@tea-agent/loop-agent 0.44.0-next.12 → 0.44.0-next.14

package/dist/worker/console/static-src/operator-chat/use-stat-dialog.js

@@ -0,0 +1,95 @@
+import { useEffect, useLayoutEffect, useRef, useState } from "react";
+/** Viewport margin the placement clamp keeps (DSH PANEL_MARGIN parity). */
+const PANEL_MARGIN = 12;
+/** Distance between the trigger's top edge and the panel's bottom (DSH gap). */
+const PANEL_GAP = 8;
+/**
+ * Unplaced portal panel: hidden but laid out so the clamp measures real
+ * dimensions (DSH MEASURE_STYLE parity).
+ */
+export const MEASURE_STYLE = { visibility: "hidden", left: 0, top: 0 };
+/**
+ * Trigger-anchored, viewport-clamped fixed placement for a portaled panel
+ * (DSH useAnchoredPosition / useStatDialog parity): the panel floats above
+ * the trigger with PANEL_GAP and is clamped to PANEL_MARGIN inside the
+ * viewport, so a trigger near a window edge cannot push it off-screen.
+ * Re-measures on open, resize, and scroll (capture) while open.
+ */
+export function useAnchoredPosition(props) {
+    const { open, triggerRef, panelRef } = props;
+    const [pos, setPos] = useState(null);
+    const measure = () => {
+        const trigger = triggerRef.current;
+        const panel = panelRef.current;
+        if (!trigger || !panel)
+            return;
+        const triggerRect = trigger.getBoundingClientRect();
+        const panelRect = panel.getBoundingClientRect();
+        const vw = window.innerWidth;
+        const vh = window.innerHeight;
+        // Preferred side: above the trigger (composer pills sit at the bottom).
+        let top = triggerRect.top - panelRect.height - PANEL_GAP;
+        if (top < PANEL_MARGIN) {
+            top = Math.min(triggerRect.bottom + PANEL_GAP, vh - panelRect.height - PANEL_MARGIN);
+        }
+        top = Math.max(PANEL_MARGIN, Math.min(top, vh - panelRect.height - PANEL_MARGIN));
+        // Horizontal: align the panel's left edge with the trigger, clamp right.
+        let left = triggerRect.left;
+        if (left + panelRect.width + PANEL_MARGIN > vw) {
+            left = vw - panelRect.width - PANEL_MARGIN;
+        }
+        left = Math.max(PANEL_MARGIN, left);
+        setPos({ position: "fixed", top: `${Math.round(top)}px`, left: `${Math.round(left)}px` });
+    };
+    useLayoutEffect(() => {
+        if (!open) {
+            setPos(null);
+            return;
+        }
+        measure();
+        window.addEventListener("resize", measure);
+        window.addEventListener("scroll", measure, true);
+        return () => {
+            window.removeEventListener("resize", measure);
+            window.removeEventListener("scroll", measure, true);
+        };
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [open]);
+    return pos;
+}
+/**
+ * One trigger-anchored dialog seat: open state, viewport-clamped placement,
+ * outside-pointerdown close (portaled panel counts as inside), Escape close
+ * (DSH useStatDialog parity).
+ */
+export function useStatDialog() {
+    const [open, setOpen] = useState(false);
+    const rootRef = useRef(null);
+    const panelRef = useRef(null);
+    const pos = useAnchoredPosition({ open, triggerRef: rootRef, panelRef });
+    useEffect(() => {
+        if (!open)
+            return;
+        const onPointerDown = (event) => {
+            const target = event.target;
+            if (!target)
+                return;
+            if (rootRef.current?.contains(target) ||
+                panelRef.current?.contains(target)) {
+                return;
+            }
+            setOpen(false);
+        };
+        const onKeyDown = (event) => {
+            if (event.key === "Escape")
+                setOpen(false);
+        };
+        document.addEventListener("pointerdown", onPointerDown);
+        document.addEventListener("keydown", onKeyDown);
+        return () => {
+            document.removeEventListener("pointerdown", onPointerDown);
+            document.removeEventListener("keydown", onKeyDown);
+        };
+    }, [open]);
+    return { open, setOpen, rootRef, panelRef, pos };
+}

