@tea-agent/loop-agent 0.44.0-next.1 → 0.44.0-next.10

package/dist/workflows/dag/rerun-task.js

@@ -1,3 +1,4 @@
+import { sha256OfCanonicalJson } from "../../task/contract/hash.js";
 import { access, mkdir, readFile } from "node:fs/promises";
 import { createHash } from "node:crypto";
 import path from "node:path";
@@ -28,7 +29,7 @@ export function parseDagRerunTaskArgs(args) {
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index];
         if (arg === undefined)
-            break;
+            throw new Error("dag rerun-task argument is missing");
         if (arg === "--run-id")
             parentRunId = args[++index];
         else if (arg.startsWith("--run-id="))
@@ -103,6 +104,9 @@ async function readFrontendRecoveryDescriptor(runDir, parentRunId, requestId) {
         plan.schemaVersion !== 1 ||
         plan.parentRunId !== parentRunId ||
         plan.requestId !== requestId ||
+        plan.failureSource !== raw.failureSource ||
+        plan.failureOwner !== raw.failureOwner ||
+        plan.resetRootNodeId !== raw.resetRootNodeId ||
         !Array.isArray(plan.resetNodeIds) ||
         !Array.isArray(plan.importedNodeIds)) {
         throw new Error("frontend recovery descriptor is invalid or unbound");
@@ -126,6 +130,8 @@ function buildFrontendRecoveryIntent(input) {
         attemptIndex: input.parentRecovery?.attemptIndex ?? 0,
         continuationCount: input.parentRecovery?.continuationCount ?? 0,
         failureSource: input.failureSource,
+        ...(input.failureOwner ? { failureOwner: input.failureOwner } : {}),
+        ...(input.resetRootNodeId ? { resetRootNodeId: input.resetRootNodeId } : {}),
         revision: 0,
     };
 }
@@ -391,6 +397,8 @@ async function executeFrontendRecoveryContinuation(input) {
             parentRunId: input.parentRunId,
             requestId: input.requestId,
             failureSource: descriptor.failureSource,
+            failureOwner: descriptor.failureOwner,
+            resetRootNodeId: descriptor.resetRootNodeId,
             parentRecovery: parentState.frontendRecoveryState,
         }),
         recoveryPlan: descriptor.plan,
@@ -404,75 +412,63 @@ async function executeFrontendRecoveryContinuation(input) {
     // these through its own durable tools (normal commit entry, child binding)
     // and the model only corrects the rows the design review flagged; the
     // parent ledger is never rewritten and the finalize terminal is not
-    // inherited. Best-effort: a parent without plan facts plans fresh.
-    try {
+    // inherited. Only an absent parent ledger permits a fresh Plan.
+    if (descriptor.plan.resetRootNodeId === "frontend-plan-pi") {
         const parentPlanLedger = path.join(located.runDir, "frontend-plan-pi", "plan-decision-facts.jsonl");
-        const parentRaw = await readFile(parentPlanLedger, "utf8");
-        const parentRecords = await readTypedEventStoreFromJsonl(parentPlanLedger);
-        // Collapse superseded records first: the parent ledger is append-only
-        // (replace:true appends a corrected row), and replaying both the original
-        // and its correction would trip FACT_IDENTITY_CONFLICT in the child.
-        const { collapseDecisionEntriesByKind } = await import("./frontend-plan-decision-contract.js");
-        const byKind = new Map();
-        for (const record of parentRecords) {
-            const kind = String(record.fact.kind);
-            if (record.phase !== "committed" || kind === "finalize_decision")
-                continue;
-            const entry = record.fact.entry;
-            if (typeof entry !== "object" || entry === null || Array.isArray(entry))
-                continue;
-            const bucket = byKind.get(kind) ?? [];
-            bucket.push(entry);
-            byKind.set(kind, bucket);
-        }
-        let parentCanonicalSha256;
-        try {
-            const parentCanonical = await readFile(path.join(located.runDir, "contracts", "frontend-implementation-contract.json"), "utf8");
-            parentCanonicalSha256 = createHash("sha256").update(parentCanonical).digest("hex");
-        }
-        catch {
-            // Parent canonical unavailable → the identical-plan guard is skipped.
-        }
-        // Carry the design findings that blocked the parent run: the child's
-        // finalize runs a per-finding closure check against them.
-        let designFindings = [];
-        try {
-            const designFacts = await readTypedEventStoreFromJsonl(path.join(located.runDir, "frontend-design-review-pi", "design-typed-facts.jsonl"));
-            for (const record of designFacts) {
-                const fact = record.fact;
-                if (record.phase !== "committed" || fact.kind !== "design-finding")
+        const parentRaw = await readFile(parentPlanLedger, "utf8").catch((error) => {
