@tea-agent/loop-agent 0.44.0-next.8 → 0.44.0-next.9

package/dist/workflows/dag/init-hybrid.js

@@ -1,3 +1,7 @@
+import { sourceBudgetContractIdentity } from "../../application/evaluation/budget.js";
+import { sha256OfCanonicalJson } from "../../task/contract/hash.js";
+import { readTaskSourceProviderBudget, freezeTaskSourceUsage } from "../../task/source-prepare/source-provider-budget.js";
+import { inspectFrontendTestCommand } from "./frontend-test-execution-evidence.js";
 import { createHash } from "node:crypto";
 import { frontendExecutionPolicySchema } from "../../shared/frontend-execution-policy.js";
 import { access, readdir, readFile, realpath } from "node:fs/promises";
@@ -30,7 +34,7 @@ import { extractRequirementFactsFromMarkdown } from "../../task/source-prepare/p
 import { computeLedgerInputDigest, parseLedgerJson, recoverLedgerInputContract, validateRequirementLedger, } from "../../task/source-prepare/ledger.js";
 import { REQUIREMENT_LEDGER_FILE_NAME } from "../../task/contract/constants.js";
 import { dagHasWriterExecution } from "./task-contract-binding.js";
-import { BACKEND_TEST_MODULE_INDEX_HEADER, BACKEND_TEST_MODULE_SPLIT_REASONS, backendTestModuleIndexHeaderMarkdown, canonicalBackendTestModuleMarkdownPath, } from "./backend-test-plan-protocol.js";
+import { BACKEND_TEST_MODULE_INDEX_HEADER, BACKEND_TEST_MODULE_SPLIT_REASONS, } from "./backend-test-plan-protocol.js";
 import { DEFAULT_VERIFY_TIMEOUT_MS, resolveVerifyPreset, } from "../../executors/shell-verification.js";
 import { resolveExecutorModelMatrices } from "../../executors/model-routing.js";
 import { normalizeTaskRequirementText, resolveTaskDagTemplateSelection, } from "./task-demand-routing.js";
@@ -995,7 +999,7 @@ function extractFrontendVerifyCommandsFromMarkdown(input) {
             .trim()
             .replace(/^[-*]\s*(?:\[[ xX]\]\s*)?/, "")
             .trim();
-        const codeSpanCommands = Array.from(bulletless.matchAll(/`([^`]+)`/g), (match) => match[1].trim());
+        const codeSpanCommands = Array.from(bulletless.matchAll(/`([^`]+)`/g), (match) => match[1]?.trim() ?? "").filter(Boolean);
         const candidates = codeSpanCommands.length > 0 ? codeSpanCommands : [bulletless];
         for (const candidate of candidates) {
             if (isSupportedMarkdownVerifyCommand(candidate)) {
@@ -1037,8 +1041,8 @@ function extractFrontendMockVerifyCommandsFromMarkdown(input) {
         if (!/(?:mock|模拟服务|接口桩)/i.test(line))
             continue;
         for (const match of line.matchAll(/`([^`]+)`/g)) {
-            const commandText = match[1].trim();
-            if (!isSupportedMarkdownVerifyCommand(commandText))
+            const commandText = match[1]?.trim();
+            if (!commandText || !isSupportedMarkdownVerifyCommand(commandText))
                 continue;
             const command = markdownVerifyCommand(input.repoRoot, commandText);
             if (command)
@@ -1064,12 +1068,23 @@ function chooseFrontendVerifyCommands(input) {
 /**
  * Generation-time lane split for frontend verify commands. The mode itself
  * is owned by `classifyFrontendVerifyCommandText` (contract module); this
- * wrapper only preserves the local call shape.
+ * wrapper adds the generation-time policy for unrecognized commands.
+ *
+ * An unrecognized command has no inferable lane. Defaulting it to `behavior`
+ * would place it in the test-observed lane and block writer admission with an
+ * error no model-side change can clear, so generation fails loudly instead and
+ * asks the operator to declare the lane.
  */
-function classifyFrontendVerifyCommand(command) {
-    return classifyFrontendVerifyCommandText(command);
+function classifyFrontendVerifyCommand(command, label) {
+    const mode = classifyFrontendVerifyCommandText(command);
+    if (!mode) {
+        throw new Error(`verifyCommands[${label}]: unrecognized verification command ${JSON.stringify(command)}; declare its lane explicitly with mode: "static" or mode: "behavior", or use a recognized test runner such as \`npx vitest run\``);
+    }
+    return mode;
 }
-function buildExplicitFrontendVerifyCommands(taskConfig, repoRoot) {
+/** Exported for direct unit testing of lane assignment and the
+ * unrecognized-command guard; not part of the module's public runtime API. */
+export function buildExplicitFrontendVerifyCommands(taskConfig, repoRoot) {
     const staticCommands = [];
     const behaviorCommands = [];
     if (!repoRoot)
@@ -1081,7 +1096,22 @@ function buildExplicitFrontendVerifyCommands(taskConfig, repoRoot) {
             label: command.label,
             timeoutMs: command.timeoutMs,
         };
-        if (classifyFrontendVerifyCommand(command.command) === "static") {
+        // An explicit `mode` declaration wins over automatic classification. The
+        // operator knows the command's nature; the classifier only guesses from
+        // text. This matters because the behavior lane requires test-observation
+        // capability at writer admission, so a governance/lint script that text
+        // classification calls "behavior" blocks admission deterministically and
+        // no model-side fix can clear it. A declared command still runs and its
+        // exit code is still checked in whichever lane it lands.
+        // An undeclared command is classified by text, and
+        // `classifyFrontendVerifyCommand` fails at generation when that text
+        // carries no recognizable verification semantics. Failing there keeps the
+        // decision with the operator, where it is cheap to fix, instead of
+        // silently entering the test-observed behavior lane and surfacing much
+        // later as an unactionable `FRONTEND_TEST_OBSERVATION_INVALID`.
+        const mode = command.mode ??
