@tea-agent/loop-agent 0.44.0-next.1 → 0.44.0-next.10

package/dist/application/evaluation/frontend-pair-registration.js

@@ -0,0 +1,143 @@
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { z } from "zod";
+import { readCandidateRecord } from "../../infrastructure/evaluation/candidate-store.js";
+import { readFileBoundarySafe } from "../../shared/path-safety.js";
+import { campaignPlanSchema, candidateIdSchema } from "./types.js";
+import { computeCampaignPlanHash } from "./campaign-hash.js";
+const hash = z.string().regex(/^[a-f0-9]{64}$/);
+const bundleHash = z.string().regex(/^sha256:[a-f0-9]{64}$/);
+const ref = z.object({ path: z.string().min(1), sha256: hash }).strict();
+// Keep registration schemas independent of DAG evidence readers: DAG types
+// import this module while the readers themselves depend on DAG lifecycle.
+export const frontendSharedArtifactsSchema = z.object({ source: ref, budget: ref, model: ref, initialTree: ref }).strict();
+const sharedSchema = z.object({ source: hash, model: hash, budget: hash, initialTree: hash, acceptance: hash }).strict();
+const armSchema = z.object({ candidateId: candidateIdSchema, bundleHash, controllerFingerprint: bundleHash, controller: ref, promptTools: ref }).strict();
+const registrationSchema = z.object({
+    schemaVersion: z.literal(1), kind: z.literal("frontend-task-pair-registration"),
+    createdAt: z.string().datetime(), campaignId: z.string().min(1), planHash: bundleHash,
+    baseline: armSchema, candidate: armSchema, shared: sharedSchema, sharedArtifacts: frontendSharedArtifactsSchema.optional(),
+    gatewayTopology: ref.optional(),
+}).strict();
+const observedSchema = sharedSchema.extend({ protocol: hash, controller: hash, promptTools: hash }).strict();
+/** Identity admission only, not acceptance or promotion. `identities` must be
+ * collected by a reader which verifies the run and all referenced artifacts;
+ * this gate binds those identities to predeclared, rehashed candidate bytes. */
+export async function validateFrontendPairRegistration(input) {
+    const registrationRef = ref.parse(input.registration);
+    const read = async () => {
+        const bytes = await readFileBoundarySafe({ boundaryRoot: input.repoRoot,
+            targetPath: path.resolve(input.repoRoot, registrationRef.path), label: "frontend pair registration" });
+        if (createHash("sha256").update(bytes).digest("hex") !== registrationRef.sha256)
+            throw Error("pair registration hash mismatch");
+        return registrationSchema.parse(JSON.parse(bytes.toString("utf8")));
+    };
+    const registration = await read();
+    const plan = campaignPlanSchema.parse(input.plan);
+    if (computeCampaignPlanHash(plan.campaignId, plan.cells) !== plan.planHash)
+        throw Error("pair plan content hash mismatch");
+    if (registration.campaignId !== plan.campaignId || registration.planHash !== plan.planHash)
+        throw Error("pair registration plan mismatch");
+    if (registration.baseline.candidateId === registration.candidate.candidateId)
+        throw Error("distinct registered candidates required");
+    const startedAt = Date.parse(z.string().datetime().parse(input.earliestRunStartedAt));
+    const registeredAt = Date.parse(registration.createdAt), plannedAt = Date.parse(plan.createdAt);
+    if (!Number.isFinite(plannedAt) || plannedAt > registeredAt || registeredAt >= startedAt)
+        throw Error("pair must be planned and registered before execution");
+    const baselineCells = plan.cells.filter(cell => cell.cellId === input.baselineCellId);
+    const candidateCells = plan.cells.filter(cell => cell.cellId === input.candidateCellId);
+    if (baselineCells.length !== 1 || candidateCells.length !== 1)
+        throw Error("pair cells missing or duplicated");
+    const baseline = baselineCells[0], candidate = candidateCells[0];
+    if (baseline.executionRole !== "candidate_run" || candidate.executionRole !== "candidate_run" ||
+        baseline.taskRef !== candidate.taskRef || baseline.seed !== candidate.seed || baseline.split !== candidate.split)
+        throw Error("pair cells do not share task/seed/split");
+    for (const [side, cell] of [["baseline", baseline], ["candidate", candidate]]) {
+        const arm = registration[side];
+        if (cell.candidateId !== arm.candidateId || cell.bundleHash !== arm.bundleHash)
+            throw Error("pair cell candidate mismatch");
+        const record = await readCandidateRecord(input.repoRoot, arm.candidateId);
+        if (record.manifest.bundleHash !== arm.bundleHash)
+            throw Error("registered candidate bundle mismatch");
+        const candidateTime = Date.parse(record.manifest.createdAt);
+        const recordedAt = Date.parse(record.events[0]?.at ?? "");
