@tea-agent/loop-agent 0.44.0-next.1 → 0.44.0-next.11

package/dist/workflows/dag/frontend-implementation-contract.js

@@ -1,3 +1,5 @@
+import { readFileBoundarySafe } from "../../shared/path-safety.js";
+import { capabilityBoundarySchema } from "../../task/config-types.js";
 import { frontendExecutionSchema, collectFrontendExecutionGroups } from "./frontend-execution-groups.js";
 import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
@@ -195,6 +197,20 @@ export function isRecognizedFrontendVerifyCommandText(command) {
         /\b(tsc|eslint|typecheck|check-types)\b/i.test(command) ||
         /\bscripts[\\/]+ci(?:-tests)?\.sh\b/i.test(command));
 }
+/**
+ * Repo-level shell scripts whose name marks them as governance/static checks
+ * rather than test runners: `scripts/check-*.sh`, `scripts/ci.sh`,
+ * `scripts/ci-governance.sh` and friends. The behavior lane is test-observed
+ * at writer admission, so these must not be admitted there — they cannot emit
+ * a test report.
+ *
+ * A test word in the name still wins, because the test-semantics check runs
+ * earlier in `classifyFrontendVerifyCommandText`, so a real test script such as
+ * `scripts/run-tests.sh` or `scripts/check-tests.sh` is unaffected.
+ */
+const VERIFY_STATIC_SCRIPT_PATH_RE = /\bscripts[\\/]+(?:ci(?:-governance|-tests)?|check-[a-z0-9-]+)\.sh\b/i;
+/** A shell script whose own name marks it as a test runner. */
+const VERIFY_BEHAVIOR_SCRIPT_PATH_RE = /\bscripts[\\/]+[a-z0-9-]*(?:tests?|specs?|e2e)[a-z0-9-]*\.sh\b/i;
 /**
  * Classify a raw verification command text into the runtime-owned mode.
  * Shared single implementation used by DAG generation (lane split) and
@@ -207,6 +223,14 @@ export function isRecognizedFrontendVerifyCommandText(command) {
  * static scripts (`npm run check`, `check:types`) and leading binaries
  * (`tsc`, `eslint`) stay static. Package-manager flags (`npm --prefix
  * website run build`) are skipped when locating the script.
+ *
+ * Returns `undefined` for a command whose text carries no recognizable
+ * verification semantics. The previous fallback returned `"behavior"`, which
+ * silently pushed unknown commands into the strictest lane: the behavior lane
+ * is test-observed at writer admission, so a command that cannot emit a test
+ * report blocked admission deterministically with no way for the model to
+ * clear it. Callers must now decide explicitly instead of inheriting a lane
+ * from an unrecognized string.
  */
 export function classifyFrontendVerifyCommandText(command) {
     if (VERIFY_RUNNER_RE.test(command) || VERIFY_E2E_RE.test(command)) {
@@ -220,16 +244,24 @@ export function classifyFrontendVerifyCommandText(command) {
         }
         return segments.some((segment) => VERIFY_STATIC_SCRIPT_WORDS.has(segment))
             ? "static"
-            : "behavior";
+            : undefined;
     }
     const head = command.trim().split(/\s+/, 1)[0] ?? "";
     const binary = head.split(/[\\/]/).pop() ?? "";
+    // A test word in the invoked script's own name wins over the static
+    // governance pattern: `scripts/check-tests.sh` runs tests even though it
+    // starts with `check-`, so it must stay in the test-observed lane.
+    if (VERIFY_BEHAVIOR_SCRIPT_PATH_RE.test(command)) {
+        return "behavior";
+    }
     if (/^(tsc|eslint|stylelint|lint|typecheck|check|build)$/i.test(binary) ||
         /\b(tsc|eslint|typecheck|check-types)\b/i.test(command) ||
-        /\bscripts[\\/]+ci(?:-tests)?\.sh\b/i.test(command)) {
+        VERIFY_STATIC_SCRIPT_PATH_RE.test(command)) {
         return "static";
     }
-    return "behavior";
+    // Unrecognized: no lane is inferred. Callers must require an operator
+    // declaration rather than defaulting into the test-observed behavior lane.
