@tea-agent/loop-agent 0.44.0-next.10 → 0.44.0-next.12

package/dist/workflows/dag/hybrid/templates/frontend-test.js

@@ -0,0 +1,702 @@
+/** DAG hybrid frontend-test 模板族：串行浏览器 RAG DAG 与 frontend-test 布局应用。 */
+import path from "node:path";
+import { existsSync } from "node:fs";
+import { assertValidDagSpec } from "../../validate.js";
+import { DEFAULT_DAG_EXECUTOR_MODELS, DEFAULT_DAG_OUTPUT_LANGUAGE, parseDagSpec } from "../../types.js";
+import { pathMatchesPattern } from "../../../../shared/git-progress.js";
+import { applyFrontendTestLayoutToText, resolveFrontendTestLayout } from "../../frontend-test-layout.js";
+import { buildFrontendTestOutcomeGateShellSnippet } from "../../frontend-test-result-contract.js";
+import { GENERATED_DAG_RUNTIME_CONTRACT, HYBRID_DEFAULTS, STANDARD_GLOBAL_CONSTRAINTS, buildDagSourceBinding, buildSourceContextBlock, extractObjective, extractSuccessCriteria, resolveDagVerifyStrategy } from "../sources.js";
+import { applyDefaultReadOnlyRetryPolicy, commonForbiddenPaths, commonReadOnlyPaths, stampGeneratedArtifactBindings, } from "./shared.js";
+export function buildFrontendTestHybridDag(sources) {
+    const rawFrontendTest = sources.taskConfig.frontendTest;
+    const layout = resolveFrontendTestLayout(rawFrontendTest);
+    const config = {
+        // Default 32: common FE suites cover ~24 AC with multi-dimension cases; 20 caused map maxExpandedNodes failures.
+        maxCasesPerBatch: rawFrontendTest?.maxCasesPerBatch ?? 32,
+        maxTokensPerCase: rawFrontendTest?.maxTokensPerCase,
+        maxTotalTokens: rawFrontendTest?.maxTotalTokens,
+        reviewMode: rawFrontendTest?.reviewMode ?? "off",
+        strictOutcomeGate: rawFrontendTest?.strictOutcomeGate === true,
+        maxRerunAttempts: (() => {
+            const raw = rawFrontendTest?.maxRerunAttempts;
+            if (raw === undefined || raw === null || Number.isNaN(Number(raw))) {
+                return rawFrontendTest?.reviewMode === "blocking" ? 2 : 1;
+            }
+            return Math.min(4, Math.max(0, Math.trunc(Number(raw))));
+        })(),
+        reports: {
+            retrospect: rawFrontendTest?.reports?.retrospect === true,
+            l5: rawFrontendTest?.reports?.l5 !== false,
+        },
+    };
+    const declaredRequirementIds = buildDagSourceBinding(sources).requirementIds;
+    const declaredAcIds = declaredRequirementIds.filter((id) => /^AC(?:-[A-Z0-9]+)+$/i.test(id));
+    // Optional project-local UI anchor ledger: only mention it in prompts when it
+    // exists so ledger-less projects keep generating without noise.
+    const hasUiAnchorsLedger = Boolean(sources.repoRoot &&
+        existsSync(path.join(sources.repoRoot, layout.ragDir, "ui-anchors.md")));
+    const uiAnchorsLedgerInstruction = hasUiAnchorsLedger
+        ? `Also read ${layout.ragDir}/ui-anchors.md (UI anchor ledger). Every passing find assertion in generated cases must quote a ledger row whose 状态 is 有效 for the matching page x state section; rows marked 不可断言/失效 must not be used as passing assertions. When an AC names a control absent from the ledger section for that state, emit a blocked case note (blockedReason unique-control-unavailable) instead of exploratory find steps, and follow ledger 备注 alternatives (split-node short literals) exactly.`
+        : "";
+    const reviewMode = config.reviewMode;
+    const blockingReview = reviewMode === "blocking";
+    const strictOutcomeGate = config.strictOutcomeGate;
+    const maxRerunAttempts = config.maxRerunAttempts;
+    const enableRetrospect = config.reports?.retrospect === true;
+    const enableL5Report = config.reports?.l5 !== false;
+    if (!allowedPathsCoverFrontendTestRoot(sources.taskConfig.allowedPaths, layout.testRoot)) {
+        throw new Error(`frontend-test requires task.json allowedPaths to cover "${layout.testRoot}/**" (or an explicit containing glob).`);
+    }
+    const forbidden = commonForbiddenPaths(sources);
+    const ragWriteSet = [`${layout.ragDir}/**`];
+    const caseDraftWriteSet = [
+        `${layout.casesDir}/FE-*.md`,
+        `${layout.casesDir}/index.md`,
+        `${layout.casesDir}/manifest.draft.json`,
+    ];
+    // The shell materializer alone owns the final manifest boundary.
+    const casesWriteSet = [`${layout.casesDir}/**`];
+    const evidenceRoot = layout.evidenceDir;
+    const declaredAcIdsLiteral = JSON.stringify(declaredAcIds);
+    const maxCasesPerBatchLiteral = String(config.maxCasesPerBatch);
+    const checklistScript = [
+        "const fs=require('fs'),path=require('path');",
+        "const root='testcase/frontend/cases';",
+        "const draft=path.join(root,'manifest.draft.json');",
+        "const final=path.join(root,'manifest.json');",
+        "const manifestPath=fs.existsSync(draft)?draft:(fs.existsSync(final)?final:null);",
+        "if(!manifestPath)throw new Error('checklist: missing manifest.draft.json or manifest.json');",
+        "const manifest=JSON.parse(fs.readFileSync(manifestPath,'utf8'));",
+        "if(!Array.isArray(manifest.cases)||manifest.cases.length===0)throw new Error('checklist: empty cases');",
+        `const declaredAc=new Set(${declaredAcIdsLiteral});`,
+        "const issues=[];",
+        "const openRe=/playwright-cli\\s+open\\s+--browser=chrome\\s+https?:\\/\\/\\S+/i;",
+        "const prodRe=/(?:^|\\/\\/)(?:www\\.)?[^\\s\\/]*(?:prod|production)/i;",
+        "const caseIdRe=/^FE-[A-Za-z0-9][A-Za-z0-9-]*$/;",
+        ,
+        "const acIdRe=/^AC(?:-[A-Z0-9]+)+$/i;",
+        "const truncatedAcRe=/^AC-FE-[A-Z]+$/i;",
+        "const truncatedUndeclaredAcRe=/^(?:AC-\\d{3}|AC-FE-[A-Z]+)$/i;",
+        "for(const c of manifest.cases){",
+        " const id=c&&c.caseId||'?';",
+        " if(typeof c.caseId!=='string'||!caseIdRe.test(c.caseId))issues.push({ruleId:'case-id-shape',caseId:id,detail:'caseId must be FE-<FEATURE>-<NNN>-<dimension>, never AC-FE-*'});",
+        " if(typeof c.caseId==='string'&&/^AC-/i.test(c.caseId))issues.push({ruleId:'case-id-is-ac',caseId:id,detail:'do not use acceptance id as caseId; put AC-FE-* only in acIds'});",
+        " const casePath=typeof c.casePath==='string'?c.casePath:null;",
+        " if(!casePath||!fs.existsSync(casePath)){issues.push({ruleId:'case-file-missing',caseId:id,detail:String(casePath)});continue;}",
+        " if(typeof c.caseId==='string'&&casePath!=='testcase/frontend/cases/'+c.caseId+'.md')issues.push({ruleId:'case-path-mismatch',caseId:id,detail:casePath+' must equal testcase/frontend/cases/'+c.caseId+'.md'});",
+        " const body=fs.readFileSync(casePath,'utf8');",
+        " if(!openRe.test(body))issues.push({ruleId:'open-prefix',caseId:id,detail:'missing playwright-cli open --browser=chrome <absolute-url>; playwright-cli is strongly recommended for browser execution'});",
+        ,
+        " const m=body.match(/playwright-cli\\s+open\\s+--browser=chrome\\s+(https?:\\/\\/\\S+)/i);",
+        " if(m){const url=m[1].replace(/[)\\]},.\"']+$/,''); if(prodRe.test(url))issues.push({ruleId:'production-url',caseId:id,detail:url});}",