+        if (!Number.isFinite(candidateTime) || !Number.isFinite(recordedAt) ||
+            candidateTime > registeredAt || recordedAt > registeredAt)
+            throw Error("candidate registered after pair protocol");
+        const identity = observedSchema.parse(input.identities[side]);
+        if (identity.protocol !== registrationRef.sha256)
+            throw Error("observed protocol mismatch");
+        for (const key of ["source", "model", "budget", "initialTree", "acceptance"]) {
+            if (identity[key] !== registration.shared[key])
+                throw Error(`shared pair identity mismatch: ${key}`);
+        }
+        for (const key of ["controller", "promptTools"]) {
+            const declared = arm[key];
+            if (!record.manifest.contentRefs.some(content => content.path === declared.path && content.sha256 === `sha256:${declared.sha256}`))
+                throw Error(`candidate does not own registered ${key} snapshot`);
+            if (identity[key] !== declared.sha256)
+                throw Error(`observed candidate ${key} mismatch`);
+        }
+    }
+    if (registration.gatewayTopology) {
+        const { assertFrontendGatewayTopology } = await import("./frontend-gateway-evidence.js");
+        await assertFrontendGatewayTopology({ repoRoot: input.repoRoot, topology: registration.gatewayTopology, plan, registrationCreatedAt: registration.createdAt });
+    }
+    await read();
+    return { campaignId: plan.campaignId, planHash: plan.planHash, registrationSha256: registrationRef.sha256,
+        baselineCandidateId: baseline.candidateId, candidateId: candidate.candidateId };
+}
+export const frontendPairExecutionBindingSchema = z.object({
+    registration: ref, cellId: z.string().min(1),
+}).strict();
+/** Called by the runner before allocation and on resume. */
+export async function assertFrontendPairExecution(input) {
+    const pair = frontendPairExecutionBindingSchema.parse(input.binding.frontendPair);
+    const bytes = await readFileBoundarySafe({ boundaryRoot: input.repoRoot,
+        targetPath: path.resolve(input.repoRoot, pair.registration.path), label: "frontend execution registration" });
+    if (createHash("sha256").update(bytes).digest("hex") !== pair.registration.sha256)
+        throw Error("execution registration hash mismatch");
+    const protocol = registrationSchema.parse(JSON.parse(bytes.toString("utf8")));
+    const { readCampaignPlan } = await import("../../infrastructure/evaluation/campaign-store.js");
+    const stored = await readCampaignPlan(input.repoRoot, input.binding.campaignId);
+    if (!stored)
+        throw Error("frontend pair campaign plan missing");
+    const plan = campaignPlanSchema.parse(stored);
+    if (protocol.campaignId !== input.binding.campaignId || protocol.planHash !== plan.planHash ||
+        computeCampaignPlanHash(plan.campaignId, plan.cells) !== plan.planHash)
+        throw Error("execution pair plan mismatch");
+    const registeredAt = Date.parse(protocol.createdAt), startedAt = Date.parse(input.startedAt), plannedAt = Date.parse(plan.createdAt);
+    if (![registeredAt, startedAt, plannedAt].every(Number.isFinite) || plannedAt > registeredAt || registeredAt >= startedAt)
+        throw Error("execution pair protocol must predate run");
+    const arms = [protocol.baseline, protocol.candidate].filter(arm => arm.candidateId === input.binding.candidateId);
+    const cells = plan.cells.filter(cell => cell.cellId === pair.cellId);
+    if (arms.length !== 1 || cells.length !== 1)
+        throw Error("execution pair arm or cell missing/ambiguous");
+    const arm = arms[0], cell = cells[0];
+    if (cell.executionRole !== "candidate_run" || cell.candidateId !== arm.candidateId || cell.bundleHash !== arm.bundleHash ||
+        input.binding.bundleHash !== arm.bundleHash || cell.seed !== input.binding.seed || cell.split !== input.binding.split || cell.taskRef !== input.binding.taskRef)
+        throw Error("execution pair cell binding mismatch");
+    if (protocol.baseline.candidateId === protocol.candidate.candidateId)
+        throw Error("execution pair requires distinct arms");
+    for (const member of [protocol.baseline, protocol.candidate]) {
+        const partners = plan.cells.filter(row => row.executionRole === "candidate_run" && row.candidateId === member.candidateId &&
+            row.taskRef === cell.taskRef && row.seed === cell.seed && row.split === cell.split);
+        if (partners.length !== 1 || partners[0].bundleHash !== member.bundleHash)
+            throw Error("execution pair counterpart missing or mismatched");
+    }
+    if (arm.controllerFingerprint !== input.controllerFingerprint)
+        throw Error("execution pair controller fingerprint mismatch");
+    const record = await readCandidateRecord(input.repoRoot, arm.candidateId);
