabilitiesDocument() {
     const actions = [
+        {
+            action: "prepareScheduledTask", cli: "console scheduled task preparation", kind: "mutation",
+            inputSchemaVersion: 1, resultSchemaVersion: 1, envelopeSchemaVersion: 1, requiredErrorCodes: ["INVALID_INPUT"],
+            description: "Preferred entry for natural-language one-time scheduled tasks, including read-only inspection reports. Call this directly after understanding the goal, output scope, executable acceptance and time; the server uses the CURRENT project directory and creates the immutable PRD, managed Task and strict writeSet gate, binds THIS Chat automatically and returns a REAL planned goal/confirmation card. No pre-existing task, worktree or session ID is needed: never ask the user for these internal fields and do not manually create/edit them with bash/write/newTask/importPrd. Keep preparation concise: preserve the user goal without inventing extra requirements. Omit budget for ordinary tasks. Use minimal independent acceptance commands (AC-1, AC-2), preferably existing test/build scripts or test -s scheduled-report.md for a report; no compound shell/pipelines/substitution, language-specific grep checks or redundant scope assertions (the host enforces scope). Infer routine defaults and verification commands from the repository; ask only about genuinely ambiguous goal/scope/time. For read-only requests allow just an ordinary report file in the current project directory, e.g. scheduled-report.md, not .harness/. Use schedule.delayMinutes for relative time (counted after preparation finishes), or localAt + IANA timezone for an exact date/time. The current workspace must match committed HEAD; never auto-commit/stash/reset existing changes. The card exposes the exact time, bounded defaults and committed base before one human confirmation. Same request in this Chat is idempotent. Only a returned goalId with state=planned is a prepared reservation; textual drafts, Tasks or failed operations are NOT bookings. Never replace a requested schedule with immediate execution or sleep, never call runDag or self-confirm. On failure explain the returned stage, correct business inputs and retry this tool; do not mutate imported PRD/runtime artifacts. For a new distinct appointment, make its goal/time distinct.",
+            inputParams: [{ name: "request", type: "object", required: true, description: "Business goal, workflow, allowedPaths, acceptance and schedule; optional forbiddenPaths/budget. Runtime identity is server-owned." }],
+            modelCallable: "always", humanConfirmation: "none",
+        },
+        {
+            "action": "prepareScheduledGoal",
+            "cli": "console scheduled goal service",
+            "kind": "mutation",
+            "inputSchemaVersion": 1,
+            "resultSchemaVersion": 1,
+            "envelopeSchemaVersion": 1,
+            "requiredErrorCodes": [
+                "INVALID_INPUT"
+            ],
+            "description": "Advanced entry ONLY for an already prepared Task. For a new natural-language reservation use prepareScheduledTask instead. Requires the current repository or its linked worktree at frozenBase and a managed Task already strict-prepared at its writeSet gate. booking must include managedTaskId, originalGoal, chatSessionRef, workflow, worktreeRef, frozenBase, allowedPaths, forbiddenPaths, acceptance {policy, criteria [{acId,description,command}]}, budget {maxTurns,maxDagRuns,maxSupervisorCalls}, time {executeAtUtc,latestStartUtc,stopAtUtc,expiresAt,timezone,allowedHours,misfirePolicy}. Resolve natural-language dates with the user timezone; ask about ambiguous time/AC/scope. No execution or authorization occurs. Show the complete scope/time/budget for one browser confirmation. Never call runDag for this reservation.",
+            "inputParams": [
+                {
+                    "name": "booking",
+                    "type": "object",
+                    "required": true,
+                    "description": "Complete frozen booking inputs; never supply prepared, controllerRef, approval or owner tokens."
+                }
+            ],
+            "modelCallable": "always",
+            "humanConfirmation": "none"
+        },
+        {
+            "action": "confirmScheduledGoal",
+            "cli": "console scheduled goal service",
+            "kind": "mutation",
+            "inputSchemaVersion": 1,
+            "resultSchemaVersion": 1,
+            "envelopeSchemaVersion": 1,
+            "requiredErrorCodes": [
+                "INVALID_INPUT"
+            ],
+            "description": "Human browser confirmation of the exact displayed ScheduledGoal envelope.",
+            "inputParams": [
+                {
+                    "name": "goalId",
+                    "type": "string",
+                    "required": true,
+                    "description": "Prepared goal id"
+                },
+                {
+                    "name": "stateVersion",
+                    "type": "number",
+                    "required": true,
+                    "description": "Displayed state version"
+                },
+                {
+                    "name": "envelopeHash",
+                    "type": "string",
+                    "required": true,
+                    "description": "Displayed envelope hash"
+                }
+            ],
+            "modelCallable": "never",
+            "humanConfirmation": "required"
+        },
+        {
+            "action": "cancelScheduledGoal",
+            "cli": "console scheduled goal service",
