@tea-agent/loop-agent 0.44.0-next.7 → 0.44.0-next.9

package/dist/workflows/dag/frontend-plan-canary.js

@@ -1,19 +1,15 @@
+import { FRONTEND_PLAN_CANARY_SCENARIOS, readFrontendCanaryEvidence, compareFrontendPairIdentity, readFrontendRootObservation } from "./frontend-root-observation.js";
 import { readFrontendPlanCanaryRunMetrics, } from "./frontend-session-budget.js";
-export const FRONTEND_PLAN_CANARY_SCENARIOS = [
-    "missing-idle-loading-empty",
-    "loading-not-mounted",
-    "test-layer-does-not-prove-wiring",
-    "mock-claimed-as-real-integration",
-];
+export { FRONTEND_PLAN_CANARY_SCENARIOS } from "./frontend-root-observation.js";
 const reduction = (before, after) => before !== null && after !== null && before > 0 ? ((before - after) / before) * 100 : null;
 /** Compare two same-input runs. Missing observations fail the canary rather
  * than being interpreted as a zero-cost candidate. */
 export function evaluateFrontendPlanCanary(input) {
-    const required = { planSessionsPct: 30, planWallClockPct: 30, protocolRetryPct: 50, ...input.requiredReductions };
+    const required = { planSessionsPct: 30, planWallClockPct: 30, factReplacementPct: 50, ...input.requiredReductions };
     const reductions = {
         planSessionsPct: reduction(input.baseline.planSessions, input.candidate.planSessions),
         planWallClockPct: reduction(input.baseline.planWallClockMs, input.candidate.planWallClockMs),
-        protocolRetryPct: reduction(input.baseline.retries, input.candidate.retries),
+        factReplacementPct: reduction(input.baseline.factReplacements, input.candidate.factReplacements),
     };
     const failedChecks = [];
     if (reductions.planSessionsPct === null || reductions.planSessionsPct < required.planSessionsPct)
@@ -23,31 +19,85 @@ export function evaluateFrontendPlanCanary(input) {
     // A zero retry baseline is already optimal: a zero->zero candidate is not a
     // regression and must not block, while zero->positive or missing evidence
     // still fails closed.
-    const retriesAlreadyOptimal = input.baseline.retries === 0 && input.candidate.retries === 0;
+    const retriesAlreadyOptimal = input.baseline.factReplacements === 0 && input.candidate.factReplacements === 0;
     if (!retriesAlreadyOptimal &&
-        (reductions.protocolRetryPct === null || reductions.protocolRetryPct < required.protocolRetryPct)) {
-        failedChecks.push("protocol-retry-reduction");
+        (reductions.factReplacementPct === null || reductions.factReplacementPct < required.factReplacementPct)) {
+        failedChecks.push("fact-replacement-reduction");
     }
     for (const scenario of FRONTEND_PLAN_CANARY_SCENARIOS) {
         const result = input.scenarios[scenario];
         if (result !== "blocked" && result !== "reported")
             failedChecks.push(`regression:${scenario}`);
     }
-    return { pass: failedChecks.length === 0, reductions, failedChecks };
+    for (const metric of ["planModelRequests", "planTokens", "toolRejections", "transportRetries", "correctionSessions", "finalizeRejections"]) {
+        const before = input.baseline[metric], after = input.candidate[metric];
+        if (before == null || after == null || !Number.isFinite(before) || !Number.isFinite(after) || after < 0 || after > before)
+            failedChecks.push(`plan-cost:${metric}`);
+    }
+    const planPass = failedChecks.length === 0;
+    for (const metric of ["rootTokens", "rootReservedRequests"]) {
+        const before = input.baseline[metric], after = input.candidate[metric];
+        const allowance = metric === "rootTokens" ? 1.1 : 1;
+        if (before == null || after == null || !Number.isFinite(before) || !Number.isFinite(after) || before < 0 || after < 0 || after > before * allowance)
+            failedChecks.push(`root-cost:${metric}`);
+    }
+    for (const metric of ["dagWallClockMs", "designReviewRejectRate", "finalReviewDefectRate", "recoveryCount"]) {
+        const before = input.baseline[metric], after = input.candidate[metric];
+        if (before == null || after == null || !Number.isFinite(before) || !Number.isFinite(after) || after < 0 || after > before)
+            failedChecks.push(`quality:${metric}`);
+    }
+    return { pass: failedChecks.length === 0, planPass, reductions, failedChecks };
 }
 /** Read two frozen run directories and evaluate the same-input canary. Plan
- * cost metrics come from persisted session receipts; supplemental DAG/review/
- * recovery values come from each run's `frontend-plan-canary-metrics.json`.
