Contract verification report for d6e6448 (macOS arm64).

• Global CLI discovery: qwen 0.24.6 --help / --version passed. These planned Java task-event/cancel routes cannot be exercised through the CLI, so verification used the real contract validator and independent schema checks. Runtime E2E is deferred to H3 and the cancellation implementation slices.
• Java: PlannedTaskContractTest, ManagedAgentApiContractTest, ManagedSessionStoreContractFixtureTest: 15 tests passed; Checkstyle: 0 violations. JDK 21.0.11, Maven 3.8.4.
• WebShell: regeneration and both managed API tests passed. Published structure comparison against the baseline was identical after excluding descriptions/version metadata.
• Baseline: all four task-cancel schema/union paths accepted cancelled and failed without a reason. Updated: all four reject those cases and retain valid states and other command kinds. Independent checks: 76 baseline + 76 updated passed.
• Reverse verification: 10 one-rule mutations across public and WebShell schemas were caught by the intended assertions (cancelled status, missing failure reason, unknown event field, missing cursor, null cursor). Mutations used temporary copies, not the working tree.
• Frozen-lockfile install, complete build/bundle via prepare, root typecheck, focused ESLint, Prettier and diff checks passed. Local bundle version smoke check passed.
• Three open-ended/reverse audit rounds completed before commit; the last two independently reported Critical 0 / Suggestion 0. The first round corrected recovery waiting indefinitely for a live stream to reach its end.

Final OpenAPI SHA256: 29183869ef7e0107bae8b92fe73beda137a597448e85e2ee88d499572ee90882. These results establish schema constraints and existing consumer compatibility, not the future runtime's retention, publication, archival or cancellation guarantees.

@qwen-code /takeover

🤝 Takeover engaged: the autofix loop now manages this PR — it will address new review feedback and resolve base conflicts until the label is removed or the round cap is reached. Remove the autofix/takeover label (or comment @qwen-code /takeover stop) to release.

✅ AutoFix round 5 finished — view run. See this round's report below.

🤖 Addressed the latest review feedback (round 1/100). What changed, and what I pushed back on: · 已处理最新评审反馈（第 1/100 轮）。改动内容与我反驳保留之处如下：

Round summary

Both inline suggestions from the automated reviewer were reproduced as real
coverage gaps on the current spec and implemented in
packages/sdk-java/managed-agent-server/src/test/java/com/alibaba/qwen/code/managedagent/PlannedTaskContractTest.java.
No production code, spec, or documentation changed. Commit:
test(managed-agent): Pin the task artifact_refs bound and event field matrix (#12998).

[rc:4134535131] R1-1 — artifact_refs maxItems: 100 / uniqueItems unexercised — Implemented

Reproduced the gap before editing: deleting maxItems: 100 from both
artifact_refs mirrors left all 7 PlannedTaskContractTest tests green.

In taskViewKeepsItsStateInvariants, next to the existing
"duplicate capability" reject, added two rejects built from the existing
task(...) helper (so the instances still satisfy PublicTask's state
conditionals): one with 101 artifact_refs entries, one with a duplicated
entry. The existing check() mirror machinery validates each instance against
both PublicTask and the camelCase WebShellTask copy.

[rc:4134535150] R1-2 — newly permitted optional event field not covered — Implemented

Reproduced the gap before editing: adding an unconditioned optional
exit_code/exitCode property to both event mirrors left all 7 tests green.

Added pinEventFieldTotality(), called at the end of
taskEventsKeepOneShapePerType. It derives the optional property set from
each schema (properties minus top-level required) and asserts that for
each known type (state_changed, output, artifact) every optional
property is either in that type's then.required or in its
then.not.anyOf[].required, apart from one explicit companions allow-table
(state_changed → runtime_state, output → truncated, artifact → none,
per design section 4.3). The same table is camelCased with the existing
camelCase() helper for the WebShellTaskEvent mirror reached through
MIRRORS, so the WebShell copy is checked against the same table rather than
a second hand-listed set. A conditional added for a type missing from the
table also fails, keeping the matrix explicit.

