agent-dealer 1.2.7 → 1.2.9

package/bundle/server/dist/coordinator/projection.js

@@ -14,19 +14,25 @@ export function projectDeveloperRoute(route, currentStatus, round) {
                 effect: { kind: "enqueue", workItem: "reviewer", atHeadSha: route.headSha },
                 advance: "none",
             };
-        case "retry_developer":
+        case "retry_developer": {
+            // NOT-313: a CI-repair retry spends the CI budget, never the infra one —
+            // the route's budget marker (set only by the checks_failed path) decides.
+            const isCiRepair = route.budget === "ci";
             return {
                 projection: {
                     // developing → developing and repairing → repairing are both self-loops;
-                    // an infra-retry developer failure stays in "repairing".
+                    // a retried developer failure stays in "repairing".
                     issueStatus: currentStatus === "repairing" ? "repairing" : "developing",
                     currentOwner: "developer",
-                    currentIntent: `Developer retrying (infra attempt) — ${route.reason}`,
+                    currentIntent: isCiRepair
+                        ? `Developer retrying (CI repair attempt) — ${route.reason}`
+                        : `Developer retrying (infra attempt) — ${route.reason}`,
                     events: ["worker.failed"],
                 },
                 effect: { kind: "enqueue", workItem: "developer", retryReason: route.reason },
-                advance: "infra",
+                advance: isCiRepair ? "ci" : "infra",
             };
+        }
         case "retry_publish":
             return {
                 projection: {

package/bundle/server/dist/coordinator/projection.test.js

@@ -119,6 +119,19 @@ test("infra-class retries — including a stale re-review — spend the infra bu
     const stale = projectReviewerRoute(routeReviewerOutcome({ kind: "stale", currentHeadSha: "new" }, REVIEW_ROUNDS_LEFT, PINNED_HEAD), 1, false);
     assert.equal(stale.advance, "infra");
 });
+test("NOT-313: a checks_failed retry spends the CI budget, never the infra one", () => {
+    const ciRetry = projectDeveloperRoute(routeDeveloperOutcome({ kind: "checks_failed" }, REVIEW_ROUNDS_LEFT), "developing", 1);
+    assert.equal(ciRetry.advance, "ci");
+    assert.deepStrictEqual(ciRetry.effect, {
+        kind: "enqueue",
+        workItem: "developer",
+        retryReason: "CI repair attempt 1 of 3: Developer's PR checks failed.",
+    });
+    assert.match(ciRetry.projection.currentIntent, /CI repair attempt/);
+    // An infra-class retry keeps the exact pre-NOT-313 shape — no budget marker.
+    const infraRetry = projectDeveloperRoute(routeDeveloperOutcome({ kind: "session_failed" }, REVIEW_ROUNDS_LEFT), "developing", 1);
+    assert.equal(infraRetry.advance, "infra");
+});
 test("NOT-147: empty-tip no-progress escalation projects to needs_human without spending infra budget", () => {
     const INFRA_ATTEMPTS_LEFT = {
         currentRound: 1,

package/bundle/server/dist/coordinator/prompts-execution-contract.test.js

@@ -0,0 +1,107 @@
+// NOT-306: developer and reviewer prompts render the frozen execution contract
+// as dedicated sections — mode, non-goals, exit predicate, one-PR boundary,
+// per-criterion evidence — without telling the worker to rediscover them.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { buildDeveloperPrompt, buildReviewerPrompt } from "./prompts.js";
+import { parseReviewerResult } from "./reviewer-result.js";
+const CONTRACT = {
+    version: "v1",
+    executionMode: "bug fix",