+ * cost metrics come from persisted session receipts and optionally explicit root
+ * lineage. Free numeric supplements cannot establish quality evidence.
  * Missing observations surface as `null` and fail the evaluation, never as a
  * manufactured zero-cost improvement. */
 export async function compareFrontendPlanCanaryRuns(input) {
     const baseline = await readFrontendPlanCanaryRunMetrics(input.baselineRunDir);
     const candidate = await readFrontendPlanCanaryRunMetrics(input.candidateRunDir);
+    const lineageChecks = [];
+    const regressionEvidence = [];
+    const identities = {};
+    if (input.rootRuns) {
+        for (const [name, metrics, runId] of [["baseline", baseline, input.rootRuns.baselineRunId], ["candidate", candidate, input.rootRuns.candidateRunId]]) {
+            const root = await readFrontendRootObservation(input.rootRuns.workspaceRoot, runId);
+            const consumed = root.cumulativeBudget?.consumed;
+            Object.assign(metrics, root.plan, { dagWallClockMs: root.dagWallClockMs, recoveryCount: root.recoveryCount,
+                rootTokens: root.complete && consumed?.missingTokenNodeIds?.length === 0 ? consumed.tokens : null,
+                rootReservedRequests: root.complete ? consumed?.providerRequests ?? null : null });
+            if (!root.complete)
+                lineageChecks.push(`lineage:${name}`);
+            if (root.complete && input.evidence?.[name]) {
+                try {
+                    const evidence = await readFrontendCanaryEvidence({ workspaceRoot: input.rootRuns.workspaceRoot, runDir: name === "baseline" ? input.baselineRunDir : input.candidateRunDir, runIds: root.runIds, manifest: input.evidence[name] });
+                    identities[name] = evidence.identity;
+                    regressionEvidence.push(evidence.regressions);
+                    Object.assign(metrics, { designReviewRejectRate: evidence.designReviewRejectRate, finalReviewDefectRate: evidence.finalReviewDefectRate });
+                    if (!evidence.acceptancePassed)
+                        lineageChecks.push(`acceptance:${name}`);
+                }
+                catch (error) {
+                    lineageChecks.push(`evidence:${name}:${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            else
+                lineageChecks.push(`missing-evidence:${name}`);
+        }
+    }
+    else
+        lineageChecks.push("missing-root-lineage");
+    const scenarios = {};
+    for (const scenario of FRONTEND_PLAN_CANARY_SCENARIOS) {
+        scenarios[scenario] = regressionEvidence.length === 2 && regressionEvidence.every(evidence => evidence[scenario] === "blocked" || evidence[scenario] === "reported") ? "reported" : "not-observed";
+    }
     const evaluation = evaluateFrontendPlanCanary({
         baseline,
         candidate,
-        scenarios: input.scenarios,
+        scenarios,
         requiredReductions: input.requiredReductions,
     });
-    return { ...evaluation, baseline, candidate };
+    const identityChecks = compareFrontendPairIdentity(identities.baseline ?? {}, identities.candidate ?? {});
+    const failedChecks = [...evaluation.failedChecks, ...identityChecks, ...lineageChecks];
+    return { ...evaluation, pass: failedChecks.length === 0, failedChecks, baseline, candidate };
 }

package/dist/workflows/dag/frontend-plan-decision-contract.js

@@ -1,3 +1,4 @@
+import { repairAssertionSchema } from "./frontend-repair-assertions.js";
 import { z } from "zod";
 import { pathMatchesPattern } from "../../shared/git-progress.js";
 import { deterministicSha256 } from "./frontend-implementation-contract.js";
@@ -94,7 +95,7 @@ export function projectFrontendSafetyFacts(input) {
         const ids = sorted(group?.requirementIds ?? []);
         for (const id of ids)
             verificationByRequirement[id]?.push(focus.id);
-        return { id: focus.id, file: focus.file, commandId: focus.commandId, requirementIds: ids };
+        return { id: focus.id, file: focus.file, commandId: focus.commandId, requirementIds: ids, evidenceLevel: focus.evidenceLevel, ...(focus.boundary ? { boundary: focus.boundary } : {}) };
     });
     for (const id of requirementIds)
         verificationByRequirement[id] = sorted(verificationByRequirement[id]);
@@ -443,6 +444,8 @@ export function buildFrontendPlanRelationshipPatch(input) {
             : declaredStateNamesByGroup.get(focus.behaviorGroupId) ?? [];
         return {
             id: focus.id,
+            evidenceLevel: focus.evidenceLevel,
+            ...(focus.boundary ? { boundary: focus.boundary } : {}),
             commandId: focus.commandId,
             file: focus.file,
             requirementIds,
@@ -450,7 +453,7 @@ export function buildFrontendPlanRelationshipPatch(input) {
         };
     });
     const verificationTargetIds = new Set(verificationTargets.map(target => target.id));
-    // ---- requirements: derived group expansion + contract deliverable
+    // ---- requirements: preserve group placement separately from contract deliverable
     // obligations. Every requirement must keep a placement and at least one
     // verification target (both are guaranteed post-finalize because the
     // decision safety projection blocks unplaced / unverified requirements).