+    return undefined;
 }
 export function slugFrontendVerifyCommandId(label, taken) {
     const slug = label
@@ -591,23 +623,22 @@ async function deriveFrontendCapabilityBoundaryFromRun(runDir) {
     try {
         raw = await readFile(specPath, "utf8");
     }
-    catch {
-        return undefined;
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
     }
     let spec;
     try {
         spec = JSON.parse(raw);
     }
     catch {
-        return undefined;
+        throw new Error("capability-boundary-source-invalid: run.json is malformed");
     }
     for (const task of spec.tasks ?? []) {
         const boundary = task.shell?.frontendDesignPolicy?.capabilityBoundary;
-        if (boundary &&
-            ((boundary.allowed?.length ?? 0) > 0 ||
-                (boundary.forbidden?.length ?? 0) > 0)) {
-            return boundary;
-        }
+        if (boundary !== undefined)
+            return capabilityBoundarySchema.parse(boundary);
     }
     return undefined;
 }
@@ -617,44 +648,67 @@ async function deriveFrontendCapabilityBoundaryFromRun(runDir) {
 export function composeDependencyPolicyWithBoundary(policy, boundary) {
     if (!boundary)
         return policy;
-    const allowed = (boundary.allowed ?? []).filter((item) => item.trim());
-    const forbidden = (boundary.forbidden ?? []).filter((item) => item.trim());
-    if (allowed.length === 0 && forbidden.length === 0)
-        return policy;
-    if (policy?.includes(CAPABILITY_BOUNDARY_MARKER))
-        return policy;
-    const sentence = `${CAPABILITY_BOUNDARY_MARKER}：` +
-        (allowed.length > 0 ? `仅可使用 ${allowed.join("、")}` : "无允许清单") +
-        (forbidden.length > 0 ? `；禁止 ${forbidden.join("、")}` : "") +
-        "。";
-    return policy?.trim() ? `${policy.trim()}；${sentence}` : sentence;
+    const frozen = capabilityBoundarySchema.parse(boundary);
+    // Replace only our explicit complete block; a prose mention never grants
+    // ownership of the author's following constraints.
+    const begin = "<!-- frontend-capability-boundary:start -->";
+    const end = "<!-- frontend-capability-boundary:end -->";
+    const source = policy ?? "";
+    const start = source.indexOf(begin);
+    const finish = start < 0 ? -1 : source.indexOf(end, start + begin.length);
+    const prefix = (finish < 0 ? source : source.slice(0, start) + source.slice(finish + end.length)).trim();
+    const parts = [
+        frozen.allowed?.length ? `仅可使用 ${frozen.allowed.join("、")}` : undefined,
+        frozen.forbidden?.length ? `禁止 ${frozen.forbidden.join("、")}` : undefined,
+        frozen.requiredClauses?.length ? `必须满足：${frozen.requiredClauses.join("；")}` : undefined,
+    ].filter(Boolean);
+    const sentence = `${CAPABILITY_BOUNDARY_MARKER}：${parts.join("；")}。`;
+    const block = `${begin}\n${sentence}\n${end}`;
+    return prefix ? `${prefix}\n${block}` : block;
 }
 /** Read the generation-frozen requirement→file ownership from run.json
- * (frontendDesignPolicy spec). Absent (legacy fixtures) → no ownership gate. */
-export async function deriveRequirementOwnershipFromRun(runDir) {
+ * (frontendDesignPolicy spec), bound to the canonical source identity. */
+export async function deriveRequirementOwnershipFromRun(runDir, expectedBinding) {
     const specPath = path.join(runDir, "run.json");
     let raw;
     try {
         raw = await readFile(specPath, "utf8");
     }
-    catch {
-        return [];
+    catch (error) {
+        if (error.code === "ENOENT" && (!expectedBinding || !isDagSourceBindingV2(expectedBinding)))
+            return [];
+        if (error.code === "ENOENT")
+            throw new Error("requirement-ownership-source-invalid: frozen run.json is missing");
+        throw error;
     }
     let spec;
     try {
         spec = JSON.parse(raw);
     }
     catch {
-        return [];
+        throw new Error("requirement-ownership-source-invalid: run.json is malformed");
     }
     const merged = new Map();
     for (const task of spec.tasks ?? []) {
-        for (const entry of task.shell?.frontendDesignPolicy?.requirementOwnership ?? []) {
+        const raw = task.shell?.frontendDesignPolicy?.requirementOwnership;
+        if (raw === undefined)
+            continue;
+        const parsed = z.array(z.object({ requirementIds: z.array(z.string().min(1)).min(1), implementationFiles: z.array(z.string().min(1)).optional(), verificationFiles: z.array(z.string().min(1)).optional() }).strict()).safeParse(raw);
+        if (!parsed.success)
+            throw new Error("requirement-ownership-source-invalid: frozen requirementOwnership is malformed");