Mutation probes

Each probe mutated the spec, re-ran mvn test -Dtest=PlannedTaskContractTest,
and was reverted with git checkout afterwards:

• maxItems: 100 removed from both mirrors → RED:
  PublicTask/WebShellTask artifact_refs over the bound: expected invalid.
• uniqueItems: true removed from both mirrors → RED:
  PublicTask/WebShellTask duplicate artifact_ref: expected invalid.
• {"required": ["artifact_id"]} removed from the output conditional's
  not.anyOf on both mirrors → RED: output leaves artifact_id /
  artifactId neither required nor forbidden (the reviewer's acceptance
  mutation).
• Unconditioned optional exit_code/exitCode added to both mirrors → RED:
  totality failure on all three known types on both mirrors.
• Conditional added for an unlisted fourth type (cancelled) → RED:
  has an unlisted conditional for cancelled on both mirrors.

After restoring the spec, the suite is green again.

Verification

• mvn test -Dtest=PlannedTaskContractTest (managed-agent-server) — 7 tests passed
• mvn test (managed-agent-server, full unit suite) — 184 tests passed
• mvn checkstyle:check (managed-agent-server) — passed, 0 violations
• npm run build — passed (with COREPACK_HOME=/tmp/corepack-home; the sandbox's HOME is read-only for the build user)
• npm run typecheck — passed
• npm run lint — passed
• Focused Vitest: not applicable — the touched package (packages/sdk-java/managed-agent-server) is Maven-only and has no JS test gate; no TypeScript file changed this round.

Base-conflict check · 基分支冲突检查: no conflict with main. · 与 main 无冲突。

🧵 Resolved all 2 selected review thread(s). · 已关闭全部选中的 2 条评审线程。

Re-review when you have a moment. After round 100 this bot stops and leaves the PR for a human. · 有空请复审；第 100 轮后本 bot 停止并将 PR 交给人工。

🧠 Handled by Qwen Code · model/模型 kimi-k3 · CLI 0.24.7

@qwen-code /takeover from 3

🤝 Takeover engaged: the autofix loop now manages this PR — it will address new review feedback and resolve base conflicts until the label is removed or the round cap is reached. This window's round counter starts at 3 (the rounds this PR spent in review before takeover), so the Critical-only brake engages after 2 more change-producing round(s) instead of a full fresh 5. Remove the autofix/takeover label (or comment @qwen-code /takeover stop) to release.

@qwen-code /resolve

Qwen Code resolved the merge conflicts and pushed the branch update.

Merge resolution: PR #12998 ← main

Merge commit 05047ae6c7 (parents edae9a9e73 + a1c90bd2a8). Only conflicted — and only edited — file: managed-agent-public-api.openapi.json (sdk-java).

Root cause

A contract-version race. On main, #12955 (G0 public Workspace file turns) bumped info.version 1.21.0 → 1.22.0 and appended a v1.22 … sentence to info.description. This PR bumped the same two lines to 1.22.0 for the settled task event/cancel semantics. Both wrote to the same append point, so git could not order them. The rest did not overlap and auto-merged; main's four G0 edits all survived.

Textual + one semantic decision

Textually adjacent, but info.version is an append-only shared namespace and both claimed 1.22. main's v1.22 is already published, so this PR's entry renumbers to v1.23 (junction elided):

"version": "1.23.0",
"description": "… 404. v1.22 adds deployment-opted-in creation with an initial Workspace file-tool Turn (G0) … v1.23 settles the planned task event and cancel semantics: … remain planned."

Load-bearing

• Append order. main's v1.22 sentence must precede this PR's v1.23 sentence, and info.version must equal the highest vN.NN in that history. Appending without raising info.version, or reusing a number main has since published, breaks this.
• Nothing pins the version. OpenApiContract.java asserts none, server.test.ts's sole OpenAPI hit is a comment, and the web-shell generator never emits info. So no regeneration was needed — managed-agent-api.ts auto-merged as an exact union.
• Union verified. Diff vs main = 94 insertions / 23 deletions, identical to this PR's diff vs the merge-base; parses as JSON, no duplicate keys.