+    const recordedAt = Date.parse(record.events[0]?.at ?? "");
+    if (record.manifest.bundleHash !== arm.bundleHash || !Number.isFinite(recordedAt) || recordedAt > registeredAt)
+        throw Error("execution pair candidate registration mismatch");
+    for (const key of ["controller", "promptTools"]) {
+        if (!record.manifest.contentRefs.some(content => content.path === arm[key].path && content.sha256 === `sha256:${arm[key].sha256}`))
+            throw Error("execution pair snapshot not owned by candidate");
+    }
+    if (protocol.gatewayTopology) {
+        const { assertFrontendGatewayTopology } = await import("./frontend-gateway-evidence.js");
+        await assertFrontendGatewayTopology({ repoRoot: input.repoRoot, topology: protocol.gatewayTopology, plan, registrationCreatedAt: protocol.createdAt });
+    }
+    return { planHash: plan.planHash, shared: protocol.shared, sharedArtifacts: protocol.sharedArtifacts, gatewayTopology: protocol.gatewayTopology };
+}

package/dist/application/evaluation/frontend-paired-summary.js

@@ -0,0 +1,150 @@
+import { z } from "zod";
+import { campaignPlanSchema } from "./types.js";
+const metric = z.number().finite().nonnegative().nullable();
+const observationSchema = z.object({
+    cellId: z.string().min(1),
+    bundleHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    runId: z.string().min(1),
+    firstPassed: z.boolean().nullable(),
+    finalPassed: z.boolean().nullable(),
+    requests: z.number().int().nonnegative().nullable(),
+    tokens: z.number().int().nonnegative().nullable(),
+    wallClockMs: metric,
+}).strict().refine(row => row.firstPassed !== true || row.finalPassed === true, {
+    message: "first success requires final success",
+});
+/** For independent paired trials, Hoeffding bounds the mean of differences
+ * in [-1, 1]: P(|mean - E(mean)| >= e) <= 2 exp(-n e² / 2).
+ * This deliberately stays wide for small samples, including all ties.
+ * Each interval has marginal 95% coverage, not simultaneous coverage across
+ * metrics/cases, and targets this fixed plan rather than unseen task classes. */
+function pairedUncertainty(pairs) {
+    const calculate = (field) => {
+        let observed = 0, totalDifference = 0;
+        for (const pair of pairs) {
+            const before = pair.baseline?.[field], after = pair.candidate?.[field];
+            if (before == null || after == null)
+                continue;
+            observed++;
+            totalDifference += Number(after) - Number(before);
+        }
+        const complete = observed === pairs.length && observed > 0;
+        const difference = complete ? totalDifference / observed : null;
+        const halfWidth = complete ? Math.sqrt(2 * Math.log(40) / observed) : null;
+        return {
+            method: "paired-hoeffding", confidenceLevel: 0.95,
+            assumption: "independent-paired-trials-fixed-plan",
+            planned: pairs.length, observed, difference,
+            interval: difference === null || halfWidth === null ? null : {
+                lower: Math.max(-1, difference - halfWidth), upper: Math.min(1, difference + halfWidth),
+            },
+        };
+    };
+    return { first: calculate("firstPassed"), final: calculate("finalPassed") };
+}
+function distribution(values) {
+    if (!values.length || values.some(value => value === null)) {
+        return { values, total: null, median: null, maximum: null };
+    }
+    const sorted = values.slice().sort((a, b) => a - b);
+    const middle = Math.floor(sorted.length / 2);
+    return {
+        values,
+        total: sorted.reduce((sum, value) => sum + value, 0),
+        median: sorted.length % 2 ? sorted[middle] : (sorted[middle - 1] + sorted[middle]) / 2,
+        maximum: sorted.at(-1),
+    };
+}
+function summarize(rows) {
+    const success = (field) => {
+        const values = rows.map(row => row?.[field] ?? null);
+        const passed = values.filter(value => value === true).length;
+        const failed = values.filter(value => value === false).length;
+        const unknown = values.length - passed - failed;
+        return { planned: rows.length, passed, failed, unknown, rate: unknown || !rows.length ? null : passed / rows.length };
+    };
+    const first = success("firstPassed"), final = success("finalPassed");
+    const requests = distribution(rows.map(row => row?.requests ?? null));
+    const tokens = distribution(rows.map(row => row?.tokens ?? null));
+    const wallClockMs = distribution(rows.map(row => row?.wallClockMs ?? null));
+    return {
+        first, final, requests, tokens, wallClockMs,
+        // Failed attempts remain in the numerator. Unknown or zero correct
+        // deliveries cannot yield an apparent zero-cost delivery.
