@tea-agent/loop-agent 0.44.0-next.7 → 0.44.0-next.9

package/dist/task/contract/schema.js

@@ -1,3 +1,4 @@
+import { capabilityBoundarySchema } from "../config-types.js";
 import { z } from "zod";
 import { backendTestConfigSchema, frontendOpenspecConfigSchema, taskKindSchema, taskVerifyCommandSchema, } from "../config-types.js";
 import { TASK_CONFIG_SCHEMA_VERSION, TASK_CONTRACT_CANONICALIZER_VERSION, TASK_CONTRACT_DRAFT_SCHEMA_VERSION, TASK_CONTRACT_PROJECTION_VERSION, TASK_CONTRACT_REF_SCHEMA_VERSION, } from "./constants.js";
@@ -84,14 +85,7 @@ export const taskContractDraftSchema = z
     })
         .strict())
         .optional(),
-    capabilityBoundary: z
-        .object({
-        allowed: z.array(z.string().min(1)).optional(),
-        forbidden: z.array(z.string().min(1)).optional(),
-        requiredClauses: z.array(z.string().min(1)).optional(),
-    })
-        .strict()
-        .optional(),
+    capabilityBoundary: capabilityBoundarySchema.optional(),
     interactionIds: z.array(z.string().min(1)).optional(),
     interviewAssessmentRef: z
         .object({

package/dist/task/frontend-preflight.js

@@ -2,7 +2,7 @@ import { mkdir, readFile } from "node:fs/promises";
 import path from "node:path";
 import { z } from "zod";
 import { executePiStep } from "../executors/pi-executor.js";
-import { resolveDagPiModelConfig } from "../executors/dag-pi-executor.js";
+import { resolveDagPiModelConfig } from "../executors/dag-pi/model-config.js";
 import { writeJsonAtomic } from "../infrastructure/harness/atomic-write.js";
 import { pathMatchesPattern } from "../shared/git-progress.js";
 import { loadHarnessManifest } from "../governance/harness.js";

package/dist/task/source-prepare/parse-intent.js

@@ -261,8 +261,37 @@ export function extractRequirementFactsFromMarkdown(markdown, options) {
     let current = { key: "other", lines: [] };
     sections.push(current);
     let acCounter = options?.acCounterStart ?? 1;
+    // Ids the source states explicitly anywhere in the document (as a bullet
+    // `- AC-002: …`, a `#### AC-002 …` heading, or a list/heading under a
+    // requirement section). Auto-numbering must not hand one of these ids to an
+    // unrelated unlabeled bullet: doing so silently REPLACES the authored
+    // criterion with the auto-assigned one, so the requirement the PRD actually
+    // stated disappears while the import still looks complete. That is how a
+    // `## 需求` list of AC-001..AC-004 became three acceptance bullets taken
+    // from `## 验收`, with AC-001/AC-002 overwritten and only AC-003/AC-004
+    // reported as dropped.
+    const explicitlyClaimedIds = new Set();
+    for (const line of lines) {
+        const heading = isAtxHeading(line);
+        if (heading) {
+            const embedded = parseEmbeddedAcHeading(heading.text);
+            if (embedded)
+                explicitlyClaimedIds.add(embedded.id);
+            continue;
+        }
+        const item = parseListItem(line);
+        if (!item)
+            continue;
+        const labeled = /^(AC[-_]?\d+)\s*[:：]/iu.exec(item);
+        if (labeled)
+            explicitlyClaimedIds.add(normalizeAcceptanceId(labeled[1]));
+    }
     const nextId = () => {
-        const id = `AC-${String(acCounter).padStart(3, "0")}`;
+        let id = `AC-${String(acCounter).padStart(3, "0")}`;
+        while (explicitlyClaimedIds.has(id)) {
+            acCounter += 1;
+            id = `AC-${String(acCounter).padStart(3, "0")}`;
+        }
         acCounter += 1;
         return id;
     };
@@ -277,7 +306,15 @@ export function extractRequirementFactsFromMarkdown(markdown, options) {
                     key: "acceptance",
                     lines: [`- ${embeddedAc.id}: ${embeddedAc.text}`],
                 });
-                current = { key: "other", lines: [] };
+                // The body under an embedded AC heading must not become an extra
+                // criterion, but it must not be thrown away either: the derived
+                // projection and the frontend shape classifier read requirement
+                // prose, so a capability signal stated only in the body (for
+                // example a required remote /api/… fetch) would otherwise be
+                // invisible at generation time and only resurface at
+                // post-Contract as `reshape-required`. Attribute the body to its
+                // heading instead.