Not verified / follow-up

• Two stale version references remain in files that did not conflict, so I left them: docs/design/2026-09-27-managed-agent-task-contract.md:52 ("in contract v1.22.0") and …task-contract.zh-CN.md:41. A follow-up must renumber both to v1.23.0 or the docs contradict the contract; nothing else cites a version.
• No build/typecheck/lint/test was run. PlannedTaskContractTest.java and managed-agent-api.test.ts read paths/schemas, not info, so the renumber should not reach them — unverified.

Local real-environment verification — PR #12998 @ 05047ae6 (macOS arm64)

Verdict: mergeable. I found no correctness defect in the contract, the schema conditionals or the generated client. Before merging, I recommend fixing F1: two design-doc lines and the PR description still say v1.22.0 after the /resolve renumber. F2 (the three open bot threads) is test strength only; a verified candidate is linked below. Coordinate N1 (version numbering) with #12946, which also claims 1.23.0.

Environment. JDK 21.0.12 · Maven 3.9.16 · Node 24.18.1 · pnpm 11.24.0 (frozen, offline) · Spring Boot 3.5.16 jars · dedicated MySQL 8.4.11 container (JVM and DB both UTC). The base arm is the merge base a1c90bd2. origin/main is now 19684f37, one unrelated commit ahead, and a trial merge with it is clean.

What I ran

Findings

F1 — stale version references (docs; small fix, recommended before merge). 05047ae6 renumbered the contract to 1.23.0 and added a v1.23 history sentence. Three places still say v1.22.0:

• docs/design/2026-09-27-managed-agent-task-contract.md:52: "settles A1–A8 … in contract v1.22.0"
• docs/design/2026-09-27-managed-agent-task-contract.zh-CN.md:41: "在契约 v1.22.0 中确定"
• the PR description: "Contract v1.22.0 …" and "The contract version is 1.22.0 on top of main's 1.21.0."

The /resolve result already listed the two doc lines as a follow-up; they are still unchanged at this head.

F2 — the three open Suggestions are real test-strength gaps (non-blocking). I confirmed each one independently with a mutant that the current suites let through:

• R2-1: lowering artifact_refs maxItems from 100 to 50 survives, because no instance accepts a full list.
• R2-2: making state_changed forbid its companion runtime_state survives.
• R1-2 (fix-induced): replacing output's {required:[artifact_id]} with a conjunction {artifact_id, state} survives, because pinEventFieldTotality counts each name of a conjunction as forbidden.

A +15/−6 candidate fixes all three:

• accept exactly 100 unique refs, and reject 101 from the same instance;
• accept state_changed with runtime_state: ready;
• count only single-name not.anyOf branches as forbidding a field.

With it, all three mutants are killed by the intended assertions, the unmutated baseline stays 15/15, the other 12 mutants give the same results, and Checkstyle is 0. AutoFix round 4 is still running. If it lands a different fix, the linked harness re-checks it against the same mutants in a few minutes.

N1 — merge order with #12946 (both claim contract 1.23.0). #12946 (H1 Hosted MCP) also sets "version": "1.23.0" and appends its own v1.23 sentence; each PR merges cleanly with main on its own. After this PR lands, merging #12946 conflicts only on info.description. The "version": "1.23.0" line is identical on both sides, so git merges it silently. A resolver who just concatenates the two sentences leaves two v1.23 entries under one version. Whichever PR lands second must bump to 1.24.0 by hand, in the JSON and in any design-doc reference (see F1). #13037 (draft) still claims v1.22, which main's G0 already uses.

N2 — correction to triage Stage 2, note 3 (activation coupling). Un-planning only the new conditional does not produce a generated type that requires an undeclared field. openapi-typescript does not render if/then; the output just gains one more & unknown. The §4.1 rule (un-plan the conditional together with taskId/failureCode) is still right for contract consistency. Either way, the generated-sync test forces a regeneration (mutant C7), so the trap cannot pass CI silently.

N3 — live observation for the H3 gate. Real Sessions advertise capabilities.tasks: true, artifacts: false. That fits the new rule "any output-producing task requires capabilities.artifacts" only because no served task produces output yet: ManagedTaskService always returns empty artifact_refs. Consider adding "flip artifacts before the first output-producing task" to the §6.1 acceptance list. Optional.