@@ -458,7 +461,7 @@ export function buildFrontendPlanRelationshipPatch(input) {
         const groupId = groupByRequirement.get(requirement.id);
         const placed = sorted(placementPathsById.get(groupId ?? "") ?? []);
         const deliverable = sorted(requiredByRequirement.get(requirement.id) ?? []);
-        const implementationTargets = sorted([...placed, ...deliverable]);
+        const implementationTargets = placed;
         const derivedVerificationTargetIds = sorted([...(vtIdsByGroup.get(groupId ?? "") ?? [])].filter(id => verificationTargetIds.has(id)));
         return {
             id: requirement.id,
@@ -613,12 +616,6 @@ export function buildFrontendPlanRelationshipPatch(input) {
         ...(stylingStrategy ? { stylingStrategy } : {}),
     };
 }
-const repairAssertionSchema = z.discriminatedUnion("check", [
-    z.object({ check: z.literal("file-absent"), token: z.string().min(1), source: z.string() }).strict(),
-    z.object({ check: z.literal("state-present"), token: z.string().min(1), source: z.string() }).strict(),
-    z.object({ check: z.literal("vt-changed"), token: z.string().min(1), source: z.string(),
-        expectedRequirementIds: z.array(z.string().min(1)).min(1) }).strict(),
-]);
 /** No heuristic fallback: absent structured expectations mean that semantic
  * closure must be decided by the subsequent design review. Invalid explicit
  * assertions throw rather than silently disabling a requested check. */
@@ -742,26 +739,21 @@ export function collapseDecisionEntriesByKind(kind, collected) {
     };
     const byKey = new Map();
     const keyless = [];
-    // Retracted tombstones remove their own key and every other record keyed to
-    // the same interaction — a wrong-named record cannot survive a rename (r19).
-    const retractedKeys = new Set();
-    for (const entry of collected) {
-        if (entry.retracted === true && typeof entry.interaction === "string") {
-            retractedKeys.add(entry.interaction);
-        }
-    }
+    // Chronological last-wins semantics also permit a later explicit correction
+    // after a tombstone. Never return the original tombstones as active rows.
     for (const entry of collected) {
-        if (entry.retracted === true)
-            continue;
         const key = keyOf(entry);
-        if (kind === "data-flow" && typeof entry.interaction === "string" && retractedKeys.has(entry.interaction))
+        if (entry.retracted === true) {
+            if (key)
+                byKey.delete(key);
             continue;
+        }
         if (key)
             byKey.set(key, entry);
         else
             keyless.push(entry);
     }
-    return byKey.size > 0 ? [...byKey.values(), ...keyless] : [...collected];
+    return [...byKey.values(), ...keyless];
 }
 /** Compile committed decision facts into a FrontendPlanDecisionContract. Each
  * fact's `entry` is already schema-shaped (the tool validates it); this collects

package/dist/workflows/dag/frontend-plan-progress.js

@@ -0,0 +1,92 @@
+import { assemblePlanPatchFromCommittedFacts } from "./frontend-committed-facts.js";
+import { createHash } from "node:crypto";
+const object = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
+const identity = (params) => {
+    const p = object(params), entry = object(p.entry ?? p.choice);
+    return String(p.id ?? p.scopeId ?? p.requirementId ?? entry.id ?? entry.name ?? entry.purpose ?? entry.state ?? entry.interaction ?? entry.boundary ?? "singleton");
+};
+/** Counts unresolved diagnostic identities, not tool activity. A changed
+ * rationale/read/heartbeat cannot resolve the same compiler diagnostic. */
+export function createFrontendPlanProgressGuard() {
+    let stop;
+    let terminal = false;
+    let failures = [];
+    const states = [];
+    const warned = new Set();
+    const listeners = new Set();
+    return {
+        readStop: () => stop,
+        acceptTerminal: () => { if (!stop) {
+            terminal = true;
+            failures = [];
+        } },
+        subscribe(listener) { listeners.add(listener); if (stop)
+            listener(); return () => { listeners.delete(listener); }; },
+        observe(tool, params, details, committed, effectiveDigest) {
+            if (stop)
+                return stop;
+            if (terminal)
+                return undefined;
+            const key = `${tool}:${identity(params)}`;
+            if (details?.ok === true) {
+                // Only a successful durable correction of the rejected identity (or
+                // a successful compile) resolves it. Unrelated writes do not reset it.