+        for (const entry of parsed.data) {
             const key = [...(entry.requirementIds ?? [])].sort().join("|");
-            if (!merged.has(key))
+            const previous = merged.get(key);
+            if (previous && serializeDeterministicJson(previous) !== serializeDeterministicJson(entry))
+                throw new Error("requirement-ownership-source-invalid: conflicting ownership declarations");
+            if (!previous)
                 merged.set(key, entry);
         }
     }
+    if (merged.size && expectedBinding) {
+        if (!spec.sourceBinding || serializeDeterministicJson(spec.sourceBinding) !== serializeDeterministicJson(expectedBinding))
+            throw new Error("requirement-ownership-source-invalid: frozen source binding mismatch or missing");
+    }
     return [...merged.values()];
 }
 /** Deterministic requirement→file ownership check. A requirement's
@@ -700,27 +754,15 @@ function checkRequirementOwnership(canonical, ownership) {
                 continue;
             if (implementationFiles.length > 0) {
                 const allTargets = requirement.implementationTargets ?? [];
-                // Test-shaped placements belong to the verification lane (a shared
-                // behavior group's placement carries the test file for the
-                // test-writing requirement); they are governed by allowedPaths and
-                // the entry's verificationFiles, not by implementationFiles.
-                const implementationFilesAreTestShaped = implementationFiles.some((file) => isFrontendTestFilePath(file));
-                const targets = implementationFilesAreTestShaped
-                    ? allTargets
-                    : allTargets.filter((file) => !isFrontendTestFilePath(file));
-                // Contract deliverables are existence obligations, not ownership
-                // claims: a contract may require a mounting file to exist for a
-                // requirement implemented elsewhere (smoke r55 — a deliverable
-                // otherwise made plan finalize permanently unfixable).
-                const deliverables = new Set(requirement.deliverableTargets ?? []);
-                const ownedTargets = targets.filter((file) => !deliverables.has(file));
-                // Only files OUTSIDE the declared set violate. An empty owned set
-                // means every mapped file is a deliverable/test-shaped obligation —
-                // unplaced requirements are rejected upstream, not here (r56:
-                // "maps [X] expects [X]" still violated when deliverables covered
-                // the whole mapping).
-                const outside = ownedTargets.filter((file) => !implementationFiles.includes(file));
-                if (outside.length > 0) {
+                // A verification placement must have explicit verification
+                // ownership AND a bound verification target. File names alone
+                // never exempt implementation responsibility.
+                const verificationPlacements = new Set([...(targetsByRequirement.get(id) ?? [])].filter(file => verificationFiles.includes(file)));
+                const targets = allTargets.filter(file => !verificationPlacements.has(file) || implementationFiles.includes(file));
+                // implementationTargets retains actual placements. Existence-only
+                // deliverableTargets never subtract from this ownership claim.
+                const outside = targets.filter(file => !implementationFiles.includes(file));
+                if (outside.length > 0 || !targets.some(file => implementationFiles.includes(file))) {
                     findings.push({
                         code: "requirement-ownership-violated",
                         message: `requirement ${id} expects implementation within [${implementationFiles.join(", ")}] but plan maps [${targets.join(", ") || "none"}] — re-map the owning behavior group's module placement`,
@@ -759,7 +801,7 @@ const FRONTEND_CONTRACT_REVIEW_GROUPS = [
     },
     {
         id: "data-design",
-        fields: ["mockApi", "designEvidence", "dependencyPolicy", "realIntegrationGap"],
+        fields: ["mockApi", "designEvidence", "capabilityBoundary", "dependencyPolicy", "realIntegrationGap"],
     },
     {
         id: "verification",
@@ -1101,11 +1143,15 @@ export const frontendImplementationContractSchema = z
         uiStates: z.array(z.string().min(1)),
         // Display-only test scope; never read by control flow.
         scope: frontendVerificationScopeSchema.optional(),
+        // Planned evidence strength, never proof of observed behavior.