+            if (error.code === "ENOENT")
+                return undefined;
+            throw error;
+        });
+        if (parentRaw !== undefined) {
+            const parentRecords = await readTypedEventStoreFromJsonl(parentPlanLedger);
+            // Collapse superseded records first: the parent ledger is append-only
+            // (replace:true appends a corrected row), and replaying both the original
+            // and its correction would trip FACT_IDENTITY_CONFLICT in the child.
+            const { collapseDecisionEntriesByKind } = await import("./frontend-plan-decision-contract.js");
+            const byKind = new Map();
+            for (const record of parentRecords) {
+                const kind = String(record.fact.kind);
+                if (record.phase !== "committed" || kind === "finalize_decision")
                     continue;
-                const finding = (fact.finding ?? {});
-                designFindings.push({
-                    severity: typeof finding.severity === "string" ? finding.severity : "Important",
-                    issue: typeof finding.issue === "string" ? finding.issue : "",
-                    requiredChange: typeof finding.requiredChange === "string" ? finding.requiredChange : "",
-                });
+                const entry = record.fact.entry;
+                if (typeof entry !== "object" || entry === null || Array.isArray(entry))
+                    continue;
+                const bucket = byKind.get(kind) ?? [];
+                bucket.push(entry);
+                byKind.set(kind, bucket);
             }
+            let parentCanonicalSha256;
+            try {
+                const parentCanonical = await readFile(path.join(located.runDir, "contracts", "frontend-implementation-contract.json"), "utf8");
+                parentCanonicalSha256 = createHash("sha256").update(parentCanonical).digest("hex");
+            }
+            catch {
+                // Parent canonical unavailable → the identical-plan guard is skipped.
+            }
+            const { readCurrentFrontendRepairFindings } = await import("./rerun-feedback.js");
+            const feedback = await readCurrentFrontendRepairFindings(located.runDir);
+            const designFindings = feedback?.verdict === "request" ? feedback.findings : [];
+            const parentSpec = await readDagRunSpec(located.runDir);
+            const snapshot = {
+                schemaVersion: 1,
+                schemaId: "frontend-plan-parent-decision-snapshot-v1",
+                parentRunId: input.parentRunId,
+                parentLedgerSha256: createHash("sha256").update(parentRaw).digest("hex"),
+                sourceBindingSha256: sha256OfCanonicalJson(parentSpec.sourceBinding ?? null),
+                ...(feedback ? { feedbackBinding: { sourceNodeId: feedback.sourceNodeId, ledgerSha256: feedback.ledgerSha256, terminalEventId: feedback.terminalEventId } } : {}),
+                ...(parentCanonicalSha256 ? { parentCanonicalSha256 } : {}),
+                designFindings,
+                facts: [...byKind.entries()].flatMap(([kind, entries]) => collapseDecisionEntriesByKind(kind, entries).map((entry) => ({
+                    kind,
+                    entry,
+                }))),
+            };
+            await mkdir(path.join(locatedChild.runDir, "frontend-plan-pi"), {
+                recursive: true,
+            });
+            await writeJsonAtomic(path.join(locatedChild.runDir, "frontend-plan-pi", "parent-decision-snapshot.json"), snapshot);
         }
-        catch {
-            // No readable design findings → the closure check has no assertions.
-        }
-        const snapshot = {
-            schemaVersion: 1,
-            schemaId: "frontend-plan-parent-decision-snapshot-v1",
-            parentRunId: input.parentRunId,
-            parentLedgerSha256: createHash("sha256").update(parentRaw).digest("hex"),
-            ...(parentCanonicalSha256 ? { parentCanonicalSha256 } : {}),
-            designFindings,
-            facts: [...byKind.entries()].flatMap(([kind, entries]) => collapseDecisionEntriesByKind(kind, entries).map((entry) => ({
-                kind,
-                entry,
-            }))),
-        };
-        await mkdir(path.join(locatedChild.runDir, "frontend-plan-pi"), {
-            recursive: true,
-        });
-        await writeJsonAtomic(path.join(locatedChild.runDir, "frontend-plan-pi", "parent-decision-snapshot.json"), snapshot);
-    }
-    catch {
-        // No parent plan ledger (or unreadable) → the child plans fresh,
-        // exactly like a run without recovery lineage.
     }
     const childSpec = await readDagRunSpec(locatedChild.runDir);
     const childState = await readDagRunState(locatedChild.runDir);

