@tea-agent/loop-agent 0.44.0-next.1 → 0.44.0-next.10

package/dist/workflows/dag/frontend-durable-tools.js

@@ -1,3 +1,4 @@
+import { frontendPlanSemanticDigest } from "./frontend-plan-progress.js";
 import { mkdir, open, rename, rm } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import path from "node:path";
@@ -12,7 +13,7 @@ export function readFrontendToolProgress(tools) {
     const counters = [...new Set((tools ?? []).flatMap(tool => tool && typeof tool === "object" && progressByTool.has(tool) ? [progressByTool.get(tool)] : []))];
     if (!counters.length)
         return undefined;
-    return counters.reduce((sum, item) => ({ failedRecords: sum.failedRecords + item.failedRecords, duplicateRecords: sum.duplicateRecords + item.duplicateRecords, durableSubmissions: sum.durableSubmissions + item.durableSubmissions, durableReplacements: sum.durableReplacements + item.durableReplacements }), { failedRecords: 0, duplicateRecords: 0, durableSubmissions: 0, durableReplacements: 0 });
+    return counters.reduce((sum, item) => ({ finalizeRejections: sum.finalizeRejections + item.finalizeRejections, failedRecords: sum.failedRecords + item.failedRecords, duplicateRecords: sum.duplicateRecords + item.duplicateRecords, durableSubmissions: sum.durableSubmissions + item.durableSubmissions, durableReplacements: sum.durableReplacements + item.durableReplacements }), { finalizeRejections: 0, failedRecords: 0, duplicateRecords: 0, durableSubmissions: 0, durableReplacements: 0 });
 }
 async function exclusive(key, work) {
     const previous = queues.get(key) ?? Promise.resolve();
@@ -61,7 +62,8 @@ export async function createDurableFrontendTools(input) {
         return { ...tool, parameters: { ...schema, properties: { ...schema.properties, replace: { type: "boolean", description: "Explicitly revise the current fact with the same identity. Omit for new facts or identical replay." } } } };
     });
     const bindingSha256 = hash({ version: 1, attemptId: input.attemptId, binding: input.binding, schemas: tools.map(t => ({ name: t.name, parameters: t.parameters })) });
-    const publish = (store) => { input.store.records = store.records; input.store.revision = store.revision; input.setWorkingStore(input.store); };
+    const publish = (store) => { input.store.records = store.records; input.store.revision = store.revision; input.setWorkingStore(input.store); if (hasCommittedTerminalEvent(store, input.attemptId))
+        input.planControl?.acceptTerminal(); };
     const validate = async (records) => {
         let revision = 0;
         let terminal = false;
@@ -89,81 +91,99 @@ export async function createDurableFrontendTools(input) {
             throw ledgerError("FRONTEND_LEDGER_MISSING", "frontend durable ledger disappeared or became empty; refusing an unproven acknowledgement");
     };
     await exclusive(file, restore);
-    const progress = { failedRecords: 0, duplicateRecords: 0, durableSubmissions: 0, durableReplacements: 0 };
+    const progress = { finalizeRejections: 0, failedRecords: 0, duplicateRecords: 0, durableSubmissions: 0, durableReplacements: 0 };
     const replay = (receipt) => { progress.duplicateRecords++; return receipt; };
     const wrapped = tools.map(tool => ({ ...tool, execute: (...args) => exclusive(file, async () => {
-            const [callId, params] = args;
-            const valid = Check(tool.parameters, params);
-            if (!valid) {
-                const errors = [...Errors(tool.parameters, params)];
-                return failure("TOOL_SCHEMA_INVALID", `${tool.name}: ${errors.slice(0, 8).map(e => `${e.instancePath || "/"}: ${e.message}`).join("; ")}${errors.length > 8 ? `; ${errors.length - 8} more fields` : ""}`);
-            }
-            try {
-                await restore();
-                const paramsSha256 = hash(params);
-                const singleton = new Set(["record_route_selection", "record_state_registry", "record_mock_api", "record_data_flow", "record_dependency", "record_design_deviation", "record_required_deliverables", "record_target_surface", "finalize_contract", "finalize_plan", "finalize_decision"]);
-                const naturalId = params?.id ?? params?.scopeId ?? params?.entry?.id ?? params?.requirementId ?? params?.choice?.purpose ?? params?.entry?.purpose ?? params?.entry?.state ?? params?.entry?.interaction ?? params?.entry?.boundary ?? (tool.name === "record_openspec_selection" ? params?.path : undefined) ?? (params?.endpoint ? `${params.endpoint.method}:${params.endpoint.path}` : undefined) ?? (singleton.has(tool.name) ? "singleton" : undefined);
-                const identity = `${tool.name}:${typeof naturalId === "string" ? naturalId : "incremental"}`;
-                const submissions = input.store.records.flatMap(r => r.submission?.receipt ? [r.submission] : []);
-                const previousCall = submissions.find(s => s.callId === callId);
-                if (previousCall)
-                    return previousCall.tool === tool.name && previousCall.paramsSha256 === paramsSha256 ? replay(previousCall.receipt) : failure("REQUEST_ID_REUSE_CONFLICT", `${tool.name}: call id already acknowledged with different parameters`);
-                const previousFact = submissions.filter(s => s.identity === identity).at(-1);
-                if (tool.name !== "record_plan_group_coverage" && previousFact?.paramsSha256 === paramsSha256)
-                    return replay(previousFact.receipt);
-                // A committed finalize terminal carries no domain payload in its params