+        " if(!Array.isArray(c.acIds)||c.acIds.length===0)issues.push({ruleId:'ac-mapping',caseId:id,detail:'acIds required (AC-FE-* acceptance ids, not caseId)'});",
+        " else {",
+        "  for(const ac of c.acIds){",
+        "   if(typeof ac!=='string'){issues.push({ruleId:'ac-id-shape',caseId:id,detail:String(ac)+' must look like AC-FE-001'});continue;}",
+        "   if(/^FE-/i.test(ac)){issues.push({ruleId:'ac-id-is-case',caseId:id,detail:ac+' looks like caseId; acIds must be AC-*'});continue;}",
+        "   if(!acIdRe.test(ac)){issues.push({ruleId:'ac-id-shape',caseId:id,detail:ac+' must look like AC-FE-001'});continue;}",
+        "   if(truncatedAcRe.test(ac)||(declaredAc.size===0&&truncatedUndeclaredAcRe.test(ac))){issues.push({ruleId:'ac-id-truncated',caseId:id,detail:ac+' is a truncated acceptance id (missing feature prefix or sequence number)'});continue;}",
+        "   if(declaredAc.size>0&&!declaredAc.has(ac))issues.push({ruleId:'unknown-ac',caseId:id,detail:ac+' not in task sourceBinding.requirementIds'});",
+        "  }",
+        " }",
+        "}",
+        "if(issues.length){console.error('frontend-test checklist blocked: '+JSON.stringify(issues)); process.exit(1);}",
+        "console.log('frontend-test checklist ok cases='+manifest.cases.length+' source='+path.basename(manifestPath));",
+    ].join("");
+    // Pass generated JavaScript as base64 rather than embedding it inside a
+    // shell-quoted `node -e` argument. Git Bash otherwise consumes backslashes
+    // such as \\s/\\d and interprets Markdown backticks before Node sees them.
+    const checklistScriptBase64 = Buffer.from(checklistScript, "utf8").toString("base64");
+    const checklistValidation = [
+        "node -e \"require('node:vm').runInThisContext(Buffer.from(process.argv[1],'base64').toString('utf8'))\"",
+        checklistScriptBase64,
+    ].join(" ");
+    const manifestValidation = [
+        "node -e",
+        JSON.stringify([
+            "const fs=require('fs'),path=require('path');",
+            "function fail(ruleId,detail){ const msg=JSON.stringify({ruleId:ruleId,detail:String(detail||'')}); console.error('frontend-test manifest blocked: '+msg); throw new Error('frontend-test manifest blocked: '+ruleId+(detail?(': '+detail):'')); }",
+            "const draft='testcase/frontend/cases/manifest.draft.json',file='testcase/frontend/cases/manifest.json',tmp=file+'.tmp';",
+            "if(!fs.existsSync(draft)) fail('draft-missing','missing '+draft);",
+            "let manifest; try{manifest=JSON.parse(fs.readFileSync(draft,'utf8'));}catch(e){fail('draft-invalid-json',e&&e.message||e);}",
+            "if(manifest.schemaVersion!==1) fail('draft-schema','schemaVersion must be 1');",
+            "if(!Array.isArray(manifest.cases)||manifest.cases.length===0) fail('draft-empty-cases','cases must be a non-empty array');",
+            `const maxCases=${maxCasesPerBatchLiteral};`,
+            "if(manifest.cases.length>maxCases) fail('map-capacity-exceeded','cases='+manifest.cases.length+' exceeds maxCasesPerBatch/maxExpandedNodes='+maxCases+'; raise frontendTest.maxCasesPerBatch or shrink the suite');",
+            "const dims=new Set(['core','boundary','flow','backend']);",
+            `const declaredAc=new Set(${declaredAcIdsLiteral});`,
+            "const seen=new Set(); const seenCasePath=new Set(); const seenEvidenceDir=new Set();",
+            "const acIdRe=/^AC(?:-[A-Z0-9]+)+$/i;",
+            "const truncatedAcRe=/^AC-FE-[A-Z]+$/i;",
+            "const truncatedUndeclaredAcRe=/^(?:AC-\\d{3}|AC-FE-[A-Z]+)$/i;",
+            "for(const c of manifest.cases){",
+            " if(!c||typeof c.caseId!=='string'||!/^FE-[A-Za-z0-9][A-Za-z0-9-]*$/.test(c.caseId)) fail('case-id-shape','caseId must be FE-*, never AC-FE-*: '+String(c&&c.caseId));",
+            " if(/^AC-/i.test(c.caseId)) fail('case-id-is-ac','caseId must not be an acceptance id: '+c.caseId);",
+            " if(seen.has(c.caseId)) fail('duplicate-case-id',c.caseId);",
+            " seen.add(c.caseId);",
+            " if(typeof c.dimension!=='string'||!dims.has(c.dimension)) fail('invalid-dimension',String(c.dimension));",
+            " if(!Array.isArray(c.acIds)||c.acIds.length===0||c.acIds.some(a=>typeof a!=='string'||!a.trim())) fail('ac-mapping','invalid acIds for '+c.caseId);",
+            " for(const ac of c.acIds){ if(!acIdRe.test(ac)) fail('ac-id-shape','acIds entry must be AC-* acceptance id, not caseId: '+ac); if(truncatedAcRe.test(ac)||(declaredAc.size===0&&truncatedUndeclaredAcRe.test(ac))) fail('ac-id-truncated','acIds entry is a truncated acceptance id (missing feature prefix or sequence number): '+ac); if(declaredAc.size>0&&!declaredAc.has(ac)) fail('unknown-ac',ac+' not in sourceBinding; repair generator input or AC list'); }",
+            " c.casePath='testcase/frontend/cases/'+c.caseId+'.md';",
+            " c.evidenceDir='testcase/frontend/evidence/'+c.caseId+'/';",
+            " for(const k of ['casePath','evidenceDir']){ const v=c[k]; if(typeof v!=='string'||path.isAbsolute(v)||v.includes('..')) fail('unsafe-path',k+': '+String(v)); }",
+            " if(!fs.existsSync(c.casePath)) fail('case-file-missing','missing case file '+c.casePath+' (filename must equal caseId.md)');",
+            " if(seenCasePath.has(c.casePath)) fail('duplicate-case-path',c.casePath); seenCasePath.add(c.casePath);",
+            " if(seenEvidenceDir.has(c.evidenceDir)) fail('duplicate-evidence-dir',c.evidenceDir); seenEvidenceDir.add(c.evidenceDir);",
+            "}",
+            "const payload=JSON.stringify(manifest,null,2)+'\\n';",
+            "fs.writeFileSync(tmp,payload); fs.renameSync(tmp,file); try{fs.unlinkSync(draft);}catch(_){}",
+            "process.stdout.write(JSON.stringify({cases:manifest.cases}));",
+        ].join("")),
+    ].join(" ");
+    const frontendTestOutcomeGate = buildFrontendTestOutcomeGateShellSnippet();
+    const frontendCaseQualityAdvisory = [
+        "node -e",
+        JSON.stringify([
+            "const fs=require('fs'),path=require('path');",
+            "const runDir=process.env.HARNESS_DAG_RUN_DIR; if(!runDir)throw new Error('missing HARNESS_DAG_RUN_DIR');",
+            "const resultPath=path.join(runDir,'contracts','frontend-test-result.json'); if(!fs.existsSync(resultPath))throw new Error('missing '+resultPath);",
+            "const r=JSON.parse(fs.readFileSync(resultPath,'utf8')); const findings=Array.isArray(r.advisoryFindings)?r.advisoryFindings:[];",
+            "const reports='testcase/frontend/reports'; fs.mkdirSync(reports,{recursive:true});",
+            "const esc=v=>String(v??'').replaceAll('&','&amp;').replaceAll('<','&lt;').replaceAll('>','&gt;').replaceAll('\\\"','&quot;');",
+            "const labels={cases:'用例总数',passed:'通过',failed:'失败',blocked:'阻塞'}; const totals=r.totals||{}; const missing=r.acceptanceCoverage&&Array.isArray(r.acceptanceCoverage.missing)?r.acceptanceCoverage.missing:[];",
+            "const md=['# 前端测试质量建议报告','','> Advisory：以下 finding 用于改进测试资产和证据质量，不阻塞后续流程。','','## 执行摘要','',...Object.entries(labels).map(([k,v])=>'- '+v+': '+Number(totals[k]||0)),'- 执行结果: '+String(r.outcome||'unknown'),'- 缺失 AC: '+(missing.join(', ')||'无'),'','## 建议项','',...(findings.length?findings.map(f=>'- ['+f.ruleId+']'+(f.caseId?' '+f.caseId:'')+': '+f.detail):['- 未发现建议项。']),''];",