package/dist/workflows/dag/runner.js

@@ -1,3 +1,7 @@
+import { assertFrontendPairExecution } from "../../application/evaluation/frontend-pair-registration.js";
+import { sourceBudgetContractIdentity } from "../../application/evaluation/budget.js";
+import { summarizeFrozenSourceUsage } from "../../task/source-prepare/source-provider-budget.js";
+import { sha256OfCanonicalJson } from "../../task/contract/hash.js";
 import { readdir, readFile } from "node:fs/promises";
 import { createHash } from "node:crypto";
 import { writeJsonAtomic } from "../../infrastructure/harness/atomic-write.js";
@@ -244,6 +248,17 @@ export function createInitialRunState(spec, opts, ranks, runId = opts.runId ?? "
             : {}),
     };
     initRunBudgetLedger(state, spec.budget);
+    if (spec.sourceProviderBudget) {
+        if (sha256OfCanonicalJson(spec.sourceProviderBudget.contract ?? null) !== sha256OfCanonicalJson(sourceBudgetContractIdentity(spec.taskContractBinding) ?? null) || !state.budgetLedger || spec.sourceProviderBudget.ledger.taskId !== spec.sourceBinding?.taskId || spec.sourceProviderBudget.ledger.maxProviderRequests !== state.budgetLedger.limits.maxProviderRequests || spec.sourceProviderBudget.sourceBindingSha256 !== sha256OfCanonicalJson(spec.sourceBinding))
+            throw Error("FRONTEND_PROVIDER_BUDGET_INVALID: source snapshot does not match DAG");
+        state.sourceProviderBudget = structuredClone(spec.sourceProviderBudget);
+        state.budgetLedger.consumed.providerRequests = spec.sourceProviderBudget.ledger.reservedRequests;
+        const sourceUsage = summarizeFrozenSourceUsage(spec.sourceProviderBudget);
+        if (sourceUsage.complete)
+            state.budgetLedger.consumed.tokens = sourceUsage.totalTokens;
+        else if (spec.sourceProviderBudget.ledger.reservedRequests > 0)
+            state.budgetLedger.consumed.missingTokenNodeIds.push(`task-budget:${spec.sourceProviderBudget.ledger.budgetId}`);
+    }
     return state;
 }
 export function assertFrozenEvaluationBinding(spec, state) {
@@ -280,6 +295,12 @@ export async function runDag(spec, opts) {
     if (!runningIdentity) {
         throw new Error("running controller identity could not be resolved; refuse to create an unpinned DAG run");
     }
+    if (spec.evaluation?.frontendPair)
+        await assertFrontendPairExecution({
+            repoRoot: opts.cwd, binding: spec.evaluation,
+            controllerFingerprint: runningIdentity.packageFingerprint.value,
+            startedAt: new Date().toISOString(),
+        });
     assertRuntimeContractCompatible(spec, {
         ...DAG_CONTROLLER_CAPABILITIES,
         controllerVersion: runningIdentity.packageVersion,
@@ -453,6 +474,12 @@ export async function resumeDagRun(opts) {
     if (!runningIdentity) {
         throw new Error("running controller identity could not be resolved; refuse to resume an unpinned DAG run");
     }
+    if (spec.evaluation?.frontendPair)
+        await assertFrontendPairExecution({
+            repoRoot: opts.cwd, binding: spec.evaluation,
+            controllerFingerprint: runningIdentity.packageFingerprint.value,
+            startedAt: state.startedAt,
+        });
     assertRuntimeContractCompatible(spec, {
         ...DAG_CONTROLLER_CAPABILITIES,
         controllerVersion: runningIdentity.packageVersion,
@@ -602,8 +629,12 @@ async function executeDagCheckpoint(input) {
     };
     const onSigTerm = () => shutdownOnSignal("SIGTERM");
     const onSigInt = () => shutdownOnSignal("SIGINT");
-    process.once("SIGTERM", onSigTerm);
-    process.once("SIGINT", onSigInt);
+    // Keep listeners installed until persistence completes. Pi dependencies use
+    // signal-exit, which recounts listeners during signal dispatch and re-sends
+    // the signal if a once-listener has already removed itself. terminalSignal
+    // above makes repeated signals idempotent; normal cleanup removes listeners.
+    process.on("SIGTERM", onSigTerm);
+    process.on("SIGINT", onSigInt);