package/dist/worker/console/static-src/operator-chat/useRepoBrowser.js

@@ -16,6 +16,12 @@ export function repoHtmlPreviewUrl(origin, workspaceId, file) {
     return `${base}${REPO_HTML_PREVIEW_ROUTE_PREFIX}${encodeURIComponent(id)}/${segments.map(encodeURIComponent).join("/")}`;
 }
 function withHtmlPreviewUrl(preview, origin, workspaceId) {
+    if (preview.kind === "image") {
+        // Images load their bytes from the same workspace-scoped route that
+        // serves HTML relative assets; the JSON snapshot itself stays empty.
+        const previewUrl = repoHtmlPreviewUrl(origin, workspaceId, preview.path);
+        return previewUrl ? { ...preview, previewUrl } : preview;
+    }
     const language = preview.language.trim().toLowerCase();
     if (language !== "html" && language !== "htm")
         return preview;

package/dist/worker/console/workspace-context.js

@@ -41,6 +41,8 @@ import { TodoListRegistry } from "./chat/todos.js";
 import { GoalRegistry } from "./chat/goals.js";
 import { GoalRoundDriver } from "./chat/goal-round-driver.js";
 import { TerminalSessionRegistry } from "./chat/terminal-sessions.js";
+import { PetService } from "./chat/pet/pet-service.js";
+import { loadPetRegistry } from "./chat/pet/pet-registry.js";
 import { ScmService } from "./chat/scm-service.js";
 import { BrowserAutomationService } from "./chat/browser-automation.js";
 import { driveGoalRound, recoverDeferredTurns } from "./chat/routes.js";
@@ -306,6 +308,7 @@ export async function createWorkspaceContext(record, deps) {
         profileDir: appData.browserProfile,
         downloadsDir: appData.browserDownloads,
         screenshotsDir: appData.browserScreenshots,
+        workspaceId: record.workspaceId,
     });
     const chatRuntime = new ConsolePiRuntime({
         cwd: repoRoot,
@@ -323,6 +326,11 @@ export async function createWorkspaceContext(record, deps) {
     });
     let chatRouteDeps;
     const goalRoundDriver = new GoalRoundDriver((sessionId) => driveGoalRound(chatRouteDeps, sessionId));
+    // Operator pet (dsh-pet port): one service per workspace context. The
+    // registry reads pet manifests from the console static pets dir (shipped
+    // with the SPA build); persistence lands under the workspace app-data dir.
+    const petRegistry = loadPetRegistry(path.join(deps.staticDir, "pets"));
+    const petService = new PetService(chatEvents, petRegistry, appData.root);
     chatRouteDeps = {
         runtime: chatRuntime,
         store: chatStore,
@@ -334,6 +342,7 @@ export async function createWorkspaceContext(record, deps) {
         sddDataAlignment,
         goalRoundDriver,
         operationLinker: chatOperationLinker,
+        pet: petService,
         terminals: terminalRegistry,
         scm: scmService,
         browserAutomation,
@@ -386,6 +395,12 @@ export async function createWorkspaceContext(record, deps) {
                 return;
             disposed = true;
             scheduledGoalHost.stop();
+            try {
+                petService.dispose();
+            }
+            catch {
+                // best-effort
+            }
             try {
                 goalRoundDriver.dispose();
             }