+                current = { key: "acBody", lines: [], acBodyId: embeddedAc.id };
                 sections.push(current);
                 continue;
             }
@@ -295,6 +332,9 @@ export function extractRequirementFactsFromMarkdown(markdown, options) {
     const invariants = [];
     const openQuestions = [];
     const assumptions = [];
+    // Requirement ids that a requirement list loses when its first item is
+    // lifted into the Objective (see the objective branch below).
+    const droppedRequirementIds = [];
     for (const section of sections) {
         if (section.key === "objective" && !objective) {
             const paragraph = firstParagraph(section.lines);
@@ -324,6 +364,14 @@ export function extractRequirementFactsFromMarkdown(markdown, options) {
                     acceptanceCriteria.push(ac);
             }
         }
+        else if (section.key === "acBody") {
+            const body = section.lines.join("\n").trim();
+            if (!body || !section.acBodyId)
+                continue;
+            const owner = acceptanceCriteria.find((criterion) => criterion.id === section.acBodyId);
+            if (owner)
+                owner.body = owner.body ? `${owner.body}\n${body}` : body;
+        }
         else if (section.key === "constraints") {
             invariants.push(...collectListItems(section.lines));
         }
@@ -343,6 +391,30 @@ export function extractRequirementFactsFromMarkdown(markdown, options) {
                 paragraph.length > OBJECTIVE_MAX_CHARS
                     ? paragraph.slice(0, OBJECTIVE_MAX_CHARS)
                     : paragraph;
+            // Requirement prose living in an unrecognized section (a bare
+            // `## 需求` is not a known heading alias) is scraped for the objective
+            // and then abandoned: the remaining AC-shaped bullets never reach
+            // `acceptanceCriteria`. A later `requirementOwnership` declaration
+            // referencing one of those ids then fails at plan finalize with
+            // `unknown requirement id`. Surface the ids so callers can warn.
+            //
+            // A bullet counts as dropped when it carries an AC id that no
+            // criterion claims. That includes the bullet scraped into the
+            // objective: it survives only as free objective prose, not as a
+            // requirement any plan fact can reference.
+            const accepted = new Set(acceptanceCriteria.map((criterion) => criterion.id));
+            for (const line of lines) {
+                const item = parseListItem(line);
+                if (!item)
+                    continue;
+                const demoted = /^(AC[-_]?\d+)\s*[:：]/iu.exec(item);
+                if (!demoted)
+                    continue;
+                const id = normalizeAcceptanceId(demoted[1]);
+                if (accepted.has(id))
+                    continue;
+                droppedRequirementIds.push(id);
+            }
         }
     }
     const acceptance = dedupeAcceptance(acceptanceCriteria);
@@ -357,6 +429,7 @@ export function extractRequirementFactsFromMarkdown(markdown, options) {
         assumptions: dedupeText(assumptions),
         sourceLabels: options?.sourceLabel ? [options.sourceLabel] : [],
         acceptanceConflicts: acceptance.conflicts,
+        droppedRequirementIds: [...new Set(droppedRequirementIds)],
     };
 }
 function dedupeText(items) {
@@ -373,6 +446,7 @@ function dedupeText(items) {
 }
 function dedupeAcceptance(items) {
     const byId = new Map();
+    const bodyById = new Map();
     const order = [];
     const conflicts = new Map();
     for (const item of items) {
@@ -380,12 +454,25 @@ function dedupeAcceptance(items) {
         const text = item.text.trim();
         if (!id || !text)
             continue;
+        const body = item.body?.trim();
         const existing = byId.get(id);
         if (existing === undefined) {
             byId.set(id, text);
+            if (body)
+                bodyById.set(id, body);
             order.push(id);
             continue;
         }
+        // A duplicate id keeps the first text (or records a conflict) but still
+        // accumulates the criterion body, which carries the requirement prose the
+        // derived projection and shape classifier depend on.