     // Exit-time diagnostics (silent-death forensics): write an `armed` line at
     // checkpoint start and append process-exit / uncaught-exception /
     // unhandled-rejection lines with a live state snapshot so an abnormal death
@@ -862,7 +893,12 @@ async function executeDagCheckpoint(input) {
                     trigger: recoveryTrigger,
                     deps: input.recovery,
                 });
-                if (created.kind === "conflict") {
+                if (created.kind === "blocked") {
+                    state.status = "failed";
+                    state.terminalReason = created.reason;
+                    state.frontendRecoveryResult = buildRecoveryResultForTrigger(state, recoveryTrigger, "auto-recovery-blocked");
+                }
+                else if (created.kind === "conflict") {
                     // Same clientRequestId with a different payload → fail closed; never
                     // create a second recovery operation (AC-004).
                     state.status = "failed";
@@ -1276,7 +1312,7 @@ export async function finalizeTerminalRunStatus(state, taskCount, runDir, cwd, f
                         // The rejected design is a plan input defect. Reset from the
                         // planner so the next child can incorporate the committed
                         // findings before design review runs again.
-                        failureSource: "frontend-plan-pi",
+                        failureSource: "frontend-design-review-pi",
                         failureOwner: classifyReviewIssueCategoryFailureOwner(designRequestFact.issueCategory),
                         protocolFailureReason: `frontend design review request_design_changes (issueCategory=${designRequestFact.issueCategory})`,
                         recoveryMode: "new-dag",
@@ -1477,6 +1513,20 @@ export async function finalizeTerminalRunStatus(state, taskCount, runDir, cwd, f
  */
 async function createRecoveryOperation(input) {
     const { cwd, runDir, spec, state, trigger } = input;
+    const { computeFrontendRecoveryPlanForSource } = await import("./frontend-recovery-plan.js");
+    let plan;
+    try {
+        plan = computeFrontendRecoveryPlanForSource({
+            spec,
+            parentRunId: state.runId,
+            requestId: trigger.requestId,
+            failureSource: trigger.failureSource,
+            failureOwner: trigger.failureOwner,
+        });
+    }
+    catch (error) {
+        return { kind: "blocked", reason: error instanceof Error ? error.message : String(error) };
+    }
     const recoveryLease = await acquireDagRecoveryLease({
         cwd,
         parentRunId: state.runId,
@@ -1502,13 +1552,6 @@ async function createRecoveryOperation(input) {
             observeOnly = true;
         }
     }
-    const { computeFrontendRecoveryPlanForSource } = await import("./frontend-recovery-plan.js");
-    const plan = computeFrontendRecoveryPlanForSource({
-        spec,
-        parentRunId: state.runId,
-        requestId: trigger.requestId,
-        failureSource: trigger.failureSource,
-    });
     const planHash = createHash("sha256")
         .update(JSON.stringify(plan))
         .digest("hex");
@@ -1518,6 +1561,8 @@ async function createRecoveryOperation(input) {
         parentRunId: state.runId,
         requestId: trigger.requestId,
         failureSource: trigger.failureSource,
+        failureOwner: plan.failureOwner,
+        resetRootNodeId: plan.resetRootNodeId,
         recoveryMode: trigger.recoveryMode,
         planHash,
         plan,
@@ -1529,7 +1574,8 @@ async function createRecoveryOperation(input) {
             parentRunId: state.runId,
             requestId: trigger.requestId,
             failureSource: trigger.failureSource,
-            failureOwner: trigger.failureOwner,
+            failureOwner: plan.failureOwner,
+            resetRootNodeId: plan.resetRootNodeId,
             protocolFailureReason: trigger.protocolFailureReason,
             recoveryMode: trigger.recoveryMode,
             planHash,