+        evidenceLevel: z.enum(["unit", "mounted", "real-integration"]).optional(),
+        boundary: z.string().min(1).optional(),
     })
         .strict()).min(1),
     evidenceGaps: z.array(gap).optional(),
     stylingStrategy: z.string().min(1).optional(),
     uiComponentChoices: uiComponentChoicesSchema.optional(),
+    capabilityBoundary: capabilityBoundarySchema.optional(),
     dependencyPolicy: z.string().min(1).optional(),
     residualRisks: z.array(z.string().min(1)).optional(),
     realIntegrationGap: z.string().min(1).optional(),
@@ -2032,7 +2078,7 @@ function assertFrontendContractPathsSafe(value) {
     const record = asRecord(value);
     if (!record)
         return;
-    const pathFields = ["files", "file", "implementationTargets", "fixture", "consumer"];
+    const pathFields = ["files", "file", "implementationTargets", "deliverableTargets", "fixture", "consumer"];
     for (const [key, child] of Object.entries(record)) {
         if (pathFields.includes(key) && Array.isArray(child)) {
             for (const item of child) {
@@ -2326,6 +2372,8 @@ export function coerceFrontendImplementationContractInput(value, canonicalBindin
             file,
             symbol: asString(vt.symbol) || undefined,
             ...(scope ? { scope } : {}),
+            ...(vt.evidenceLevel !== undefined ? { evidenceLevel: vt.evidenceLevel } : {}),
+            ...(vt.boundary !== undefined ? { boundary: vt.boundary } : {}),
             requirementIds: requirementIds.length > 0
                 ? requirementIds
                 : [...canonicalBinding.requirementIds],
@@ -2755,7 +2803,10 @@ export async function analyzeFrontendImplementationContract(input) {
     // field (r10/r11 design-review findings).
     const referencedConcretePaths = [
         ...new Set([
-            ...result.data.requirements.flatMap((requirement) => requirement.implementationTargets),
+            ...result.data.requirements.flatMap(requirement => [
+                ...requirement.implementationTargets,
+                ...(requirement.deliverableTargets ?? []),
+            ]),
             // Mock endpoint paths stay in the set: the zod refine validated
             // them against the declared targets.files patterns, so the
             // narrowing must keep covering them. Verification-target files
@@ -2765,6 +2816,9 @@ export async function analyzeFrontendImplementationContract(input) {
             ...(result.data.mockApi?.endpoints ?? []).flatMap((endpoint) => [endpoint.fixture, endpoint.consumer].filter((value) => typeof value === "string" && value.length > 0)),
         ].filter((value) => value.length > 0)),
     ].sort();
+    const outsideDelivery = result.data.requirements.flatMap(requirement => requirement.deliverableTargets ?? []).filter(file => !parsedTargetFiles.some(pattern => pathMatchesPattern(file, pattern)));
+    if (outsideDelivery.length)
+        fail("blocked", `target-path-outside-write-set: deliverable paths [${outsideDelivery.join(", ")}] exceed frozen targets`, candidateJsonSha256);
     if (referencedConcretePaths.length > 0) {
         result.data.targets = {
             ...result.data.targets,
@@ -2793,7 +2847,26 @@ export async function analyzeFrontendImplementationContract(input) {
         if (!result.data.requirements.some((item) => item.id === requirementId) &&
             !(result.data.evidenceGaps ?? []).some((item) => item.requirementId === requirementId))
             fail("blocked", `frontend contract does not cover ${requirementId}`, candidateJsonSha256);
-    result.data.dependencyPolicy = composeDependencyPolicyWithBoundary(result.data.dependencyPolicy, await deriveFrontendCapabilityBoundaryFromRun(input.runDir));
+    // Both finalize prechecks and the final materializer enter this function.
+    // Check the submitted placement before normalization can invent a fallback.