+            "kind": "mutation",
+            "inputSchemaVersion": 1,
+            "resultSchemaVersion": 1,
+            "envelopeSchemaVersion": 1,
+            "requiredErrorCodes": [
+                "INVALID_INPUT"
+            ],
+            "description": "Cancel future ScheduledGoal admission; in-flight/unknown ownership remains until reconciled.",
+            "inputParams": [
+                {
+                    "name": "goalId",
+                    "type": "string",
+                    "required": true,
+                    "description": "Goal id"
+                },
+                {
+                    "name": "stateVersion",
+                    "type": "number",
+                    "required": true,
+                    "description": "Current state version"
+                },
+                {
+                    "name": "reason",
+                    "type": "string",
+                    "required": true,
+                    "description": "Human cancellation reason"
+                }
+            ],
+            "modelCallable": "never",
+            "humanConfirmation": "required"
+        },
+        {
+            "action": "scheduledGoalGet",
+            "cli": "console scheduled goal service",
+            "kind": "read",
+            "inputSchemaVersion": 1,
+            "resultSchemaVersion": 1,
+            "envelopeSchemaVersion": 1,
+            "requiredErrorCodes": [
+                "INVALID_INPUT"
+            ],
+            "description": "Read a durable ScheduledGoal booking and separate execution, acceptance, delivery and reconciliation results. Never implies authorization.",
+            "inputParams": [
+                {
+                    "name": "goalId",
+                    "type": "string",
+                    "required": true,
+                    "description": "Goal id"
+                }
+            ],
+            "modelCallable": "always",
+            "humanConfirmation": "none"
+        },
+        {
+            "action": "scheduledGoalList",
+            "cli": "console scheduled goal service",
+            "kind": "read",
+            "inputSchemaVersion": 1,
+            "resultSchemaVersion": 1,
+            "envelopeSchemaVersion": 1,
+            "requiredErrorCodes": [
+                "INVALID_INPUT"
+            ],
+            "description": "List durable ScheduledGoals, including those whose original Chat was archived or deleted.",
+            "inputParams": [
+                {
+                    "name": "chatSessionRef",
+                    "type": "string",
+                    "required": false,
+                    "description": "Optional original Chat session id"
+                }
+            ],
+            "modelCallable": "always",
+            "humanConfirmation": "none"
+        },
         {
             action: "operatorCapabilities",
             cli: "loop-agent operator capabilities --json",
@@ -714,6 +855,24 @@ export function buildOperatorCapabilitiesDocument() {
                     required: false,
                     description: "optional verify commands (label:command or shell)",
                 },
+                {
+                    name: "requirementOwnership",
+                    type: "array",
+                    required: false,
+                    description: "optional frozen requirement→file ownership for frontend-implementation DAGs: [{requirementIds, implementationFiles?, verificationFiles?}] — machine-enforced at plan finalize",
+                },
+                {
+                    name: "capabilityBoundary",
+                    type: "array",
+                    required: false,
+                    description: "optional frozen test capability boundary {allowed?, forbidden?} composed into dependencyPolicy by the runtime",
+                },
+                {
+                    name: "interactionIds",
+                    type: "array",
+                    required: false,
+                    description: "optional frozen interaction id vocabulary — contract interaction names are machine-checked against it at plan finalize",
+                },
             ],
             modelCallable: "always",
             humanConfirmation: "none",
@@ -1069,6 +1228,27 @@ export function buildOperatorCapabilitiesDocument() {
                     required: false,
                     description: "verification entries as label:command strings",
                 },
+                {
+                    name: "requirementOwnership",
+                    type: "array",
+                    itemsType: "string",
+                    required: false,
+                    description: "frozen requirement→file ownership: [{requirementIds, implementationFiles?, verificationFiles?}] — machine-enforced at plan finalize",
+                },
+                {
+                    name: "capabilityBoundary",
+                    type: "array",
+                    itemsType: "string",
+                    required: false,
+                    description: "frozen test capability boundary {allowed?, forbidden?} composed into dependencyPolicy by the runtime",
+                },
+                {
+                    name: "interactionIds",
+                    type: "array",
+                    itemsType: "string",
+                    required: false,
+                    description: "frozen interaction id vocabulary — contract interaction names are machine-checked against it at plan finalize",
+                },
                 {
                     name: "approveGate",
                     type: "string",