+                if (tool.startsWith("finalize_") && committed) {
+                    terminal = true;
+                    failures = [];
+                }
+                else if (committed)
+                    failures = failures.filter(f => f.key !== key);
+                return undefined;
+            }
+            const stage = typeof details?.validationStage === "string" ? details.validationStage : undefined;
+            const completed = Array.isArray(details?.completedValidationStages) ? details.completedValidationStages : [];
+            failures = failures.filter(f => !f.stage || !completed.includes(f.stage));
+            const error = String(details?.error ?? details?.code ?? "unknown tool failure").replace(/\s+/g, " ").trim();
+            const fingerprint = createHash("sha256").update(JSON.stringify([key, details?.code ?? null, error])).digest("hex");
+            failures.push({ fingerprint, key, stage });
+            const state = `${stage ?? key}:${fingerprint}:${effectiveDigest ?? "unknown"}`;
+            states.push(state);
+            if (states.length > 8)
+                states.shift();
+            failures = failures.slice(-12);
+            const tail = failures.slice(-6);
+            const repeated = failures.filter(f => f.fingerprint === fingerprint).length;
+            if (repeated >= 6 || (tail.length === 6 && new Set(tail.map(f => f.fingerprint)).size <= 2) || (states.length === 8 && new Set(states).size <= 2)) {
+                stop = { code: "FRONTEND_PLAN_NO_PROGRESS", fingerprint, error: `Unresolved repeated Plan diagnostic: ${error}` };
+                for (const listener of listeners)
+                    listener();
+                return stop;
+            }
+            if (repeated >= 3 && !warned.has(fingerprint)) {
+                warned.add(fingerprint);
+                return { code: "FRONTEND_PLAN_REPAIR_HINT", fingerprint, error: `The same diagnostic remains unresolved. Correct the named fact before repeating this call: ${error}` };
+            }
+            return undefined;
+        },
+    };
+}
+/** Effective facts for the existing node retry ladder. Replacement history and
+ * explanation-only edits must not look like a new implementation decision. */
+export function frontendPlanSemanticDigest(records) {
+    const current = new Map();
+    const strip = (value) => Array.isArray(value) ? value.map(strip) : value && typeof value === "object"
+        ? Object.fromEntries(Object.entries(value).filter(([key]) => !["rationale", "replaces"].includes(key)).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => [key, strip(item)])) : value;
+    const ordinary = records.some(r => ["plan-requirement", "plan-verification-target", "state-registry", "component-choice", "state-flow", "mock-api"].includes(String(object(r.fact).kind)));
+    if (ordinary) {
+        try {
+            const patch = assemblePlanPatchFromCommittedFacts(records.map(r => ({ ...r, fact: { ...object(r.fact), origin: "plan" } })));
+            if (patch)
+                return createHash("sha256").update(JSON.stringify(strip(patch))).digest("hex");
+        }
+        catch { /* An incomplete ledger still needs a stable diagnostic state. */ }
+    }
+    for (const record of records) {
+        if (record.phase !== "committed")
+            continue;
+        const fact = object(record.fact);
+        const key = `${fact.kind}:${identity(fact)}`;
+        current.set(key, strip(fact));
+    }
+    return createHash("sha256").update(JSON.stringify([...current].sort(([a], [b]) => a.localeCompare(b)))).digest("hex");
+}

package/dist/workflows/dag/frontend-recovery-plan.js

@@ -14,8 +14,7 @@ export const FRONTEND_RECOVERY_IMPORT_MANIFEST_REL_PATH = ".runtime/import-manif
 /** Staging directory prefix under `active/` for in-flight child materialization. */
 export const FRONTEND_RECOVERY_STAGING_PREFIX = ".frontend-recovery-staging-";
 export function deriveFrontendRecoveryFailureSource(result) {
-    if (result.failureSource === "frontend-contract-pi" ||
-        result.failureSource === "frontend-plan-pi" ||
+    if (result.failureSource === "frontend-plan-pi" ||
         result.failureSource === "frontend-design-policy-shell" ||
         result.failureSource === "frontend-implement-pi" ||
         result.failureSource === "frontend-verify-shell") {
@@ -62,14 +61,14 @@ function computeFrontendRecoveryPlanForSource(input) {
     // verification commands / trace. Resetting only verify + its descendants
     // would re-run the same failing checks against the same implementation, so
     // reset from implement: the recovery re-implements and re-verifies.