+            "fs.writeFileSync(path.join(reports,'frontend-test-case-quality-advisory.md'),md.join('\\n'));",
+            "const rows=findings.length?findings.map(f=>'<tr><td><code>'+esc(f.ruleId)+'</code></td><td>'+esc(f.caseId||'-')+'</td><td>'+esc(f.detail)+'</td></tr>').join(''):'<tr><td colspan=3>未发现建议项。</td></tr>';",
+            "const html='<!doctype html><html lang=\\\"zh-CN\\\"><head><meta charset=\\\"utf-8\\\"><meta name=\\\"viewport\\\" content=\\\"width=device-width,initial-scale=1\\\"><title>前端测试质量建议报告</title><style>body{font:16px system-ui,Microsoft YaHei,sans-serif;background:#f5f7fb;color:#172033;margin:0;padding:32px}main{max-width:1100px;margin:auto;background:#fff;padding:32px;border-radius:16px}.badge{display:inline-block;padding:6px 10px;border-radius:999px;background:#fff3cd;color:#946200}.grid{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:12px}.card{padding:16px;background:#f8fafc;border-radius:10px}table{width:100%;border-collapse:collapse}th,td{text-align:left;padding:10px;border-bottom:1px solid #e5e7eb}code{color:#475467}@media(max-width:700px){.grid{grid-template-columns:1fr 1fr}}</style></head><body><main><h1>前端测试质量建议报告</h1><p><span class=\\\"badge\\\">Advisory，不阻塞后续流程</span></p><h2>执行摘要</h2><div class=\\\"grid\\\">'+Object.entries(labels).map(([k,v])=>'<div class=\\\"card\\\"><strong>'+v+'</strong><div>'+Number(totals[k]||0)+'</div></div>').join('')+'</div><p>执行结果：'+esc(r.outcome||'unknown')+'；缺失 AC：'+esc(missing.join(', ')||'无')+'</p><h2>建议项</h2><table><thead><tr><th>规则</th><th>Case ID</th><th>说明与建议</th></tr></thead><tbody>'+rows+'</tbody></table></main></body></html>';",
+            "fs.writeFileSync(path.join(reports,'frontend-test-case-quality-advisory.html'),html); console.log('frontend-test advisory report findings='+findings.length);",
+        ].join("")),
+    ].join(" ");
+    const tasks = [
+        {
+            id: "preflight-frontend-browser-tool-shell",
+            depends_on: [],
+            role: "verifier",
+            executor: "shell",
+            complexity: "LOW",
+            writePolicy: "read-only",
+            allowedPaths: [],
+            forbiddenPaths: forbidden,
+            outputContract: "Deterministic browser-tool preflight: SDK-only custom-tool capability + controller verified playwright-cli launcher + --help contract + frozen controller origin. Fail closed with playwright-cli-unavailable | playwright-cli-contract-incompatible | browser-command-capability-unavailable before any frontend-test Pi node.",
+            subtask_prompt: "Verify CODE_AGENT_PI_BACKEND permits SDK, the Pi SDK structured custom-tool surface is available, and the controller-resolved playwright-cli launcher and --help list open/close/find/snapshot/click. Do not resolve or freeze the target URL in this node. Do not install packages. Do not start a browser session. On failure exit non-zero so retrieve/generate/map never run (zero frontend-test Pi calls).",
+            shell: {
+                commands: [],
+                frontendBrowserToolPreflight: {},
+                cwd: ".",
+                timeoutMs: 60000,
+            },
+        },
+        {
+            id: "prepare-frontend-test-package-shell",
+            depends_on: ["preflight-frontend-browser-tool-shell"],
+            role: "verifier",
+            executor: "shell",
+            complexity: "LOW",
+            writePolicy: "exclusive",
+            writeSet: ragWriteSet,
+            allowedPaths: [...ragWriteSet],
+            forbiddenPaths: forbidden,
+            outputContract: "Write testcase/frontend/rag/standard-scenarios.v1.json for generate-time standard scenario coverage. Copy docs/templates or harness.json governanceRoot templates (including ai_workspace/loop-agent/templates) when present; otherwise write the minimal STD-FE-SMOKE-ENTRY fallback.",
+            subtask_prompt: "Prepare frontend-test package: materialize standard-scenarios.v1.json into the RAG package from docs/templates, governanceRoot/templates, or the init-projected ai_workspace/loop-agent/templates path.",
+            shell: {
+                commands: [],
+                frontendTestStandardScenarios: {},
+                cwd: ".",
+                timeoutMs: 60_000,
+            },
+        },
+        {
+            id: "retrieve-frontend-test-context-pi",
+            depends_on: ["prepare-frontend-test-package-shell"],
+            role: "planner",
+            executor: "pi",
+            toolProfile: "write",
+            complexity: "MED",
+            writePolicy: "exclusive",
+            writeGuardPolicy: "tools-only",
+            writeSet: ragWriteSet,
+            allowedPaths: [...commonReadOnlyPaths(sources), ...ragWriteSet],
+            forbiddenPaths: forbidden,
+            outputContract: "Write short testcase/frontend/rag/context.md and coverage-map.md with a model-resolved non-production baseUrl/baseUrlSource from task source config, environmentProbe=pending, and capability notes.",
+            subtask_prompt: [
+                "Build the frontend test RAG package (keep it short).",
+                "Read task source, routes/components/API or Mock facts, and execution contract. Write only testcase/frontend/rag/context.md and coverage-map.md.",
+                "Prefer fixed fields: baseUrl, baseUrlSource, environmentProbe, AC table, capability matrix (backend real/mock, pagination data, HTTP observation, error injection), risks, forbidden hosts. Do not paste large implementation dumps.",
+                "Base URL resolution (required): read the bound task source and config/environment references. Prefer TARGET_URL/targetUrl as the concrete tested entry, then BASE_URL/baseUrl or FRONTEND_BASE_URL/frontendUrl, then LOGIN_URL/loginUrl; accept common casing and underscore/kebab/space variants. Choose one absolute non-production http(s) URL, never API-only or production hosts. If no usable URL exists, use http://localhost:5173. Write `baseUrl: <url>`, `baseUrlSource: <bound source path>|default-localhost-5173`, and `environmentProbe: pending`. Include exact start prefix: playwright-cli open --browser=chrome <resolved-base-url> with the concrete selected URL.",
+                buildSourceContextBlock(sources),
+            ].join("\n\n"),
+        },
+        {
+            id: "materialize-frontend-test-execution-shell",
+            depends_on: ["retrieve-frontend-test-context-pi"],
+            role: "verifier",
+            executor: "shell",
+            complexity: "LOW",
+            writePolicy: "exclusive",
+            writeSet: ragWriteSet,
+            allowedPaths: [...ragWriteSet],
+            forbiddenPaths: forbidden,
+            outputContract: "Fail-closed environment preflight: absolute non-production baseUrl + curl HTTP reachability; writes environmentProbe facts; unreachable => blockedReason frontend-base-url-unreachable with errorClass (connection-refused / dns-unresolved / connect-timeout / http-N / curl-exit-N). Node ERROR so generate/map do not run. Does not start the app.",