package/dist/task/config-types.js

@@ -286,6 +286,35 @@ const taskConfigObjectSchema = z.object({
     verifyPreset: verifyPresetSchema.optional().default("auto"),
     /** Task-contract commands that must be included in final DAG shell verification. */
     verifyCommands: z.array(taskVerifyCommandSchema).optional().default([]),
+    /** Generation-frozen requirement→file ownership for frontend-implementation
+     * DAGs. Machine-checked at plan finalize: a requirement's implementation
+     * targets (and its verification targets' files) must stay inside the
+     * declared sets, so ownership never depends on model compliance with prose.
+     */
+    requirementOwnership: z
+        .array(z
+        .object({
+        requirementIds: z.array(z.string().min(1)).min(1),
+        implementationFiles: z.array(z.string().min(1)).optional(),
+        verificationFiles: z.array(z.string().min(1)).optional(),
+    })
+        .strict()
+        .refine((entry) => (entry.implementationFiles?.length ?? 0) > 0 ||
+        (entry.verificationFiles?.length ?? 0) > 0, { message: "requirementOwnership entry needs implementationFiles or verificationFiles" }))
+        .optional(),
+    /** Generation-frozen test capability boundary composed into the canonical
+     * dependencyPolicy by the runtime (planner never maintains it). */
+    capabilityBoundary: z
+        .object({
+        allowed: z.array(z.string().min(1)).optional(),
+        forbidden: z.array(z.string().min(1)).optional(),
+    })
+        .strict()
+        .refine((entry) => (entry.allowed?.length ?? 0) > 0 || (entry.forbidden?.length ?? 0) > 0, { message: "capabilityBoundary needs allowed or forbidden entries" })
+        .optional(),
+    /** Generation-frozen interaction id vocabulary. Contract interaction names
+     * must come from this set (plan finalize deterministic check). */
+    interactionIds: z.array(z.string().min(1)).optional(),
     /** Verification selection policy. Intermediate loops may use quota; final gates still run full required verification. */
     verifyQuota: verifyQuotaSchema.optional().default("full"),
     /** DAG supervised verify strategy. Final quota is fixed to full; intermediate quota may reduce cost. */

package/dist/task/contract/project.js

@@ -187,6 +187,15 @@ export function mergeManagedTaskConfigFields(existing, draft) {
         ...(draft.frontendOpenspec !== undefined
             ? { frontendOpenspec: draft.frontendOpenspec }
             : {}),
+        ...(draft.requirementOwnership !== undefined
+            ? { requirementOwnership: draft.requirementOwnership }
+            : {}),
+        ...(draft.capabilityBoundary !== undefined
+            ? { capabilityBoundary: draft.capabilityBoundary }
+            : {}),
+        ...(draft.interactionIds !== undefined
+            ? { interactionIds: draft.interactionIds }
+            : {}),
     };
     if (draft.featureId !== undefined) {
         next.featureId = draft.featureId;

package/dist/task/contract/schema.js

@@ -75,6 +75,23 @@ export const taskContractDraftSchema = z
     assumptions: z.array(z.string()).optional(),
     hardConstraints: z.array(z.string()).optional(),
     frontendOpenspec: frontendOpenspecConfigSchema.optional(),
+    requirementOwnership: z
+        .array(z
+        .object({
+        requirementIds: z.array(z.string().min(1)).min(1),
+        implementationFiles: z.array(z.string().min(1)).optional(),
+        verificationFiles: z.array(z.string().min(1)).optional(),
+    })
+        .strict())
+        .optional(),
+    capabilityBoundary: z
+        .object({
+        allowed: z.array(z.string().min(1)).optional(),
+        forbidden: z.array(z.string().min(1)).optional(),
+    })
+        .strict()
+        .optional(),
+    interactionIds: z.array(z.string().min(1)).optional(),
     interviewAssessmentRef: z
         .object({
         draftSha256: z.string().min(1),