+            classifyFrontendVerifyCommand(command.command, command.label);
+        if (mode === "static") {
             staticCommands.push(verifyCommand);
         }
         else {
@@ -1102,10 +1132,13 @@ function verifyCommandKey(command) {
     return [cwdKey, normalizedArgs.join("\0"), envKey].join("\u0001");
 }
 function normalizeVerifyCommandArgs(args) {
+    const [shell, flag, payload] = args;
     if (args.length === 3 &&
-        /^(?:bash|sh)(?:\.exe)?$/i.test(path.basename(args[0])) &&
-        args[1] === "-lc") {
-        const parsed = tokenizeSimpleShellCommand(args[2]);
+        shell !== undefined &&
+        payload !== undefined &&
+        /^(?:bash|sh)(?:\.exe)?$/i.test(path.basename(shell)) &&
+        flag === "-lc") {
+        const parsed = tokenizeSimpleShellCommand(payload);
         if (parsed)
             return normalizeVerifyCommandArgs(parsed);
     }
@@ -1483,6 +1516,7 @@ function deriveParallelScoutPaths(taskConfig) {
                 : allowed,
     };
 }
+const FRONTEND_NO_STATIC_VERIFICATION_MARKER = `node -e "console.log('${FRONTEND_NO_VERIFICATION_MARKER_TEXT}; static/behavior verification not-run')"`;
 /**
  * Resolve frontend verification fallbacks from the target project's own
  * package scripts. The DAG builder is also used by unit fixtures without a
@@ -1492,7 +1526,6 @@ function deriveParallelScoutPaths(taskConfig) {
  * at verify time, so such projects fall through to the tsc probe and may end
  * up with no fallback commands plus a generation-time advisory.
  */
-const FRONTEND_NO_STATIC_VERIFICATION_MARKER = `node -e "console.log('${FRONTEND_NO_VERIFICATION_MARKER_TEXT}; static/behavior verification not-run')"`;
 async function discoverFrontendFallbackVerifyCommands(repoRoot) {
     const genericFallback = {
         staticCommands: ["npm run typecheck", "npm run build"],
@@ -2559,26 +2592,12 @@ function resolveFrontendMockContextBlock(sources) {
         parts.push("Mock-backed frontend verification is required. Prefer the detected native service; otherwise the assessment may select an existing browser interception harness or reversible request adapter. Any handler, fixture, adapter, and UI changes stay in the single frontend-implement-pi writeSet.");
     }
     if (mode === "not-required") {
-        // The assessment sentence is deliberately split: every branch keeps the
-        // "select not-needed when Mock is intentionally skipped" guidance, because
-        // that is the correct action in both cases, and only the permissive
-        // "or select a safe Mock strategy if project evidence supports one" tail is
-        // withheld when the allow-list is frozen.
-        //
-        // Emitting both was a direct instruction conflict, and it cost a whole
-        // frontend run (dogfood R2): the model resolved it the permissive way, the
-        // typed tool accepted ten `native` records with ok:true, and the
-        // design-policy shell rejected the contract ~90s later, killing 8
-        // downstream nodes. The fix belongs here - stop contradicting ourselves -
-        // rather than in extra enforcement that would leave the model guessing.
-        const mockAssessment = "Generation-time evidence does not require Mock. The assessment must still use contract/scout evidence: select not-needed when Mock is intentionally skipped";
         if (frontendMockStrategyMustBeNotNeeded(sources)) {
-            parts.push(`${mockAssessment}.`);
-            parts.push('Auto mode has no confirmed project Mock capability or no deterministic Mock verification command. The structured contract must set mockApi.strategy to "not-needed". Keep the real request path as the default, record any unproved backend behavior as Real Integration Gap, and do not add Mock files or dependencies within this run.');
+            parts.push('Generation-time evidence does not require Mock. The assessment must still use contract/scout evidence: select not-needed when Mock is intentionally skipped. Auto mode has no confirmed project Mock capability or no deterministic Mock verification command. The structured contract must set mockApi.strategy to "not-needed". Keep the real request path as the default, record any unproved backend behavior as Real Integration Gap, and do not add Mock files or dependencies within this run.');
             parts.push('HARD CONSTRAINT (frozen at generation time): this DAG allows only mockApi.strategy "not-needed"; the prewrite gate rejects any other strategy. If project governance (openspec / ai_workspace / decision records, e.g. a DEC rule requiring native) demands Mock-backed verification, that is a generation-time contract gap, not a plan-revision defect: declare frontendMock.verifyCommands (or policy: "required") in task.json and regenerate the DAG.');
         }
         else {
-            parts.push(`${mockAssessment}, or select a safe Mock strategy if project evidence supports one.`);
+            parts.push("Generation-time evidence does not require Mock. The assessment must still use contract/scout evidence: select not-needed when Mock is intentionally skipped, or select a safe Mock strategy if project evidence supports one.");
         }
     }
     if (mode === "blocked") {
@@ -3063,7 +3082,7 @@ async function buildFrontendHybridDagFromTask(sources) {
         "- interactions[]: name, trigger, expectedBehavior, implementationTargets, verificationTargetIds",
         "- targets: routes, publicApiChanges (files are runtime-owned)",
         "- mockApi: strategy, productionDefaultOff, activation, endpoints[]",
-        "- verificationTargets[]: id (a stable id you choose, e.g. VT-001; it is not derived from test titles), commandId (frozen directory key), mode + commandLabel (runtime-resolved), file, requirementIds, uiStates, scope? (display-only)",
+        "- verificationTargets[]: id (stable target identity; execution binds commandId + file, never test titles), commandId (frozen directory key), mode + commandLabel (runtime-resolved), file, requirementIds, uiStates, scope? (display-only)",
         "- designEvidence: source, paths, conflicts; evidenceGaps[] (optional)",
         "- optional: stylingStrategy, uiComponentChoices[], dependencyPolicy, residualRisks[], realIntegrationGap",
         "- uiComponentChoices[]: purpose, component, decision (specified|reuse-existing|new), specReference { path, section, line } | null, rationale",
@@ -3146,14 +3165,52 @@ async function buildFrontendHybridDagFromTask(sources) {
         ...explicitFrontendVerifyCommands.behaviorCommands,
     ].map(verifyCommandKey));
     const adapterVerifyCommands = (sources.verifyCommands?.final ?? []).filter((command) => !explicitCommandKeys.has(verifyCommandKey(command)));
+    // Split adapter commands by lane BEFORE handing them to either lane. The
+    // same array used to be passed to both `chooseFrontendVerifyCommands` calls,
+    // so every adapter command entered static and behavior at once. The behavior
+    // lane is test-observed at writer admission, so a governance script from
+    // harness.json (`bash scripts/check-repo.sh`) demanded test-report
+    // capability it can never have and blocked admission deterministically.
+    // Adapter commands carry no declared lane, so classify them from their text;
+    // an explicit declaration still wins because it is chosen earlier.
+    //
+    // A declared task verifier owns this task's verification boundary and the
+    // adapter array is discarded for both lanes, so an unclassifiable adapter
+    // entry is harmless then and must not fail generation.
     const hasDeclaredFrontendVerification = explicitFrontendVerifyCommands.staticCommands.length > 0 ||
         explicitFrontendVerifyCommands.behaviorCommands.length > 0 ||
         parsedFrontendVerifyCommands.staticCommands.length > 0 ||
         parsedFrontendVerifyCommands.behaviorCommands.length > 0;
+    const adapterStaticCommands = [];
+    const adapterBehaviorCommands = [];
+    for (const command of adapterVerifyCommands) {
+        // Classify on the bare argv only. The frozen shell form prepends an env
+        // prefix and a `cd …` prologue, which would obscure the runner name.