+    nonGoals: ["Rewriting the Linear ticket from Dealer", "Changing product scope after start"],
+    exitPredicate: "The login retry succeeds observably on the second attempt.",
+    onePrStoppingPoint: "Stop after the retry fix lands with its regression test.",
+    acceptanceCriteria: [
+        { text: "Retry succeeds on the second attempt", evidence: "auth tests | npm run test:unit | green" },
+        { text: "No new warnings in the log", evidence: null },
+    ],
+};
+const LEGACY_SNAPSHOT = {
+    title: "Add widget",
+    description: "Build the widget.",
+    acceptanceCriteria: "Widget renders.",
+    repo: "acme/app",
+    baseBranch: "main",
+};
+const CONTRACT_SNAPSHOT = { ...LEGACY_SNAPSHOT, executionContract: CONTRACT };
+test("developer prompt renders every contract section verbatim, never as pointers", () => {
+    const prompt = buildDeveloperPrompt({ taskSnapshot: CONTRACT_SNAPSHOT, round: 1 });
+    assert.match(prompt, /## Execution contract \(frozen v1/);
+    assert.match(prompt, /### Execution mode/);
+    assert.ok(prompt.includes("bug fix"), "mode value must appear verbatim");
+    assert.match(prompt, /### Non-goals/);
+    assert.ok(prompt.includes("Rewriting the Linear ticket from Dealer"));
+    assert.ok(prompt.includes("Changing product scope after start"));
+    assert.match(prompt, /### Exit predicate/);
+    assert.ok(prompt.includes("The login retry succeeds observably on the second attempt."));
+    assert.match(prompt, /### One-PR stopping point/);
+    assert.ok(prompt.includes("Stop after the retry fix lands with its regression test."));
+    assert.match(prompt, /### Per-criterion evidence/);
+    assert.ok(prompt.includes("Retry succeeds on the second attempt"));
+    assert.ok(prompt.includes("Evidence: auth tests | npm run test:unit | green"));
+    assert.ok(prompt.includes("No new warnings in the log"));
+    assert.match(prompt, /do not rediscover/i);
+});
+test("reviewer prompt renders the contract and demands exit-predicate plus per-criterion evidence verdicts", () => {
+    const prompt = buildReviewerPrompt({
+        taskSnapshot: CONTRACT_SNAPSHOT,
+        round: 1,
+        baseSha: "a".repeat(40),
+        headSha: "b".repeat(40),
+        diff: "diff --git a/x b/x\n+added line\n",
+    });
+    assert.match(prompt, /## Execution contract \(frozen v1/);
+    assert.ok(prompt.includes("The login retry succeeds observably on the second attempt."));
+    assert.ok(prompt.includes("Evidence: auth tests | npm run test:unit | green"));
+    // The verdict contract assesses the exit predicate and each evidence line —
+    // not just the prose acceptance criteria.
+    assert.match(prompt, /"exitPredicateAssessment"/);
+    assert.match(prompt, /EACH criterion's stated evidence/i);
+    assert.match(prompt, /never a blanket "evidence looks good"/);
+    assert.match(prompt, /"approved" additionally requires the exit predicate to hold/);
+});
+test("legacy snapshots without a contract omit the contract section but keep the shared verdict shape", () => {
+    const developer = buildDeveloperPrompt({ taskSnapshot: LEGACY_SNAPSHOT, round: 1 });
+    assert.doesNotMatch(developer, /## Execution contract/);
+    assert.match(developer, /## Acceptance criteria/);
+    const reviewer = buildReviewerPrompt({
+        taskSnapshot: LEGACY_SNAPSHOT,
+        round: 1,
+        baseSha: "a".repeat(40),
+        headSha: "b".repeat(40),
+        diff: "diff --git a/x b/x\n+added line\n",
+    });
+    assert.doesNotMatch(reviewer, /## Execution contract/);
+    // The exit-predicate/evidence verdict rules apply to every review, so the
+    // reviewer shape always carries the optional assessment field.