Gaps disclosed by the bot reviews that this run covers

• Round 1 said it "did not run PlannedTaskContractTest under the real networknt validator". This run did, and also checked the same instances with Ajv (pre-release: fix ci #1, TypeError in Authentication Selection Interface #5).
• Round 2 said "zero mutants probed" and that its Suggestions had "no independent verifier ruling". This run used 15 mutants, and each of the three Suggestions reproduces (API Key是要设成阿里云的API Key吗？ #7, F2).
• Round 2 also said the consumers "were never systematically traced". The runtime never reads the spec. artifact_refs is always empty in ManagedTaskService. The generator output matches byte for byte (如何自定义密钥文件 .env可能与其他文件冲突 #3, OpenAI API Error: 401 Incorecct API Key provided #6).

CI and scope

At this head, 21 checks pass and only review-pr is pending. Hosted process fault gates / MySQL 8.4 was red on d6e6448 (a pre-existing main failure) and is green on 05047ae6.

Not covered:

• Runtime retention, publication, archival and cancellation guarantees. Those routes are unmapped; §6.1 correctly defers them to H3 and the cancel slice.
• Windows/Linux locally. The change is platform-independent contract data, and the CI Java legs on ubuntu, windows and macOS are green.

The harness is here: build, real-server A/B, Ajv differential, generator probe, mutants and figures.

🤖 Addressed the latest review feedback (round 4/100). What changed, and what I pushed back on: · 已处理最新评审反馈（第 4/100 轮）。改动内容与我反驳保留之处如下：

Autofix round — PR #12998

Two commits this round: a merge of origin/main resolving the contract-version conflict, and one commit resolving all three review findings in PlannedTaskContractTest.java (net 46 insertions / 46 deletions).

Merge conflict resolution (--conflict true)

packages/sdk-java/managed-agent-server/src/main/resources/openapi/managed-agent-public-api.openapi.json conflicted in info: both this PR and main's #12955 (G0 public Workspace file turns) had bumped the contract from 1.21.0 to 1.22.0 with different change entries. Resolved by keeping main's v1.22 entry intact and renumbering this PR's entry to v1.23 ("version": "1.23.0", description sentence v1.23 settles the planned task event and cancel semantics: ...). The two design docs that named the follow-up's contract version were renumbered to match (docs/design/2026-09-27-managed-agent-task-contract.md and its .zh-CN.md twin, one occurrence each). The rest of the file merged textually; the merged JSON parses, has no duplicate keys, and the WebShell client was regenerated with npm run generate:managed-agent-api --workspace=@qwen-code/web-shell, which produced no diff — the auto-merged generated file was already correct, and it embeds no version string.

Findings

R2-1 [rc:4138276315] — artifact_refs bound pinned only in the widening direction — RESOLVED

Claim verified by reading the test: task() seeds an empty artifact_refs and only the two rejects populated it, so lowering maxItems below 100 was unobservable. Implemented the suggested fix: added an at-bound accept of exactly 100 distinct refs (artifact-0…artifact-99, satisfying uniqueItems and the 1–128 item length bounds) ahead of the over-bound reject, mirroring the file's own two-sided pin of the limit bound (100 valid / 101 invalid).

Mutation probe: set maxItems 100 → 99 on both PublicTask.artifact_refs and WebShellTask.artifactRefs, ran the suite — taskViewKeepsItsStateInvariants failed on both surfaces with artifact_refs at the bound: expected valid (the previously invisible mutation). Restored; suite green.

R2-2 [rc:4138276348] — no positive assertion that state_changed permits its runtime_state companion — RESOLVED

Resolved by the probe rewrite below: the generated probe set includes state_changed with runtime_state (runtime_state: "ready", a valid TaskRuntimeState literal) expecting valid on both surfaces, which is exactly the requested positive assertion.

Mutation probe: added {"required": ["runtime_state"]} to the state_changed conditional's then.not.anyOf on PublicTaskEvent (and {"required": ["runtimeState"]} on WebShellTaskEvent) — taskEventsKeepOneShapePerType failed on both surfaces with state_changed with runtime_state: expected valid. Restored; suite green.