+        tokensPerCorrectDelivery: final.unknown || !final.passed || tokens.total === null ? null : tokens.total / final.passed,
+    };
+}
+/** Descriptive statistics only. The caller must verify source artifacts and
+ * preregistered identity/model/budget/oracle bindings before interpreting these
+ * observations. This function never authorizes promotion or returns a pass. */
+export function summarizeFrontendTaskPairs(input) {
+    const plan = campaignPlanSchema.parse(input.plan);
+    if (input.baselineCandidateId === input.candidateId)
+        throw Error("distinct candidates required");
+    const cells = plan.cells.filter(cell => cell.executionRole === "candidate_run" &&
+        [input.baselineCandidateId, input.candidateId].includes(cell.candidateId));
+    const byId = new Map(cells.map(cell => [cell.cellId, cell]));
+    if (byId.size !== cells.length)
+        throw Error("duplicate planned cell");
+    const observations = new Map();
+    const runIds = new Set();
+    for (const raw of input.observations) {
+        const row = observationSchema.parse(raw), cell = byId.get(row.cellId);
+        if (!cell || cell.bundleHash !== row.bundleHash)
+            throw Error("observation does not match planned candidate cell");
+        if (observations.has(row.cellId) || runIds.has(row.runId))
+            throw Error("duplicate cell or run observation");
+        observations.set(row.cellId, row);
+        runIds.add(row.runId);
+    }
+    const groups = new Map();
+    for (const cell of cells) {
+        const key = JSON.stringify([cell.split, cell.taskRef, cell.seed]);
+        const pair = groups.get(key) ?? { taskRef: cell.taskRef, split: cell.split, seed: cell.seed };
+        const side = cell.candidateId === input.baselineCandidateId ? "baselineCellId" : "candidateCellId";
+        if (pair[side])
+            throw Error("duplicate planned candidate/task/seed/split");
+        pair[side] = cell.cellId;
+        groups.set(key, pair);
+    }
+    if (!groups.size || [...groups.values()].some(pair => !pair.baselineCellId || !pair.candidateCellId)) {
+        throw Error("plan must contain both arms for every pair");
+    }
+    const pairs = [...groups.values()].map(pair => ({
+        ...pair,
+        baseline: observations.get(pair.baselineCellId) ?? null,
+        candidate: observations.get(pair.candidateCellId) ?? null,
+    }));
+    const perCase = [...new Set(pairs.map(pair => JSON.stringify([pair.split, pair.taskRef])))].map(key => {
+        const selected = pairs.filter(pair => JSON.stringify([pair.split, pair.taskRef]) === key);
+        const tally = (field) => {
+            const counts = { baselineWins: 0, candidateWins: 0, ties: 0, unknown: 0 };
+            for (const pair of selected) {
+                const before = pair.baseline?.[field], after = pair.candidate?.[field];
+                if (before == null || after == null)
+                    counts.unknown++;
+                else if (before === after)
+                    counts.ties++;
+                else if (after)
+                    counts.candidateWins++;
+                else
+                    counts.baselineWins++;
+            }
+            return counts;
+        };
+        return { taskRef: selected[0].taskRef, split: selected[0].split,
+            first: tally("firstPassed"), final: tally("finalPassed"),
+            pairedUncertainty: pairedUncertainty(selected),
+            baseline: summarize(selected.map(pair => pair.baseline)),
+            candidate: summarize(selected.map(pair => pair.candidate)) };
+    });
+    return {
+        evidenceKind: "descriptive-task-pair-summary", perCase,
+        campaignId: plan.campaignId, planHash: plan.planHash,
+        baselineCandidateId: input.baselineCandidateId, candidateId: input.candidateId,
+        pairs,
+        pairedUncertainty: pairedUncertainty(pairs),
+        baseline: summarize(pairs.map(pair => pair.baseline)),
+        candidate: summarize(pairs.map(pair => pair.candidate)),
+    };
+}

package/dist/application/evaluation/frontend-run-observation.js

@@ -0,0 +1,144 @@
+import { readFrontendCorpusBrowserAcceptance } from "./frontend-corpus-browser-acceptance.js";
+import { readFrontendGatewayGraph } from "./frontend-gateway-evidence.js";
+import { readFrontendSharedEvidence } from "./frontend-shared-evidence.js";
+import { readFrontendBrowserAcceptance } from "./frontend-browser-acceptance.js";
+import { computeCampaignPlanHash } from "./campaign-hash.js";
+import { readCampaignPlan } from "../../infrastructure/evaluation/campaign-store.js";
+import { realpath } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { readFileBoundarySafe } from "../../shared/path-safety.js";
+import { locateDagRun, readDagRunSpec, readDagRunState } from "../../workflows/dag/lifecycle.js";
+import { readFrontendRootObservation } from "../../workflows/dag/frontend-root-observation.js";
+import { verifyControllerIdentityForResume } from "../../workflows/dag/controller-identity.js";
+import { assertFrontendPairExecution } from "./frontend-pair-registration.js";
+import { summarizeFrontendTaskPairs } from "./frontend-paired-summary.js";
+/** Collect run/cost facts. FINISHED is deliberately not converted to a passed