-    const resetRoot = input.failureSource === "frontend-contract-pi"
-        ? "frontend-contract-pi"
-        :
-            input.failureSource === "frontend-verify-shell"
-                ? "frontend-implement-pi"
-                : input.failureSource === "frontend-review-pi"
-                    ? "frontend-implement-pi"
-                    : input.failureSource;
+    const ownerRoots = { contract: "frontend-contract-pi", scout: "frontend-scout-pi", plan: "frontend-plan-pi", implementation: "frontend-implement-pi", "verification-config": "frontend-contract-pi" };
+    if (input.failureOwner && !ownerRoots[input.failureOwner])
+        throw new Error(`FRONTEND_RECOVERY_OWNER_UNSUPPORTED: ${input.failureOwner}; resolve the owning input before retrying`);
+    const resetRoot = input.failureOwner ? ownerRoots[input.failureOwner] :
+        input.failureSource === "frontend-verify-shell" || input.failureSource === "frontend-review-pi" ? "frontend-implement-pi" :
+            input.failureSource === "frontend-design-review-pi" ? "frontend-plan-pi" : input.failureSource;
+    if (!input.spec.tasks.some(task => task.id === resetRoot))
+        throw new Error(`FRONTEND_RECOVERY_PRODUCER_UNAVAILABLE: ${resetRoot}; this topology has no authorized producer, reproject the task contract instead of importing the same candidate`);
     const resetNodeIds = computeResetClosure(input.spec, resetRoot);
     const resetSet = new Set(resetNodeIds);
     const importedNodeIds = input.spec.tasks
@@ -81,6 +80,8 @@ function computeFrontendRecoveryPlanForSource(input) {
         parentRunId: input.parentRunId,
         requestId: input.requestId,
         failureSource: input.failureSource,
+        ...(input.failureOwner ? { failureOwner: input.failureOwner } : {}),
+        resetRootNodeId: resetRoot,
         resetNodeIds,
         importedNodeIds,
     };

package/dist/workflows/dag/frontend-recovery-run.js

@@ -298,6 +298,34 @@ async function casUpdateFrontendRecoveryState(parentRunDir, expectedRevision, de
 }
 async function materializeChildStaging(input) {
     const { cwd, parentRunDir, parentRunId, parentSpec, parentState, recovery, recoveryPlan, requestId, childRunId, stagingDir, createdAt, } = input;
+    // Phase 5: writer transient partial-write recovery resets the writer subtree
+    // (frontend-implement-pi) instead of the candidate producer; everything
+    // upstream is imported as verified parent facts.
+    let plan;
+    if (recoveryPlan) {
+        plan = recoveryPlan;
+    }
+    else if (recovery.failureSource) {
+        plan = computeFrontendRecoveryPlanForSource({
+            spec: parentSpec,
+            parentRunId,
+            requestId,
+            failureSource: recovery.failureSource,
+            failureOwner: recovery.failureOwner,
+        });
+    }
+    else {
+        const admissionRead = await readFrontendWriterAdmissionResult(parentRunDir);
+        if (!admissionRead.ok) {
+            throw new Error(admissionRead.reason);
+        }
+        plan = computeFrontendRecoveryPlan({
+            spec: parentSpec,
+            parentRunId,
+            requestId,
+            result: admissionRead.result,
+        });
+    }
     await prepareRunDir(stagingDir);
     // Design-review rejection must be visible to the reset planner. Recovery
     // children otherwise copy the old spec and only rerun design review, which
@@ -305,6 +333,8 @@ async function materializeChildStaging(input) {
     // findings into the child spec as ordinary rerun feedback.