+    assert.match(reviewer, /"exitPredicateAssessment"/);
+    assert.match(reviewer, /Tasks without a contract omit "exitPredicateAssessment"/);
+});
+test("a null contract is identical to an absent one", () => {
+    const absent = buildDeveloperPrompt({ taskSnapshot: LEGACY_SNAPSHOT, round: 1 });
+    assert.equal(buildDeveloperPrompt({ taskSnapshot: { ...LEGACY_SNAPSHOT, executionContract: null }, round: 1 }), absent);
+});
+test("reviewer output parses an exit-predicate assessment; legacy outputs still parse", () => {
+    const withPredicate = {
+        verdict: "approved",
+        baseSha: "aaaa",
+        headSha: "bbbb",
+        acceptanceCriteriaAssessment: "All criteria met.",
+        evidenceAssessment: "Criterion 1 verified via auth tests (green); criterion 2 has no stated evidence.",
+        exitPredicateAssessment: "The retry succeeds observably on the second attempt — holds at this tip.",
+        findings: [],
+        risks: [],
+    };
+    const parsed = parseReviewerResult(`\`\`\`json\n${JSON.stringify(withPredicate)}\n\`\`\``);
+    assert.deepEqual(parsed, withPredicate);
+    const legacy = {
+        verdict: "approved",
+        baseSha: "aaaa",
+        headSha: "bbbb",
+        acceptanceCriteriaAssessment: "Meets criteria.",
+        evidenceAssessment: "Tests pass.",
+        findings: [],
+        risks: [],
+    };
+    assert.deepEqual(parseReviewerResult(JSON.stringify(legacy)), legacy);
+});

package/bundle/server/dist/coordinator/prompts.js

@@ -1,4 +1,42 @@
+import { MUSE_SANDBOX_CAPABILITIES } from "../runners/muse-code-args.js";
+import { checkMuseVisualQa, museVisualQaPromptSection, } from "../adapters/muse-visual-qa.js";
 import { formatVerificationReceiptSection, } from "./verification-receipt.js";
+import { formatOperatorCriteria, } from "./operator-criteria.js";
+/**
+ * NOT-306: render the frozen execution contract as dedicated sections. These
+ * are the ticket's own execution semantics — the worker follows them as
+ * written and never goes back to the ticket (or anywhere else) to rediscover
+ * them. Empty/absent renders nothing so legacy prompts stay byte-for-byte.
+ */
+function executionContractSection(contract) {
+    if (!contract)
+        return [];
+    const lines = [
+        `## Execution contract (frozen ${contract.version} — follow as written, do not rediscover)`,
+        `These execution semantics come from the Planner-authored ticket and are frozen for this workflow. Do not re-derive them, do not renegotiate scope, and do not ask the operator to restate them.`,
+        ``,
+        `### Execution mode`,
+        contract.executionMode,
+        ``,
+        `### Non-goals (out of scope — do not build these)`,
+        ...contract.nonGoals.map((goal) => `- ${goal}`),
+        ``,
+        `### Exit predicate (you are done only when this observably holds)`,
+        contract.exitPredicate,
+        ``,
+        `### One-PR stopping point (stop here even if more work suggests itself)`,
+        contract.onePrStoppingPoint,
+        ``,
+        `### Per-criterion evidence (verify each criterion exactly this way)`,
+    ];
+    for (const criterion of contract.acceptanceCriteria) {
+        lines.push(`- ${criterion.text}`);
+        if (criterion.evidence)
+            lines.push(`  Evidence: ${criterion.evidence}`);
+    }
+    lines.push(``);
+    return lines;
+}
 function guidanceSection(guidance) {
     if (!guidance?.length)
         return [];
@@ -9,6 +47,135 @@ function guidanceSection(guidance) {
         ...guidance.flatMap((g) => [g.trim(), ``]),
     ];
 }
+/** NOT-310: the merge-conflict repair directive. Empty/absent renders nothing so
+ * ordinary rounds produce byte-for-byte the prompt they always did. */
+function conflictRepairSection(directive) {
+    const base = directive?.baseBranch?.trim();