+        const text = command.args.join(" ");
+        const mode = classifyFrontendVerifyCommandText(text);
+        if (mode === "static") {
+            adapterStaticCommands.push(command);
+            continue;
+        }
+        if (mode === "behavior") {
+            adapterBehaviorCommands.push(command);
+            continue;
+        }
+        // Unrecognized adapter command. When the task declares any verification
+        // of its own, it owns the verification boundary and the adapter array is
+        // discarded for both lanes, so an unclassifiable entry is harmless and
+        // must not fail generation. Only an adapter command that would actually
+        // be USED needs a lane, and defaulting it to `behavior` would make writer
+        // admission demand test-report capability it cannot provide. Fail loudly
+        // there and name the operator's fix.
+        if (hasDeclaredFrontendVerification)
+            continue;
+        throw new Error(`adapter verification command ${JSON.stringify(text)} (label ${JSON.stringify(command.label)}) has no recognizable lane; declare it explicitly with mode: "static" or mode: "behavior" in task verifyCommands, or remove it from the harness manifest`);
+    }
     const staticVerifyCommands = chooseFrontendVerifyCommands({
         explicitCommands: explicitFrontendVerifyCommands.staticCommands,
         parsedCommands: parsedFrontendVerifyCommands.staticCommands,
-        adapterCommands: adapterVerifyCommands,
+        adapterCommands: adapterStaticCommands,
     });
     const partitionedStaticVerifyCommands = partitionFrontendStaticVerifyCommands({
         repoRoot: sources.repoRoot,
@@ -3163,7 +3220,7 @@ async function buildFrontendHybridDagFromTask(sources) {
     const behaviorVerifyCommands = chooseFrontendVerifyCommands({
         explicitCommands: explicitFrontendVerifyCommands.behaviorCommands,
         parsedCommands: parsedFrontendVerifyCommands.behaviorCommands,
-        adapterCommands: adapterVerifyCommands,
+        adapterCommands: adapterBehaviorCommands,
         // A declared task verifier owns this task's verification boundary. A
         // static-only task must not inherit unrelated root-level test commands.
         allowAdapter: !hasDeclaredFrontendVerification,
@@ -3238,6 +3295,16 @@ async function buildFrontendHybridDagFromTask(sources) {
         behaviorCommandTexts: behaviorVerifyEvidence.commandTexts,
         mockCommandTexts: mockVerifyEvidence?.commandTexts ?? [],
     });
+    // Freeze capability only after final selection; discarded adapter commands
+    // cannot block this task. Unsupported inputs remain explicit preflight
+    // failures and writer admission refuses them before any implementation.
+    behaviorVerifyEvidence.preflight = await Promise.all(behaviorShellCommands.map(async (command, index) => {
+        const label = behaviorVerifyEvidence.commandLabels[index] ?? command;
+        const prior = sources.verificationPreflight?.find(entry => entry.label === label);
+        const inspected = await inspectFrontendTestCommand({ command, cwd: sources.repoRoot ?? process.cwd(), workspaceRoot: sources.repoRoot ?? process.cwd(), allowedPaths: implementPaths.allowedPaths, forbiddenPaths });
+        const commandId = frontendVerifyDirectory.find(entry => entry.mode === "behavior" && entry.label === label)?.commandId;
+        return { label, status: prior?.status ?? "ok", testObservation: { ...inspected.observation, commandId } };
+    }));
     const fixedVerificationContext = [
         "## Fixed frontend verification entrypoints",
         "These shell entrypoints are fixed at DAG generation and are the only commands the static and behavior shell nodes execute. A strategy or plan may add tests behind an existing entrypoint inside writeSet, but must not invent or replace commands or assume subtask_prompt executes a command.",
@@ -3429,7 +3496,7 @@ async function buildFrontendHybridDagFromTask(sources) {
                     "Plan only the delta between the frozen frontend-contract-pi facts and frontend-scout-pi target surface. Do not reinterpret the task, repeat requirements, search the repository, or choose implementation order.",
                     "Record only: requirement-to-file/verification coverage; component/styling choices; applicable UI state and interaction behavior; data/Mock strategy; and a dependency policy or genuine evidence gap. Reuse Scout paths. If scope is missing, record a blocking gap instead of inventing a path.",
                     "Use the typed tool schemas as the field contract. Runtime owns schemaVersion, sourceBinding, riskLevel, targets.files, mockApi.productionDefaultOff, aliases, command allowlisting, path containment, and final validation; do not restate those rules or emit a full JSON contract.",
-                    `Cover each frozen requirement ID exactly once: ${requirementIds.join(", ") || "(none)"}. Bind every verification target to a frozen commandId from the directory above plus a Scout-confirmed file. Behavior commands prove observable behavior: one target may cover multiple related requirementIds when one test behavior proves them together; do not mechanically create one target per requirement. A behavior target id is the stable identifier of that contract entry and its file must be a test file. Static commands are project-wide checks traced by file and command only.`,
+                    `Cover each frozen requirement ID exactly once: ${requirementIds.join(", ") || "(none)"}. Bind every verification target to a frozen commandId from the directory above plus a Scout-confirmed file. Behavior commands prove observable behavior: one target may cover multiple related requirementIds when one test behavior proves them together; do not mechanically create one target per requirement. A behavior target id is the stable machine trace token and its file must be a test file. Static commands are project-wide checks traced by file and command only.`,
                     "UX vocabulary protocol: record_state_registry FIRST with the full global vocabulary — one stable kebab-case behavior-domain name per UI state/interaction (e.g. planner-task-edit, focus-queue-move), never one name per AC number and never a rename of an already-recorded concept. Details consume complete execution-group scopes and reuse the same global names across scopes. Constraints/exclusions must not manufacture UI. Then record_state_flow entries whose names all come from that registry; uiState names must use the contract's declared authoritative ids (declaredUiStates in the plan input) when present. Retry attempts see committedUx in this input — reuse those exact names. Components: one choice may cover many state/interaction ids via covers; reuse-existing requires evidencePath naming an existing repo file (greenfield must be decision=new).",
                     ...(requiresOpenspecClassification ? ["When a component choice uses an OpenSpec selection, cite that selection; otherwise do not classify unrelated candidates."] : []),
                     "Call finalize_plan; correct rejected facts until one successful terminal after the necessary typed facts. Return no Markdown narrative.",
@@ -3611,7 +3678,6 @@ async function buildFrontendHybridDagFromTask(sources) {