package/dist/worker/console/workspace-initialization.js

@@ -70,7 +70,7 @@ export class WorkspaceInitializationService {
             }
             const surface = await this.jsonFile(".harness/init-surface.json");
             const harness = await this.jsonFile("harness.json");
-            if (surface && (surface.schemaVersion !== 1 || !surface.files || typeof surface.files !== "object" || Array.isArray(surface.files))) {
+            if (surface && (![1, 2].includes(Number(surface.schemaVersion)) || !surface.files || typeof surface.files !== "object" || Array.isArray(surface.files))) {
                 throw new Error("初始化记录不完整，请检查 .harness/init-surface.json");
             }
             if (!surface && !harness) {
@@ -83,10 +83,15 @@ export class WorkspaceInitializationService {
                 }
                 return snapshot;
             }
-            const report = await this.command(["init", "check-update", "--json"], "check");
+            const report = await this.command(["init", "check-update", "--legacy-audit", "--json"], "check");
             if (!["recorded", "inferred-baseline", "missing"].includes(String(report.surfaceState)) || typeof report.ok !== "boolean") {
                 throw new Error("初始化检查返回了未知状态");
             }
+            const coreState = String(report.coreState);
+            const migrationState = String(report.migrationState);
+            if (!["ready", "blocked", "error"].includes(coreState) || !["clean", "retained", "review-required", "in-progress", "failed"].includes(migrationState)) {
+                throw new Error("初始化检查缺少核心或迁移状态");
+            }
             const actions = entries(report.deterministicActions);
             const merges = entries(report.modelMergeTasks);
             const decisions = entries(report.humanDecisions);
@@ -98,17 +103,20 @@ export class WorkspaceInitializationService {
                     const detail = typeof item.reason === "string" ? item.reason : undefined;
                     const baseline = item.type === "bootstrap-surface";
                     const itemKind = baseline ? "confirmation" : kind;
+                    const legacyCandidate = typeof item.candidateId === "string";
                     const reason = baseline ? "缺少可靠的初始化记录，不能直接判断哪些内容可覆盖。"
-                        : kind === "safe-update" ? "此项可由程序安全更新，保留项目自定义内容。"
-                            : kind === "merge" ? "现有内容与新版初始化模板不同，需要保留项目配置后合并。"
-                                : /not a directory/.test(detail ?? "") ? "这里需要一个目录，但当前路径被文件占用。"
-                                    : /removed.*local changes/.test(detail ?? "") ? "新版不再使用此文件，但它包含本地修改，需要决定保留还是删除。"
-                                        : /target path.*already exists/.test(detail ?? "") ? "迁移目标已有不同内容，需要确认两份文件如何保留。"
-                                            : "此项无法安全自动处理，请先核对检查详情，再确定处理方式。";
+                        : legacyCandidate ? "这是历史初始化候选，但当前证据不足以自动删除。"
+                            : kind === "safe-update" ? "此项可由程序安全更新，保留项目自定义内容。"
+                                : kind === "merge" ? "现有内容与新版初始化模板不同，需要保留项目配置后合并。"
+                                    : /not a directory/.test(detail ?? "") ? "这里需要一个目录，但当前路径被文件占用。"
+                                        : /removed.*local changes/.test(detail ?? "") ? "新版不再使用此文件，但它包含本地修改，需要决定保留还是删除。"
+                                            : /target path.*already exists/.test(detail ?? "") ? "迁移目标已有不同内容，需要确认两份文件如何保留。"
+                                                : "此项无法安全自动处理，请先核对检查详情，再确定处理方式。";
                     pendingItems.push({ path: item.path, kind: itemKind, reason,
                         nextStep: itemKind === "safe-update" ? "点击更新按钮即可处理。"
                             : itemKind === "merge" ? "可将下方处理说明交给智能体合并；只有需求冲突时才需你确认。"
-                                : "将处理说明交给智能体检查；需要取舍时确认方案，处理后重新检查。",
+                                : legacyCandidate ? "在对话页手动调用 /skill:init-update；Skill 会解释证据并在需要时询问，不会直接删除文件。"
+                                    : "将处理说明交给智能体检查；需要取舍时确认方案，处理后重新检查。",
                         ...(detail ? { detail } : {}) });
                 }
             }
@@ -118,19 +126,20 @@ export class WorkspaceInitializationService {
                     reason: "当前模型配置或认证尚未就绪，更新文件不能解决此问题。",
                     nextStep: "检查模型定义及提供商认证，保留仍可用的模型配置，完成后重新检查。" });
             const canUpdate = pendingItems.some(item => item.kind === "safe-update");
-            const needsAttention = pendingItems.some(item => item.kind !== "safe-update") || !report.ok || report.surfaceState !== "recorded" && !canUpdate;
+            const needsAttention = pendingItems.some(item => item.kind !== "safe-update") || coreState !== "ready" || migrationState === "review-required" || migrationState === "failed" || report.surfaceState !== "recorded" && !canUpdate;
             if (needsAttention || canUpdate) {
                 const safeCount = pendingItems.filter(item => item.kind === "safe-update").length;
+                const coreReadyPrefix = coreState === "ready" ? "核心初始化已就绪；" : "";
                 const message = canUpdate
-                    ? `有 ${safeCount} 项可在此更新。${needsAttention ? "其余待处理项的原因和下一步见下方。" : "更新会保留项目自定义内容。"}`
-                    : "暂无可直接更新的内容。请按下方原因处理，完成后重新检查。";
+                    ? `${coreReadyPrefix}有 ${safeCount} 项可在此安全更新。${needsAttention ? "其余旧初始化待处理项见下方。" : "更新会保留项目自定义内容。"}`
+                    : `${coreReadyPrefix}暂无可直接更新的内容。请按下方原因处理，完成后重新检查。`;
                 if (!pendingItems.length)
                     pendingItems.push({ path: "初始化配置", kind: "confirmation",
                         reason: "检查尚未通过，但没有返回可自动更新的项目。",
                         nextStep: "复制处理说明交给智能体检查初始化记录，完成后重新检查。" });
-                return { ...this.snapshot(needsAttention ? "needs-attention" : "update-available", message, [...new Set(pendingItems.map(item => item.path))]), canUpdate, pendingItems };
+                return { ...this.snapshot(needsAttention ? "needs-attention" : "update-available", message, [...new Set(pendingItems.map(item => item.path))]), canUpdate, pendingItems, coreState: coreState, migrationState: migrationState };
             }
-            return this.snapshot("ready", "工作区配置已就绪");
+            return { ...this.snapshot("ready", migrationState === "retained" ? "核心初始化已就绪；旧初始化内容已按决定保留。" : "工作区配置已就绪"), coreState: coreState, migrationState: migrationState };
         }
         catch (error) {
             return this.snapshot("error", error instanceof Error ? error.message : "初始化状态检查失败");
@@ -182,10 +191,10 @@ export class WorkspaceInitializationService {
             if (before.state === "uninitialized") {
                 if (!model || !before.models?.some(item => item.reference === model))
                     throw new Error("请选择一个可用的初始模型；可在模型设置中完成认证后重新检查");
-                await this.command(["init", "--profile", "full", "--merge", "--client-recovery", "project", "--model", model, "--json"], "apply");
+                await this.command(["init", "--merge", "--model", model, "--json"], "apply");
             }
             else if (before.canUpdate) {
-                await this.command(["init", "update", "--apply-safe", "--client-recovery", "project", "--json"], "apply");
+                await this.command(["init", "update", "--apply-safe", "--legacy-audit", "--json"], "apply");
             }
             else if (before.state !== "ready")
                 throw new Error("没有可安全更新的内容；请查看待处理项的原因和下一步。");