+    const branch = directive?.branch?.trim();
+    if (!base || !branch)
+        return [];
+    const files = (directive?.files ?? []).map((f) => f.trim()).filter((f) => f.length > 0);
+    return [
+        `## Merge conflict with ${base} — resolve it first`,
+        `This PR's branch \`${branch}\` cannot merge into \`${base}\`: the base moved and merging it conflicts. Do this before any other work in this round:`,
+        ``,
+        `1. In your worktree: \`git fetch origin ${base}\` and \`git merge origin/${base}\`.`,
+        `2. Resolve every conflict preserving both sides' intent — the base side carries other tickets' merged work, never discard it to keep your side.`,
+        files.length > 0
+            ? `   Files seen conflicting at merge time: ${files.map((f) => `\`${f}\``).join(", ")}.`
+            : `   The conflicting files are unknown — your own merge output lists them; resolve all of them.`,
+        `3. Run the full verification suite on the resolved tree, then commit the resolution.`,
+        `4. Never rebase this published branch and never force-push — the coordinator publishes your tip with a plain push.`,
+        ``,
+    ];
+}
+/** NOT-314: the frozen snapshot's `[operator]` criteria for the developer.
+ * Empty/absent renders nothing so operator-free tasks produce byte-for-byte
+ * the prompt they always did. */
+function operatorDeveloperSection(criteria) {
+    if (!criteria?.length)
+        return [];
+    return [
+        `## Operator verification required ([operator] criteria)`,
+        `These acceptance criteria can only be proven by a human operator with real credentials, a real login, or a paid session — Dealer blocks the merge until the operator records the result, so do not work around the gate. Do not attempt these; ship the ready-to-run probe and a doc, put the exact command in the PR body:`,
+        ``,
+        ...formatOperatorCriteria(criteria),
+        ``,
+    ];
+}
+/** NOT-314: an operator_verification `repair` note, verbatim. Empty/absent
+ * renders nothing so ordinary rounds produce byte-for-byte the prompt they always did. */
+function operatorRepairSection(note) {
+    if (!note?.trim())
+        return [];
+    return [
+        `## Operator verification feedback`,
+        `A human reviewed the operator-gated criteria and sent the work back instead of verifying. Address this before anything else, and do not ask the operator to re-verify the same head without fixing it:`,
+        ``,
+        note.trim(),
+        ``,
+    ];
+}
+/** NOT-314: the frozen snapshot's `[operator]` criteria for the reviewer.
+ * Missing operator evidence is NOT a defect (Dealer gates the merge itself) —
+ * but the probe and the doc must exist. Empty/absent renders nothing. */
+function operatorReviewerSection(criteria) {
+    if (!criteria?.length)
+        return [];
+    return [
+        `## Operator-gated criteria ([operator]) — not yours to verify`,
+        `Missing operator evidence is NOT a defect: Dealer blocks the merge until a human operator records the result, so never raise a blocking finding and never escalate for an unverified [operator] criterion. What you MUST check instead is that the probe and doc exist: the diff must ship the ready-to-run probe for each criterion below, the doc must name the exact command, and the PR body must carry it. A missing probe or doc IS a blocking finding.`,
+        ``,
+        ...formatOperatorCriteria(criteria),
+        ``,
+    ];
+}
+/**
+ * NOT-316: the Muse developer sandbox limits, rendered from
+ * `MUSE_SANDBOX_CAPABILITIES` (which is tied by test to the real
+ * `--sandbox-network` launch flag) instead of hand-written prose, so the
+ * prompt cannot drift from what the sandbox actually does. Muse developers
+ * only — returns [] otherwise, so non-Muse prompts are byte-for-byte
+ * unchanged.