-                // (r15: the model acknowledged with {replace:false}, the executor's
-                // auto-finalize sends {}) — both are acknowledgements of the same durable
-                // terminal, so any later finalize call replays the receipt instead of
-                // demanding a params match no caller can reproduce. Other singletons
-                // (state registry, data flows, ...) carry domain payloads and keep the
-                // replace:true correction path.
-                if (FINALIZE_TERMINAL_TOOLS.has(tool.name) && previousFact?.receipt)
-                    return replay(previousFact.receipt);
-                if (previousFact && naturalId !== undefined && params?.replace !== true && !["record_evidence_expectation", "record_required_deliverables", "record_data_flow"].includes(tool.name))
-                    return failure("FACT_IDENTITY_CONFLICT", `${identity}: changing a saved fact requires explicit replacement (replace:true)`);
-                if (input.store.records.some(r => ["contract-finalized", "finalize_plan", "finalize_decision", "approve_review", "request_review_changes", "approve_design", "request_design_changes"].includes(String(r.fact.kind))))
-                    return failure("TERMINAL_CONFLICT", "A successful terminal is already durable; only identical acknowledged submissions may be replayed");
-                const draft = structuredClone(input.store);
-                input.setWorkingStore(draft);
-                let result;
+            const beforeRevision = input.store.revision;
+            const execute = async () => {
+                const stopped = input.planControl?.readStop();
+                if (stopped)
+                    return failure(stopped.code, stopped.error);
+                const [callId, params] = args;
+                const valid = Check(tool.parameters, params);
+                if (!valid) {
+                    const errors = [...Errors(tool.parameters, params)];
+                    return failure("TOOL_SCHEMA_INVALID", `${tool.name}: ${errors.slice(0, 8).map(e => `${e.instancePath || "/"}: ${e.message}`).join("; ")}${errors.length > 8 ? `; ${errors.length - 8} more fields` : ""}`);
+                }
                 try {
-                    // Protocol controls must not be spread into domain facts by permissive callers.
-                    const original = input.tools.find(t => t.name === tool.name);
-                    const domainParams = { ...params };
-                    if (!original.parameters.properties?.replace)
-                        delete domainParams.replace;
-                    result = await tool.execute(args[0], domainParams, ...args.slice(2));
+                    await restore();
+                    const isReviewFinding = ["record_review_finding", "record_design_finding"].includes(tool.name);
+                    const paramsSha256 = hash(isReviewFinding ? { ...params, replace: undefined } : params);
+                    const singleton = new Set(["record_route_selection", "record_state_registry", "record_mock_api", "record_data_flow", "record_dependency", "record_design_deviation", "record_required_deliverables", "record_target_surface", "finalize_contract", "finalize_plan", "finalize_decision"]);
+                    const naturalId = params?.id ?? params?.scopeId ?? params?.entry?.id ?? params?.requirementId ?? params?.choice?.purpose ?? params?.entry?.purpose ?? params?.entry?.state ?? params?.entry?.interaction ?? params?.entry?.boundary ?? (tool.name === "record_openspec_selection" ? params?.path : undefined) ?? (params?.endpoint ? `${params.endpoint.method}:${params.endpoint.path}` : undefined) ?? (singleton.has(tool.name) ? "singleton" : undefined);
+                    const identity = `${tool.name}:${typeof naturalId === "string" ? naturalId : "incremental"}`;
+                    const submissions = input.store.records.flatMap(r => r.submission?.receipt ? [r.submission] : []);
+                    const previousCall = submissions.find(s => s.callId === callId);
+                    if (previousCall)
+                        return previousCall.tool === tool.name && previousCall.paramsSha256 === paramsSha256 ? replay(previousCall.receipt) : failure("REQUEST_ID_REUSE_CONFLICT", `${tool.name}: call id already acknowledged with different parameters`);
+                    const previousFact = submissions.filter(s => s.identity === identity).at(-1);
+                    if (isReviewFinding && !previousFact && params?.replace === true)
+                        return failure("FACT_REPLACEMENT_NOT_FOUND", `${identity}: replacement requires an existing finding; omit replace to create it`);
+                    if (tool.name !== "record_plan_group_coverage" && previousFact?.paramsSha256 === paramsSha256)
+                        return replay(previousFact.receipt);
+                    // A committed finalize terminal carries no domain payload in its params
+                    // (r15: the model acknowledged with {replace:false}, the executor's
+                    // auto-finalize sends {}) — both are acknowledgements of the same durable
+                    // terminal, so any later finalize call replays the receipt instead of
+                    // demanding a params match no caller can reproduce. Other singletons
+                    // (state registry, data flows, ...) carry domain payloads and keep the
+                    // replace:true correction path.