package/dist/worker/delivery/package.js

@@ -48,12 +48,15 @@ const controllerIdentityEvidenceSchema = z.object({
     reportedVersion: z.string().min(1).optional(),
     packageFingerprint: z.object({
         algorithm: z.literal("sha256"),
-        scopeVersion: z.literal(1),
+        scopeVersion: z.literal(2),
         scope: z.tuple([
             z.literal("package.json"),
             z.literal("bin/**"),
             z.literal("dist/**"),
             z.literal("skills/**"),
+            z.literal("docs/templates/**"),
+            z.literal("resources/**"),
+            z.literal("resource-catalog.v1.json"),
         ]),
         value: z.string().regex(/^sha256:[a-f0-9]{64}$/),
         fileCount: z.number().int().positive(),

package/dist/worker/materialize/harness-task-lineage.js

@@ -5,6 +5,8 @@ import { sha256OfCanonicalJson } from "../../task/contract/hash.js";
 import { resolveLoopAgentProfile } from "../profile-mapping.js";
 import { mapRiskLevelToComplexity } from "../task-spec/complexity-mapping.js";
 import { resolveWorkflow, } from "../task-spec/workflow-routing.js";
+import { BACKEND_TEST_DEFAULT_TEST_ROOT } from "../../workflows/dag/backend-test-layout.js";
+import { FRONTEND_TEST_DEFAULT_TEST_ROOT } from "../../workflows/dag/frontend-test-layout.js";
 export const HARNESS_TASK_LINEAGE_MATERIALIZATION_VERSION = 1;
 export const MAX_HARNESS_TASK_ID_LENGTH = 96;
 export function slugifyIdentity(value) {
@@ -131,10 +133,10 @@ export async function resolveRevisionDigestsForTaskSpec(input) {
 /** Union TaskSpec allowed_paths with workflow-owned write roots. */
 export function expandAllowedPathsForWorkflow(workflow, allowedPaths, options) {
     const extras = workflow === "backend-test"
-        ? ["testcase/**", "docs/test-reports/**"]
+        ? [`${BACKEND_TEST_DEFAULT_TEST_ROOT}/**`, "docs/test-reports/**"]
         : workflow === "frontend-test"
             ? [
-                `${options?.frontendTestRoot ?? "testcase/frontend"}/**`,
+                `${options?.frontendTestRoot ?? FRONTEND_TEST_DEFAULT_TEST_ROOT}/**`,
                 "docs/test-reports/**",
             ]
             : [];