                     "Execute in fixed stages and report each in the delivery summary: (1) Contract confirm, (2) Tests sync, (3) Component/UI state implementation, (4) API/Mock wiring per contract.mockApi, (5) Focused checks behind frozen entrypoints only, (6) Diff cleanup.",
                     "Map every requirement id, expectedOutcome, interaction trigger/expectedBehavior, and applicable UI state from the contract to concrete files. Do not invent shell verification commands; only frozen static/behavior entrypoints will run.",
                     "A behavior verification target's target.id is only the contract's identifier for that entry; it does not need to appear in test titles. Never add tests, rename describe/it/test titles, or restructure files just to carry generated ids — reuse affected existing test files and their names. The requirement ↔ verification-target association lives in the contract (requirementIds / verificationTargetIds), not in title strings.",
-                    "Tests must genuinely prove the behavior each target maps to; a passing test-file execution does not by itself prove every mapped behavior is covered — keep assertions aligned with the contract's expectedBehavior, and state any residual gap honestly in Tests Changed.",
                     "Begin implementation after the contract and its target files are confirmed. Do not spend the turn collecting optional context. If the canonical contract lacks behavior needed to edit safely, stop and state the blocking reason in the summary instead of reopening broad discovery.",
                     "Your implementation status is derived by the executor from mechanical facts (persisted write-tool events, run delta, write guard, requirement coverage, focused-check failures), never from any IMPLEMENTATION_OUTCOME first line. Do not emit an IMPLEMENTATION_OUTCOME first line.",
                     "The node runs a bounded micro-loop: after each write attempt the executor re-runs frozen focused checks and records a per-round diff checkpoint; the write guard stays active every round. Only repair local issues attributable to the current diff (syntax/type/import/format/unit-assert/obvious omission). Never change requirements, design, writeSet, or verification strictness inside the loop.",
@@ -5158,7 +5224,7 @@ async function buildBackendTestHybridDag(sources) {
                     `STRICT_BACKEND_TEST_MODULE_LAYOUT=${JSON.stringify(taskConfig.backendTest.moduleLayout)}`,
                 ]
                 : []),
-            `Include exactly one \`## Module Index\` table with this exact header: \`${backendTestModuleIndexHeaderMarkdown()}\`. The Markdown Path cell must contain exactly one resolved repository-relative path such as \`${canonicalBackendTestModuleMarkdownPath(layout.markdownDir, "health")}\`; do not emit a Markdown link or repeat the path. Split Reason is exactly one of \`${BACKEND_TEST_MODULE_SPLIT_REASONS.join("\`, \`")}\`. Group by stable business resource/domain, not by CRUD operation, AC, parameter/field axis, scenario type or regression purpose: one resource's list/detail/create/update/delete and its filters/response assertions/regression floor belong in one module. Multiple modules owning the same exact \`METHOD /path\` are forbidden unless every such row is \`explicit-user-layout\` from primary-requirement path pairs or has a documented \`output-budget\` proof. Keep the total module count at the smallest safe value and never exceed 8 modules. Name model-derived modules with stable lowercase business stems such as \`health\` or \`resource_notes\`; explicit-user-layout preserves the primary requirement filename stem even when it is more specific. Do not use priority-only stems \`p0\`, \`p1\` or \`p2\`; Priority belongs only in the Coverage Matrix. Pure hexadecimal/hash-like opaque stems and test-purpose-only stems are forbidden. Do not use Case-ID-like module filenames. Markdown Path, Pytest Path and downstream automation mapping must be one-to-one and exact; for model-derived modules the default pair remains \`${layout.markdownDir}/<module>.md\` and \`${layout.scriptDir}/test_<module>.py\`, while explicit-user-layout preserves the primary requirement paths. Do not hand-write a conflicting module count in prose; the Module Index row count is the only count truth.`,
+            `Include exactly one \`## Module Index\` table with this exact header: \`| Module Stem | Business Resource | Owned Operations | Owned Rule Keys | Case IDs | Split Reason | Markdown Path | Pytest Path |\`. The Markdown Path cell must contain exactly one resolved repository-relative path such as \`${layout.markdownDir}/health.md\`; do not emit a Markdown link or repeat the path. Split Reason is exactly one of \`explicit-user-layout\`, \`primary-business-resource\`, \`independent-business-resource\`, \`output-budget\`. Group by stable business resource/domain, not by CRUD operation, AC, parameter/field axis, scenario type or regression purpose: one resource's list/detail/create/update/delete and its filters/response assertions/regression floor belong in one module. Multiple modules owning the same exact \`METHOD /path\` are forbidden unless every such row is \`explicit-user-layout\` from primary-requirement path pairs or has a documented \`output-budget\` proof. Keep the total module count at the smallest safe value and never exceed 8 modules. Name model-derived modules with stable lowercase business stems such as \`health\` or \`resource_notes\`; explicit-user-layout preserves the primary requirement filename stem even when it is more specific. Do not use priority-only stems \`p0\`, \`p1\` or \`p2\`; Priority belongs only in the Coverage Matrix. Pure hexadecimal/hash-like opaque stems and test-purpose-only stems are forbidden. Do not use Case-ID-like module filenames. Markdown Path, Pytest Path and downstream automation mapping must be one-to-one and exact; for model-derived modules the default pair remains \`${layout.markdownDir}/<module>.md\` and \`${layout.scriptDir}/test_<module>.py\`, while explicit-user-layout preserves the primary requirement paths. Do not hand-write a conflicting module count in prose; the Module Index row count is the only count truth.`,
             "Scenario Partitions (query/filter axes): inspect every affected GET/list operation for query/path parameters whose bound source documents a finite enum or classification domain. If at least one such axis exists, add exactly one machine-readable `## Scenario Partitions` section after the Coverage Matrix using exactly `| Partition ID | Operation | Axis | Domain | Required Slots | Expected by Slot | Bind Rule |` with the separator row and one row per eligible axis. If no affected axis has a source-backed finite domain, omit the entire `## Scenario Partitions` heading and section; do not emit an explanatory prose-only section. Partition ID is a stable `SP-<OPERATION>-<AXIS>` token; Domain must copy the legal values verbatim from the bound OpenAPI enum or requirement sentence (never guess), using bare semicolon-separated identifier values inside the single table cell (for example `ACTIVE; ARCHIVED`, with no Markdown backticks or prose); Required Slots must contain `each-value` and exactly one `not-in-set`, plus `omitted` only when the parameter is optional. Before returning, expand every declared partition into its complete deterministic