+                    if (FINALIZE_TERMINAL_TOOLS.has(tool.name) && previousFact?.receipt)
+                        return replay(previousFact.receipt);
+                    if (previousFact && naturalId !== undefined && params?.replace !== true && !["record_evidence_expectation", "record_required_deliverables", "record_data_flow"].includes(tool.name))
+                        return failure("FACT_IDENTITY_CONFLICT", `${identity}: changing a saved fact requires explicit replacement (replace:true)`);
+                    if (input.store.records.some(r => ["contract-finalized", "finalize_plan", "finalize_decision", "approve_review", "request_review_changes", "approve_design", "request_design_changes"].includes(String(r.fact.kind))))
+                        return failure("TERMINAL_CONFLICT", "A successful terminal is already durable; only identical acknowledged submissions may be replayed");
+                    const draft = structuredClone(input.store);
+                    input.setWorkingStore(draft);
+                    let result;
+                    try {
+                        // Protocol controls must not be spread into domain facts by permissive callers.
+                        const original = input.tools.find(t => t.name === tool.name);
+                        const domainParams = { ...params };
+                        if (!original.parameters.properties?.replace)
+                            delete domainParams.replace;
+                        result = await tool.execute(args[0], domainParams, ...args.slice(2));
+                    }
+                    finally {
+                        input.setWorkingStore(input.store);
+                    }
+                    if (result.details?.ok !== true)
+                        return result;
+                    const newRecords = draft.records.filter(r => r.phase === "committed" && r.revision > input.store.revision);
+                    if (!newRecords.length)
+                        return replay(result);
+                    for (const record of draft.records) {
+                        record.submission ??= { version: 1, bindingSha256, tool: "bootstrap", callId: record.requestId, identity: record.eventId, paramsSha256: record.payloadSha256 };
+                    }
+                    for (const record of newRecords)
+                        record.submission = { version: 1, bindingSha256, tool: tool.name, callId, identity, paramsSha256 };
+                    newRecords.at(-1).submission.receipt = JSON.parse(JSON.stringify(result));
+                    const committed = draft.records.filter(r => r.phase === "committed");
+                    await validate(committed);
+                    await persist(file, committed);
+                    publish(draft);
+                    progress.durableSubmissions++;
+                    if (previousFact)
+                        progress.durableReplacements++;
+                    return result;
                 }
-                finally {
+                catch (error) {
                     input.setWorkingStore(input.store);
+                    return failure(typeof error?.code === "string" ? error.code : "FRONTEND_COMMIT_FAILED", error instanceof Error ? error.message : String(error));
                 }
-                if (result.details?.ok !== true)
-                    return result;
-                const newRecords = draft.records.filter(r => r.phase === "committed" && r.revision > input.store.revision);
-                if (!newRecords.length)
-                    return replay(result);
-                for (const record of draft.records) {
-                    record.submission ??= { version: 1, bindingSha256, tool: "bootstrap", callId: record.requestId, identity: record.eventId, paramsSha256: record.payloadSha256 };
-                }
-                for (const record of newRecords)
-                    record.submission = { version: 1, bindingSha256, tool: tool.name, callId, identity, paramsSha256 };
-                newRecords.at(-1).submission.receipt = JSON.parse(JSON.stringify(result));
-                const committed = draft.records.filter(r => r.phase === "committed");
-                await validate(committed);
-                await persist(file, committed);
-                publish(draft);
-                progress.durableSubmissions++;
-                if (previousFact)
-                    progress.durableReplacements++;