+            subtask_prompt: "Parse the resolved absolute baseUrl from testcase/frontend/rag/context.md, reject production/non-http(s)/credential/query/fragment URLs, then probe it with curl HEAD and GET fallback (connect/max-time; no auth/cookie). 2xx/3xx => reachable and continue. Connection refused (curl 7) records errorClass=connection-refused and tells the operator to start the local app (scripts/serve.sh or npm start) then rerun from this node. 4xx/5xx/DNS/timeout/TLS => blockedReason frontend-base-url-unreachable with a distinct errorClass. Missing curl => blockedReason curl-unavailable. Do not start the app. Fixture/reset remain soft guidance.",
+            shell: {
+                commands: [],
+                frontendTestEnvironmentProbe: {},
+                cwd: ".",
+                timeoutMs: 60000,
+            },
+        },
+        {
+            id: "generate-frontend-functional-cases-pi",
+            depends_on: ["materialize-frontend-test-execution-shell"],
+            role: "implementer",
+            executor: "pi",
+            toolProfile: "write",
+            complexity: "HIGH",
+            writePolicy: "exclusive",
+            writeGuardPolicy: "tools-only",
+            writeSet: caseDraftWriteSet,
+            allowedPaths: [...ragWriteSet, ...caseDraftWriteSet],
+            forbiddenPaths: forbidden,
+            outputContract: "Write executable Markdown frontend cases, index.md, and manifest.draft.json schemaVersion 1 only; the exclusive shell materializer promotes the validated draft to manifest.json. Do not write manifest.json or test source code.",
+            subtask_prompt: [
+                "Use skill playwright-cli-case-generator.",
+                "Read testcase/frontend/rag/standard-scenarios.v1.json and cover priority=must scenarios (or record GAP in coverage-map). Include ## 测试点 and ## 测试步骤 in each case.",
+                ...(uiAnchorsLedgerInstruction ? [uiAnchorsLedgerInstruction] : []),
+                "Read only testcase/frontend/rag/context.md, testcase/frontend/rag/coverage-map.md, and the draft case paths testcase/frontend/cases/FE-*.md, testcase/frontend/cases/index.md, and testcase/frontend/cases/manifest.draft.json. Write only those same draft paths. Do not write testcase/frontend/cases/manifest.json.",
+                "Generate Markdown cases, index.md and manifest.draft.json (schemaVersion 1; cases[] with caseId, casePath, dimension, acIds, evidenceDir).",
+                "HARD ID CONTRACT (do not confuse these):",
+                "- caseId / filename MUST be FE-<FEATURE>-<NNN>-<dimension> (example FE-LOGIN-001-core). NEVER use AC-FE-* as caseId or filename.",
+                "- acIds MUST list acceptance criteria only: AC-FE-* / AC-* from the declared task list (example AC-FE-001). NEVER put FE-* case ids into acIds.",
+                "- casePath MUST equal testcase/frontend/cases/<caseId>.md; evidenceDir MUST equal testcase/frontend/evidence/<caseId>/. Materialize will rewrite paths, but files must already use caseId filenames.",
+                `Declared acceptance ids for this task (use only these in acIds when non-empty): ${declaredAcIds.length > 0 ? declaredAcIds.join(", ") : "(none extracted - still use AC-* shape, never FE-* case ids)"}.`,
+                "dimensions: core|boundary|flow|backend only.",
+                "Prefer a small smoke suite (default max roughly 4-8 cases unless task frontendTest.maxCasesPerBatch is higher). Never invent unavailable API fields or credentials. Do not create pytest or Playwright source.",
+                "HARD playwright-cli-only: every browser step must use repo skill playwright-cli declared commands only. Forbidden: bare `playwright`, `npx playwright`, `playwright test`, `@playwright/test`, Node Playwright API, or generating Playwright/Pytest source. No fallback when playwright-cli is unavailable - case must instruct blocked evidence playwright-cli-unavailable.",
+                "Copy the resolved absolute baseUrl from testcase/frontend/rag/context.md after the environment probe has marked it reachable. Every browser start command must be exactly: playwright-cli open --browser=chrome <resolved-base-url-from-context.md> with that concrete URL. Never leave a base-url placeholder. Use default browser session only; never write -s=<case-id>.",
+                "HARD dynamic refs: executable playwright-cli lines must never contain an angle-bracket token such as <fresh-ref> or descriptive <...> placeholder. Use only shell-safe documentation placeholders `eX`, `eY`, ...; each means the real `eNN` ref parsed from the immediately preceding latest `snapshot`. Write a fresh snapshot before every element reference. eX/eY are never literal structured-tool arguments; a later snapshot invalidates prior refs, so never reuse stale refs.",
+                "HARD file-output argv: use canonical `--filename` only. Screenshot uses `playwright-cli screenshot --filename final.png` (a real ref may precede the flag); PDF uses `playwright-cli pdf --filename final.pdf`; snapshot without filename is response-only and a snapshot file uses `playwright-cli snapshot --filename snapshot.txt`. Never generate `playwright-cli screenshot <path>`, use `--path`, `--output`, or `--file`, or pass an output path as a positional target.",
+                "Each case must be independently reproducible with fixture/reset, UI reset, snapshot-before-ref, evidence write point under testcase/frontend/evidence/<case-id>/. If the isolated environment is unavailable, require writing blocked evidence before any browser command.",
+                "U/D data ownership (required for modify/delete): (1) Only mutate data whose ownership is proven by current login identity + observable UI/API owner fields - never by name/guessed id/list order alone. (2) If current user has no data, create tagged cleanable data in current-user context, then U/D, then cleanup+verify. (3) Else only task-authorized Mock, labeled as Mock (not real backend proof). (4) If ownership unverifiable and create/Mock unavailable: write blocked with blockedReason current-user-data-unavailable | data-ownership-unverifiable | safe-test-data-setup-unavailable - do not risk cross-user data. (5) Never touch other users, shared fixtures, production, or non-cleanable data.",
+            ].join("\n\n"),
+        },
+    ];
+    if (blockingReview) {
+        tasks.push({
+            id: "review-frontend-cases-pi",
+            depends_on: ["generate-frontend-functional-cases-pi"],
+            role: "reviewer",
+            executor: "pi",
+            complexity: "HIGH",
+            writePolicy: "read-only",
+            allowedPaths: [...ragWriteSet, ...casesWriteSet],
+            forbiddenPaths: forbidden,
+            outputContract: "First line VERDICT: pass or VERDICT: request-revision, followed by AC-to-case coverage and execution risk findings; no writes. request-revision blocks manifest materialization.",