exact slot ID set: one `TP-<Partition ID>-<VALUE-TOKEN>` per Domain value, `TP-<Partition ID>-OMITTED` only for an optional axis, and exactly one `TP-<Partition ID>-NOT-IN-SET`. Every expanded slot ID must appear verbatim in the binding Rule's `Required Test Points` cell and be assigned to concrete Case IDs in that same Coverage Matrix row; ordinary alias/family Test Points do not replace this inventory. Scheme A: Case count may be smaller than the enum count, but every exact slot still needs an independent variant Test Point and pytest.param id; never use SINGLE/MULTIPLE aliases as coverage. Expected by Slot states the documented expectation per slot kind (`domain-value`, `default-behavior`, `empty-result`/`excluded-result` when documented, or `GAP` when the source does not document the complement expectation — never invent 空列表/400). POST/PUT body field-validation enums stay in the Coverage Matrix as `TP-<FIELD>-ENUM-*` and MUST NOT get a Scenario Partition row. Do not create partitions for axes without a documented legal-value domain. Only GET/list query or path parameters whose bound source documents a finite enum or classification set may become a Scenario Partition. Do not create partitions for free-form strings, primary keys, required-or-optional-only parameters, or boundary/format-only axes. If an axis has no finite legal-value domain, do not declare a Partition row and do not invent NOT-IN-SET cases. Cross-axis combinations stay as ONE nominal Case; never declare a cross-axis cartesian partition.",
             "Before finalizing README, calculate the predicted collected-item count as `sum(max(1, number of variant Test Points in each Case))`. If the task declares an item budget, the prediction must not exceed it. Reduce excess only by removing duplicate execution and converting same-request checkpoints to assertions; never drop required rules, boundaries, enums, operation-specific inputs, or business states. Record the prediction in README. Use only environment-supported fixtures/targets/isolation, record evidence gaps in Chinese, and do not emit JSON, pytest, or execute commands.",
             ...(sharedSetupPrompt ? [sharedSetupPrompt] : []),
@@ -5398,7 +5464,7 @@ async function buildBackendTestHybridDag(sources) {
                     "Output budget protocol (hard, max output <=16K per turn): Write exactly the frozen `{{item.pytestPath}}`. Never paste full Python modules into assistant chat. Do not merge or split modules. Do not reduce params/assertions/skips to fit. If OUTPUT_LIMIT_RECOVERY is injected, continue only listed missing/broken scripts.",
                     "Align every variant pytest.param payload with the Markdown scenario intent (empty/missing/null/length/pattern/enum/wrong-type/nominal). Prefer literal payloads over Faker for intent-critical fields so pre-execution scenario-param checks can verify them. Hard contract: intent=enum-invalid MUST pass a concrete invalid value literal (string/number/boolean), never `_OMIT`/None/missing key; intent=missing/empty may use `_OMIT` or delete the key; intent=custom-literal:trim|whitespace-padded requires a leading/trailing whitespace string with non-empty trimmed content (all-whitespace belongs to empty/whitespace-only, not trim); intent=custom-literal:ACTIVE|ARCHIVED requires the exact enum string, never descriptive tokens like filter-active; intent=max/min/max+1 should pass a repeated-string length expression, a bare length number N, or a helper named _*_LEN{N} / _*_MAX_LENGTH / _*_OVER_LENGTH — never a bare 1 for oversize. Hard contract: request payload dicts may only contain DTO field keys from Payload Allowed Paths; never put expect/expected/echo_* helper keys inside the JSON body dict. Path/query/header identifiers and scenario-control metadata (including `id`, expected codes, and selector labels) must stay in separate pytest parameters and helper arguments; never merge them into a DTO patch or JSON body unless that exact path is allowed by the Markdown payload contract. Normalize the configured API base URL with `rstrip(\"/\")` (or equivalently join exactly one slash) before appending endpoint paths; generated requests must never contain a `//api/...` path. When the bound source documents a concrete non-secret local API URL, generated clients must use it as the fallback in `os.environ.get(\"API_BASE_URL\", \"<documented-url>\")`; do not require an otherwise-uninjected environment variable or fail setup solely because it is absent. Missing-field helpers must remove keys idempotently with `payload.pop(field, None)`, never `del payload[field]`, because optional fields may already be absent.",
                     "For every response contract that requires an object or pagination envelope, first assert that each envelope/data value is a dict and that required keys exist, then index fields and assert values. Never let an incidental KeyError or list/string TypeError stand in for the explicit response-shape contract failure.",
-                    'Ensure every automatable final Markdown Case ID in this module appears in exactly one primary pytest test function or pytest test class method region, using the exact `primary symbol` declared by Markdown. Skip evidence-only meta Cases that declare `脚本/primary symbol=无` with empty variants; do not invent a business pytest symbol for them. The symbol must start with `test_BE_<MODULE>_<NNN>_` so every parameterized collected item remains associated with its Case. Module-level functions and class-based pytest methods are both supported. Only `变体测试点` may use stable `pytest.param(..., id="TP-...")` IDs, and every atomic variant ID must appear exactly once with a genuine input/state/outcome change. A Case with exactly one variant Test Point still needs one literal `pytest.param(..., id="TP-...")` row; never leave a single-variant Case as a bare function with the TP only in the docstring. Use a literal direct `pytest.param(..., id=...)` expression for every row; never hide or wrap it behind `_post_case`, `_put_case`, row-factory functions, comprehensions, generators, or dynamically returned parameter lists; do not use decorator-level `ids=[...]`, generated suffixes, or IDs that extend/shorten the exact Markdown TP. Do not parameterize `场景断言测试点` or `横切证据测试点`; execute all assertion checkpoints within the same business journey/item and use shared helpers for cross-cutting evidence. Governance-only cross-cutting bindings such as writeSet compliance, execution count, report existence, or orchestration state are metadata-only in business pytest: preserve their IDs in `Cross-Cutting-Test-Points`, but never assert `__file__`, filesystem placement, pytest invocation count, Harness state, or report artifacts inside the business test. Harness-owned evidence verifies those bindings. The first statement inside every primary symbol must be a triple-quoted docstring containing exact lines `Case-ID: BE-...`, `Assertion-Test-Points: TP-...;TP-...` and `Cross-Cutting-Test-Points: TP-...;TP-...` (use `none` when empty), for example `def test_BE_X_001():\n    """\n    Case-ID: BE-X-001\n    Assertion-Test-Points: TP-X-ASSERT\n    Cross-Cutting-Test-Points: none\n    """`. Module/class docstrings, comments before `def`, and singular `Assertion-Test-Point:` comments never bind a Test Point. Implement request dictionaries so their direct and nested key paths and enum literals exactly satisfy the Case `Payload Required Paths`, `Payload Allowed Paths`, and `Payload Enum`; for `Payload Contract: none`, do not invent a JSON/body DTO. GET/list filters still declare query fields in those payload labels when the Case varies `params=`/`query=` keys. Python `True`/`False` may implement JSON/OpenAPI `true`/`false` query or body booleans. GET/DELETE setup journeys may create resources, but their setup DTO must not change the target operation\'s no-body payload contract. No Test Point may be invented, renamed, omitted or bound in two modes. The generated pytest collection shape must equal the Markdown prediction `sum(max(1, variant count per Case))`; keep it at or below the task\'s explicit budget by removing duplicate execution, never by collapsing multiple parameter rows under a coarse family TP. Assertions come only from 预期结果 and setup comes only from 前置条件/测试数据/自动化映射.',