+        if (body) {
+            const prior = bodyById.get(id);
+            if (!prior)
+                bodyById.set(id, body);
+            else if (!prior.includes(body))
+                bodyById.set(id, `${prior}\n${body}`);
+        }
         if (existing !== text) {
             const texts = conflicts.get(id) ?? new Set([existing]);
             texts.add(text);
@@ -393,12 +480,16 @@ function dedupeAcceptance(items) {
         }
     }
     return {
-        items: order.map((id) => ({ id, text: byId.get(id) })),
+        items: order.map((id) => {
+            const body = bodyById.get(id);
+            return body ? { id, text: byId.get(id), body } : { id, text: byId.get(id) };
+        }),
         conflicts: [...conflicts].map(([id, texts]) => ({ id, texts: [...texts] })),
     };
 }
 export function mergeAcceptanceCriteria(parts) {
     const byId = new Map();
+    const bodyById = new Map();
     const order = [];
     for (const group of parts) {
         for (const item of group) {
@@ -411,16 +502,29 @@ export function mergeAcceptanceCriteria(parts) {
                 order.push(id);
             }
             byId.get(id)?.add(text);
+            // Bodies accumulate across documents; a conflict on the statement
+            // text must not discard the prose that carries the requirement's
+            // substance.
+            const body = item.body?.trim();
+            if (body) {
+                const prior = bodyById.get(id);
+                if (!prior)
+                    bodyById.set(id, body);
+                else if (!prior.includes(body))
+                    bodyById.set(id, `${prior}\n${body}`);
+            }
         }
     }
     const conflicts = [];
     const items = [];
     for (const id of order) {
         const texts = [...(byId.get(id) ?? [])];
+        const body = bodyById.get(id);
         if (texts.length === 1) {
             const [onlyText] = texts;
-            if (onlyText !== undefined)
-                items.push({ id, text: onlyText });
+            if (onlyText !== undefined) {
+                items.push(body ? { id, text: onlyText, body } : { id, text: onlyText });
+            }
         }
         else if (texts.length > 1) {
             conflicts.push({ id, texts });
@@ -536,6 +640,21 @@ export function parseVerifyTimeoutFlag(raw) {
     }
     return { label, timeoutMs };
 }
+/** Parse `<label>:<static|behavior>` for `--verify-lane`. Declaring the lane
+ * overrides text classification; it is the operator's escape hatch for a
+ * command that provably cannot emit a test report. */
+export function parseVerifyLaneFlag(raw) {
+    const idx = raw.indexOf(":");
+    if (idx <= 0 || idx === raw.length - 1) {
+        throw new Error(`invalid --verify-lane value "${raw}"; expected <label>:<static|behavior>, e.g. --verify-lane "repo check:static"`);
+    }
+    const label = raw.slice(0, idx).trim();
+    const mode = raw.slice(idx + 1).trim().toLowerCase();
+    if (mode !== "static" && mode !== "behavior") {
+        throw new Error(`invalid --verify-lane value "${raw}"; lane must be "static" or "behavior"`);
+    }
+    return { label, mode };
+}
 export function parseAcceptanceFlag(raw) {
     const idx = raw.indexOf(":");
     if (idx <= 0 || idx === raw.length - 1) {

package/dist/task/source-prepare/prepare.js

@@ -1,3 +1,4 @@
+import { observeSourceExecution } from "./source-execution.js";
 import { randomUUID } from "node:crypto";
 import { lstat, readFile } from "node:fs/promises";
 import path from "node:path";
@@ -463,6 +464,9 @@ function emptyObservedHashPlaceholder() {
  * No LLM. Production md writes only via applyTaskContract projection.