-                return result;
-            }
-            catch (error) {
-                input.setWorkingStore(input.store);
-                return failure(typeof error?.code === "string" ? error.code : "FRONTEND_COMMIT_FAILED", error instanceof Error ? error.message : String(error));
+            };
+            const result = await execute();
+            if (result.details?.ok !== true) {
+                progress.failedRecords++;
+                if (FINALIZE_TERMINAL_TOOLS.has(tool.name))
+                    progress.finalizeRejections++;
             }
-        }).then(result => { if (result.details?.ok !== true)
-            progress.failedRecords++; return result; }) }));
+            const note = input.planControl?.observe(tool.name, args[1], result.details, input.store.revision > beforeRevision, input.planControl ? frontendPlanSemanticDigest(input.store.records) : undefined);
+            if (note)
+                return { ...result, content: [...(Array.isArray(result.content) ? result.content : []), { type: "text", text: JSON.stringify(note) }], details: { ...result.details, planProgress: note } };
+            return result;
+        }) }));
     for (const tool of wrapped)
         progressByTool.set(tool, progress);
     return {

package/dist/workflows/dag/frontend-implementation-contract.js

@@ -1,3 +1,5 @@
+import { readFileBoundarySafe } from "../../shared/path-safety.js";
+import { capabilityBoundarySchema } from "../../task/config-types.js";
 import { frontendExecutionSchema, collectFrontendExecutionGroups } from "./frontend-execution-groups.js";
 import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
@@ -195,6 +197,20 @@ export function isRecognizedFrontendVerifyCommandText(command) {
         /\b(tsc|eslint|typecheck|check-types)\b/i.test(command) ||
         /\bscripts[\\/]+ci(?:-tests)?\.sh\b/i.test(command));
 }
+/**
+ * Repo-level shell scripts whose name marks them as governance/static checks
+ * rather than test runners: `scripts/check-*.sh`, `scripts/ci.sh`,
+ * `scripts/ci-governance.sh` and friends. The behavior lane is test-observed
+ * at writer admission, so these must not be admitted there — they cannot emit
+ * a test report.
+ *
+ * A test word in the name still wins, because the test-semantics check runs
+ * earlier in `classifyFrontendVerifyCommandText`, so a real test script such as
+ * `scripts/run-tests.sh` or `scripts/check-tests.sh` is unaffected.
+ */
+const VERIFY_STATIC_SCRIPT_PATH_RE = /\bscripts[\\/]+(?:ci(?:-governance|-tests)?|check-[a-z0-9-]+)\.sh\b/i;
+/** A shell script whose own name marks it as a test runner. */
+const VERIFY_BEHAVIOR_SCRIPT_PATH_RE = /\bscripts[\\/]+[a-z0-9-]*(?:tests?|specs?|e2e)[a-z0-9-]*\.sh\b/i;
 /**
  * Classify a raw verification command text into the runtime-owned mode.
  * Shared single implementation used by DAG generation (lane split) and
@@ -207,6 +223,14 @@ export function isRecognizedFrontendVerifyCommandText(command) {
  * static scripts (`npm run check`, `check:types`) and leading binaries
  * (`tsc`, `eslint`) stay static. Package-manager flags (`npm --prefix
  * website run build`) are skipped when locating the script.
+ *
+ * Returns `undefined` for a command whose text carries no recognizable
+ * verification semantics. The previous fallback returned `"behavior"`, which
+ * silently pushed unknown commands into the strictest lane: the behavior lane
+ * is test-observed at writer admission, so a command that cannot emit a test
+ * report blocked admission deterministically with no way for the model to
+ * clear it. Callers must now decide explicitly instead of inheriting a lane
+ * from an unrecognized string.
  */
 export function classifyFrontendVerifyCommandText(command) {
     if (VERIFY_RUNNER_RE.test(command) || VERIFY_E2E_RE.test(command)) {
@@ -220,16 +244,24 @@ export function classifyFrontendVerifyCommandText(command) {
         }
         return segments.some((segment) => VERIFY_STATIC_SCRIPT_WORDS.has(segment))
             ? "static"
-            : "behavior";
+            : undefined;
     }
     const head = command.trim().split(/\s+/, 1)[0] ?? "";
     const binary = head.split(/[\\/]/).pop() ?? "";
+    // A test word in the invoked script's own name wins over the static
+    // governance pattern: `scripts/check-tests.sh` runs tests even though it
+    // starts with `check-`, so it must stay in the test-observed lane.