package/dist/workflows/dag/types.js

@@ -1,7 +1,12 @@
+import { frontendPairExecutionBindingSchema } from "../../application/evaluation/frontend-pair-registration.js";
+import { sourceBudgetContractIdentity } from "../../application/evaluation/budget.js";
+import { sha256OfCanonicalJson } from "../../task/contract/hash.js";
+import { frontendTestObservationSchema } from "./frontend-test-execution-evidence.js";
+import { capabilityBoundarySchema } from "../../task/config-types.js";
 import { z } from "zod";
 import { frontendExecutionPolicySchema } from "../../shared/frontend-execution-policy.js";
 import { DEFAULT_FRONTEND_SPEC_ROOTS, isFrontendSpecFilePath, isValidFrontendSpecRoot, OPENSPEC_SPEC_EXT_RE, } from "../../shared/openspec-spec.js";
-import { campaignBudgetSchema, } from "../../application/evaluation/budget.js";
+import { campaignBudgetSchema, sourceProviderBudgetBindingSchema, } from "../../application/evaluation/budget.js";
 import { assertDagPromptSourceRule } from "./prompt-source.js";
 // Leaf-module import: dagRetryPolicySchema must be defined by a module that
 // never transitively reaches types.ts during init (retry-policy does, via
@@ -89,6 +94,7 @@ export const dagShellVerifyEvidenceSchema = z.object({
         .array(z.object({
         label: z.string(),
         status: z.enum(["ok", "future-delivery-script", "future-test-target"]),
+        testObservation: frontendTestObservationSchema.optional(),
     }))
         .default([]),
     /** Effective timeout applied independently to each shell command. */
@@ -463,13 +469,7 @@ export const dagFrontendDesignPolicySchema = z
         .optional(),
     /** Generation-frozen test capability boundary composed into the
      * canonical dependencyPolicy by the runtime. */
-    capabilityBoundary: z
-        .object({
-        allowed: z.array(z.string().min(1)).optional(),
-        forbidden: z.array(z.string().min(1)).optional(),
-    })
-        .strict()
-        .optional(),
+    capabilityBoundary: capabilityBoundarySchema.optional(),
     /** Generation-frozen interaction id vocabulary (plan finalize check). */
     interactionIds: z.array(z.string().min(1)).optional(),
     /** Generation-frozen roots that bound custom normative directories. */
@@ -1320,6 +1320,7 @@ export const dagEvaluationBindingSchema = z
     seed: z.number().int().nonnegative(),
     split: z.enum(["public", "private", "held_out"]).optional(),
     taskRef: z.string().min(1).optional(),
+    frontendPair: frontendPairExecutionBindingSchema.optional(),
 })
     .strict();
 /** Eval Lab Campaign Budget (W3.4); enforced by runner ledger when mode=hard. */
@@ -1424,6 +1425,7 @@ export const dagSpecSchema = z
     evaluation: dagEvaluationBindingSchema.optional(),
     /** Optional hard/record-only budget; requires version 3 or 4. */
     budget: dagBudgetSchema.optional(),
+    sourceProviderBudget: sourceProviderBudgetBindingSchema.optional(),
     frontendExecutionPolicy: frontendExecutionPolicySchema.optional(),
     sourceBinding: dagSourceBindingSchema.optional(),
     /** v4 managed Task Contract binding; only valid on version 4. */
@@ -1494,6 +1496,9 @@ export const dagSpecSchema = z
     tasks: z.array(dagTaskSchema).min(1),
 })
     .superRefine((spec, ctx) => {
+    if (spec.sourceProviderBudget && (!spec.sourceBinding || spec.sourceProviderBudget.ledger.taskId !== spec.sourceBinding.taskId || sha256OfCanonicalJson(spec.sourceProviderBudget.contract ?? null) !== sha256OfCanonicalJson(sourceBudgetContractIdentity(spec.taskContractBinding) ?? null) || spec.budget?.mode !== "hard" || spec.sourceProviderBudget.ledger.maxProviderRequests !== spec.budget?.limits.maxProviderRequests || spec.sourceProviderBudget.sourceBindingSha256 !== sha256OfCanonicalJson(spec.sourceBinding))) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["sourceProviderBudget"], message: "source request budget must match the frozen source and request limit" });
+    }
     const supportsV3Fields = spec.version === 3 || spec.version === 4;
     validateFrozenArtifactBindings(spec.tasks, ctx);
     if (spec.evaluation && !supportsV3Fields) {
@@ -1618,6 +1623,8 @@ export const frontendRecoveryStateSchema = z
      *  frontend-plan-revision-pi / frontend-prewrite-gate-shell /
      *  frontend-implement-pi (writer partial write). */
     failureSource: z.string().min(1).optional(),
+    failureOwner: z.enum(["contract", "scout", "plan", "implementation", "verification-config", "environment", "scope", "unknown"]).optional(),
+    resetRootNodeId: z.string().min(1).optional(),
     revision: z.number().int().nonnegative(),
 })
     .strict()