+            subtask_prompt: "Review only the RAG package, frontend Markdown cases, and manifest.draft.json. Verify traceability, independent execution, safe data/environment handling, manifest correctness, session consistency, fixture/UI reset and fresh snapshot steps, and evidence requirements. Any Important or Critical finding requires VERDICT: request-revision. Browser execution is blocked unless this review passes.",
+        }, {
+            id: "revise-frontend-cases-pi",
+            depends_on: ["review-frontend-cases-pi"],
+            runIf: "$.nodes['review-frontend-cases-pi'].firstVerdictLine == 'VERDICT: request-revision'",
+            role: "implementer",
+            executor: "pi",
+            toolProfile: "write",
+            complexity: "HIGH",
+            writePolicy: "exclusive",
+            writeGuardPolicy: "tools-only",
+            writeSet: caseDraftWriteSet,
+            allowedPaths: [...ragWriteSet, ...caseDraftWriteSet],
+            forbiddenPaths: forbidden,
+            outputContract: "Apply the one permitted frontend case revision to FE-*.md, index.md, and manifest.draft.json only; the exclusive shell materializer remains the sole writer of manifest.json. No browser execution or evidence writes.",
+            subtask_prompt: "This is the only permitted case revision. Read the first review findings and the RAG package. Revise only testcase/frontend/cases/FE-*.md, testcase/frontend/cases/index.md, and testcase/frontend/cases/manifest.draft.json; preserve traceable AC mappings. Preserve the dynamic-ref contract: executable playwright-cli lines use only eX/eY-style shell-safe documentation placeholders, never <...>; each placeholder is resolved from the immediately preceding latest snapshot and stale refs are not reused. Do not write testcase/frontend/cases/manifest.json, execute a browser, or write evidence. HARD: Never delete case files; only edit in place or add missing cases. Preserve the full planned suite, index.md, and manifest.draft.json.",
+        }, {
+            id: "review-frontend-cases-final-pi",
+            depends_on: ["revise-frontend-cases-pi"],
+            runIf: "$.nodes['review-frontend-cases-pi'].firstVerdictLine == 'VERDICT: request-revision'",
+            role: "reviewer",
+            executor: "pi",
+            complexity: "HIGH",
+            writePolicy: "read-only",
+            allowedPaths: [...ragWriteSet, ...casesWriteSet],
+            forbiddenPaths: forbidden,
+            outputContract: "First line VERDICT: pass or VERDICT: request-revision after the single allowed case revision; no writes.",
+            subtask_prompt: "Perform the final frontend case review after the sole permitted revision. Apply the same traceability, isolation, manifest, reset, session, snapshot, and evidence checks. First verdict line must be exact; any Important or Critical finding requires request-revision. Do not write files.",
+        }, {
+            id: "final-frontend-case-review-gate-shell",
+            depends_on: [
+                "review-frontend-cases-pi",
+                "review-frontend-cases-final-pi",
+            ],
+            dependsPolicy: "all-or-condition-skip",
+            role: "verifier",
+            executor: "shell",
+            complexity: "LOW",
+            writePolicy: "read-only",
+            allowedPaths: [...ragWriteSet, ...casesWriteSet],
+            forbiddenPaths: forbidden,
+            outputContract: "Pass-only effective frontend case review gate; final review takes precedence when the revision branch ran.",
+            subtask_prompt: "Authorize checklist/manifest materialization only after the effective frontend case review passes.",
+            shell: {
+                commands: [],
+                verdictGate: {
+                    fromNodeId: "review-frontend-cases-final-pi",
+                    fallbackFromNodeIds: ["review-frontend-cases-pi"],
+                    accept: ["VERDICT: pass"],
+                    label: "effective frontend case review",
+                    lineMode: "first-verdict-line",
+                },
+                cwd: ".",
+                timeoutMs: 60000,
+            },
+        });
+    }
+    const checklistDependsOn = blockingReview
+        ? ["final-frontend-case-review-gate-shell"]
+        : ["generate-frontend-functional-cases-pi"];
+    tasks.push({
+        id: "checklist-and-materialize-manifest-shell",
+        depends_on: checklistDependsOn,
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "exclusive",
+        writeSet: casesWriteSet,
+        allowedPaths: [...ragWriteSet, ...casesWriteSet],
+        forbiddenPaths: forbidden,
+        outputContract: "Mechanical checklist then atomic manifest.json materialization; stdout one final JSON line {cases}.",
+        subtask_prompt: "Run deterministic checklist then materialize manifest.json from draft after optional blocking review.",
+        shell: {
+            commands: [],
+            frontendTestCaseManifest: {
+                maxCases: config.maxCasesPerBatch,
+            },
+            cwd: ".",
+            timeoutMs: 120000,
+        },
+    }, {
+        id: "execute-frontend-cases-map",
+        depends_on: ["checklist-and-materialize-manifest-shell"],
+        role: "verifier",
+        executor: "static",
+        complexity: "LOW",
+        writePolicy: "none",
+        allowedPaths: [],
+        forbiddenPaths: forbidden,
+        outputContract: "Serial aggregate of case execution summaries, evidence paths, tokens, and token-budget or executor blocked/failed cases.",
+        subtask_prompt: "Expand and execute the validated frontend case manifest serially. Child executor failures become case-level failed/blocked evidence so closeout can still run.",
+        static: { resultMarkdown: "Frontend case map expansion barrier." },
+        dynamicExpansion: {
+            type: "map_agent",
+            workflowNodeId: "execute-frontend-cases-map",
+            itemsFrom: "$.nodes['checklist-and-materialize-manifest-shell'].output.cases",
+            itemName: "case",
+            maxItems: config.maxCasesPerBatch,
+            maxExpandedNodes: config.maxCasesPerBatch,
+            childIdPrefix: "execute-frontend-case",
+            workspaceTemplate: "{{case.evidenceDir}}",
+            tolerateChildFailures: true,
+            tokenBudget: {
+                maxTokensPerCase: config.maxTokensPerCase,
+                maxTotalTokens: config.maxTotalTokens,
+            },
+            childTask: {
+                executor: "pi",
+                role: "implementer",
+                skills: ["playwright-cli"],
+                toolProfile: "write",
+                commandPolicy: {
+                    mode: "capability-allowlist",
+                    capabilities: ["playwright-cli"],
+                },
+                complexity: "MED",
+                writePolicy: "exclusive",
+                writeGuardPolicy: "tools-only",
+                allowedPaths: [
+                    "testcase/frontend/cases/{{case.caseId}}.md",
+                    "testcase/frontend/rag/context.md",
+                    "testcase/frontend/rag/coverage-map.md",