R1-2 [rc:4138276359] — totality helper flattens not.anyOf[].required, so a conjunction branch silently widens — RESOLVED

Implemented the finding's class-closing fix rather than the narrower fail-loudly guard: pinEventFieldTotality() no longer re-implements the constraint grammar. It still discovers the conditional types from the document (failing closed on an unlisted conditional) and the top-level optional property set, but now builds each type's minimal valid event and, for every optional field, issues a validator probe via the existing check(...): companions expect valid, every other field expects invalid. Prohibition spelling no longer matters — the validator decides — and the mirror leg comes free from check(), so the hand-rolled mirror loop and camelCase branch are gone. A new optional field without a known valid probe value fails closed (no known valid value for ...). Three hand-written crossing checks (state_changed with text, output with state, artifact with truncated) were removed because the probe loop regenerates byte-identical instances for them; required-ness pins (state_changed without state, output without text, empty output, artifact without artifact_id) are untouched. This is a .java test file, outside the JS/TS test-weakening watch; the regeneration preserves every removed assertion.

Mutation probe: merged output's not.anyOf branches [{required:[runtime_state]}, {required:[artifact_id]}] into [{required:[runtime_state, artifact_id]}] on both surfaces (the exact witness from the finding) — taskEventsKeepOneShapePerType failed on both surfaces with output with runtime_state: expected invalid and output with artifact_id: expected invalid. Restored; suite green.

Verification

• mvn -o -B -Dmaven.repo.local=/tmp/pr13061-m2/repository test -Dtest=PlannedTaskContractTest (JDK 21.0.12.1, Maven 3.9.11) — 7/7 green on the merged contract before the fix (baseline), and 7/7 green after the fix.
• Mutation probe A (R2-1): maxItems 100 → 99 on both artifact_refs surfaces — FAIL as expected (artifact_refs at the bound: expected valid, both surfaces); restored and re-green.
• Mutation probe B (R2-2): {"required": ["runtime_state"]} added to state_changed's then.not.anyOf on both event schemas — FAIL as expected (state_changed with runtime_state: expected valid, both surfaces); restored and re-green.
• Mutation probe C (R1-2): output's forbid branches merged into one conjunction on both event schemas — FAIL as expected (output with runtime_state / output with artifact_id: expected invalid, both surfaces); restored and re-green.
• mvn -o -B -Dmaven.repo.local=/tmp/pr13061-m2/repository test (full managed-agent-server module) — 196 tests, 0 failures, BUILD SUCCESS.
• mvn -o -B -Dmaven.repo.local=/tmp/pr13061-m2/repository checkstyle:check — BUILD SUCCESS.
• npx vitest run client/components/managed/managed-agent-api.test.ts (packages/web-shell) — 2 passed.
• COREPACK_HOME=/tmp/corepack-cache npm run build — passed (COREPACK_HOME override needed because corepack cannot write to the sandboxed $HOME/.cache).
• COREPACK_HOME=/tmp/corepack-cache npm run typecheck — passed (exit 0).
• COREPACK_HOME=/tmp/corepack-cache npm run lint — passed (exit 0).

Base-conflict check · 基分支冲突检查: conflicted with main — resolved in this push. · 与 main 有冲突——已在本次推送中解决。

⚠️ The branch received new commits while this round ran; they were merged into this push, but this round's verification predates that merge — re-check anything that landed mid-run. · 本轮运行期间分支收到了新的提交；本次推送已将其合并，但本轮验证在合并之前完成——请复查运行期间落地的改动。

⚠️ Review-thread resolution skipped — guard: salvage merge; resolved 0 of 3 selected thread(s), 3 left for a later round. · 评审线程关闭被跳过——守卫:salvage merge;选中 3 条,本轮关闭 0 条,其余 3 条留待后续轮次。

Re-review when you have a moment. After round 100 this bot stops and leaves the PR for a human. · 有空请复审；第 100 轮后本 bot 停止并将 PR 交给人工。

🧠 Handled by Qwen Code · model/模型 kimi-k3 · CLI 0.24.7

🤖 Addressed the latest review feedback (round 5/100). What changed, and what I pushed back on: · 已处理最新评审反馈（第 5/100 轮）。改动内容与我反驳保留之处如下：

AutoFix round — PR #12998 (commit b1754087cd)

All eight round-3 inline findings are addressed in the code; the maintainer's
verification comment is answered below. Five files changed, all inside the
PR's footprint: the two design docs, the OpenAPI spec, the planned-contract
test, and the regenerated WebShell types (+253/−63).