+ * product: independent acceptance and shared-identity admission are separate. */
+export async function readFrontendTaskRunObservation(input) {
+    if (input.acceptance && input.corpusBrowser)
+        throw Error("conflicting browser acceptance evidence");
+    const root = await readFrontendRootObservation(input.repoRoot, input.runId);
+    if (!root.runIds.length)
+        throw Error("frontend observation root missing");
+    const snapshots = [];
+    let binding;
+    let sharedRegistration;
+    let registeredAcceptance;
+    let firstStatus;
+    let lastState;
+    for (const runId of root.runIds) {
+        const located = await locateDagRun(input.repoRoot, runId);
+        if (!located)
+            throw Error("frontend observation run missing");
+        const read = (name) => readFileBoundarySafe({ boundaryRoot: located.runDir,
+            targetPath: path.join(located.runDir, name), label: "frontend run observation" });
+        const snapshot = { runDir: located.runDir, state: await read("state.json"), spec: await read("run.json"), controller: await read("controller-identity.json") };
+        const state = await readDagRunState(located.runDir), spec = await readDagRunSpec(located.runDir);
+        if (await realpath(state.cwd) !== await realpath(input.repoRoot))
+            throw Error("frontend observation workspace mismatch");
+        firstStatus ??= state.status;
+        if (state.runId !== runId || !state.evaluation?.frontendPair || !spec.evaluation?.frontendPair ||
+            JSON.stringify(state.evaluation) !== JSON.stringify(spec.evaluation))
+            throw Error("frontend observation frozen evaluation mismatch");
+        if (binding && JSON.stringify(binding) !== JSON.stringify(state.evaluation))
+            throw Error("frontend observation recovery evaluation drift");
+        binding = state.evaluation;
+        const artifact = JSON.parse(snapshot.controller.toString("utf8"));
+        if (state.controllerIdentityRef?.path !== "controller-identity.json" || artifact.status !== "pinned" || !artifact.identity)
+            throw Error("frontend observation controller not pinned");
+        const pinned = await verifyControllerIdentityForResume({ runDir: located.runDir, state, currentIdentity: artifact.identity });
+        const registration = await assertFrontendPairExecution({ repoRoot: input.repoRoot, binding,
+            controllerFingerprint: pinned.identity.packageFingerprint.value, startedAt: state.startedAt });
+        sharedRegistration = registration;
+        registeredAcceptance = registration.shared.acceptance;
+        snapshots.push(snapshot);
+        lastState = state;
+    }
+    let acceptance;
+    if (input.acceptance) {
+        if (input.acceptance.contract.sha256 !== registeredAcceptance)
+            throw Error("browser acceptance contract not registered for run");
+        acceptance = await readFrontendBrowserAcceptance({ repoRoot: input.repoRoot, runDir: snapshots.at(-1).runDir, ...input.acceptance });
+    }
+    let corpusBrowserEvidence;
+    if (input.corpusBrowser) {
+        if (input.corpusBrowser.contract.sha256 !== registeredAcceptance)
+            throw Error("corpus browser contract not registered for run");
+        corpusBrowserEvidence = await readFrontendCorpusBrowserAcceptance({ repoRoot: input.repoRoot, runDir: snapshots.at(-1).runDir, ...input.corpusBrowser });
+    }
+    // A failed required browser behavior disproves delivery. Passing browser
+    // checks alone does not prove the remaining product quality gates.
+    const productVerdict = corpusBrowserEvidence?.browserPassed === false || acceptance?.passed === false ? false : null;
+    const sharedEvidence = sharedRegistration?.sharedArtifacts ? await readFrontendSharedEvidence({
+        repoRoot: input.repoRoot, runDirs: snapshots.map(snapshot => snapshot.runDir),
+        artifacts: sharedRegistration.sharedArtifacts, expected: sharedRegistration.shared,
+    }) : undefined;
+    let gatewayObservation;
+    if (input.gatewaySnapshots) {
+        if (!sharedRegistration?.gatewayTopology)
+            throw Error("frontend run gateway topology not registered");
+        const graph = await readFrontendGatewayGraph({ repoRoot: input.repoRoot,
+            topology: sharedRegistration.gatewayTopology, expectedPlanHash: sharedRegistration.planHash,
+            evidence: input.gatewaySnapshots });
+        const providerAttempts = graph.providerAttempts.filter(row => row.originCellId === binding.frontendPair.cellId);
+        if (providerAttempts.some(row => row.originTaskRef !== binding.taskRef))
+            throw Error("frontend gateway task binding mismatch");
+        gatewayObservation = {
+            evidenceKind: "registered-cell-gateway-observations",
+            cellId: binding.frontendPair.cellId, taskRef: binding.taskRef,
+            topologySha256: graph.topologySha256, snapshots: input.gatewaySnapshots,
+            observedProviderAttempts: providerAttempts.length,
+            reportedProviderTokens: graph.diagnostics.length || providerAttempts.some(row => row.totalTokens === null)
+                ? null : providerAttempts.reduce((sum, row) => sum + row.totalTokens, 0),
+            providerAttempts,
+            // Graph-wide unresolved hops remain conservative even for another cell.