+                    'Ensure every automatable final Markdown Case ID in this module appears in exactly one primary pytest test function or pytest test class method region, using the exact `primary symbol` declared by Markdown. Skip evidence-only meta Cases that declare `脚本/primary symbol=无` with empty variants; do not invent a business pytest symbol for them. The symbol must start with `test_BE_<MODULE>_<NNN>_` so every parameterized collected item remains associated with its Case. Module-level functions and class-based pytest methods are both supported. Only `变体测试点` may use stable `pytest.param(..., id="TP-...")` IDs, and every atomic variant ID must appear exactly once with a genuine input/state/outcome change. A Case with exactly one variant Test Point still needs one literal `pytest.param(..., id="TP-...")` row; never leave a single-variant Case as a bare function with the TP only in the docstring. Use a literal direct `pytest.param(..., id=...)` expression for every row; never hide or wrap it behind `_post_case`, `_put_case`, row-factory functions, comprehensions, generators, or dynamically returned parameter lists; do not use decorator-level `ids=[...]`, generated suffixes, or IDs that extend/shorten the exact Markdown TP. Do not parameterize `场景断言测试点` or `横切证据测试点`; execute all assertion checkpoints within the same business journey/item and use shared helpers for cross-cutting evidence. Governance-only cross-cutting bindings such as writeSet compliance, execution count, report existence, or orchestration state are metadata-only in business pytest: preserve their IDs in `Cross-Cutting-Test-Points`, but never assert `__file__`, filesystem placement, pytest invocation count, Harness state, or report artifacts inside the business test. Harness-owned evidence verifies those bindings. The primary symbol docstring must contain exact metadata lines `Case-ID: BE-...`, `Assertion-Test-Points: TP-...;TP-...` and `Cross-Cutting-Test-Points: TP-...;TP-...` (use `none` when empty). Implement request dictionaries so their direct and nested key paths and enum literals exactly satisfy the Case `Payload Required Paths`, `Payload Allowed Paths`, and `Payload Enum`; for `Payload Contract: none`, do not invent a JSON/body DTO. GET/list filters still declare query fields in those payload labels when the Case varies `params=`/`query=` keys. Python `True`/`False` may implement JSON/OpenAPI `true`/`false` query or body booleans. GET/DELETE setup journeys may create resources, but their setup DTO must not change the target operation\'s no-body payload contract. No Test Point may be invented, renamed, omitted or bound in two modes. The generated pytest collection shape must equal the Markdown prediction `sum(max(1, variant count per Case))`; keep it at or below the task\'s explicit budget by removing duplicate execution, never by collapsing multiple parameter rows under a coarse family TP. Assertions come only from 预期结果 and setup comes only from 前置条件/测试数据/自动化映射.',
                     "Name the generated pytest file so it corresponds one-to-one with its source Markdown module file: this module stem `{{item.stem}}` maps to exactly the frozen `{{item.pytestPath}}`. The <module> stem is the Markdown filename without the `.md` extension, lowercased and with non-alphanumeric characters replaced by underscores. For example, `resource_notes` → `testcase/test_resource_notes.py`, `health` → `testcase/test_health.py`. If Markdown automation mapping names a different path than this module stem path, still write the frozen manifest pytest path and do not invent prefixes. Never merge multiple Markdown modules into one pytest file, never split one module across several files, and never invent pytest filenames unrelated to the Markdown modules.",
                     "Scenario Partition slots: every `TP-<Partition ID>-...` variant Test Point declared by this module's Markdown MUST become exactly one literal direct `pytest.param(..., id=\"TP-<Partition ID>-...\")` row with the exact slot ID; the not-in-set slot passes a concrete literal absent from the documented Domain (e.g. `UNKNOWN_TYPE`) — never `_OMIT`, never a descriptive token. Never split one slot into multiple params or merge several slots under a family TP id. Slot filtering requests hit the documented list endpoint with the slot value as the query/path filter.",
                     "Keep this module self-contained: define module-local fixtures and helpers directly in `{{item.pytestPath}}`, so pytest discovers every fixture dependency without external plugin registration. The request log must include method, URL/path, and request parameters (query plus JSON/body/payload summary). The response log must include status code and response result (JSON/text/body summary), and both records must be visible in pytest stdout/stderr without changing assertions. Recursively redact sensitive values and apply bounded truncation before logging.",
@@ -5456,7 +5522,7 @@ async function buildBackendTestHybridDag(sources) {
         outputContract: "First non-empty line is IMPLEMENTATION_OUTCOME: changed|blocked, followed by a concise repair summary. This node runs only for REPAIRABLE initial facts, so already-satisfied is invalid and a successful outcome requires a non-empty bounded diff. Modify only generated pytest scripts/helpers/factories and preserve every Markdown Case, Test Point, primary symbol and assertion meaning.",
         subtask_prompt: [
             "Repair the generated backend pytest asset as one bounded program using the direct upstream collection assessment. This is the only repair attempt and happens before any business test body execution. The direct upstream JSON includes authoritative `repairPaths` and bounded `repairFindings`; treat both as the complete mandatory checklist without searching for a run directory or report file. Treat any upstream line such as `Repair paths: testcase/test_x.py` as equivalent authoritative repairPaths evidence. Directly read and edit that testcase path; do not search for separate root-level `contracts/**`, guess a DAG run directory, or require another report artifact. If the read tool successfully returns the testcase file, the path exists—continue the bounded repair and never later claim that file is absent.",