Findings

R3-1 — 409 session_operation_active missing from cancel admission (rc:4141536997).
Resolved, taking the finding's first option: cancel admission IS subject to
the Session-scoped open-operation guard, because cancel operations share
managed_agent_operation with the lifecycle commands and the implemented
store admits one open operation per Session. A6 step 5 now states this, §4.7
gains the session_operation_active row, and A7's "different keys" promise is
scoped to keys that each pass admission including step 5 — in both languages.
Both cancel route descriptions (public and WebShell) now name the code, so a
client mapping the documented 409s has a branch for it. No Java change: the
guard already exists and is what the cancel slice will reuse.

R3-2 — A7 settled only status (rc:4141537004). Resolved. A7 now fixes
the sibling required fields per outcome (both languages): pending/running
carry java_durable and pending/leased with no receipt; completed
carries harness_confirmed, confirmed and the task authority's
receipt_id; failed and recovery_blocked carry java_durable and
delivery_state: blocked — delivery stopped, never claimable again — with
failed adding failure_code. This defines the previously unproduced
blocked value rather than retiring it (the alternative the finding offered),
because the terminal non-completed outcomes need a non-claimable delivery
state. The pairing is encoded as two task_cancel conditionals inside the
same planned allOf member on both surfaces, so the generator still filters
it out. PlannedTaskContractTest.taskCancelOutcomesDescribeTheCommand now
pins one instance per settled outcome with its required pair, plus negatives
(still pending, still java_durable, still unconfirmed) — the instances
the finding named now go red without the conditionals (measured, see
Verification).

R3-3 — §6.1 lacks the capabilities precondition (rc:4141537012).
Resolved. Both §6.1 lists gain a bullet: before routes become partial, H3
must demonstrate that a Session with capabilities.tasks: true and
capabilities.artifacts: false admits no output-producing task, including one
whose output goes only to Artifacts. This also implements the maintainer's
optional N3 note.

R3-4 — rotation prohibition not propagated (rc:4141537018). Resolved.
Both artifact_refs/artifactRefs field descriptions now forbid rotation
until older Artifacts can be enumerated and attributed to the task (an evicted
Artifact stays readable by id but is not discoverable from the task); design
§4.2 points at the bound instead of assuring safe rotation; §7's "should add"
became "must land", matching §4.7. The WebShell types were regenerated, so the
stale assurance no longer reaches SDK authors.

R3-5 — task-events 409 resolves to the replaced rule (rc:4141537027).
Resolved with the finding's first option: a new TaskCursorExpired response
component ("strictly below the task's durable retention floor, which survives
an empty retained set; equality is valid; replay_floor_sequence and
snapshot_through_sequence stay absent because task cursors are opaque") now
backs the 409 of both planned task-events routes. The shared CursorExpired
is untouched, so the implemented Session events route keeps its true
retained-floor description. The §4.7 table rows in both languages already
stated this rule, so no doc edit was needed there.

R3-6 — failure_code has no durable home (rc:4141537036). Resolved as
tracked follow-up work, which is what the finding asked for: §4.1's
cancel-slice sentence now requires the migration (task_id and
failure_code columns on managed_agent_operation, the reason written in the
same transaction as the FAILED transition so it survives re-lease and
restart), and §7 gains a "Cancel operation storage" bullet beside the Artifact
attribution one. Both languages.

R3-7 — failure_code rule has no scoping test (rc:4141537046). Resolved
with the finding's exact instance: another command may fail without a code
(a failed submit_input with no code stays valid). The hoist mutant the
finding described reddens it on all four schemas (measured, see Verification).