+    if (VERIFY_BEHAVIOR_SCRIPT_PATH_RE.test(command)) {
+        return "behavior";
+    }
     if (/^(tsc|eslint|stylelint|lint|typecheck|check|build)$/i.test(binary) ||
         /\b(tsc|eslint|typecheck|check-types)\b/i.test(command) ||
-        /\bscripts[\\/]+ci(?:-tests)?\.sh\b/i.test(command)) {
+        VERIFY_STATIC_SCRIPT_PATH_RE.test(command)) {
         return "static";
     }
-    return "behavior";
+    // Unrecognized: no lane is inferred. Callers must require an operator
+    // declaration rather than defaulting into the test-observed behavior lane.
+    return undefined;
 }
 export function slugFrontendVerifyCommandId(label, taken) {
     const slug = label
@@ -591,23 +623,22 @@ async function deriveFrontendCapabilityBoundaryFromRun(runDir) {
     try {
         raw = await readFile(specPath, "utf8");
     }
-    catch {
-        return undefined;
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
     }
     let spec;
     try {
         spec = JSON.parse(raw);
     }
     catch {
-        return undefined;
+        throw new Error("capability-boundary-source-invalid: run.json is malformed");
     }
     for (const task of spec.tasks ?? []) {
         const boundary = task.shell?.frontendDesignPolicy?.capabilityBoundary;
-        if (boundary &&
-            ((boundary.allowed?.length ?? 0) > 0 ||
-                (boundary.forbidden?.length ?? 0) > 0)) {
-            return boundary;
-        }
+        if (boundary !== undefined)
+            return capabilityBoundarySchema.parse(boundary);
     }
     return undefined;
 }
@@ -617,44 +648,67 @@ async function deriveFrontendCapabilityBoundaryFromRun(runDir) {
 export function composeDependencyPolicyWithBoundary(policy, boundary) {
     if (!boundary)
         return policy;
-    const allowed = (boundary.allowed ?? []).filter((item) => item.trim());
-    const forbidden = (boundary.forbidden ?? []).filter((item) => item.trim());
-    if (allowed.length === 0 && forbidden.length === 0)
-        return policy;
-    if (policy?.includes(CAPABILITY_BOUNDARY_MARKER))
-        return policy;
-    const sentence = `${CAPABILITY_BOUNDARY_MARKER}：` +
-        (allowed.length > 0 ? `仅可使用 ${allowed.join("、")}` : "无允许清单") +
-        (forbidden.length > 0 ? `；禁止 ${forbidden.join("、")}` : "") +
-        "。";
-    return policy?.trim() ? `${policy.trim()}；${sentence}` : sentence;
+    const frozen = capabilityBoundarySchema.parse(boundary);
+    // Replace only our explicit complete block; a prose mention never grants
+    // ownership of the author's following constraints.
+    const begin = "<!-- frontend-capability-boundary:start -->";
+    const end = "<!-- frontend-capability-boundary:end -->";
+    const source = policy ?? "";
+    const start = source.indexOf(begin);
+    const finish = start < 0 ? -1 : source.indexOf(end, start + begin.length);
+    const prefix = (finish < 0 ? source : source.slice(0, start) + source.slice(finish + end.length)).trim();
+    const parts = [
+        frozen.allowed?.length ? `仅可使用 ${frozen.allowed.join("、")}` : undefined,
+        frozen.forbidden?.length ? `禁止 ${frozen.forbidden.join("、")}` : undefined,
+        frozen.requiredClauses?.length ? `必须满足：${frozen.requiredClauses.join("；")}` : undefined,
+    ].filter(Boolean);
+    const sentence = `${CAPABILITY_BOUNDARY_MARKER}：${parts.join("；")}。`;
+    const block = `${begin}\n${sentence}\n${end}`;
+    return prefix ? `${prefix}\n${block}` : block;
 }
 /** Read the generation-frozen requirement→file ownership from run.json
- * (frontendDesignPolicy spec). Absent (legacy fixtures) → no ownership gate. */
-export async function deriveRequirementOwnershipFromRun(runDir) {
+ * (frontendDesignPolicy spec), bound to the canonical source identity. */
+export async function deriveRequirementOwnershipFromRun(runDir, expectedBinding) {
     const specPath = path.join(runDir, "run.json");
     let raw;
     try {
         raw = await readFile(specPath, "utf8");
     }
-    catch {
-        return [];
+    catch (error) {
+        if (error.code === "ENOENT" && (!expectedBinding || !isDagSourceBindingV2(expectedBinding)))
+            return [];
+        if (error.code === "ENOENT")
+            throw new Error("requirement-ownership-source-invalid: frozen run.json is missing");
+        throw error;
     }