package/dist/workflows/loop/benchmark.js

@@ -40,7 +40,7 @@ export const LOOP_BENCHMARK_FIXTURE_SAMPLES = [
             regressionPause: false,
             changedPaths: 2,
             repairPasses: 1,
-        }, ["./test/dag-runner.test.ts"], "Single repair exhausts before the third successful hard verification."),
+        }, ["./test/dag-runner.test.ts", "./test/dag-runner-convergence.test.ts", "./test/dag-runner-artifacts.test.ts", "./test/dag-runner-decisions.test.ts"], "Single repair exhausts before the third successful hard verification."),
         result("3-pass-convergence", {
             pass: true,
             fullVerifyPass: true,
@@ -51,7 +51,7 @@ export const LOOP_BENCHMARK_FIXTURE_SAMPLES = [
             regressionPause: false,
             changedPaths: 2,
             repairPasses: 3,
-        }, ["./test/dag-runner.test.ts"], "Convergence re-enters supervisor, repair, and hard verify until pass 3."),
+        }, ["./test/dag-runner.test.ts", "./test/dag-runner-convergence.test.ts", "./test/dag-runner-artifacts.test.ts", "./test/dag-runner-decisions.test.ts"], "Convergence re-enters supervisor, repair, and hard verify until pass 3."),
         result("3-pass-convergence+quota", {
             pass: true,
             fullVerifyPass: true,
@@ -64,6 +64,9 @@ export const LOOP_BENCHMARK_FIXTURE_SAMPLES = [
             repairPasses: 3,
         }, [
             "./test/dag-runner.test.ts",
+            "./test/dag-runner-convergence.test.ts",
+            "./test/dag-runner-artifacts.test.ts",
+            "./test/dag-runner-decisions.test.ts",
             "./test/verify-step.test.ts",
         ], "Intermediate verification uses quota while final hard gate remains full."),
     ]),
@@ -78,7 +81,7 @@ export const LOOP_BENCHMARK_FIXTURE_SAMPLES = [
             regressionPause: false,
             changedPaths: 3,
             repairPasses: 1,
-        }, ["./test/dag-runner.test.ts"], "Single repair ends failed without enough evidence to classify regression."),
+        }, ["./test/dag-runner.test.ts", "./test/dag-runner-convergence.test.ts", "./test/dag-runner-artifacts.test.ts", "./test/dag-runner-decisions.test.ts"], "Single repair ends failed without enough evidence to classify regression."),
         result("3-pass-convergence", {
             pass: false,
             fullVerifyPass: false,
@@ -89,7 +92,7 @@ export const LOOP_BENCHMARK_FIXTURE_SAMPLES = [
             regressionPause: true,
             changedPaths: 3,
             repairPasses: 2,
-        }, ["./test/dag-runner.test.ts"], "Convergence pauses instead of retrying blindly after regression signal."),