+    const ownership = await deriveRequirementOwnershipFromRun(input.runDir, input.sourceBinding);
+    for (const entry of ownership) {
+        if (!entry.implementationFiles?.length)
+            continue;
+        for (const id of entry.requirementIds) {
+            const original = asRecord(parsed)?.requirements?.find(item => asRecord(item)?.id === id);
+            if (!original || asStringArray(asRecord(original)?.implementationTargets).length === 0)
+                fail("retryable-invalid", `requirement-ownership-placement-missing: ${id} requires an explicit placement from its Plan facts`, candidateJsonSha256);
+        }
+    }
+    const ownershipFindings = checkRequirementOwnership(result.data, ownership);
+    if (ownershipFindings.length)
+        throw new PlanPolicyPrecheckFailure(ownershipFindings.map(f => `${f.code}: ${f.message}`).join("; "), ownershipFindings);
+    const frozenBoundary = await deriveFrontendCapabilityBoundaryFromRun(input.runDir);
+    delete result.data.capabilityBoundary;
+    if (frozenBoundary)
+        result.data.capabilityBoundary = frozenBoundary;
+    result.data.dependencyPolicy = composeDependencyPolicyWithBoundary(result.data.dependencyPolicy, frozenBoundary);
     return {
         canonical: result.data,
         candidateRawSha256,
@@ -2990,6 +3063,7 @@ export async function writeFrontendImplementationContractArtifact(input) {
     };
 }
 const FRONTEND_PLAN_PATCH_PROTECTED_PATHS = [
+    "/capabilityBoundary",
     "/schemaVersion",
     "/sourceBinding",
     "/riskLevel",
@@ -3036,7 +3110,7 @@ function frontendPlanPatchProtectedPathViolations(patch) {
     if (!record)
         return ["/"];
     const violations = [];
-    for (const key of ["schemaVersion", "sourceBinding", "riskLevel"]) {
+    for (const key of ["schemaVersion", "sourceBinding", "riskLevel", "capabilityBoundary"]) {
         if (Object.hasOwn(record, key))
             violations.push(`/${key}`);
     }
@@ -3050,6 +3124,22 @@ function frontendPlanPatchProtectedPathViolations(patch) {
         violations.push("/mockApi/productionDefaultOff");
     return violations;
 }
+/** Read-only verification references do not grant writer permissions. */
+export async function collectExistingFrontendVerificationPaths(workspaceRoot, contract) {
+    if (!workspaceRoot)
+        return [];
+    const existing = [];
+    for (const target of contract.verificationTargets) {
+        if (target.mode === "static" || existing.includes(target.file))
+            continue;
+        try {
+            await readFileBoundarySafe({ boundaryRoot: workspaceRoot, targetPath: path.resolve(workspaceRoot, target.file), label: "frontend existing verification" });
+            existing.push(target.file);
+        }
+        catch { /* Missing or unsafe files cannot bypass the write-set check. */ }
+    }
+    return existing;
+}
 function workspaceRootFromDagRunDir(runDir) {
     const absolute = path.resolve(runDir);
     const segments = absolute.split(path.sep);
@@ -3253,9 +3343,8 @@ export async function analyzeFrontendPlanPatchCandidate(input) {
         ...checkRequiredDeliverables(analysis.canonical),
         ...checkUxNameCollisions(analysis.canonical),
         ...checkDependencies(analysis.canonical, await deriveAllowedDependenciesFromRun(input.runDir)),
-        ...checkTargetPaths(analysis.canonical, await deriveWriteSetFromRun(input.runDir)),
+        ...checkTargetPaths(analysis.canonical, await deriveWriteSetFromRun(input.runDir), await collectExistingFrontendVerificationPaths(workspaceRootFromDagRunDir(input.runDir), analysis.canonical)),
         ...checkComponentChoiceSourceReferences(analysis.canonical, await deriveFrontendSourceBindingPathsFromRun(input.runDir)),
-        ...checkRequirementOwnership(analysis.canonical, await deriveRequirementOwnershipFromRun(input.runDir)),
         ...checkInteractionIdVocabulary(analysis.canonical, await deriveFrontendInteractionIdsFromRun(input.runDir)),
         ...checkMockApiStrategyAllowed(analysis.canonical, await deriveFrontendAllowedMockStrategiesFromRun(input.runDir)),
     ];

package/dist/workflows/dag/frontend-plan-canary.js

@@ -1,19 +1,15 @@
+import { FRONTEND_PLAN_CANARY_SCENARIOS, readFrontendCanaryEvidence, compareFrontendPairIdentity, readFrontendRootObservation } from "./frontend-root-observation.js";