     let spec;
     try {
         spec = JSON.parse(raw);
     }
     catch {
-        return [];
+        throw new Error("requirement-ownership-source-invalid: run.json is malformed");
     }
     const merged = new Map();
     for (const task of spec.tasks ?? []) {
-        for (const entry of task.shell?.frontendDesignPolicy?.requirementOwnership ?? []) {
+        const raw = task.shell?.frontendDesignPolicy?.requirementOwnership;
+        if (raw === undefined)
+            continue;
+        const parsed = z.array(z.object({ requirementIds: z.array(z.string().min(1)).min(1), implementationFiles: z.array(z.string().min(1)).optional(), verificationFiles: z.array(z.string().min(1)).optional() }).strict()).safeParse(raw);
+        if (!parsed.success)
+            throw new Error("requirement-ownership-source-invalid: frozen requirementOwnership is malformed");
+        for (const entry of parsed.data) {
             const key = [...(entry.requirementIds ?? [])].sort().join("|");
-            if (!merged.has(key))
+            const previous = merged.get(key);
+            if (previous && serializeDeterministicJson(previous) !== serializeDeterministicJson(entry))
+                throw new Error("requirement-ownership-source-invalid: conflicting ownership declarations");
+            if (!previous)
                 merged.set(key, entry);
         }
     }
+    if (merged.size && expectedBinding) {
+        if (!spec.sourceBinding || serializeDeterministicJson(spec.sourceBinding) !== serializeDeterministicJson(expectedBinding))
+            throw new Error("requirement-ownership-source-invalid: frozen source binding mismatch or missing");
+    }
     return [...merged.values()];
 }
 /** Deterministic requirement→file ownership check. A requirement's
@@ -700,27 +754,15 @@ function checkRequirementOwnership(canonical, ownership) {
                 continue;
             if (implementationFiles.length > 0) {
                 const allTargets = requirement.implementationTargets ?? [];
-                // Test-shaped placements belong to the verification lane (a shared
-                // behavior group's placement carries the test file for the
-                // test-writing requirement); they are governed by allowedPaths and
-                // the entry's verificationFiles, not by implementationFiles.
-                const implementationFilesAreTestShaped = implementationFiles.some((file) => isFrontendTestFilePath(file));
-                const targets = implementationFilesAreTestShaped
-                    ? allTargets
-                    : allTargets.filter((file) => !isFrontendTestFilePath(file));
-                // Contract deliverables are existence obligations, not ownership
-                // claims: a contract may require a mounting file to exist for a
-                // requirement implemented elsewhere (smoke r55 — a deliverable
-                // otherwise made plan finalize permanently unfixable).
-                const deliverables = new Set(requirement.deliverableTargets ?? []);
-                const ownedTargets = targets.filter((file) => !deliverables.has(file));
-                // Only files OUTSIDE the declared set violate. An empty owned set
-                // means every mapped file is a deliverable/test-shaped obligation —
-                // unplaced requirements are rejected upstream, not here (r56:
-                // "maps [X] expects [X]" still violated when deliverables covered
-                // the whole mapping).
-                const outside = ownedTargets.filter((file) => !implementationFiles.includes(file));
-                if (outside.length > 0) {
+                // A verification placement must have explicit verification
+                // ownership AND a bound verification target. File names alone
+                // never exempt implementation responsibility.
+                const verificationPlacements = new Set([...(targetsByRequirement.get(id) ?? [])].filter(file => verificationFiles.includes(file)));
+                const targets = allTargets.filter(file => !verificationPlacements.has(file) || implementationFiles.includes(file));
+                // implementationTargets retains actual placements. Existence-only
+                // deliverableTargets never subtract from this ownership claim.