     let childSpec = parentSpec;
     if (recovery.failureSource === "frontend-plan-pi" ||
+        recovery.failureSource === "frontend-design-review-pi" ||
+        plan.resetRootNodeId === "frontend-contract-pi" ||
         recovery.failureSource === "frontend-review-pi") {
         const designRecovery = parentState.terminalReason === "design-request-changes";
         const reviewRecovery = recovery.failureSource === "frontend-review-pi" ||
@@ -331,12 +361,13 @@ async function materializeChildStaging(input) {
             }
         }
         catch (error) {
-            if (designRecovery || reviewRecovery) {
-                throw new Error(`frontend recovery feedback unavailable: ${error instanceof Error ? error.message : String(error)}`);
-            }
+            throw new Error(`frontend recovery feedback unavailable: ${error instanceof Error ? error.message : String(error)}`);
         }
         if (feedback) {
             childSpec = { ...parentSpec, rerunFeedback: feedback };
+            if (plan.resetRootNodeId === "frontend-contract-pi") {
+                childSpec = { ...childSpec, tasks: childSpec.tasks.map(task => task.id !== plan.resetRootNodeId ? task : { ...task, subtask_prompt: `${task.subtask_prompt}\n\n<contract_recovery_diagnostic>\nParent run: ${parentRunId}\nSource node: ${feedback.sourceNodeId}\nRe-extract only from the unchanged frozen task source. These parent findings are diagnostic hypotheses, not new requirements or authorization. Do not import the parent's Plan as Contract facts. Report unresolved source ambiguity rather than inventing a decision.\n${feedback.feedbackText}\n</contract_recovery_diagnostic>` }) };
+            }
         }
         else if (designRecovery || reviewRecovery) {
             // A design/review rejection cannot be safely retried without its typed
@@ -346,33 +377,6 @@ async function materializeChildStaging(input) {
         }
     }
     await writeJsonVerified(stagingDir, "run.json", childSpec);
-    // Phase 5: writer transient partial-write recovery resets the writer subtree
-    // (frontend-implement-pi) instead of the candidate producer; everything
-    // upstream is imported as verified parent facts.
-    let plan;
-    if (recoveryPlan) {
-        plan = recoveryPlan;
-    }
-    else if (recovery.failureSource) {
-        plan = computeFrontendRecoveryPlanForSource({
-            spec: parentSpec,
-            parentRunId,
-            requestId,
-            failureSource: recovery.failureSource,
-        });
-    }
-    else {
-        const admissionRead = await readFrontendWriterAdmissionResult(parentRunDir);
-        if (!admissionRead.ok) {
-            throw new Error(admissionRead.reason);
-        }
-        plan = computeFrontendRecoveryPlan({
-            spec: parentSpec,
-            parentRunId,
-            requestId,
-            result: admissionRead.result,
-        });
-    }
     const { ranks } = topoSortToRanks(childSpec);
     const resetSet = new Set(plan.resetNodeIds);
     const importedSet = new Set(plan.importedNodeIds);
@@ -408,16 +412,16 @@ async function materializeChildStaging(input) {
     }
     // Canonical contract + writer-admission identity facts are copied alongside
     // the per-node facts so reset nodes can re-read them (AC-4).
-    const canonicalContract = await copyArtifactVerified({
+    const canonicalContract = plan.importedNodeIds.some(id => ["frontend-design-policy-shell", "frontend-contract-import-shell"].includes(id)) ? await copyArtifactVerified({
         parentRunDir,
         newRunDir: stagingDir,
         relativePath: resolveCanonicalContractRelPath(childSpec),
-    });
-    const writerAdmissionResult = await copyArtifactVerified({
+    }) : undefined;
+    const writerAdmissionResult = plan.importedNodeIds.includes("frontend-writer-admission-shell") ? await copyArtifactVerified({
         parentRunDir,
         newRunDir: stagingDir,
         relativePath: FRONTEND_WRITER_ADMISSION_RESULT_ARTIFACT,
-    });
+    }) : undefined;
     // Imported nodes keep their parent FINISHED record, so the run-owned files
     // their bodies wrote outside the node directory travel with them (smoke r31:
     // a review-triggered recovery reached review-context with no worktree
@@ -470,6 +474,7 @@ async function materializeChildStaging(input) {
         }
     }
     const childState = {
+        ...(parentSpec.sourceProviderBudget ? { sourceProviderBudget: structuredClone(parentSpec.sourceProviderBudget) } : {}),
         ...(parentState.budget ? { budget: structuredClone(parentState.budget) } : {}),
         ...(parentState.budgetLedger ? { budgetLedger: structuredClone(parentState.budgetLedger) } : {}),
         version: 1,