 import { readFrontendPlanCanaryRunMetrics, } from "./frontend-session-budget.js";
-export const FRONTEND_PLAN_CANARY_SCENARIOS = [
-    "missing-idle-loading-empty",
-    "loading-not-mounted",
-    "test-layer-does-not-prove-wiring",
-    "mock-claimed-as-real-integration",
-];
+export { FRONTEND_PLAN_CANARY_SCENARIOS } from "./frontend-root-observation.js";
 const reduction = (before, after) => before !== null && after !== null && before > 0 ? ((before - after) / before) * 100 : null;
 /** Compare two same-input runs. Missing observations fail the canary rather
  * than being interpreted as a zero-cost candidate. */
 export function evaluateFrontendPlanCanary(input) {
-    const required = { planSessionsPct: 30, planWallClockPct: 30, protocolRetryPct: 50, ...input.requiredReductions };
+    const required = { planSessionsPct: 30, planWallClockPct: 30, factReplacementPct: 50, ...input.requiredReductions };
     const reductions = {
         planSessionsPct: reduction(input.baseline.planSessions, input.candidate.planSessions),
         planWallClockPct: reduction(input.baseline.planWallClockMs, input.candidate.planWallClockMs),
-        protocolRetryPct: reduction(input.baseline.retries, input.candidate.retries),
+        factReplacementPct: reduction(input.baseline.factReplacements, input.candidate.factReplacements),
     };
     const failedChecks = [];
     if (reductions.planSessionsPct === null || reductions.planSessionsPct < required.planSessionsPct)
@@ -23,31 +19,85 @@ export function evaluateFrontendPlanCanary(input) {
     // A zero retry baseline is already optimal: a zero->zero candidate is not a
     // regression and must not block, while zero->positive or missing evidence
     // still fails closed.
-    const retriesAlreadyOptimal = input.baseline.retries === 0 && input.candidate.retries === 0;
+    const retriesAlreadyOptimal = input.baseline.factReplacements === 0 && input.candidate.factReplacements === 0;
     if (!retriesAlreadyOptimal &&
-        (reductions.protocolRetryPct === null || reductions.protocolRetryPct < required.protocolRetryPct)) {
-        failedChecks.push("protocol-retry-reduction");
+        (reductions.factReplacementPct === null || reductions.factReplacementPct < required.factReplacementPct)) {
+        failedChecks.push("fact-replacement-reduction");
     }
     for (const scenario of FRONTEND_PLAN_CANARY_SCENARIOS) {
         const result = input.scenarios[scenario];
         if (result !== "blocked" && result !== "reported")
             failedChecks.push(`regression:${scenario}`);
     }
-    return { pass: failedChecks.length === 0, reductions, failedChecks };
+    for (const metric of ["planModelRequests", "planTokens", "toolRejections", "transportRetries", "correctionSessions", "finalizeRejections"]) {
+        const before = input.baseline[metric], after = input.candidate[metric];
+        if (before == null || after == null || !Number.isFinite(before) || !Number.isFinite(after) || after < 0 || after > before)
+            failedChecks.push(`plan-cost:${metric}`);
+    }
+    const planPass = failedChecks.length === 0;
+    for (const metric of ["rootTokens", "rootReservedRequests"]) {
+        const before = input.baseline[metric], after = input.candidate[metric];
+        const allowance = metric === "rootTokens" ? 1.1 : 1;
+        if (before == null || after == null || !Number.isFinite(before) || !Number.isFinite(after) || before < 0 || after < 0 || after > before * allowance)
+            failedChecks.push(`root-cost:${metric}`);
+    }
+    for (const metric of ["dagWallClockMs", "designReviewRejectRate", "finalReviewDefectRate", "recoveryCount"]) {
+        const before = input.baseline[metric], after = input.candidate[metric];
+        if (before == null || after == null || !Number.isFinite(before) || !Number.isFinite(after) || after < 0 || after > before)
+            failedChecks.push(`quality:${metric}`);
+    }
+    return { pass: failedChecks.length === 0, planPass, reductions, failedChecks };
 }
 /** Read two frozen run directories and evaluate the same-input canary. Plan
- * cost metrics come from persisted session receipts; supplemental DAG/review/
- * recovery values come from each run's `frontend-plan-canary-metrics.json`.