package/dist/worker/observe/static/console-theme.css

@@ -41,37 +41,37 @@
 :root[data-console-theme="daylight"] body[data-shell="observe-console"],
 :root[data-console-theme="daylight"] .inspect-workspace-root {
 	color-scheme: light;
-	--canvas: #eef0f2;
-	--canvas-soft: #f3f4f5;
-	--surface: #f9fafb;
-	--surface-muted: #e5e9ed;
-	--ink: #303b47;
-	--surface-ink: #303b47;
-	--body: #4b5867;
-	--muted: #5e6a78;
-	--muted-soft: #697583;
-	--muted-ink: #5e6a78;
-	--hairline: #dce1e6;
-	--hairline-strong: #b5bfc9;
-	--orange: #466581;
-	--orange-active: #365570;
-	--blue: #466581;
-	--brand: #706387;
-	--theme-action: #536f88;
-	--theme-action-hover: #466079;
+	--canvas: #f5f6f7;
+	--canvas-soft: #f9fafb;
+	--surface: #ffffff;
+	--surface-muted: #f1f3f5;
+	--ink: #0f1115;
+	--surface-ink: #0f1115;
+	--body: #61666b;
+	--muted: #5c636a;
+	--muted-soft: #8b9198;
+	--muted-ink: #5c636a;
+	--hairline: #ebeef2;
+	--hairline-strong: #d9dee6;
+	--orange: #4868b2;
+	--orange-active: #4176e6;
+	--blue: #4868b2;
+	--brand: #4176e6;
+	--theme-action: #4176e6;
+	--theme-action-hover: #679efe;
 	--theme-on-action: #ffffff;
-	--green: #3e735d;
-	--amber: #85632d;
-	--warn: #85632d;
-	--red: #a04f5c;
-	--peach: #dfe7ee;
-	--mint: #e0eae4;
-	--lavender: #e7e3ed;
+	--green: #15803d;
+	--amber: #b45309;
+	--warn: #b45309;
+	--red: #dc2626;
+	--peach: #edf3fe;
+	--mint: #e6faed;
+	--lavender: #e7edf7;
 	--gold: #927644;
-	--shadow-sm: 0 1px 2px rgb(35 45 58 / 4%);
-	--shadow-panel: 0 1px 2px rgb(35 45 58 / 3%), 0 6px 18px rgb(35 45 58 / 3%);
-	--shadow-soft: 0 8px 24px rgb(35 45 58 / 6%);
-	--shadow-lg: 0 16px 40px rgb(35 45 58 / 9%);
+	--shadow-sm: 0 1px 2px rgb(15 17 21 / 4%);
+	--shadow-panel: 0 1px 2px rgb(15 17 21 / 3%), 0 6px 18px rgb(15 17 21 / 3%);
+	--shadow-soft: 0 8px 24px rgb(15 17 21 / 6%);
+	--shadow-lg: 0 16px 40px rgb(15 17 21 / 9%);
 }
 
 /* Only the two added themes override component literals; original warm paper
@@ -172,3 +172,7 @@
 	.hljs-addition { color: var(--green); background: var(--mint); }
 	.hljs-deletion { color: var(--red); background: color-mix(in srgb, var(--red) 12%, var(--surface)); }
 }
+
+:root[data-console-theme="daylight"] {
+	.oc-bubble-user { background: var(--peach); }
+}

package/dist/worker/observe/static/operator-chrome.js

@@ -12,8 +12,7 @@
  */
 
 import { withWorkspaceQuery } from "./router.js";
-import { CONSOLE_THEMES, applyStoredConsoleTheme, setConsoleTheme } from "./console-theme.js";
-export { CONSOLE_THEMES } from "./console-theme.js";
+import { applyStoredConsoleTheme } from "./console-theme.js";
 
 export const OPERATE_TABS = Object.freeze([
 	{ id: "tasks", label: "任务", href: "/#/operate/tasks" },
@@ -711,46 +710,6 @@ export function mountOperatorChrome(root, config = {}) {
 
 		global.appendChild(el("span", "och-spacer"));
 