+                const outside = targets.filter(file => !implementationFiles.includes(file));
+                if (outside.length > 0 || !targets.some(file => implementationFiles.includes(file))) {
                     findings.push({
                         code: "requirement-ownership-violated",
                         message: `requirement ${id} expects implementation within [${implementationFiles.join(", ")}] but plan maps [${targets.join(", ") || "none"}] — re-map the owning behavior group's module placement`,
@@ -759,7 +801,7 @@ const FRONTEND_CONTRACT_REVIEW_GROUPS = [
     },
     {
         id: "data-design",
-        fields: ["mockApi", "designEvidence", "dependencyPolicy", "realIntegrationGap"],
+        fields: ["mockApi", "designEvidence", "capabilityBoundary", "dependencyPolicy", "realIntegrationGap"],
     },
     {
         id: "verification",
@@ -1101,11 +1143,15 @@ export const frontendImplementationContractSchema = z
         uiStates: z.array(z.string().min(1)),
         // Display-only test scope; never read by control flow.
         scope: frontendVerificationScopeSchema.optional(),
+        // Planned evidence strength, never proof of observed behavior.
+        evidenceLevel: z.enum(["unit", "mounted", "real-integration"]).optional(),
+        boundary: z.string().min(1).optional(),
     })
         .strict()).min(1),
     evidenceGaps: z.array(gap).optional(),
     stylingStrategy: z.string().min(1).optional(),
     uiComponentChoices: uiComponentChoicesSchema.optional(),
+    capabilityBoundary: capabilityBoundarySchema.optional(),
     dependencyPolicy: z.string().min(1).optional(),
     residualRisks: z.array(z.string().min(1)).optional(),
     realIntegrationGap: z.string().min(1).optional(),
@@ -2032,7 +2078,7 @@ function assertFrontendContractPathsSafe(value) {
     const record = asRecord(value);
     if (!record)
         return;
-    const pathFields = ["files", "file", "implementationTargets", "fixture", "consumer"];
+    const pathFields = ["files", "file", "implementationTargets", "deliverableTargets", "fixture", "consumer"];
     for (const [key, child] of Object.entries(record)) {
         if (pathFields.includes(key) && Array.isArray(child)) {
             for (const item of child) {
@@ -2326,6 +2372,8 @@ export function coerceFrontendImplementationContractInput(value, canonicalBindin
             file,
             symbol: asString(vt.symbol) || undefined,
             ...(scope ? { scope } : {}),
+            ...(vt.evidenceLevel !== undefined ? { evidenceLevel: vt.evidenceLevel } : {}),
+            ...(vt.boundary !== undefined ? { boundary: vt.boundary } : {}),
             requirementIds: requirementIds.length > 0
                 ? requirementIds
                 : [...canonicalBinding.requirementIds],
@@ -2755,7 +2803,10 @@ export async function analyzeFrontendImplementationContract(input) {
     // field (r10/r11 design-review findings).
     const referencedConcretePaths = [
         ...new Set([
-            ...result.data.requirements.flatMap((requirement) => requirement.implementationTargets),
+            ...result.data.requirements.flatMap(requirement => [
+                ...requirement.implementationTargets,
+                ...(requirement.deliverableTargets ?? []),
+            ]),
             // Mock endpoint paths stay in the set: the zod refine validated
             // them against the declared targets.files patterns, so the
             // narrowing must keep covering them. Verification-target files
@@ -2765,6 +2816,9 @@ export async function analyzeFrontendImplementationContract(input) {
             ...(result.data.mockApi?.endpoints ?? []).flatMap((endpoint) => [endpoint.fixture, endpoint.consumer].filter((value) => typeof value === "string" && value.length > 0)),
         ].filter((value) => value.length > 0)),
     ].sort();
+    const outsideDelivery = result.data.requirements.flatMap(requirement => requirement.deliverableTargets ?? []).filter(file => !parsedTargetFiles.some(pattern => pathMatchesPattern(file, pattern)));
+    if (outsideDelivery.length)
+        fail("blocked", `target-path-outside-write-set: deliverable paths [${outsideDelivery.join(", ")}] exceed frozen targets`, candidateJsonSha256);
     if (referencedConcretePaths.length > 0) {
         result.data.targets = {
             ...result.data.targets,
@@ -2793,7 +2847,26 @@ export async function analyzeFrontendImplementationContract(input) {
         if (!result.data.requirements.some((item) => item.id === requirementId) &&
             !(result.data.evidenceGaps ?? []).some((item) => item.requirementId === requirementId))
             fail("blocked", `frontend contract does not cover ${requirementId}`, candidateJsonSha256);
-    result.data.dependencyPolicy = composeDependencyPolicyWithBoundary(result.data.dependencyPolicy, await deriveFrontendCapabilityBoundaryFromRun(input.runDir));
+    // Both finalize prechecks and the final materializer enter this function.