+ * cost metrics come from persisted session receipts and optionally explicit root
+ * lineage. Free numeric supplements cannot establish quality evidence.
  * Missing observations surface as `null` and fail the evaluation, never as a
  * manufactured zero-cost improvement. */
 export async function compareFrontendPlanCanaryRuns(input) {
     const baseline = await readFrontendPlanCanaryRunMetrics(input.baselineRunDir);
     const candidate = await readFrontendPlanCanaryRunMetrics(input.candidateRunDir);
+    const lineageChecks = [];
+    const regressionEvidence = [];
+    const identities = {};
+    if (input.rootRuns) {
+        for (const [name, metrics, runId] of [["baseline", baseline, input.rootRuns.baselineRunId], ["candidate", candidate, input.rootRuns.candidateRunId]]) {
+            const root = await readFrontendRootObservation(input.rootRuns.workspaceRoot, runId);
+            const consumed = root.cumulativeBudget?.consumed;
+            Object.assign(metrics, root.plan, { dagWallClockMs: root.dagWallClockMs, recoveryCount: root.recoveryCount,
+                rootTokens: root.complete && consumed?.missingTokenNodeIds?.length === 0 ? consumed.tokens : null,
+                rootReservedRequests: root.complete ? consumed?.providerRequests ?? null : null });
+            if (!root.complete)
+                lineageChecks.push(`lineage:${name}`);
+            if (root.complete && input.evidence?.[name]) {
+                try {
+                    const evidence = await readFrontendCanaryEvidence({ workspaceRoot: input.rootRuns.workspaceRoot, runDir: name === "baseline" ? input.baselineRunDir : input.candidateRunDir, runIds: root.runIds, manifest: input.evidence[name] });
+                    identities[name] = evidence.identity;
+                    regressionEvidence.push(evidence.regressions);
+                    Object.assign(metrics, { designReviewRejectRate: evidence.designReviewRejectRate, finalReviewDefectRate: evidence.finalReviewDefectRate });
+                    if (!evidence.acceptancePassed)
+                        lineageChecks.push(`acceptance:${name}`);
+                }
+                catch (error) {
+                    lineageChecks.push(`evidence:${name}:${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            else
+                lineageChecks.push(`missing-evidence:${name}`);
+        }
+    }
+    else
+        lineageChecks.push("missing-root-lineage");
+    const scenarios = {};
+    for (const scenario of FRONTEND_PLAN_CANARY_SCENARIOS) {
+        scenarios[scenario] = regressionEvidence.length === 2 && regressionEvidence.every(evidence => evidence[scenario] === "blocked" || evidence[scenario] === "reported") ? "reported" : "not-observed";
+    }
     const evaluation = evaluateFrontendPlanCanary({
         baseline,
         candidate,
-        scenarios: input.scenarios,
+        scenarios,
         requiredReductions: input.requiredReductions,
     });
-    return { ...evaluation, baseline, candidate };
+    const identityChecks = compareFrontendPairIdentity(identities.baseline ?? {}, identities.candidate ?? {});
+    const failedChecks = [...evaluation.failedChecks, ...identityChecks, ...lineageChecks];
+    return { ...evaluation, pass: failedChecks.length === 0, failedChecks, baseline, candidate };
 }

package/dist/workflows/dag/frontend-plan-decision-contract.js

@@ -1,3 +1,4 @@
+import { repairAssertionSchema } from "./frontend-repair-assertions.js";
 import { z } from "zod";
 import { pathMatchesPattern } from "../../shared/git-progress.js";
 import { deterministicSha256 } from "./frontend-implementation-contract.js";
@@ -94,7 +95,7 @@ export function projectFrontendSafetyFacts(input) {
         const ids = sorted(group?.requirementIds ?? []);
         for (const id of ids)
             verificationByRequirement[id]?.push(focus.id);
-        return { id: focus.id, file: focus.file, commandId: focus.commandId, requirementIds: ids };
+        return { id: focus.id, file: focus.file, commandId: focus.commandId, requirementIds: ids, evidenceLevel: focus.evidenceLevel, ...(focus.boundary ? { boundary: focus.boundary } : {}) };