-		const themePicker = el("div", "och-theme");
-		const trigger = el("button", "och-theme-trigger");
-		trigger.type = "button";
-		trigger.title = "主题";
-		trigger.setAttribute("aria-label", "主题");
-		trigger.appendChild(makeIcon("theme"));
-		trigger.setAttribute("aria-expanded", "false");
-		const menu = el("div", "och-theme-menu");
-		menu.id = `${popoverId}-theme`;
-		menu.popover = "auto";
-		menu.setAttribute("role", "group");
-		menu.setAttribute("aria-label", "选择主题");
-		trigger.setAttribute("aria-controls", menu.id);
-		trigger.popoverTargetElement = menu;
-		menu.addEventListener("beforetoggle", (event) => {
-			if (event.newState !== "open") return;
-			const rect = trigger.getBoundingClientRect();
-			menu.style.top = `${rect.bottom + 6}px`;
-			menu.style.left = `${Math.max(8, Math.min(rect.right - 112, window.innerWidth - 120))}px`;
-		});
-		menu.addEventListener("toggle", (event) => {
-			trigger.setAttribute("aria-expanded", String(event.newState === "open"));
-		});
-		for (const theme of CONSOLE_THEMES) {
-			const option = el("button", "och-theme-option", theme.label);
-			option.type = "button";
-			option.dataset.theme = theme.id;
-			option.setAttribute("aria-pressed", String(theme.id === (document.documentElement.dataset.consoleTheme ?? "default")));
-			option.addEventListener("click", () => {
-				setConsoleTheme(theme.id);
-				for (const item of menu.children) {
-					item.setAttribute("aria-pressed", String(item.dataset.theme === theme.id));
-				}
-				menu.hidePopover();
-				trigger.focus();
-			});
-			menu.appendChild(option);
-		}
-		themePicker.append(trigger, menu);
-		global.appendChild(themePicker);
 
 		if (model.statusVisible && model.freshness) {
 			const fresh = el("span", "och-fresh");

package/dist/workflows/dag/backend-test-case-coverage-analysis.js

@@ -666,7 +666,9 @@ function scenarioTypes(body) {
 }
 function declaredScripts(body) {
     const automation = sectionBody(body, CASE_SECTION_ALIASES.automation);
-    return orderedUnique([...automation.matchAll(/testcase\/[A-Za-z0-9_./-]*test_[A-Za-z0-9_.-]*\.py/gi)]
+    // Accept both the canonical `.harness/testcase/` root and the legacy
+    // `testcase/` root so Markdown written by older runs still declares.
+    return orderedUnique([...automation.matchAll(/(?:\.harness\/)?testcase\/[A-Za-z0-9_./-]*test_[A-Za-z0-9_.-]*\.py/gi)]
         .map((match) => match[0].replaceAll("\\", "/")));
 }
 function automationLabelBody(body, labels) {