@@ -506,6 +511,8 @@ async function materializeChildStaging(input) {
             ...(recovery.failureSource
                 ? { failureSource: recovery.failureSource }
                 : {}),
+            ...(plan.failureOwner ? { failureOwner: plan.failureOwner } : {}),
+            ...(plan.resetRootNodeId ? { resetRootNodeId: plan.resetRootNodeId } : {}),
             revision: 0,
         },
         ...(parentState.evaluation
@@ -518,14 +525,8 @@ async function materializeChildStaging(input) {
         parentRunId,
         requestId,
         createdAt,
-        canonicalContract: {
-            relativePath: canonicalContract.destinationRelativePath,
-            sha256: canonicalContract.sha256,
-        },
-        writerAdmissionResult: {
-            relativePath: writerAdmissionResult.destinationRelativePath,
-            sha256: writerAdmissionResult.sha256,
-        },
+        ...(canonicalContract ? { canonicalContract: { relativePath: canonicalContract.destinationRelativePath, sha256: canonicalContract.sha256 } } : {}),
+        ...(writerAdmissionResult ? { writerAdmissionResult: { relativePath: writerAdmissionResult.destinationRelativePath, sha256: writerAdmissionResult.sha256 } } : {}),
         importedRunArtifacts,
         importedFacts,
     };
@@ -590,7 +591,8 @@ export async function stageRecoveryChild(options) {
                 recovery.recoveryRootRunId !== intent.recoveryRootRunId ||
                 recovery.attemptIndex !== intent.attemptIndex ||
                 recovery.continuationCount !== intent.continuationCount ||
-                recovery.failureSource !== intent.failureSource) {
+                recovery.failureSource !== intent.failureSource ||
+                recovery.failureOwner !== intent.failureOwner || recovery.resetRootNodeId !== intent.resetRootNodeId) {
                 throw new Error("frontend recovery intent replay binding mismatch");
             }
         }
@@ -620,7 +622,8 @@ export async function stageRecoveryChild(options) {
     if (options.recoveryPlan) {
         if (options.recoveryPlan.parentRunId !== parentRunId ||
             options.recoveryPlan.requestId !== requestId ||
-            options.recoveryPlan.failureSource !== recovery.failureSource) {
+            options.recoveryPlan.failureSource !== recovery.failureSource ||
+            options.recoveryPlan.failureOwner !== recovery.failureOwner || options.recoveryPlan.resetRootNodeId !== recovery.resetRootNodeId) {
             throw new Error("frontend recovery plan binding mismatch");
         }
         const expectedPlan = computeFrontendRecoveryPlanForSource({
@@ -628,9 +631,11 @@ export async function stageRecoveryChild(options) {
             parentRunId,
             requestId,
             failureSource: recovery.failureSource,
+            failureOwner: recovery.failureOwner,
         });
-        if (JSON.stringify(expectedPlan.resetNodeIds) !==
-            JSON.stringify(options.recoveryPlan.resetNodeIds) ||
+        if (expectedPlan.resetRootNodeId !== options.recoveryPlan.resetRootNodeId ||
+            JSON.stringify(expectedPlan.resetNodeIds) !==
+                JSON.stringify(options.recoveryPlan.resetNodeIds) ||
             JSON.stringify(expectedPlan.importedNodeIds) !==
                 JSON.stringify(options.recoveryPlan.importedNodeIds)) {
             throw new Error("frontend recovery plan drifted from parent DAG");

package/dist/workflows/dag/frontend-repair-assertions.js

@@ -0,0 +1,36 @@
+import { z } from "zod";
+export const repairAssertionSchema = z.discriminatedUnion("check", [
+    z.object({ check: z.literal("file-absent"), token: z.string().min(1).max(512), source: z.string().max(4096) }).strict(),
+    z.object({ check: z.literal("state-present"), token: z.string().min(1).max(512), source: z.string().max(4096) }).strict(),
+    z.object({ check: z.literal("vt-changed"), token: z.string().min(1).max(512), source: z.string().max(4096), expectedRequirementIds: z.array(z.string().min(1)).min(1).max(128) }).strict(),
+]);
+/** Invalid optional assertions never erase a blocking finding or its verdict. */
+export function sanitizeRepairAssertions(value) {
+    if (value === undefined)
+        return { assertions: [], diagnostics: [] };
+    if (!Array.isArray(value))
+        return { assertions: [], diagnostics: ["repairAssertions must be an array; semantic review remains required"] };
+    const assertions = [], diagnostics = [];
+    for (const [index, raw] of value.slice(0, 32).entries()) {
+        const parsed = repairAssertionSchema.safeParse(raw);
+        if (parsed.success)
+            assertions.push(parsed.data);
+        else
+            diagnostics.push(`repairAssertions[${index}] invalid; semantic review remains required`);