  */
 export async function prepareTaskSource(input) {
+    return observeSourceExecution({ repoRoot: input.repoRoot, taskId: input.taskId, taskKind: input.flags.taskKind, phase: "prepare", dryRun: input.mode === "dry-run", inputIdentity: { intent: input.intent, flags: input.flags } }, () => prepareTaskSourceInExecution(input));
+}
+async function prepareTaskSourceInExecution(input) {
     const { repoRoot, taskId } = input;
     const contractPaths = getTaskContractPaths(repoRoot, taskId);
     const state = await observeTaskContractState(repoRoot, taskId);
@@ -798,13 +802,14 @@ export async function prepareTaskSource(input) {
     let ledgerSummary;
     const hasAuthoritativeImportedDocs = Boolean(hasImportedPrd &&
         sourceIntegrity?.parseableDocuments.some((doc) => doc.role === "requirement" || doc.role === "acceptance"));
-    // Frontend tasks created from text still need the same source-fidelity
+    // Frontend tasks created from text or structured drafts need the same source-fidelity
     // contract as imported-PRD tasks.  In that case the projected requirement
     // document is the canonical, task-owned source that the DAG can bind to;
     // without it init-hybrid would silently emit a v1 binding and the first
     // frontend-contract node would fail before making a model call.
     if (built.draft.taskKind === "frontend-implementation" &&
         (hasAuthoritativeImportedDocs ||
+            input.intent.kind === "draft" ||
             (input.intent.kind === "facts" && Boolean(input.intent.text)))) {
         try {
             const authoritativeDocs = sourceIntegrity?.parseableDocuments.filter((doc) => (doc.role === "requirement" || doc.role === "acceptance") &&

package/dist/task/source-prepare/semantic-intake.js

@@ -1,3 +1,6 @@
+import { observeSourceExecution } from "./source-execution.js";
+import { openTaskSourceProviderBudget } from "./source-provider-budget.js";
+import { sha256OfCanonicalJson } from "../contract/hash.js";
 import { randomUUID } from "node:crypto";
 import { observeFrontendSession } from "../../workflows/dag/frontend-session-budget.js";
 /**
@@ -13,12 +16,12 @@ import { mkdir, readdir, readFile, unlink, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { z } from "zod";
 import { executePiStep } from "../../executors/pi-executor.js";
-import { resolveDagPiModelConfig } from "../../executors/dag-pi-executor.js";
+import { resolveDagPiModelConfig } from "../../executors/dag-pi/model-config.js";
 import { resolveExecutorModelMatrices } from "../../executors/model-routing.js";
 import { listPiSdkAvailableModels } from "../../executors/pi-sdk-executor.js";
 import { loadHarnessManifest } from "../../governance/harness.js";
 import { TASK_CONTRACT_DRAFT_SCHEMA_VERSION } from "../contract/constants.js";
-import { getTaskPaths } from "../runtime.js";
+import { getTaskPaths, loadTaskConfig } from "../runtime.js";
 import { detectProductArtifactMeta } from "./artifact-meta.js";
 import { filterPlaceholderPaths } from "./placeholder-paths.js";
 export const SEMANTIC_INTAKE_ARTIFACT_REL = "artifacts/intake/semantic-draft.json";
@@ -47,6 +50,7 @@ const engineeringRecommendationSchema = z
         label: z.string().min(1),
         command: z.string().min(1),
         timeoutMs: z.number().int().positive().optional(),
+        mode: z.enum(["static", "behavior"]).optional(),
     }))
         .optional(),
 })
@@ -521,6 +525,9 @@ async function writeAttemptMarker(repoRoot, taskId, payload) {
  * per advance invocation). Writes artifacts under taskDir/artifacts/intake/.