+            diagnostics: [...graph.diagnostics, "gateway-run-coverage-not-proven"],
+        };
+    }
+    for (const snapshot of snapshots)
+        for (const [file, expected] of [["state.json", snapshot.state], ["run.json", snapshot.spec], ["controller-identity.json", snapshot.controller]]) {
+            const actual = await readFileBoundarySafe({ boundaryRoot: snapshot.runDir, targetPath: path.join(snapshot.runDir, file), label: "frontend observation recheck" });
+            if (!actual.equals(expected))
+                throw Error("frontend observation changed during collection");
+        }
+    const recheckedRoot = await readFrontendRootObservation(input.repoRoot, input.runId);
+    if (JSON.stringify(recheckedRoot) !== JSON.stringify(root))
+        throw Error("frontend root observations changed during collection");
+    const knownFailure = root.complete && ["failed", "partial_failed"].includes(lastState.status);
+    const consumed = root.cumulativeBudget?.consumed;
+    // Reservations precede dispatch and can survive a failed dispatch. The root
+    // timer starts at DAG allocation, after task/source preparation. Keep these
+    // useful facts, but do not relabel them as task-wide request/time metrics.
+    const observedBudget = {
+        reservedRequests: root.complete ? consumed?.providerRequests ?? null : null,
+        cumulativeTokens: root.complete && consumed?.missingTokenNodeIds.length === 0 ? consumed.tokens : null,
+        dagWallClockMs: root.dagWallClockMs,
+    };
+    const metricDiagnostics = ["task-provider-request-count-not-observed", "task-wallclock-not-observed"];
+    if (!root.sourceUsage?.complete)
+        metricDiagnostics.push("task-source-usage-not-observed");
+    const observation = {
+        cellId: binding.frontendPair.cellId, bundleHash: binding.bundleHash, runId: root.runIds[0],
+        firstPassed: root.complete && root.runIds.length === 1 ? (knownFailure ? false : productVerdict) : root.complete && ["failed", "partial_failed"].includes(firstStatus) ? false : null,
+        finalPassed: root.complete ? (knownFailure ? false : productVerdict) : null,
+        requests: null,
+        tokens: root.sourceUsage?.complete ? observedBudget.cumulativeTokens : null,
+        wallClockMs: null,
+    };
+    return { campaignId: binding.campaignId, observation, outcome: root.complete ? lastState.status : null,
+        diagnostics: [...root.diagnostics, ...metricDiagnostics, ...(gatewayObservation?.diagnostics ?? ["gateway-snapshots-not-supplied"]), ...(corpusBrowserEvidence?.diagnostics ?? acceptance?.diagnostics ?? ["independent-acceptance-pending"]), ...(sharedEvidence?.diagnostics ?? ["shared-identity-admission-pending"])],
+        acceptance, corpusBrowserEvidence, sharedEvidence, observedBudget, gatewayObservation,
+        runs: snapshots.map((snapshot, index) => ({ runId: root.runIds[index], stateSha256: createHash("sha256").update(snapshot.state).digest("hex"), runSha256: createHash("sha256").update(snapshot.spec).digest("hex") })) };
+}
+export async function collectFrontendTaskPairSummary(input) {
+    const stored = await readCampaignPlan(input.repoRoot, input.plan.campaignId);
+    if (!stored || input.plan.planHash !== stored.planHash || computeCampaignPlanHash(input.plan.campaignId, input.plan.cells) !== stored.planHash)
+        throw Error("frontend summary registered plan mismatch");
+    const collected = [];
+    for (const runId of input.runIds)
+        collected.push(await readFrontendTaskRunObservation({ repoRoot: input.repoRoot, runId, corpusBrowser: input.corpusBrowserByRun?.[runId], gatewaySnapshots: input.gatewaySnapshotsByRun?.[runId], acceptance: input.acceptanceByRun?.[runId] }));
+    if (collected.some(row => row.campaignId !== input.plan.campaignId))
+        throw Error("frontend summary campaign mismatch");
+    return { summary: summarizeFrontendTaskPairs({ ...input, observations: collected.map(row => row.observation) }), collected };
+}

package/dist/application/evaluation/frontend-shared-evidence.js

@@ -0,0 +1,105 @@
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { z } from "zod";
+import { readFileBoundarySafe } from "../../shared/path-safety.js";
+import { sha256OfCanonicalJson } from "../../task/contract/hash.js";
+import { readDagRunSpec } from "../../workflows/dag/lifecycle.js";
+import { readFrontendSessionBudgetReceipts } from "../../workflows/dag/frontend-session-budget.js";
+import { verifyFrozenSourceUsage } from "../../task/source-prepare/source-provider-budget.js";
+import { frontendSharedArtifactsSchema } from "./frontend-pair-registration.js";
+export async function readFrontendSharedEvidence(input) {
+    if (!input.runDirs.length)
+        throw Error("shared evidence requires a root run");
+    const artifacts = frontendSharedArtifactsSchema.parse(input.artifacts);