+        }, ["./test/dag-runner.test.ts", "./test/dag-runner-convergence.test.ts", "./test/dag-runner-artifacts.test.ts", "./test/dag-runner-decisions.test.ts"], "Convergence pauses instead of retrying blindly after regression signal."),
         result("3-pass-convergence+quota", {
             pass: false,
             fullVerifyPass: false,
@@ -100,7 +103,7 @@ export const LOOP_BENCHMARK_FIXTURE_SAMPLES = [
             regressionPause: true,
             changedPaths: 3,
             repairPasses: 2,
-        }, ["./test/dag-runner.test.ts"], "Quota reduces intermediate cost but still pauses on regression."),
+        }, ["./test/dag-runner.test.ts", "./test/dag-runner-convergence.test.ts", "./test/dag-runner-artifacts.test.ts", "./test/dag-runner-decisions.test.ts"], "Quota reduces intermediate cost but still pauses on regression."),
     ]),
     sample("LB-03", "write guard hard failure must not retry", "dag-runtime", [
         result("single-repair", {
@@ -113,7 +116,7 @@ export const LOOP_BENCHMARK_FIXTURE_SAMPLES = [
             regressionPause: false,
             changedPaths: 1,
             repairPasses: 1,
-        }, ["./test/dag-runner.test.ts"], "Write-guard failure remains terminal."),
+        }, ["./test/dag-runner.test.ts", "./test/dag-runner-convergence.test.ts", "./test/dag-runner-artifacts.test.ts", "./test/dag-runner-decisions.test.ts"], "Write-guard failure remains terminal."),
         result("3-pass-convergence", {
             pass: false,
             fullVerifyPass: false,
@@ -124,7 +127,7 @@ export const LOOP_BENCHMARK_FIXTURE_SAMPLES = [
             regressionPause: false,
             changedPaths: 1,
             repairPasses: 1,
-        }, ["./test/dag-runner.test.ts"], "Non-retry class is not re-entered."),
+        }, ["./test/dag-runner.test.ts", "./test/dag-runner-convergence.test.ts", "./test/dag-runner-artifacts.test.ts", "./test/dag-runner-decisions.test.ts"], "Non-retry class is not re-entered."),
         result("3-pass-convergence+quota", {
             pass: false,
             fullVerifyPass: false,
@@ -135,7 +138,7 @@ export const LOOP_BENCHMARK_FIXTURE_SAMPLES = [
             regressionPause: false,
             changedPaths: 1,
             repairPasses: 1,
-        }, ["./test/dag-runner.test.ts"], "Quota strategy does not change write-guard retry policy."),
+        }, ["./test/dag-runner.test.ts", "./test/dag-runner-convergence.test.ts", "./test/dag-runner-artifacts.test.ts", "./test/dag-runner-decisions.test.ts"], "Quota strategy does not change write-guard retry policy."),
     ]),
     sample("LB-04", "quota final gate must stay full", "loop-runtime", [
         result("single-repair", {

package/docs/README.md

@@ -2,7 +2,7 @@
 
 `docs/` 是 loop-agent 源仓的治理文档根目录。新读者不需要先浏览所有文件，先按任务选择入口，再由目录 README 或 `docs/document-catalog.json` 判断文档身份。
 