-            "Initial status REPAIRABLE means at least one listed finding remains: `already-satisfied` is forbidden, and you must produce a non-empty bounded diff on repairPaths before returning `IMPLEMENTATION_OUTCOME: changed`. Fix only readiness-proven generated testcase-local defects on initial facts repairPaths: create exact safe missing mapped test_*.py paths, repair syntax/import/symbol/decorator/parameterization, close generated fixture dependencies/plugin registration, and repair initial Markdown-to-pytest correspondence findings. Use this deterministic repair map instead of reading analyzer implementation: findings about `Case-ID`, `Assertion-Test-Points`, or `Cross-Cutting-Test-Points` are fixed by making the first statement in the declared primary symbol a triple-quoted docstring with the exact plural metadata lines; these are the primary symbol docstring metadata lines. Module/class docstrings, comments before `def`, and singular `Assertion-Test-Point:` comments are invalid. Variant binding findings are fixed in the literal direct `pytest.param(..., id=\"TP-...\")` row; primary-symbol cardinality/name findings are fixed in the function name or duplicate primary symbols; script mismatch is fixed only on the authoritative assessment repairPaths; payload findings are fixed in request payload construction. Do not read controller `src/**` or inspect JS/TS analyzer code. Do not search for `testcase/**/README.md`. Never invent a business pytest symbol for evidence-only Markdown Cases that declare `脚本/primary symbol=无` with empty variants. For fixture defects inspect both provider and importer listed by repairPaths; fix ScopeMismatch by aligning fixture scopes or inlining request-scoped values so module fixtures never depend on function fixtures; when a shared fixture depends on sibling fixtures, register the whole provider module through an exact pytest_plugins declaration rather than importing only the outer fixture. Do not create unrelated pytest scripts.",
+            "Initial status REPAIRABLE means at least one listed finding remains: `already-satisfied` is forbidden, and you must produce a non-empty bounded diff on repairPaths before returning `IMPLEMENTATION_OUTCOME: changed`. Fix only readiness-proven generated testcase-local defects on initial facts repairPaths: create exact safe missing mapped test_*.py paths, repair syntax/import/symbol/decorator/parameterization, close generated fixture dependencies/plugin registration, and repair initial Markdown-to-pytest correspondence findings. Use this deterministic repair map instead of reading analyzer implementation: findings about `Case-ID`, `Assertion-Test-Points`, or `Cross-Cutting-Test-Points` are fixed by editing the declared primary symbol docstring metadata lines; variant binding findings are fixed in the literal direct `pytest.param(..., id=\"TP-...\")` row; primary-symbol cardinality/name findings are fixed in the function name or duplicate primary symbols; script mismatch is fixed only on the authoritative assessment repairPaths; payload findings are fixed in request payload construction. Do not read controller `src/**` or inspect JS/TS analyzer code. Do not search for `testcase/**/README.md`. Never invent a business pytest symbol for evidence-only Markdown Cases that declare `脚本/primary symbol=无` with empty variants. For fixture defects inspect both provider and importer listed by repairPaths; fix ScopeMismatch by aligning fixture scopes or inlining request-scoped values so module fixtures never depend on function fixtures; when a shared fixture depends on sibling fixtures, register the whole provider module through an exact pytest_plugins declaration rather than importing only the outer fixture. Do not create unrelated pytest scripts.",
             "This is the single pytest incremental synchronization round. The `Findings` in `reports/backend-test-pytest-collection-initial.md` are the mandatory repair checklist: resolve every repairable listed finding on every authoritative `Repair paths` file before considering any other advisory evidence, and never substitute an unrelated scenario-param cleanup for a listed correspondence/collection defect. For every assessment-listed path, compare the effective Markdown Case/Test Points/test data and its `Payload Contract`/`Payload Required Paths`/`Payload Allowed Paths`/`Payload Enum` labels with the generated module. Incrementally add or repair only missing symbols, params, assertions and payload builders. Repair every assessment-listed missing nested path, unexpected key and enum mismatch; preserve exact DTO keys, nested shapes, enum/boundary literals, operation transport and business preconditions; remove guessed replacement keys only when the effective Markdown proves the exact contract. Keep path/query/header identifiers and scenario-control metadata separate from DTO patches and JSON bodies; an `id` used for a path target must be passed to the request path/helper, never inserted into a body patch unless `id` is explicitly listed in Payload Allowed Paths. Flatten every variant into a literal direct `pytest.param(..., id=\"TP-...\")` row; replace `_post_case`/`_put_case` or other parameter-row factories because correspondence and scenario readiness require the actual row values and IDs to be statically visible. Also repair helper call sites to match their defined return signatures; do not tuple-unpack a helper that returns one scalar value.",
             "Preserve final testcase/md/** semantics, every Case ID, Rule/Test Point binding, primary symbol, parameter ID, expected status/body/schema assertion, HTTP logging, redaction and truncation behavior.",
             "Use local edit only on assessment-listed paths; keep summaries short; never rewrite unrelated modules.",
@@ -7397,6 +7463,11 @@ async function buildHybridDagForTemplate(sources, template, options = {}) {
         spec.runtimeContract = GENERATED_DAG_RUNTIME_CONTRACT;
     }
     spec.sourceBinding = buildDagSourceBinding(sources, template === "frontend-implementation" ? "frontend-implementation" : undefined);
+    if (template === "frontend-implementation" && sources.repoRoot) {
+        const ledger = await readTaskSourceProviderBudget({ repoRoot: sources.repoRoot, taskId: sources.taskId, maxProviderRequests: spec.budget.limits.maxProviderRequests });
+        if (ledger)
+            spec.sourceProviderBudget = { ledger, contract: sourceBudgetContractIdentity(taskContractBinding), sourceBindingSha256: sha256OfCanonicalJson(spec.sourceBinding), evidence: await freezeTaskSourceUsage({ repoRoot: sources.repoRoot, taskId: sources.taskId, maxProviderRequests: ledger.maxProviderRequests }, ledger) };
+    }
     spec.taskContractBinding = taskContractBinding;
     assertNoGovernanceFlagOnDisallowedTemplate(spec, template);
     if (template === "standard-dag" ||

package/dist/workflows/dag/node-execution.js

@@ -1,3 +1,5 @@
+import { reserveTaskSourceProviderRequest } from "../../task/source-prepare/source-provider-budget.js";
+import { frontendPlanSemanticDigest } from "./frontend-plan-progress.js";
 import { collectFrontendExecutionGroups } from "./frontend-execution-groups.js";
 import { reserveDagProviderRequest } from "./budget-enforcement.js";
 import { createHash } from "node:crypto";
@@ -374,15 +376,11 @@ async function countContractRecordSubmissions(runDir, nodeId) {
  * `hasTerminalFact` reflects a committed `finalize_plan` terminal fact.