+    const snapshots = [];
+    const read = async (root, name, expected) => {
+        const target = path.resolve(root, name);
+        const bytes = await readFileBoundarySafe({ boundaryRoot: root, targetPath: target, label: "frontend shared evidence" });
+        if (expected && createHash("sha256").update(bytes).digest("hex") !== expected)
+            throw Error(`shared artifact hash mismatch: ${name}`);
+        snapshots.push({ root, target, bytes });
+        return JSON.parse(bytes.toString("utf8"));
+    };
+    const values = {};
+    for (const key of ["source", "budget", "model", "initialTree"]) {
+        if (artifacts[key].sha256 !== input.expected[key])
+            throw Error(`shared artifact not registered: ${key}`);
+        values[key] = await read(input.repoRoot, artifacts[key].path, artifacts[key].sha256);
+    }
+    const model = z.object({ model: z.string().min(1), parameters: z.record(z.unknown()).optional() }).strict().parse(values.model);
+    const diagnostics = [];
+    if (model.parameters && Object.keys(model.parameters).length)
+        diagnostics.push("model-sampling-parameters-not-observed");
+    const expectedTree = z.object({ gitHeadSha: z.string().regex(/^[a-f0-9]{40,64}$/), changedPaths: z.array(z.unknown()), stableGovernanceInputs: z.array(z.unknown()) }).strict().parse(values.initialTree);
+    const checkpoint = await read(input.runDirs[0], ".runtime/workspace-checkpoint-start.json");
+    const actualTree = { gitHeadSha: checkpoint.gitHeadSha, changedPaths: checkpoint.changedPaths, stableGovernanceInputs: checkpoint.stableGovernanceInputs ?? [] };
+    if (sha256OfCanonicalJson(actualTree) !== sha256OfCanonicalJson(expectedTree))
+        throw Error("shared initial tree mismatch");
+    let attempts = 0;
+    const inspected = new Map();
+    const inspect = (receipt) => {
+        if (receipt.identity.executionKind !== "model")
+            return;
+        const key = JSON.stringify([receipt.identity.runId ?? receipt.identity.taskId, receipt.identity.sessionId]);
+        const contentHash = sha256OfCanonicalJson(receipt);
+        if (inspected.has(key)) {
+            if (inspected.get(key) !== contentHash)
+                throw Error("conflicting shared model receipt");
+            return;
+        }
+        inspected.set(key, contentHash);
+        if (receipt.completion !== "complete" || !receipt.attempts.length || !receipt.planned?.capabilities.model)
+            diagnostics.push("shared model observation incomplete");
+        if (receipt.planned?.capabilities.model && receipt.planned.capabilities.model !== model.model)
+            throw Error("shared planned model mismatch");
+        for (const attempt of receipt.attempts) {
+            if (attempt.model !== model.model)
+                throw Error("shared attempt model mismatch");
+            if (attempt.completion !== "complete")
+                diagnostics.push("shared model observation incomplete");
+            attempts++;
+        }
+    };
+    const sourceReceipts = new Set();
+    for (const runDir of input.runDirs) {
+        await read(runDir, "run.json");
+        const spec = await readDagRunSpec(runDir);
+        if (sha256OfCanonicalJson(spec.sourceBinding ?? null) !== sha256OfCanonicalJson(values.source))
+            throw Error("shared source mismatch");
+        if (sha256OfCanonicalJson(spec.budget ?? null) !== sha256OfCanonicalJson(values.budget))
+            throw Error("shared budget mismatch");
+        const state = await read(runDir, "state.json");
+        for (const task of spec.tasks) {
+            const receipts = await readFrontendSessionBudgetReceipts(runDir, task.id);
+            const node = state.nodes?.[task.id];
+            if (task.executor === "pi" && node && !["PENDING", "SKIPPED"].includes(node.status) && node.origin?.kind !== "imported" && !receipts.length)
+                diagnostics.push(`missing model receipts: ${task.id}`);
+            for (const receipt of receipts)
+                inspect(receipt);
+        }
+        if (spec.sourceProviderBudget) {
+            const verified = await verifyFrozenSourceUsage(input.repoRoot, spec.sourceProviderBudget);
+            diagnostics.push(...verified.diagnostics);
+            for (const source of spec.sourceProviderBudget.evidence?.receipts ?? []) {
+                if (sourceReceipts.has(source.sha256))
+                    continue;
+                sourceReceipts.add(source.sha256);
+                inspect(JSON.parse(source.content));
+            }
+        }
+    }
+    if (!attempts)
+        diagnostics.push("shared model has no observed attempts");
+    // Sampling settings are not yet present in session receipts; matching model
+    // names alone cannot prove every parameter used by the SDK/provider.