+                    `${evidenceRoot}/{{case.caseId}}/**`,
+                ],
+                forbiddenPaths: forbidden,
+                writeSet: [`${evidenceRoot}/{{case.caseId}}/**`],
+                outputContract: "Compact JSON <=1200 characters with case status, evidence paths, error summary, and tokens. Browser actions must use structured playwright_cli tool. Passed authority requires same-child ordered controller receipts: successful open → successful find → successful post-execution cleanup.",
+                subtaskPromptTemplate: [
+                    "Primary job: EXECUTE case {{case.caseId}} from {{case.casePath}} with skill playwright-cli (fresh Pi session; do not use /new). playwright-cli-only: never bare Playwright CLI/API/test runner; no fallback.",
+                    "Use the structured playwright_cli tool for every browser action. Do not request or search for bash. Do not execute raw shell commands. Translate each playwright-cli line in the case Markdown into one playwright_cli tool call ({command, args?, timeoutSeconds?}).",
+                    "1) Read the concrete baseUrl from testcase/frontend/rag/context.md; it has already passed the environment shell safety/reachability gate. Start browser ONLY via playwright_cli command=open with args [--browser=chrome, <that-concrete-baseUrl>] (default session only; no -s=). 2) Dynamic refs: eX/eY in case Markdown are documentation placeholders, never tool args. Immediately before every structured playwright_cli call that references an element, parse the current real eNN from the immediately preceding latest snapshot and pass only that real eNN; never send literal `eX`/`eY`. A new snapshot invalidates prior refs, so never reuse stale refs. File outputs are canonical: screenshot args [--filename, final.png] (or [e5, --filename, final.png] for a real target), PDF args [--filename, final.pdf], and snapshot writes a file only with [--filename, snapshot.txt]; snapshot without filename is response-only. Never use --path, --output, --file, or any output path as a positional target. Follow case steps with snapshot before element refs using only playwright_cli. A passed case requires this same child receipt order: successful open → successful find → controller post-execution cleanup. Only successful find is a meaningful assertion; snapshot, goto, screenshot, request/console, click/fill and other ordinary interactions cannot establish passed authority. 3) Only when preflight or playwright_cli tool explicitly fails may you write blocked evidence (blockedReason playwright-cli-unavailable | frontend-base-url-unreachable); never invent CLI-unavailable solely because bash is absent. Unique-control early stop: when an AC names a specific control that is absent from the first post-navigation snapshot after reaching the required state (and no setup-required gate appeared), do ONE find with the case's literal as evidence; if it returns 0 matches, record status=blocked with blockedReason unique-control-unavailable citing that single find - do NOT re-explore with alternative literals, repeated snapshots, navigation detours, or rerun loops. 4) For U/D: enforce current-user ownership / create-or-mock-or-blocked; never mutate other users' data.",
+                    "Always write {{case.evidenceDir}}execution.md and {{case.evidenceDir}}case-result.json with caseId={{case.caseId}}, status passed|failed|blocked, evidencePaths (relative under evidenceDir). blocked needs non-empty blockedReason. After writing, self-check the same contract; if self-check fails, rewrite both files as status=blocked blockedReason=invalid-evidence-shape (never leave missing/malformed evidence).",
+                    "Business failed/blocked is a recorded result, not a node failure. Close browser via playwright_cli command=close. Return compact JSON (<=1200 chars): {caseId,status,evidencePaths,errorSummary,tokens}.",
+                ].join("\n\n"),
+            },
+        },
+    });
+    let rerunDependency = "execute-frontend-cases-map";
+    for (let round = 1; round <= maxRerunAttempts; round += 1) {
+        const selectorId = round === 1
+            ? "select-frontend-rerun-candidates-shell"
+            : `select-frontend-rerun-candidates-round${round}-shell`;
+        const mapId = round === 1
+            ? "rerun-frontend-cases-map"
+            : `rerun-frontend-cases-round${round}-map`;
+        const candidateArtifact = round === 1
+            ? "rerun-candidates.json"
+            : `rerun-candidates-round${round}.json`;
+        const selectCommand = [
+            "const fs=require('fs'),path=require('path');",
+            "const manifestPath='testcase/frontend/cases/manifest.json';",
+            "if(!fs.existsSync(manifestPath)){process.stdout.write(JSON.stringify({cases:[]}));process.exit(0);}",
+            "const manifest=JSON.parse(fs.readFileSync(manifestPath,'utf8'));const cases=[];",
+            "for(const c of (manifest.cases||[])){const evidenceDir=(c.evidenceDir||('testcase/frontend/evidence/'+c.caseId+'/')).replace(/\\/+$/,'')+'/';const resultPath=path.join(evidenceDir,'case-result.json');const execPath=path.join(evidenceDir,'execution.md');let reason=null;let attempt=0;let missing=false;if(!fs.existsSync(resultPath)){missing=true;reason='missing-result-files';}else{try{const r=JSON.parse(fs.readFileSync(resultPath,'utf8'));attempt=Number(r.rerunAttempt||0)||0;if(r.status==='blocked')reason='blocked';if(r.status==='failed')reason='failed-retry';if(!r.status){missing=true;reason='missing-result-files';}}catch(_){missing=true;reason='missing-result-files';}}if(!fs.existsSync(execPath)&&reason!=='blocked'){missing=true;reason=reason||'missing-result-files';}const should=(reason==='blocked'||reason==='failed-retry'||missing)&&attempt<" + String(round) + ";if(should){cases.push({caseId:c.caseId,casePath:c.casePath||('testcase/frontend/cases/'+c.caseId+'.md'),evidenceDir,dimension:c.dimension||'core',acIds:c.acIds||[],rerunAttempt:attempt+1,reason:reason||'blocked'});}}",
+            `fs.mkdirSync('testcase/frontend/evidence',{recursive:true});fs.writeFileSync('testcase/frontend/evidence/${candidateArtifact}',JSON.stringify({schemaVersion:1,cases},null,2)+'\\n');process.stdout.write(JSON.stringify({cases}));`,
+        ].join("");
+        tasks.push({
+            id: selectorId,
+            depends_on: [rerunDependency],
+            role: "verifier",
+            executor: "shell",
+            complexity: "LOW",
+            writePolicy: "exclusive",
+            writeSet: ["testcase/frontend/evidence/**"],
+            allowedPaths: [...casesWriteSet, "testcase/frontend/evidence/**"],
+            forbiddenPaths: forbidden,
+            outputContract: `Stdout JSON {cases} for blocked or missing-result-file cases eligible for rerun round ${round}/${maxRerunAttempts}.`,
+            subtask_prompt: "Select frontend-test cases eligible for this bounded rerun round.",
+            shell: {
+                commands: [["node -e", JSON.stringify(selectCommand)].join(" ")],
+                cwd: ".",
+                timeoutMs: 120_000,
+            },