package/dist/workflows/dag/backend-test-layout.js

@@ -1,4 +1,5 @@
 import path from "node:path";
+import { canonicalTestArtifactRoot } from "./test-artifact-namespace.js";
 /**
  * Backend-test artifact layout (plan A: configurable test asset paths).
  *
@@ -8,13 +9,15 @@ import path from "node:path";
  * writers, gates, analyzers and the executor can never disagree about where
  * backend-test assets live.
  *
- * Default layout keeps the historical frozen contract:
- *   testcase/md/README.md
- *   testcase/md/<stem>.md
- *   testcase/test_<stem>.py
- *   pytest target: testcase/
+ * Default layout (since 2026-09-17) lives under the shared runtime namespace:
+ *   .harness/testcase/md/README.md
+ *   .harness/testcase/md/<stem>.md
+ *   .harness/testcase/test_<stem>.py
+ *   pytest target: .harness/testcase/
  */
-export const BACKEND_TEST_DEFAULT_TEST_ROOT = "testcase";
+export const BACKEND_TEST_DEFAULT_TEST_ROOT = canonicalTestArtifactRoot("backend-test");
+/** Historical pre-2026-09-17 default root, kept for reference/diagnostics. */
+export const BACKEND_TEST_LEGACY_DEFAULT_TEST_ROOT = "testcase";
 export const BACKEND_TEST_DEFAULT_MARKDOWN_REL = "md";
 export const BACKEND_TEST_DEFAULT_SCRIPT_REL = ".";
 /** Repository roots that must never be configured as backend-test test roots. */
@@ -54,6 +57,9 @@ function normalizeRelPosix(value, label) {
     if (segments.some((segment) => segment === ".." || segment === ".")) {
         throw new Error(`backendTest.${label} must not contain "." or ".." segments: ${value}`);
     }
+    if (segments.some((segment) => segment.startsWith("."))) {
+        throw new Error(`backendTest.${label} must not target hidden directories: ${value}`);
+    }
     if (segments.some((segment) => !/^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(segment))) {
         throw new Error(`backendTest.${label} contains unsafe path segments: ${value}`);
     }
@@ -77,6 +83,10 @@ function normalizeOptionalRel(value, fallback, label) {
     return normalizeRelPosix(value, label);
 }
 function assertTestRootAllowed(testRoot) {
+    // D3: the canonical harness test-artifact root is the ONLY hidden-root
+    // exception. Every other hidden or forbidden top segment stays rejected.
+    if (testRoot === BACKEND_TEST_DEFAULT_TEST_ROOT)
+        return;
     const topSegment = testRoot.split("/")[0];
     if (FORBIDDEN_TEST_ROOT_PREFIXES.some((forbidden) => topSegment === forbidden || topSegment.startsWith(`${forbidden}.`))) {
         throw new Error(`backendTest.testRoot must not target production/governance trees: ${testRoot}`);
@@ -85,6 +95,16 @@ function assertTestRootAllowed(testRoot) {
         throw new Error(`backendTest.testRoot must not target hidden directories: ${testRoot}`);
     }
 }
+function resolveTestRootInput(raw, canonical) {
+    // D3: only the EXACT canonical harness test-artifact root may be a hidden
+    // path. Compare after trimming + stripping trailing slashes so
+    // `.harness/testcase/` matches, but every other hidden spelling falls
+    // through to the fail-closed normalizer below.
+    const trimmed = raw.trim().replace(/\/+$/, "");
+    if (trimmed === canonical)
+        return canonical;
+    return normalizeRelPosix(raw, "testRoot");
+}
 /**
  * Resolve the frozen backend-test artifact layout from task config.
  * Throws on unsafe or ambiguous configuration (fail-closed).
@@ -92,7 +112,7 @@ function assertTestRootAllowed(testRoot) {
 export function resolveBackendTestLayout(config) {
     const testRoot = config?.testRoot === undefined || config?.testRoot === null
         ? BACKEND_TEST_DEFAULT_TEST_ROOT
-        : normalizeRelPosix(config.testRoot, "testRoot");
+        : resolveTestRootInput(config.testRoot, BACKEND_TEST_DEFAULT_TEST_ROOT);
     assertTestRootAllowed(testRoot);
     const markdownRel = config?.markdownRel === undefined || config?.markdownRel === null
         ? BACKEND_TEST_DEFAULT_MARKDOWN_REL

package/dist/workflows/dag/backend-test-markdown-workflow.js

@@ -787,7 +787,9 @@ function extractMappedPytestScripts(testCaseBody) {
     const automation = sectionBody(testCaseBody, CASE_SECTION_ALIASES.automationNotes);
     if (!automation.trim())
         return [];
-    return unique([...automation.matchAll(/`?(testcase\/[A-Za-z0-9_./-]*test_[A-Za-z0-9_.-]*\.py)`?/gi)]
+    // Accept both the canonical `.harness/testcase/` root and the legacy
+    // `testcase/` root so Markdown written by older runs still maps.
+    return unique([...automation.matchAll(/`?((?:\.harness\/)?testcase\/[A-Za-z0-9_./-]*test_[A-Za-z0-9_.-]*\.py)`?/gi)]
         .map((match) => match[1].replaceAll("\\", "/"))
         .filter((value) => !value.includes("..")));
 }

package/dist/workflows/dag/backend-test-pytest-collection.js

@@ -422,7 +422,10 @@ function classifyCollectionFailure(output, evidence) {
     const blockedPatterns = [
         [/No module named ['\"](?!testcase(?:\.|['\"]))/i, "missing-third-party-module"],
         [/pytest(?:_|-)plugin|pluggy|unknown hook|unrecognized arguments/i, "pytest-plugin-or-config"],
-        [/(?:apps|src|server|api)\/[A-Za-z0-9_./-]+\.py/i, "production-module-import"],
+        // Windows Python installs live under ...\WindowsApps\...; after slash
+        // normalization that path suffix must not read as an `apps/…py`
+        // production import (pytest >= 9 includes the importlib bootstrap frame).
+        [/(?<!Windows)(?:apps|src|server|api)\/[A-Za-z0-9_./-]+\.py/i, "production-module-import"],
         [/permission denied|access is denied|timed? out|not recognized as an internal|no such file or directory.*python/i, "environment-or-spawn"],
     ];
     for (const [pattern, kind] of blockedPatterns) {