  */
 export async function runSemanticIntake(input) {
+    return observeSourceExecution({ repoRoot: input.repoRoot, taskId: input.taskId, taskKind: input.taskKind ?? input.flags.taskKind, phase: "semantic-intake", inputIdentity: { documents: input.documents, flags: input.flags, title: input.title } }, () => runSemanticIntakeInExecution(input));
+}
+async function runSemanticIntakeInExecution(input) {
     const paths = getTaskPaths(input.repoRoot, input.taskId);
     const intakeDir = path.join(paths.taskDir, "artifacts", "intake");
     await mkdir(intakeDir, { recursive: true });
@@ -593,6 +600,11 @@ export async function runSemanticIntake(input) {
                 message: "semantic intake has no MED/HIGH/LOW or Pi-supported models to try",
             };
         }
+        const config = await loadTaskConfig(input.repoRoot, input.taskId);
+        const taskKind = input.taskKind ?? input.flags.taskKind ?? config.taskKind;
+        const reserveProviderRequest = taskKind === "frontend-implementation"
+            ? await openTaskSourceProviderBudget({ repoRoot: input.repoRoot, taskId: input.taskId, maxProviderRequests: config.frontendRecovery?.maxProviderRequests ?? 1024 })
+            : undefined;
         // Complete text is already inline; attaching the same documents duplicates it.
         const prompt = await buildPrompt({
             taskId: input.taskId,
@@ -606,10 +618,11 @@ export async function runSemanticIntake(input) {
         for (const modelRef of queue) {
             try {
                 const result = await observeFrontendSession({
-                    phase: "semantic-intake", userMessage: "Structure the imported requirement documents into the required JSON only.", prompt, model: modelRef, taskId: input.taskId,
+                    phase: "semantic-intake", sourceDigest: sha256OfCanonicalJson(usableDocs), userMessage: "Structure the imported requirement documents into the required JSON only.", prompt, model: modelRef, taskId: input.taskId,
                     artifactPath: path.join(getTaskPaths(input.repoRoot, input.taskId).taskDir, "artifacts", "session-budget", `${randomUUID()}.json`),
                 }, observer => execute({
                     onAttemptObservation: observer,
+                    reserveProviderRequest,
                     attachedFiles: [],
                     modelConfig: resolveDagPiModelConfig(modelRef),
                     prompt,
@@ -642,6 +655,8 @@ export async function runSemanticIntake(input) {
                 }
                 lastFailure =
                     `${result.failureCategory}: ${result.stderr || result.assistantText}`.slice(0, 2000);
+                if (result.failureCategory === "budget_breach")
+                    break;
                 if (result.stopReason === "length" || ["context-overflow", "context-budget-exhausted"].includes(result.failureCategory)) {
                     lastFailure = `SEMANTIC_INTAKE_CAPACITY_EXHAUSTED: refine the complete source into independently reviewable documents; ${lastFailure}`;
                     break;

package/dist/task/source-prepare/source-execution.js

@@ -0,0 +1,65 @@
+import { z } from "zod";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { randomUUID } from "node:crypto";
+import { mkdir } from "node:fs/promises";
+import path from "node:path";
+import { writeJsonAtomic } from "../../infrastructure/harness/atomic-write.js";
+import { observeTaskContractState } from "../contract/observe.js";
+import { sha256OfCanonicalJson } from "../contract/hash.js";
+import { getTaskPaths, loadTaskConfig } from "../runtime.js";
+const context = new AsyncLocalStorage();
+export function currentSourceExecution(taskId) {
+    const current = context.getStore();
+    return current && current.taskId === taskId ? current.executionId : undefined;
+}
+/** An invocation identity, independent of request/session identities and of
+ * input equality. Persist before requests; a crash leaves an incomplete record. */
+export async function observeSourceExecution(input, execute) {
+    if (input.dryRun)
+        return execute();
+    let taskKind = input.taskKind;
+    if (!taskKind) {
+        try {
+            taskKind = (await loadTaskConfig(input.repoRoot, input.taskId)).taskKind;
+        }
+        catch {
+            return execute();
+        }
+    }
+    if (taskKind !== "frontend-implementation")
+        return execute();
+    // Preserve a missing-task result without creating a phantom artifact tree.