+        }, {
+            id: mapId,
+            depends_on: [selectorId],
+            role: "verifier",
+            executor: "static",
+            complexity: "LOW",
+            writePolicy: "none",
+            allowedPaths: [],
+            forbiddenPaths: forbidden,
+            outputContract: `Serial rerun round ${round}/${maxRerunAttempts} of blocked or missing-result frontend cases.`,
+            subtask_prompt: "Expand rerun candidates into serial browser case children.",
+            static: { resultMarkdown: `Frontend case rerun round ${round} map expansion barrier.` },
+            dynamicExpansion: {
+                type: "map_agent",
+                workflowNodeId: mapId,
+                itemsFrom: `$.nodes['${selectorId}'].output.cases`,
+                itemName: "case",
+                maxItems: config.maxCasesPerBatch,
+                maxExpandedNodes: config.maxCasesPerBatch,
+                childIdPrefix: `rerun-frontend-case-r${round}`,
+                workspaceTemplate: "{{case.evidenceDir}}",
+                tolerateChildFailures: true,
+                tokenBudget: {
+                    maxTokensPerCase: config.maxTokensPerCase,
+                    maxTotalTokens: config.maxTotalTokens,
+                },
+                childTask: {
+                    executor: "pi",
+                    role: "implementer",
+                    skills: ["playwright-cli"],
+                    toolProfile: "write",
+                    commandPolicy: { mode: "capability-allowlist", capabilities: ["playwright-cli"] },
+                    complexity: "MED",
+                    writePolicy: "exclusive",
+                    writeGuardPolicy: "tools-only",
+                    allowedPaths: [
+                        "testcase/frontend/cases/{{case.caseId}}.md",
+                        "testcase/frontend/rag/context.md",
+                        "testcase/frontend/rag/coverage-map.md",
+                        `${evidenceRoot}/{{case.caseId}}/**`,
+                    ],
+                    forbiddenPaths: forbidden,
+                    writeSet: [`${evidenceRoot}/{{case.caseId}}/**`],
+                    outputContract: "Compact JSON <=1200 characters with final case status, evidence paths, error summary, tokens, and rerunAttempt.",
+                    subtaskPromptTemplate: [
+                        "RERUN attempt {{case.rerunAttempt}} for {{case.caseId}} (reason={{case.reason}}). Rewrite the authoritative execution.md and case-result.json; its final status replaces the earlier case result.",
+                        "Primary job: EXECUTE case {{case.caseId}} from {{case.casePath}} with skill playwright-cli (fresh Pi session). Use structured playwright_cli only; headless open.",
+                        "Read the concrete baseUrl from testcase/frontend/rag/context.md and start via playwright_cli command=open with args [--browser=chrome, <that-concrete-baseUrl>]. Passed requires open → find → cleanup receipts.",
+                        "Unique-control early stop: if the first post-navigation snapshot lacks the control an AC names (and no setup-required gate appeared), one find returning 0 matches is sufficient evidence - write status=blocked blockedReason unique-control-unavailable instead of exploratory retries.",
+                        "Always write {{case.evidenceDir}}execution.md and {{case.evidenceDir}}case-result.json with caseId, status, evidencePaths, rerunAttempt={{case.rerunAttempt}}. Write fixed sections `### 执行摘要` and `### 实际执行步骤` to execution.md when available.",
+                    ].join("\n\n"),
+                },
+            },
+        });
+        rerunDependency = mapId;
+    }
+    tasks.push({
+        id: "finalize-frontend-test-result-shell",
+        depends_on: [
+            rerunDependency,
+        ],
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "exclusive",
+        writeSet: [`${evidenceRoot}/**`],
+        allowedPaths: ["testcase/frontend/cases/**", `${evidenceRoot}/**`],
+        forbiddenPaths: forbidden,
+        outputContract: "Evidence validation (advisory missing/malformed does not fail the node; hard-fail only path escape) then hash-bound frontend-test-result-v1. Node success means result-v1 was written, not that all cases passed.",
+        subtask_prompt: "Validate case evidence then materialize authoritative frontend-test-result-v1. Missing/malformed case evidence is advisory; only unsafe evidence paths hard-fail. Do not use Pi prose as input.",
+        shell: {
+            commands: [],
+            frontendTestResultFinalize: {},
+            cwd: ".",
+            timeoutMs: 120000,
+        },
+    });
+    tasks.push({
+        id: "frontend-test-reports-shell",
+        depends_on: ["finalize-frontend-test-result-shell"],
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "exclusive",
+        writeSet: ["testcase/frontend/reports/**"],
+        allowedPaths: ["testcase/frontend/**"],
+        forbiddenPaths: forbidden,
+        outputContract: "Deterministic L-5 (optional) plus main frontend-test-report.md/html from frontend-test-result-v1. Pipeline acceptance = result-v1 + main HTML.",
+        subtask_prompt: "Render operational reports from frontend-test-result-v1 only. Do not invent coverage. Main HTML is required; L-5 follows frontendTest.reports.l5.",
+        shell: {
+            commands: [],
+            frontendTestReports: { l5: enableL5Report },
+            cwd: ".",
+            timeoutMs: 120000,
+        },
+    });
+    if (strictOutcomeGate) {
+        tasks.push({
+            id: "frontend-test-result-outcome-gate-shell",
+            depends_on: [
+                "finalize-frontend-test-result-shell",
+                "frontend-test-reports-shell",
+            ],
+            role: "verifier",
+            executor: "shell",
+            complexity: "LOW",
+            writePolicy: "read-only",
+            allowedPaths: [],
+            forbiddenPaths: forbidden,
+            outputContract: "Optional quality gate: pass only when frontend-test-result-v1 is outcome=passed and integrationMode=real with 0 failed/blocked and no missing AC. Does not gate reports closeout.",
+            subtask_prompt: "Opt-in Delivery/Worker quality gate (frontendTest.strictOutcomeGate=true). Main reports do not depend on this node.",
+            shell: {
+                commands: [frontendTestOutcomeGate],
+                cwd: ".",
+                timeoutMs: 60000,
+            },
+        });
+    }
+    if (enableRetrospect) {
+        tasks.push({
+            id: "frontend-test-retrospect-pi",
+            depends_on: [
+                "finalize-frontend-test-result-shell",
+                "frontend-test-reports-shell",
+            ],
+            role: "closeout",
+            executor: "pi",
+            toolProfile: "write",
+            complexity: "MED",
+            writePolicy: "exclusive",
+            writeGuardPolicy: "tools-only",
+            writeSet: ["testcase/frontend/reports/**"],
+            allowedPaths: ["testcase/frontend/**"],
+            forbiddenPaths: forbidden,