  */
 async function readFrontendPlanCommittedSnapshot(runDir, nodeId) {
-    const records = await readTypedEventStoreFromJsonl(path.join(runDir, nodeId, "plan-typed-facts.jsonl"));
-    const committed = records.filter((record) => record.phase === "committed");
-    const digest = createHash("sha256")
-        .update(committed
-        .map((record) => record.payloadSha256)
-        .sort()
-        .join("\n"))
-        .digest("hex");
-    const hasTerminalFact = committed.some((record) => record.fact.kind === "finalize_plan");
+    const decisions = await readTypedEventStoreFromJsonl(path.join(runDir, nodeId, "plan-decision-facts.jsonl"));
+    const records = decisions.some(r => r.phase === "committed") ? decisions : await readTypedEventStoreFromJsonl(path.join(runDir, nodeId, "plan-typed-facts.jsonl"));
+    const committed = records.filter(record => record.phase === "committed");
+    const digest = frontendPlanSemanticDigest(committed);
+    const hasTerminalFact = committed.some((record) => ["finalize_plan", "finalize_decision"].includes(String(record.fact.kind)));
     return { digest, hasTerminalFact };
 }
 function planInputRecord(value) {
@@ -1564,6 +1562,7 @@ export async function executeDagNode(input) {
         // evidence so a late best-effort write cannot recreate an archived run dir.
         void input.persistState().catch(() => { });
     };
+    const scoutCompletedShards = task.id === "frontend-scout-pi" && isSafeReadOnlyPiRetryCandidate(task) ? new Map() : undefined;
     let terminalResult;
     let previousFailureCategory;
     let previousProtocolReason;
@@ -1665,7 +1664,8 @@ export async function executeDagNode(input) {
                 attemptPrompt,
             });
             result = await executeNode({
-                ...(state.budgetLedger?.mode === "hard" && state.budgetLedger.limits.maxProviderRequests !== undefined ? { reserveProviderRequest: () => reserveDagProviderRequest({ state, nodeId, attempt: attemptNumber, persist: input.persistState }) } : {}),
+                ...(scoutCompletedShards ? { scoutCompletedShards } : {}),
+                ...(state.budgetLedger?.mode === "hard" && state.budgetLedger.limits.maxProviderRequests !== undefined ? { reserveProviderRequest: () => reserveDagProviderRequest({ state, nodeId, attempt: attemptNumber, persist: input.persistState, ...(spec.sourceProviderBudget ? { reserveTaskRequest: () => reserveTaskSourceProviderRequest({ repoRoot: cwd, taskId: spec.sourceProviderBudget.ledger.taskId, maxProviderRequests: spec.sourceProviderBudget.ledger.maxProviderRequests, expectedBudgetId: spec.sourceProviderBudget.ledger.budgetId, minimumReservedRequests: spec.sourceProviderBudget.ledger.reservedRequests }) } : {}) }) } : {}),
                 task,
                 cwd,
                 model,
@@ -1906,7 +1906,7 @@ export async function executeDagNode(input) {
         // reason, detect new committed facts, and escalate instead of re-running.
         if (frontendPlanLadderEnabled && !result.ok) {
             const afterSnapshot = await readFrontendPlanCommittedSnapshot(runDir, nodeId);
-            const hasNewCommittedFact = beforeCommittedDigest !== undefined &&
+            const hasNewCommittedFact = !result.stderr?.includes("FRONTEND_PLAN_NO_PROGRESS") && beforeCommittedDigest !== undefined &&
                 afterSnapshot.digest !== beforeCommittedDigest;
             const protocolReason = projectFrontendNodeProtocolFailureReason({
                 failureCategory: result.failureCategory,

package/dist/workflows/dag/rerun-feedback.js

@@ -1,9 +1,10 @@
+import { z } from "zod";
 import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { parseJsonReviewVerdict } from "./output-protocol.js";
 import { FRONTEND_DESIGN_REVIEW_NODE_ID, FRONTEND_REVIEW_NODE_ID, readCommittedDesignRequestFact, readCommittedReviewRequestFact, } from "./frontend-review-findings.js";
-import { readTypedEventStoreFromJsonl } from "./frontend-typed-event-store.js";
+import { readTypedEventStoreFromJsonl, reviewFindingSchema } from "./frontend-typed-event-store.js";
 export const MAX_RERUN_FEEDBACK_CHARS = 12_000;
 const RERUN_FEEDBACK_TRUNCATION_MARKER = "\n\n...[上一轮反馈已按长度上限截断]...\n\n";
 const MAX_EVIDENCE_REFS = 8;
@@ -236,6 +237,35 @@ async function readCommittedTerminalKind(input) {
     }
     return undefined;
 }
+/** Current rejecting terminal, with final-review approval as a barrier to
+ * older design findings. Binds snapshot consumers to the actual ledger bytes. */
+export async function readCurrentFrontendRepairFindings(runDir) {
+    for (const [sourceNodeId, file, approveKind, rejectKind] of [
+        [FRONTEND_REVIEW_NODE_ID, "review-typed-facts.jsonl", "approve_review", "request_review_changes"],
+        [FRONTEND_DESIGN_REVIEW_NODE_ID, "design-typed-facts.jsonl", "approve_design", "request_design_changes"],
+    ]) {
+        const ledger = path.join(runDir, sourceNodeId, file);
+        let raw;
+        try {
+            raw = await readFile(ledger, "utf8");
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                continue;
+            throw error;
+        }
+        const terminal = (await readTypedEventStoreFromJsonl(ledger)).filter(record => record.phase === "committed" && [approveKind, rejectKind].includes(String(record.fact.kind))).at(-1);
+        if (!terminal)
+            continue;
+        const { sha256OfCanonicalJson } = await import("../../task/contract/hash.js");
+        if (terminal.payloadSha256 !== sha256OfCanonicalJson(terminal.fact))
+            throw new Error("frontend repair terminal payload hash mismatch");
+        const verdict = terminal.fact.kind === approveKind ? "approve" : "request";
+        const findings = verdict === "request" ? z.array(reviewFindingSchema).parse(terminal.fact.findings) : [];
+        return { sourceNodeId, ledgerSha256: sha256(raw), terminalEventId: terminal.eventId, verdict, findings, fact: terminal.fact };
+    }
+    return undefined;
+}
 async function readReviewTerminalKind(runDir) {
     return readCommittedTerminalKind({
         runDir,
@@ -354,9 +384,10 @@ export async function deriveDagRerunFeedback(input) {
         // reviewer re-flags them as "unresolved previous-round feedback" (r18).
         // A committed approval is a resolution barrier and prevents older
         // findings from being resurrected.
-        const typedFact = (await readTypedReviewRequestFact(input.runDir)) ??
-            (await readTypedDesignRequestFact(input.runDir)) ??
-            (await readAncestorTypedRequestFact(input.runDir));
+        const current = await readCurrentFrontendRepairFindings(input.runDir);
+        if (current?.verdict === "approve")
+            return undefined;
+        const typedFact = current ? { nodeId: current.sourceNodeId, fact: current.fact } : await readAncestorTypedRequestFact(input.runDir);
         if (typedFact) {
             const parentSourceBindingHash = sourceBindingHash(input.spec);
             return withDigest({