+ */
+function museEnvironmentLimitsSection() {
+    const caps = MUSE_SANDBOX_CAPABILITIES;
+    return [
+        `## Environment limits (sandbox network: ${caps.sandboxNetwork})`,
+        `This session runs inside the Muse sandbox with network \`${caps.network}\` — these limits come from the launch flags and cannot be worked around:`,
+        ``,
+        `- Network: ${caps.network} (no DNS — the npm registry and GitHub API are unreachable).`,
+        `- Loopback listeners: ${caps.loopbackListen ? "yes" : "no"} — \`listen()\` fails with EPERM, so do not start servers.`,
+        `- Browser: ${caps.browser ? "yes" : "no"}.`,
+        `- Credentials/Keychain: ${caps.credentialsKeychain ? "yes" : "no"}.`,
+        `After one failed attempt at something the environment cannot do (install, listen, browser, credentials), stop and hand off; do not work around the sandbox.`,
+        ``,
+    ];
+}
+function acceptanceCriteriaHasTag(acceptanceCriteria, tag) {
+    return acceptanceCriteria.includes(tag);
+}
+/**
+ * NOT-316: what `[agent]` / `[ci]` tags on acceptance criteria mean for a Muse
+ * developer. Rendered only when the AC text carries the tag (per-tag lines)
+ * and only for Muse developers — otherwise returns [] so untagged and
+ * non-Muse prompts are byte-for-byte what they always were. `[operator]`
+ * criteria are owned by the operator-gate section (`operatorDeveloperSection`)
+ * and deliberately not duplicated here.
+ */
+function tagSemanticsDeveloperSection(acceptanceCriteria) {
+    const lines = [];
+    if (acceptanceCriteriaHasTag(acceptanceCriteria, "[agent]")) {
+        lines.push(`- \`[agent]\`: verify yourself — prove the criterion with your own in-session runs (targeted tests); your verification is the evidence.`);
+    }
+    if (acceptanceCriteriaHasTag(acceptanceCriteria, "[ci]")) {
+        lines.push(`- \`[ci]\`: implement or extend the named CI job/test and push — CI is the evidence, do not reproduce it locally.`);
+    }
+    if (!lines.length)
+        return [];
+    return [`## Acceptance-criterion tags ([agent] / [ci])`, ...lines, ``];
+}
+/**
+ * NOT-316: how the reviewer judges tagged criteria. Rendered only when the AC
+ * text carries the tag (per-tag lines) — untagged reviewer prompts are
+ * byte-for-byte what they always were. `[ci]` is judged by the PR check
+ * status in the evidence, never by local runs; an `[operator]` criterion is
+ * gated by Dealer and missing operator evidence is never a defect (the
+ * probe/doc existence check lives in `operatorReviewerSection` and is not
+ * duplicated here).
+ */
+function tagSemanticsReviewerSection(acceptanceCriteria) {
+    const lines = [];
+    if (acceptanceCriteriaHasTag(acceptanceCriteria, "[ci]")) {
+        lines.push(`- Judge \`[ci]\` criteria by the PR check status in the evidence (the CI checks section), not by local runs.`);
+    }
+    if (acceptanceCriteriaHasTag(acceptanceCriteria, "[operator]")) {
+        lines.push(`- Do not mark an \`[operator]\` criterion as a defect — it is gated by Dealer.`);
+    }
+    if (!lines.length)
+        return [];
+    return [`## Criterion tags ([ci] / [operator]) — how to judge`, ...lines, ``];
+}
 /** NOT-272: a resolved product_scope_decision's human note, verbatim. Empty/absent
  * renders nothing so noteless resolves produce byte-for-byte the prompt they always did. */
 function scopeDecisionSection(note) {
@@ -78,9 +245,22 @@ export function buildDeveloperPrompt(input) {
             parts.push(...formatVerificationReceiptSection(input.priorVerificationReceipt));
         }
     }
+    // NOT-310: the conflict repair leads — it is this round's purpose, read before the task.