     });
     for (const id of requirementIds)
         verificationByRequirement[id] = sorted(verificationByRequirement[id]);
@@ -443,6 +444,8 @@ export function buildFrontendPlanRelationshipPatch(input) {
             : declaredStateNamesByGroup.get(focus.behaviorGroupId) ?? [];
         return {
             id: focus.id,
+            evidenceLevel: focus.evidenceLevel,
+            ...(focus.boundary ? { boundary: focus.boundary } : {}),
             commandId: focus.commandId,
             file: focus.file,
             requirementIds,
@@ -450,7 +453,7 @@ export function buildFrontendPlanRelationshipPatch(input) {
         };
     });
     const verificationTargetIds = new Set(verificationTargets.map(target => target.id));
-    // ---- requirements: derived group expansion + contract deliverable
+    // ---- requirements: preserve group placement separately from contract deliverable
     // obligations. Every requirement must keep a placement and at least one
     // verification target (both are guaranteed post-finalize because the
     // decision safety projection blocks unplaced / unverified requirements).
@@ -458,7 +461,7 @@ export function buildFrontendPlanRelationshipPatch(input) {
         const groupId = groupByRequirement.get(requirement.id);
         const placed = sorted(placementPathsById.get(groupId ?? "") ?? []);
         const deliverable = sorted(requiredByRequirement.get(requirement.id) ?? []);
-        const implementationTargets = sorted([...placed, ...deliverable]);
+        const implementationTargets = placed;
         const derivedVerificationTargetIds = sorted([...(vtIdsByGroup.get(groupId ?? "") ?? [])].filter(id => verificationTargetIds.has(id)));
         return {
             id: requirement.id,
@@ -613,12 +616,6 @@ export function buildFrontendPlanRelationshipPatch(input) {
         ...(stylingStrategy ? { stylingStrategy } : {}),
     };
 }
-const repairAssertionSchema = z.discriminatedUnion("check", [
-    z.object({ check: z.literal("file-absent"), token: z.string().min(1), source: z.string() }).strict(),
-    z.object({ check: z.literal("state-present"), token: z.string().min(1), source: z.string() }).strict(),
-    z.object({ check: z.literal("vt-changed"), token: z.string().min(1), source: z.string(),
-        expectedRequirementIds: z.array(z.string().min(1)).min(1) }).strict(),
-]);
 /** No heuristic fallback: absent structured expectations mean that semantic
  * closure must be decided by the subsequent design review. Invalid explicit
  * assertions throw rather than silently disabling a requested check. */
@@ -742,26 +739,21 @@ export function collapseDecisionEntriesByKind(kind, collected) {
     };
     const byKey = new Map();
     const keyless = [];
-    // Retracted tombstones remove their own key and every other record keyed to
-    // the same interaction — a wrong-named record cannot survive a rename (r19).
-    const retractedKeys = new Set();
-    for (const entry of collected) {
-        if (entry.retracted === true && typeof entry.interaction === "string") {
-            retractedKeys.add(entry.interaction);
-        }
-    }
+    // Chronological last-wins semantics also permit a later explicit correction
+    // after a tombstone. Never return the original tombstones as active rows.
     for (const entry of collected) {
-        if (entry.retracted === true)
-            continue;
         const key = keyOf(entry);
-        if (kind === "data-flow" && typeof entry.interaction === "string" && retractedKeys.has(entry.interaction))
+        if (entry.retracted === true) {
+            if (key)
+                byKey.delete(key);
             continue;
+        }
         if (key)
             byKey.set(key, entry);
         else
             keyless.push(entry);
     }
-    return byKey.size > 0 ? [...byKey.values(), ...keyless] : [...collected];
+    return [...byKey.values(), ...keyless];
 }
 /** Compile committed decision facts into a FrontendPlanDecisionContract. Each
  * fact's `entry` is already schema-shaped (the tool validates it); this collects