-**维护日：2026-08-16** — 对齐 `@tea-agent/loop-agent@0.35.3`。版本事实以根 `CHANGELOG.md` 与 `package.json` 为准；能力短摘要见 `reports/current-capability-summary.md`。
+**维护日：2026-09-16** — 对齐 `@tea-agent/loop-agent@0.41.1-beta.0`。版本事实以根 `CHANGELOG.md` 与 `package.json` 为准；能力短摘要见 `reports/current-capability-summary.md`。
 
 ## 我现在要做什么？
 

package/docs/architecture/runtime-boundaries.md

@@ -180,7 +180,7 @@ Runner / Loop         ──(迁移中)──>  逐步改为仅经 Store / Appli
 | Script | 检查内容 | 失败条件 |
 | -------- | ---------- | ---------- |
 | `scripts/check-architecture-boundaries.sh` | workflow/executor forbidden import，及 Worker → CLI/commands/application import | 新的未 allowlist violation |
-| `scripts/check-command-registry-drift.sh` | `command-reference.md` 中的 top-level command vs `src/cli/catalog.ts` | 文档引用未注册 command |
+| `scripts/check-command-registry-drift.sh` | 五处真源的 top-level command 一致性：`src/cli/command-definitions.ts`（权威）、`src/shared/operator/capabilities.ts` 覆盖表、`skills/loop-agent/references/command-reference.md`、`website/docs/reference/cli.md`、`test/cli-contract.test.ts` 的 `LEGACY_SUPPORTED_COMMANDS`（逐项且同序） | 任一真源引用未注册 command、未覆盖已注册 command，或契约测试清单与 registry 不一致 |
 | `scripts/check-exec-plan-index-sync.sh` | `ai_workspace/loop-agent/exec-plans/{active,completed}` 目录文件 vs 对应 `README.md` 索引 | 任一 plan 文件未在索引登记 |
 | `scripts/check-skill-entry.sh` | `loop-agent` / `agent-worker` 的 frontmatter、required references、入口行数与 operator trigger vocabulary | 任一公共 skill 缺失、reference/trigger 漂移或入口超过 hard limit |
 

package/docs/governance/harness-methodology-verification.md

@@ -19,9 +19,20 @@
 | 行为有覆盖 | `npm test` |
 | 完整本地交付有效 | `bash scripts/ci.sh` |
 
+## 代理与拦截层：校验状态码分布，不是请求条数
+
+当验证经过中间层（网关 shim、mock server、反向代理、录制层）时，「请求到了中间层」不等于「中间层在起作用」：
+
+- 只看条数会把 **404/5xx 也算成命中**。真实的失败模式是「流量根本没经过」或「经过了但立刻被拒」，两者都产出请求记录。
+- 必须核对 **状态码分布**（如 `200×99` 而非 `200×1 + 404×42`），以及流量是否落在**目标时间窗口**内。
+- 用一条已知成功的直接调用（curl）建立参照，并确认它的路径形态与被测链路的路径形态**一致**——baseUrl 拼接差异（如 `/v1` 重复）会造成静默 404，而外层 runner 可能仍产出看似完整的产物。
+- 尤其警惕「未触发阈值」这类结论：它既可能是真的余量充足，也可能是**根本没走到阈值判断**。两者的证据形态完全不同，不能只凭「无拦截记录」下结论。
+
 ## Red Flags
 
 - 凭意图声明完成
 - 依赖陈旧命令输出
 - 用窄检查支撑宽声明
 - 跳过失败命令的细节
+- 用计数（请求数/命中数）代替状态码与时间窗口证据
+- 把「没有触发拦截」直接读成「余量充足」，未确认流量确实经过了拦截点