+    }
+    if (value.length > 32)
+        diagnostics.push("repairAssertions exceeds 32 items; excess items require semantic review");
+    return { assertions, diagnostics };
+}
+/** Review annotations cannot authorize deletion or invent requirements/states. */
+export function authorizeRepairAssertions(assertions, input) {
+    const files = new Set(input.parent.targets?.files ?? []);
+    const required = new Set([...(input.parent.targets?.requiredDeliverables ?? []), ...(input.requiredDeliverables ?? [])]);
+    const states = new Set(input.stateIds);
+    const targets = new Set(input.parent.verificationTargets?.map(target => String(target.id)) ?? []);
+    return assertions.flatMap(assertion => {
+        const permitted = assertion.check === "file-absent" ? files.has(assertion.token) && !required.has(assertion.token) :
+            assertion.check === "state-present" ? states.has(assertion.token) : targets.has(assertion.token) && assertion.expectedRequirementIds.every(id => input.requirementIds.includes(id));
+        return permitted ? [] : [`${assertion.check}: ${assertion.token} is outside frozen repair authority or contradicts a required delivery`];
+    });
+}

package/dist/workflows/dag/frontend-review-context.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
-import { readFile } from "node:fs/promises";
+import { readFile, lstat } from "node:fs/promises";
+import { readFileBoundarySafe } from "../../shared/path-safety.js";
 import path from "node:path";
 import { writeDagRunJsonArtifact } from "../../infrastructure/harness/artifact-store.js";
 import { formatFrontendWorktreeDiffStdout, runFrontendWorktreeDiffGate, } from "./frontend-worktree-diff.js";
@@ -244,6 +245,31 @@ function assertReviewEvidence(input) {
         throw new FrontendReviewContextFailure("review-context-verification-unbound", "frontend review context verification trace is not bound to a passing contract");
     }
 }
+/** Snapshot only exact behavior-test paths already named by the frozen contract. */
+export async function captureFrontendReviewTestSources(input) {
+    const sources = [];
+    for (const [index, file] of [...new Set(input.files)].entries()) {
+        const targetPath = path.resolve(input.workspaceRoot, file);
+        const exists = await lstat(targetPath).catch((error) => { if (error.code === "ENOENT")
+            return undefined; throw error; });
+        if (!exists) {
+            sources.push({ file, status: "unavailable", scopes: [] });
+            continue;
+        }
+        const bytes = await readFileBoundarySafe({ boundaryRoot: input.workspaceRoot, targetPath, label: "frontend review test source" });
+        const sha256 = createHash("sha256").update(bytes).digest("hex");
+        const text = bytes.toString("utf8");
+        const scopes = [];
+        // Small text slices bound each model input; all slices are retained.
+        for (let offset = 0; offset < Math.max(1, text.length); offset += 2000) {
+            const relative = `contracts/test-source-${index}-${offset / 2000}.json`;
+            await writeDagRunJsonArtifact(input.runDir, relative, { schemaVersion: 1, file, sourceSha256: sha256, offset, totalCharacters: text.length, text: text.slice(offset, offset + 2000) });
+            scopes.push({ path: relative, sha256: createHash("sha256").update(await readFile(path.join(input.runDir, relative))).digest("hex") });
+        }
+        sources.push({ file, status: "captured", sha256, scopes });
+    }
+    return sources;
+}
 export async function runFrontendReviewContextGate(input) {
     const contractRelativePath = "contracts/frontend-implementation-contract.json";
     let contractRaw;
@@ -284,6 +310,7 @@ export async function runFrontendReviewContextGate(input) {
     const verifyFailure = await readOptionalVerifyFailure(input.runDir);
     const lintAssessment = await readOptionalLintAssessment(input.runDir);
     const verificationEvidence = await readVerificationEvidence(input.runDir);
+    const testSources = await captureFrontendReviewTestSources({ ...input, files: parsedContract.data.verificationTargets.filter(target => target.mode === "behavior").map(target => target.file) });
     const cumulativeDiff = await captureCumulativeDiffContext({
         runDir: input.runDir,
         workspaceRoot: input.workspaceRoot,
@@ -320,6 +347,7 @@ export async function runFrontendReviewContextGate(input) {
         },
         verificationTrace,
         verificationEvidence,
+        testSources,
         // Protocol-legal lint vocabulary; `lintConfigured: false` tells the
         // reviewer that this task declares no lint surface at all, so
         // `unavailable` reads as "not applicable", not "missing evidence".