+    // Check the submitted placement before normalization can invent a fallback.
+    const ownership = await deriveRequirementOwnershipFromRun(input.runDir, input.sourceBinding);
+    for (const entry of ownership) {
+        if (!entry.implementationFiles?.length)
+            continue;
+        for (const id of entry.requirementIds) {
+            const original = asRecord(parsed)?.requirements?.find(item => asRecord(item)?.id === id);
+            if (!original || asStringArray(asRecord(original)?.implementationTargets).length === 0)
+                fail("retryable-invalid", `requirement-ownership-placement-missing: ${id} requires an explicit placement from its Plan facts`, candidateJsonSha256);
+        }
+    }
+    const ownershipFindings = checkRequirementOwnership(result.data, ownership);
+    if (ownershipFindings.length)
+        throw new PlanPolicyPrecheckFailure(ownershipFindings.map(f => `${f.code}: ${f.message}`).join("; "), ownershipFindings);
+    const frozenBoundary = await deriveFrontendCapabilityBoundaryFromRun(input.runDir);
+    delete result.data.capabilityBoundary;
+    if (frozenBoundary)
+        result.data.capabilityBoundary = frozenBoundary;
+    result.data.dependencyPolicy = composeDependencyPolicyWithBoundary(result.data.dependencyPolicy, frozenBoundary);
     return {
         canonical: result.data,
         candidateRawSha256,
@@ -2990,6 +3063,7 @@ export async function writeFrontendImplementationContractArtifact(input) {
     };
 }
 const FRONTEND_PLAN_PATCH_PROTECTED_PATHS = [
+    "/capabilityBoundary",
     "/schemaVersion",
     "/sourceBinding",
     "/riskLevel",
@@ -3036,7 +3110,7 @@ function frontendPlanPatchProtectedPathViolations(patch) {
     if (!record)
         return ["/"];
     const violations = [];
-    for (const key of ["schemaVersion", "sourceBinding", "riskLevel"]) {
+    for (const key of ["schemaVersion", "sourceBinding", "riskLevel", "capabilityBoundary"]) {
         if (Object.hasOwn(record, key))
             violations.push(`/${key}`);
     }
@@ -3050,6 +3124,22 @@ function frontendPlanPatchProtectedPathViolations(patch) {
         violations.push("/mockApi/productionDefaultOff");
     return violations;
 }
+/** Read-only verification references do not grant writer permissions. */
+export async function collectExistingFrontendVerificationPaths(workspaceRoot, contract) {
+    if (!workspaceRoot)
+        return [];
+    const existing = [];
+    for (const target of contract.verificationTargets) {
+        if (target.mode === "static" || existing.includes(target.file))
+            continue;
+        try {
+            await readFileBoundarySafe({ boundaryRoot: workspaceRoot, targetPath: path.resolve(workspaceRoot, target.file), label: "frontend existing verification" });
+            existing.push(target.file);
+        }
+        catch { /* Missing or unsafe files cannot bypass the write-set check. */ }
+    }
+    return existing;
+}
 function workspaceRootFromDagRunDir(runDir) {
     const absolute = path.resolve(runDir);
     const segments = absolute.split(path.sep);
@@ -3253,9 +3343,8 @@ export async function analyzeFrontendPlanPatchCandidate(input) {
         ...checkRequiredDeliverables(analysis.canonical),
         ...checkUxNameCollisions(analysis.canonical),
         ...checkDependencies(analysis.canonical, await deriveAllowedDependenciesFromRun(input.runDir)),
-        ...checkTargetPaths(analysis.canonical, await deriveWriteSetFromRun(input.runDir)),
+        ...checkTargetPaths(analysis.canonical, await deriveWriteSetFromRun(input.runDir), await collectExistingFrontendVerificationPaths(workspaceRootFromDagRunDir(input.runDir), analysis.canonical)),
         ...checkComponentChoiceSourceReferences(analysis.canonical, await deriveFrontendSourceBindingPathsFromRun(input.runDir)),
-        ...checkRequirementOwnership(analysis.canonical, await deriveRequirementOwnershipFromRun(input.runDir)),
         ...checkInteractionIdVocabulary(analysis.canonical, await deriveFrontendInteractionIdsFromRun(input.runDir)),
         ...checkMockApiStrategyAllowed(analysis.canonical, await deriveFrontendAllowedMockStrategiesFromRun(input.runDir)),
     ];