+            outputContract: "Optional retrospective under testcase/frontend/reports/frontend-test-retrospect-<date>.md. Not required for pipeline acceptance.",
+            subtask_prompt: "Write optional frontend-test retrospective after result + reports. Do not recompute L-5. Pipeline success does not require this file.",
+        });
+    }
+    const globalConstraints = [
+        ...sources.taskConfig.hardConstraints,
+        ...STANDARD_GLOBAL_CONSTRAINTS,
+        "frontend-test-dag generates Markdown cases and browser evidence only; it must not generate pytest or Playwright test source code.",
+        "Each browser case runs serially in a fresh Pi execution boundary. Persist its evidence before starting the next case.",
+        "Use only the declared isolated test environment. Production URLs, real credentials, and unauthorized data are blocked.",
+        "Browser startup for generated cases must use the concrete non-production baseUrl written by retrieve-frontend-test-context-pi and validated reachable by materialize-frontend-test-execution-shell; generated operations stay in the default browser session and must not use unverified named-session flags.",
+        "Browser-tool preflight runs before any frontend-test Pi node; cli-only rollback, missing/incompatible Pi SDK custom-tool capability, missing verified playwright-cli launcher, or incompatible --help fails with zero Pi calls.",
+        "Browser case children use commandPolicy capability-allowlist playwright-cli and structured playwright_cli tool; playwright-cli stays capability-gated while ordinary writers have bash.",
+        "Passed cases require same-child ordered controller receipts: successful open → successful find → successful post-execution cleanup. Pre-start cleanup, snapshot/goto/screenshot/request/console and ordinary interactions are insufficient; missing or unordered receipts convert to blocked (browser-command-evidence-missing).",
+        "playwright-cli-only: generators and executors may call only skill-declared playwright-cli commands; bare playwright / npx playwright / @playwright/test / Playwright source are forbidden with no native Playwright fallback.",
+        "Environment preflight must parse the retrieve-authored context.md baseUrl, reject unsafe/non-production violations, and curl-probe it before generate; unreachable or curl-unavailable ends preflight as blocked (frontend-base-url-unreachable|curl-unavailable) so generate/map do not run.",
+        "U/D cases must prove current-user data ownership or create cleanable current-user data or authorized Mock; otherwise blocked (current-user-data-unavailable|data-ownership-unverifiable|safe-test-data-setup-unavailable) without cross-user mutation.",
+        "Token settings are post-case stop thresholds, never a hard provider token cap. Unstarted cases after a threshold are blocked: token-budget-exhausted.",
+        "Pipeline acceptance for frontend-test is frontend-test-result-v1 plus the main report under testcase/frontend/reports/frontend-test-report.html; case pass rate and outcome=passed are quality signals; retrospect is opt-in (frontendTest.reports.retrospect).",
+        blockingReview
+            ? "frontendTest.reviewMode=blocking: a frontend case review must emit VERDICT: pass before checklist/manifest materialization; request-revision blocks browser execution."
+            : "frontendTest.reviewMode is off|advisory by default: mechanical checklist-shell gates materialize/execute; LLM review is not a hard browser gate.",
+    ];
+    const spec = {
+        version: 3,
+        title: `Frontend test DAG: ${sources.taskConfig.title}`,
+        runtimeContract: GENERATED_DAG_RUNTIME_CONTRACT,
+        outputLanguage: sources.outputLanguage ?? DEFAULT_DAG_OUTPUT_LANGUAGE,
+        objective: extractObjective(sources.requirementMarkdown, sources.taskConfig.title),
+        successCriteria: extractSuccessCriteria(sources.requirementMarkdown, sources.taskId),
+        globalConstraints,
+        defaults: {
+            ...HYBRID_DEFAULTS,
+            skills: [],
+            writePolicy: "read-only",
+            // slim: large skill bodies + full source context cause Windows spawn ENAMETOOLONG
+            contextProfile: "slim",
+        },
+        skillsByRole: {
+            planner: [],
+            scout: ["playwright-cli"],
+            implementer: ["playwright-cli"],
+            reviewer: [],
+            verifier: ["playwright-cli"],
+            closeout: ["verification-before-completion"],
+        },
+        executorModels: sources.executorModelMatrix ?? DEFAULT_DAG_EXECUTOR_MODELS,
+        verifyStrategy: resolveDagVerifyStrategy(sources.taskConfig),
+        tasks,
+    };
+    applyFrontendTestLayoutToDagSpec(spec, layout);
+    applyDefaultReadOnlyRetryPolicy(spec);
+    stampGeneratedArtifactBindings(spec);
+    parseDagSpec(spec);
+    assertValidDagSpec(spec);
+    return spec;
+}
+export function applyFrontendTestLayoutToDagSpec(spec, layout) {
+    if (layout.isDefault) {
+        spec.frontendTestLayout = layout;
+        return;
+    }
+    const rewrite = (value) => applyFrontendTestLayoutToText(value, layout);
+    for (const task of spec.tasks) {
+        task.subtask_prompt = rewrite(task.subtask_prompt);
+        if (task.outputContract)
+            task.outputContract = rewrite(task.outputContract);
+        task.writeSet = task.writeSet?.map(rewrite);
+        task.allowedPaths = task.allowedPaths?.map(rewrite);
+        task.forbiddenPaths = task.forbiddenPaths?.map(rewrite);
+        if (task.dynamicExpansion?.childTask) {
+            const child = task.dynamicExpansion.childTask;
+            if (typeof child.subtaskPromptTemplate === "string") {
+                child.subtaskPromptTemplate = rewrite(child.subtaskPromptTemplate);
+            }
+            if (typeof child.outputContract === "string") {
+                child.outputContract = rewrite(child.outputContract);
+            }
+            if (Array.isArray(child.allowedPaths)) {
+                child.allowedPaths = child.allowedPaths.map((entry) => typeof entry === "string" ? rewrite(entry) : entry);
+            }
+            if (Array.isArray(child.writeSet)) {
+                child.writeSet = child.writeSet.map((entry) => typeof entry === "string" ? rewrite(entry) : entry);
+            }
+            if (Array.isArray(child.forbiddenPaths)) {
+                child.forbiddenPaths = child.forbiddenPaths.map((entry) => typeof entry === "string" ? rewrite(entry) : entry);
+            }
+        }
+        if (task.shell?.commands) {
+            task.shell.commands = task.shell.commands.map(rewrite);
+        }
+    }
+    spec.globalConstraints = spec.globalConstraints?.map(rewrite);
+    spec.successCriteria = spec.successCriteria?.map(rewrite);
+    spec.frontendTestLayout = layout;
+}
+export function allowedPathsCoverFrontendTestRoot(allowedPaths, testRoot) {
+    const probe = `${testRoot}/_layout_probe_`;
+    return allowedPaths.some((pattern) => pathMatchesPattern(testRoot, pattern) ||
+        pathMatchesPattern(probe, pattern));
+}