+    parts.push(...conflictRepairSection(input.conflictRepair));
     // NOT-272: the scope decision leads — the developer reads it before the task itself.
     parts.push(...scopeDecisionSection(input.scopeDecisionNote));
-    parts.push(`## Task`, input.taskSnapshot.title, input.taskSnapshot.description, ``, `## Acceptance criteria`, input.taskSnapshot.acceptanceCriteria, ``);
+    // NOT-314: operator repair feedback leads for the same reason.
+    parts.push(...operatorRepairSection(input.operatorRepairNote));
+    parts.push(`## Task`, input.taskSnapshot.title, input.taskSnapshot.description, ``, `## Acceptance criteria`, input.taskSnapshot.acceptanceCriteria, ``, 
+    // NOT-314: operator criteria render separately right after the criteria —
+    // the worker must not attempt them, only ship the probe + doc.
+    ...operatorDeveloperSection(input.operatorCriteria), 
+    // NOT-316: tag semantics render only for Muse developers whose AC text
+    // carries the tags — otherwise nothing, so untagged and non-Muse prompts
+    // stay byte-for-byte.
+    ...(input.museDeveloper
+        ? tagSemanticsDeveloperSection(input.taskSnapshot.acceptanceCriteria)
+        : []), ...executionContractSection(input.taskSnapshot.executionContract));
     if (input.findings?.length) {
         parts.push(`## Findings to address`);
         for (const f of input.findings) {
@@ -93,7 +273,20 @@ export function buildDeveloperPrompt(input) {
     parts.push(...agentDeckSection(input.worktreePath, input.deckId));
     if (input.museDeveloper)
         parts.push(...museCronProhibitionSection());
+    // NOT-316: sandbox limits rendered from MUSE_SANDBOX_CAPABILITIES — Muse
+    // developers only, so non-Muse prompts are untouched.
+    if (input.museDeveloper)
+        parts.push(...museEnvironmentLimitsSection());
+    // NOT-303: the screenshot-path preflight verdict is embedded before the session
+    // starts, so the worker reads it instead of discovering the Chrome.app abort
+    // mid-session. Non-Muse developers are untouched.
+    if (input.museDeveloper) {
+        parts.push(...museVisualQaPromptSection(input.museVisualQa ?? checkMuseVisualQa()));
+    }
     parts.push(`## Required`, 
+    // NOT-315: the coordinator provisions dependencies before the session spawns —
+    // the sandbox has no network, so an in-session install can never work.
+    `Dependencies are installed; do not run npm install (no network).`, 
     // NOT-115: encourage incremental commits so a mid-session death leaves less
     // uncommitted work for dirty_worktree escalation — soft mitigation only.
     // NOT-146: timed-spawn handoff bar is commits + targeted tests for the change.
@@ -102,7 +295,7 @@ export function buildDeveloperPrompt(input) {
     `Run targeted tests for the change. A clean handoff is valid with commits plus those targeted tests — full suite / Lens checks are not required inside this timed developer spawn (they run on a separate review/verify budget). Make incremental commits with \`git\` at coherent slice boundaries (for example after the tests for that slice pass) — do not leave all work uncommitted until the very end. A final commit of any remaining changes and the **implementation conclusion** remain required before you exit.`, `Commit any remaining changes with \`git\` — do NOT push and do NOT open a pull request; the coordinator pushes your branch and opens/updates the draft PR after this session ends.`, `End your reply with a short **implementation conclusion**: what changed, why, any deviations from the acceptance criteria, and known follow-ups. This is distinct from the PR description and is required every round.`);
     return parts.join("\n");
 }
-const REVIEWER_RESULT_SHAPE = '{"verdict":"approved"|"changes_requested"|"escalated","baseSha":"...","headSha":"...","acceptanceCriteriaAssessment":"...","evidenceAssessment":"...","findings":[{"fingerprint":"stable-slug","severity":"blocking"|"non_blocking","title":"...","rationale":"...","file":"...","line":0}],"risks":["..."],"productScopeQuestion":"..."}';
+const REVIEWER_RESULT_SHAPE = '{"verdict":"approved"|"changes_requested"|"escalated","baseSha":"...","headSha":"...","acceptanceCriteriaAssessment":"...","evidenceAssessment":"...","exitPredicateAssessment":"...","findings":[{"fingerprint":"stable-slug","severity":"blocking"|"non_blocking","title":"...","rationale":"...","file":"...","line":0}],"risks":["..."],"productScopeQuestion":"..."}';
 function reviewerContractSection(baseSha, headSha) {
     // Verdict table matches docs/PRD_ISSUE_COORDINATION.md §6.4 / design NOT-150 — do not drift.