package/dist/workflows/dag/final-verification.js

@@ -3,7 +3,8 @@ import os from 'node:os';
 import path from 'node:path';
 import { DEFAULT_DAG_EXECUTOR_MODELS } from './types.js';
 import { parseDagSpec } from './types.js';
-import { loadHarnessManifest } from '../../governance/harness.js';
+import { ProjectCapabilityScanner } from '../../governance/project-capability-scanner.js';
+import { loadNormalizedProjectConfig } from '../../governance/project-config.js';
 import { loadTaskConfig } from '../../task/runtime.js';
 import { resolveCliPath } from '../../shared/path-refs.js';
 const DEFAULT_OUTPUT_DIR = os.tmpdir();
@@ -22,14 +23,13 @@ export async function initFinalVerificationDagFromTask(repoRoot, taskId, options
     };
 }
 export async function buildFinalVerificationDagFromTask(repoRoot, taskId, options = {}) {
-    const [taskConfig, manifest] = await Promise.all([
-        loadTaskConfig(repoRoot, taskId),
-        loadHarnessManifest(repoRoot),
-    ]);
+    const taskConfig = await loadTaskConfig(repoRoot, taskId);
     const taskGlob = options.taskGlob ?? taskId;
     const closeoutPath = options.closeoutPath ?? path.join(os.tmpdir(), `${taskId}-closeout-report.md`);
-    const checkRepo = manifest.scripts.checkRepo ?? 'scripts/check-repo.sh';
-    const finalVerifyCommands = [`HARNESS_ALLOW_ACTIVE_DAG_RUNS=1 bash ${checkRepo}`];
+    const finalVerifyCommands = await resolveFinalVerificationCommands({
+        repoRoot,
+        taskCommands: taskConfig.verifyCommands.map((entry) => entry.command),
+    });
     const hasChangesetSignal = taskDeclaresReleaseImpact(taskConfig);
     const tasks = [
         shellTask({
@@ -142,12 +142,12 @@ export async function buildFinalVerificationDagFromTask(repoRoot, taskId, option
             executor: 'shell',
             contextProfile: 'slim',
             writePolicy: 'read-only',
-            skills: ['ai-engineering-context'],
+            skills: ['builtin:ai-engineering-context'],
         },
         executorModels: DEFAULT_DAG_EXECUTOR_MODELS,
         skillsByRole: {
-            verifier: ['verification-before-completion'],
-            closeout: ['loop-agent', 'verification-before-completion'],
+            verifier: ['builtin:verification-before-completion'],
+            closeout: ['builtin:loop-agent', 'builtin:verification-before-completion'],
         },
         tasks,
     });
@@ -178,3 +178,38 @@ function taskDeclaresReleaseImpact(taskConfig) {
     ].join('\n');
     return /changeset|release|publish|version/i.test(haystack);
 }
+export async function resolveFinalVerificationCommandSelection(input) {
+    if (input.taskCommands.length > 0) {
+        return {
+            source: 'task-contract',
+            commands: [...new Set(input.taskCommands)],
+        };
+    }
+    const verification = (await loadNormalizedProjectConfig(input.repoRoot)).verification;
+    const configured = verification.full.length > 0
+        ? verification.full
+        : verification.standard.length > 0
+            ? verification.standard
+            : verification.quick;
+    if (configured.length > 0) {
+        return {
+            source: 'project-config',
+            commands: [...new Set(configured)],
+        };
+    }
+    const scan = await new ProjectCapabilityScanner().scan(input.repoRoot);
+    const selected = scan.verification.commands.find((candidate) => candidate.id.endsWith(':test'))
+        ?? scan.verification.commands.find((candidate) => candidate.id.endsWith(':typecheck'))
+        ?? scan.verification.commands.find((candidate) => candidate.id.endsWith(':lint'))
+        ?? scan.verification.commands[0];
+    if (scan.verification.status !== 'ready' || !selected) {
+        throw new Error(`final verification is ${scan.verification.status}; add Task Contract verification or .loop-agent/project.json verification`);
+    }
+    return {
+        source: 'capability-scanner',
+        commands: [selected.command],
+    };
+}
+async function resolveFinalVerificationCommands(input) {
+    return (await resolveFinalVerificationCommandSelection(input)).commands;
+}