+    try {
+        await loadTaskConfig(input.repoRoot, input.taskId);
+    }
+    catch {
+        return execute();
+    }
+    const contract = async () => {
+        const state = await observeTaskContractState(input.repoRoot, input.taskId);
+        return { revision: state.ref?.revision ?? null, canonicalHash: state.ref?.canonicalHash ?? null, observedCanonicalHash: state.observedCanonicalHash ?? null };
+    };
+    const executionId = randomUUID();
+    const directory = path.join(getTaskPaths(input.repoRoot, input.taskId).taskDir, "artifacts/source-executions");
+    await mkdir(directory, { recursive: true });
+    const file = path.join(directory, `${executionId}.json`);
+    const initial = { schemaVersion: 1, executionId, taskId: input.taskId, phase: input.phase,
+        inputSha256: sha256OfCanonicalJson(input.inputIdentity), beforeContract: await contract(),
+        startedAt: new Date().toISOString(), completion: "incomplete" };
+    await writeJsonAtomic(file, initial, { repoRoot: input.repoRoot });
+    let outcome = "threw";
+    try {
+        const result = await context.run({ executionId, taskId: input.taskId }, execute);
+        outcome = result !== null && typeof result === "object" && "ok" in result ? result.ok === true ? "succeeded" : "failed" : "returned";
+        return result;
+    }
+    finally {
+        await writeJsonAtomic(file, { ...initial, completion: "complete", outcome, finishedAt: new Date().toISOString(), afterContract: await contract() }, { repoRoot: input.repoRoot });
+    }
+}
+const contractSnapshotSchema = z.object({ revision: z.number().int().nonnegative().nullable(), canonicalHash: z.string().regex(/^[a-f0-9]{64}$/).nullable(), observedCanonicalHash: z.string().regex(/^[a-f0-9]{64}$/).nullable() }).strict();
+export const completedSourceExecutionSchema = z.object({
+    schemaVersion: z.literal(1), executionId: z.string().uuid(), taskId: z.string().min(1), phase: z.enum(["prepare", "semantic-intake"]),
+    inputSha256: z.string().regex(/^[a-f0-9]{64}$/), beforeContract: contractSnapshotSchema, afterContract: contractSnapshotSchema,
+    startedAt: z.string().datetime(), finishedAt: z.string().datetime(), completion: z.literal("complete"), outcome: z.enum(["succeeded", "failed", "threw", "returned"]),
+}).strict().refine(value => Date.parse(value.finishedAt) >= Date.parse(value.startedAt));

package/dist/task/source-prepare/source-fidelity-pi.js

@@ -1,4 +1,5 @@
 import path from "node:path";
+import { openTaskSourceProviderBudget } from "./source-provider-budget.js";
 import { createHash, randomUUID } from "node:crypto";
 import { observeFrontendSession } from "../../workflows/dag/frontend-session-budget.js";
 /**
@@ -11,7 +12,7 @@ import { observeFrontendSession } from "../../workflows/dag/frontend-session-bud
  * - review：context-only / duplicate / conflict 的独立 reviewer（与 reconciler
  *   是不同调用阶段，最多一次有界修订，LEDGER_REVIEW_MAX_REVISIONS=1）。
  *
- * 模型队列镜像 semantic-intake.ts（MED→HIGH→LOW harness 档位 + Pi SDK 目录），
+ * 模型队列仅使用 MED→HIGH→LOW harness 显式档位，不追加 Pi SDK 全局目录，
  * 单次尝试沿用有界超时（SOURCE_FIDELITY_ATTEMPT_TIMEOUT_MS），工具面仅只读
  * read/grep/find/ls（无写工具）。所有模型输出经 validateOutput + zod 严格校验：
  * 无效 JSON/schema、越界 canonical ID、排除类 disposition 缺理由一律抛
@@ -21,7 +22,7 @@ import { observeFrontendSession } from "../../workflows/dag/frontend-session-bud
  */
 import { z } from "zod";