     return [
@@ -113,9 +306,18 @@ function reviewerContractSection(baseSha, headSha) {
         `- Set "baseSha" to exactly "${baseSha}" and "headSha" to exactly "${headSha}" — these are the coordinator-verified SHAs you were checked out at, not values you compute.`,
         `- "fingerprint" must be a short, stable slug for the finding (e.g. "missing-null-check-args-ts") so the same issue re-found next round is recognized as recurring, not duplicated.`,
         `- "findings" holds every blocking AND non-blocking observation; "risks" is uncertainties that are not findings tied to a location.`,
+        // NOT-306: the execution contract (when the task carries one) is judged,
+        // not just the prose criteria — the exit predicate and each criterion's
+        // stated evidence get their own assessments on top of the AC verdict.
+        `- "acceptanceCriteriaAssessment" judges the acceptance criteria; "evidenceAssessment" must judge EACH criterion's stated evidence (where to look, action/command, expected result) one by one — never a blanket "evidence looks good".`,
+        `- When the task carries an execution contract, set "exitPredicateAssessment" to whether the frozen exit predicate observably holds at this tip, and "approved" additionally requires the exit predicate to hold (AC met alone is not enough). Tasks without a contract omit "exitPredicateAssessment".`,
         `- "approved": AC met for this tip and no finding is "blocking" (non_blocking nits allowed).`,
         `- "changes_requested": any "blocking" finding a coding pass can address — including incomplete review because AC-critical files were omitted/truncated from the diff. List omitted paths in a blocking finding.`,
         `- "escalated": only when acceptance criteria / product scope are ambiguous, contradictory, or need a human product call — not ordinary code defects, not "diff too large". You MUST set non-empty "productScopeQuestion"; omit the field otherwise.`,
+        // NOT-303: a missing screenshot is never a pass. Some runtimes (Muse Code: the
+        // Chrome.app headless abort) cannot do visual QA in-session and say so in the
+        // conclusion — echo that as "visual QA not run" in "evidenceAssessment".
+        `- A missing screenshot or DOM capture is never verification: if the change has UI-visible effects and no visual evidence is in the diff, the conclusion, or the checks, state "visual QA not run" in "evidenceAssessment" — do not read the absence as a pass.`,
         `- You cannot edit files, push, or publish anything — you only return this JSON. The coordinator publishes it to GitHub on your behalf.`,
     ];
 }
@@ -176,6 +378,13 @@ export function buildReviewerPrompt(input) {
         `## Acceptance criteria`,
         input.taskSnapshot.acceptanceCriteria,
         ``,
+        // NOT-314: missing operator evidence is NOT a defect — but the probe and
+        // doc must exist. Only rendered when the snapshot carries operator criteria.
+        ...operatorReviewerSection(input.operatorCriteria),
+        // NOT-316: tagged-criterion judging lines — only when the AC text carries
+        // the tags, so untagged reviewer prompts stay byte-for-byte.
+        ...tagSemanticsReviewerSection(input.taskSnapshot.acceptanceCriteria),
+        ...executionContractSection(input.taskSnapshot.executionContract),
         `## Diff (base ${input.baseSha.slice(0, 8)} → head ${input.headSha.slice(0, 8)})`,
         "```diff",
         formatDiffForPrompt(input.diff).text,