+    if (!diagnostics.includes("model-sampling-parameters-not-observed"))
+        diagnostics.push("model-sampling-parameters-not-observed");
+    diagnostics.push("provider-resolved-model-not-observed");
+    for (const snapshot of snapshots) {
+        const latest = await readFileBoundarySafe({ boundaryRoot: snapshot.root, targetPath: snapshot.target, label: "shared evidence recheck" });
+        if (!latest.equals(snapshot.bytes))
+            throw Error("shared evidence changed during collection");
+    }
+    return { diagnostics: [...new Set(diagnostics)], model: model.model, observedAttempts: attempts,
+        verified: { source: true, budget: true, initialTree: true, modelReference: attempts > 0 && diagnostics.every(item => ["model-sampling-parameters-not-observed", "provider-resolved-model-not-observed"].includes(item)), samplingParameters: false } };
+}

package/dist/application/evaluation/types.js

@@ -265,18 +265,51 @@ const corpusManifestObjectSchema = z
         .optional(),
 })
     .strict();
-export const corpusManifestInputSchema = corpusManifestObjectSchema.superRefine(refineCorpusTasks);
-export const corpusManifestSchema = z
-    .object({
-    schemaVersion: z.literal(1),
-    corpusId: corpusIdSchema,
-    createdAt: z.string().min(1),
-    description: z.string().optional(),
-    tasks: z.array(corpusTaskSchema).min(12).max(20),
-    corpusHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
-})
-    .strict()
-    .superRefine(refineCorpusTasks);
+// The six-case exploratory frontend protocol is distinct from the heterogeneous
+// dogfood corpus. All six are public execution tasks, not held-out claims.
+const frontendCorpusCategories = [
+    "local-interaction", "form-validation", "component-reuse",
+    "table-filter-pagination", "multi-api-mock-boundary", "shared-context-domains",
+];
+const frontendCorpusFileSchema = z.object({
+    path: z.string().min(1).refine(value => !value.includes("\\") && !value.includes(":") &&
+        !value.startsWith("/") && value.split("/").every(part => part !== "" && part !== "." && part !== ".."), "corpus artifact must be a normalized relative file path"),
+    sha256: z.string().regex(/^[a-f0-9]{64}$/),
+}).strict();
+const frontendCorpusFilesSchema = z.array(frontendCorpusFileSchema).min(1).superRefine((files, ctx) => {
+    if (new Set(files.map(file => file.path)).size !== files.length)
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "duplicate corpus artifact path" });
+});
+const frontendCorpusTaskSchema = corpusTaskSchema.extend({
+    class: z.literal("frontend"), split: z.literal("public"),
+    category: z.enum(frontendCorpusCategories),
+    requirements: frontendCorpusFilesSchema,
+    initialFiles: frontendCorpusFilesSchema,
+    oracleFiles: frontendCorpusFilesSchema,
+}).superRefine((task, ctx) => {
+    if (task.seeds.length !== 3)
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "frontend corpus requires three planned repetitions" });
+});
+const frontendCorpusObjectSchema = z.object({
+    schemaVersion: z.literal(2), purpose: z.literal("frontend-task-pairs"),
+    corpusId: corpusIdSchema, createdAt: z.string().datetime(), description: z.string().optional(),
+    tasks: z.array(frontendCorpusTaskSchema).length(6),
+    corpusHash: z.string().regex(/^(sha256:)?[a-f0-9]{64}$/i).optional(),
+}).strict();
+function refineFrontendCorpus(manifest, ctx) {
+    if (new Set(manifest.tasks.map(task => task.category)).size !== frontendCorpusCategories.length)
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "frontend corpus requires all six categories exactly once" });
+    if (new Set(manifest.tasks.map(task => task.taskRef)).size !== manifest.tasks.length)
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "duplicate frontend corpus taskRef" });
+}
+export const corpusManifestInputSchema = z.union([
+    corpusManifestObjectSchema.superRefine(refineCorpusTasks),
+    frontendCorpusObjectSchema.superRefine(refineFrontendCorpus),
+]);
+export const corpusManifestSchema = z.union([
+    corpusManifestObjectSchema.extend({ corpusHash: z.string().regex(/^sha256:[a-f0-9]{64}$/) }).superRefine(refineCorpusTasks),
+    frontendCorpusObjectSchema.extend({ corpusHash: z.string().regex(/^sha256:[a-f0-9]{64}$/) }).superRefine(refineFrontendCorpus),
+]);
 // --- Private Verifier + Campaign (M4) ---
 export const privateVerifierIdSchema = z
     .string()