 import { executePiStep } from "../../executors/pi-executor.js";
-import { resolveDagPiModelConfig } from "../../executors/dag-pi-executor.js";
+import { resolveDagPiModelConfig } from "../../executors/dag-pi/model-config.js";
 import { resolveExecutorModelMatrices } from "../../executors/model-routing.js";
 import { listPiSdkAvailableModels } from "../../executors/pi-sdk-executor.js";
 import { loadHarnessManifest } from "../../governance/harness.js";
@@ -72,12 +73,12 @@ const reviewResponseSchema = z.object({
         .nullish(),
 });
 /**
- * 模型队列构建镜像 semantic-intake.ts：MED→HIGH→LOW（harness executors.pi）+
- * Pi SDK 目录（已认证优先、非 chat 模型过滤、额外模型上限沿用
- * SEMANTIC_INTAKE_MAX_EXTRA_MODELS）。队列空即 fail closed。
+ * Only configured MED→HIGH→LOW routes authorize a provider attempt. Global
+ * catalog availability or credentials do not authorize another model. An empty
+ * configured queue fails closed.
  */
 export function buildSourceFidelityModelQueue(input) {
-    return buildSemanticIntakeModelQueue(input);
+    return buildSemanticIntakeModelQueue({ harness: input.harness });
 }
 async function buildProductionModelQueue(repoRoot, listAvailableModels) {
     const manifest = await loadHarnessManifest(repoRoot);
@@ -248,13 +249,16 @@ export async function runProductionLedgerReconciliation(request, options) {
     const execute = options.executePi ?? executePiStep;
     const timeoutMs = options.timeoutMs ?? SOURCE_FIDELITY_ATTEMPT_TIMEOUT_MS;
     let lastFailure = "";
+    let attemptedModels = 0;
     for (const modelRef of queue) {
+        attemptedModels++;
         try {
             const result = await observeFrontendSession({
                 phase: "source-reconciliation", userMessage: "Reconcile the source fragment into the required JSON only.", sourceDigest: createHash("sha256").update(JSON.stringify(request)).digest("hex"), scopeIds: [request.fragment.id], prompt, model: modelRef, taskId: options.taskId, sink: options.observationSink,
                 artifactPath: options.taskId ? path.join(getTaskPaths(options.repoRoot, options.taskId).taskDir, "artifacts", "session-budget", `${randomUUID()}.json`) : undefined,
             }, observer => execute({
                 onAttemptObservation: observer,
+                reserveProviderRequest: options.reserveProviderRequest,
                 attachedFiles: [],
                 modelConfig: resolveDagPiModelConfig(modelRef),
                 prompt,
@@ -277,6 +281,8 @@ export async function runProductionLedgerReconciliation(request, options) {
             if (!result.ok) {
                 lastFailure =
                     `${result.failureCategory}: ${(result.stderr || result.assistantText).slice(0, 2000)}`;
+                if (result.failureCategory === "budget_breach")
+                    break;
                 if (result.stopReason === "length" || ["context-overflow", "context-budget-exhausted"].includes(result.failureCategory)) {
                     lastFailure = `SOURCE_FIDELITY_CAPACITY_EXHAUSTED: refine this complete source fragment without losing conditions; ${lastFailure}`;
                     break;
@@ -297,7 +303,7 @@ export async function runProductionLedgerReconciliation(request, options) {
                 `unknown: ${error instanceof Error ? error.message : String(error)}`.slice(0, 2000);
         }
     }
-    throw new LedgerReconciliationError(`source fidelity reconciliation pi failed after ${queue.length} model(s): ${lastFailure || "no attempt produced valid output"}`);
+    throw new LedgerReconciliationError(`source fidelity reconciliation pi failed after ${attemptedModels} model(s): ${lastFailure || "no attempt produced valid output"}`);
 }
 /**
  * 执行一次生产独立 review：模型队列串行尝试（默认真实 executePiStep），
@@ -315,13 +321,16 @@ export async function runProductionLedgerReview(request, options) {
     const execute = options.executePi ?? executePiStep;
     const timeoutMs = options.timeoutMs ?? SOURCE_FIDELITY_ATTEMPT_TIMEOUT_MS;
     let lastFailure = "";
+    let attemptedModels = 0;
     for (const modelRef of queue) {
+        attemptedModels++;
         try {
             const result = await observeFrontendSession({
                 phase: "source-review", userMessage: "Review the fragment disposition into the required JSON only.", sourceDigest: createHash("sha256").update(JSON.stringify(request)).digest("hex"), scopeIds: [request.fragment.id], prompt, model: modelRef, taskId: options.taskId, sink: options.observationSink,
                 artifactPath: options.taskId ? path.join(getTaskPaths(options.repoRoot, options.taskId).taskDir, "artifacts", "session-budget", `${randomUUID()}.json`) : undefined,
             }, observer => execute({
                 onAttemptObservation: observer,
+                reserveProviderRequest: options.reserveProviderRequest,
                 attachedFiles: [],
                 modelConfig: resolveDagPiModelConfig(modelRef),
                 prompt,
@@ -344,6 +353,8 @@ export async function runProductionLedgerReview(request, options) {
             if (!result.ok) {
                 lastFailure =
                     `${result.failureCategory}: ${(result.stderr || result.assistantText).slice(0, 2000)}`;
+                if (result.failureCategory === "budget_breach")
+                    break;
                 if (result.stopReason === "length" || ["context-overflow", "context-budget-exhausted"].includes(result.failureCategory)) {
                     lastFailure = `SOURCE_FIDELITY_CAPACITY_EXHAUSTED: refine this complete source fragment without losing conditions; ${lastFailure}`;
                     break;
@@ -363,7 +374,7 @@ export async function runProductionLedgerReview(request, options) {
                 `unknown: ${error instanceof Error ? error.message : String(error)}`.slice(0, 2000);
         }
     }
-    throw new LedgerReviewError(`source fidelity review pi failed after ${queue.length} model(s): ${lastFailure || "no attempt produced valid output"}`);
+    throw new LedgerReviewError(`source fidelity review pi failed after ${attemptedModels} model(s): ${lastFailure || "no attempt produced valid output"}`);
 }
 /**
  * 生产适配器工厂：返回 prepare 可注入的 reconcile executor（budgetChars=4000）
@@ -399,5 +410,7 @@ export async function resolveProductionSourceFidelityPi(input) {
     }
     if (effectiveTaskKind !== SOURCE_FIDELITY_TASK_KIND)
         return undefined;
-    return createProductionSourceFidelityPi({ repoRoot: input.repoRoot, taskId: input.taskId });
+    const config = await loadTaskConfig(input.repoRoot, input.taskId);
+    const reserveProviderRequest = await openTaskSourceProviderBudget({ ...input, maxProviderRequests: config.frontendRecovery?.maxProviderRequests ?? 1024 });
+    return createProductionSourceFidelityPi({ repoRoot: input.repoRoot, taskId: input.taskId, reserveProviderRequest });
 }