R2-2 (fix-induced) — mirror blind spot in pinEventFieldTotality
(rc:4141537053). Resolved: the helper now asserts the WebShellTaskEvent
property set equals the camelCased PublicTaskEvent set and enumerates the
mirror's conditionals for unlisted types. The mirrorOnly mutant and a
mirror-only conditional both red-den it (measured). The javadoc's guarantee
now covers both surfaces.

Maintainer comment (ic:5902574154)

• F1 (stale v1.22.0 references): both design-doc lines already read
  v1.23.0 at this head (the renumber commit fixed them; verified by grep).
  The PR description still says v1.22.0 — I have no GitHub credentials, so the
  body edit is left for the workflow or a maintainer.
• F2 (three test-strength gaps): R2-1 (100-entry bound accept/reject
  instances) and R1-2 (validator-probe totality, no name counting) are present
  at this head and were verified through the surrogate matrix. R2-2's
  replacement gap is fixed above.
• N1 (merge order with feat(managed-agent): Implement private Hosted MCP runtime (H1) #12946): a maintainer decision — whichever PR lands
  second must bump to 1.24.0. Not settled here.
• N2: noted, no action. N3: implemented via the R3-3 §6.1 bullet.

Verification

Java/Maven is not installed on this runner, so the Maven suites could not be
run here; CI's Java legs re-run them. As the surrogate, the full
PlannedTaskContractTest instance matrix (173 checks at v1, 193 at v2,
including the camelCase WebShell mirrors, the union schemas, and the
totality/parity logic) was ported to Ajv's draft 2020-12 dialect — the same
draft the networknt validator implements — and calibrated against the
pristine spec before any edit.

• Surrogate calibration, current matrix vs pristine spec: 173 checks, 0 failures
  (matches the green Java suite at this head).
• Current matrix vs edited spec: exactly 12 failures — the three
  pre-existing instances the new pairing conditionals correctly reject
  (recovery_blocked/completed/failed with delivery_state: pending),
  on all four schemas. The conditionals have teeth.
• Updated matrix vs edited spec: 193 checks, 0 failures.
• Updated matrix vs pristine (pre-round) spec: exactly 16 failures, all of
  them this round's new negative instances — the changed tests fail pre-round
  and pass post-round.
• Mutation probes against the edited spec (each caught by the intended test):
  • hoist-failure-code (R3-7's mutant, both surfaces) → 4 failures, all
    another command may fail without a code.
  • mirrorOnly property on WebShellTaskEvent (R2-2's mutant B2) → parity
    assertion fails.
  • pairing conditionals dropped → all 16 pairing negatives fail.
  • mirror-only conditional for an unlisted type → WebShellTaskEvent has an unlisted conditional failure.
  • pairing dropped from the mirror only → 8 mirror-side failures.
• npm run generate:managed-agent-api --workspace=@qwen-code/web-shell —
  regenerated; diff is exactly the two description lines (the planned
  conditionals and the new component stay filtered out).
• npx vitest run client/components/managed/managed-agent-api.test.ts
  (packages/web-shell) — 2/2 passed.
• npm run build — passed (with COREPACK_HOME=/tmp/corepack-cache; the
  sandbox's default corepack cache path is not writable, which otherwise
  aborts the pnpm shim before any compilation).
• npm run typecheck — passed.
• npm run lint — passed.
• node scripts/lint.js --prettier (the CI format gate) — passed.
• Local $ref integrity sweep over the full spec — all resolve;
  CursorExpired keeps its one implemented referrer, TaskCursorExpired has
  exactly the two planned task-events referrers.

Not run here (no JDK on this runner): mvn -o test / checkstyle:check for
managed-agent-server. The Java edits are instance data plus the finding's
own helper code following the file's existing patterns; the surrogate above
reproduces their verdicts, and CI's Java legs remain the final gate.

Base-conflict check · 基分支冲突检查: no conflict with main. · 与 main 无冲突。

🧵 Resolved all 8 selected review thread(s). · 已关闭全部选中的 8 条评审线程。

Re-review when you have a moment. After round 100 this bot stops and leaves the PR for a human. · 有空请复审；第 100 轮后本 bot 停止并将 PR 交给人工。

🧠 Handled by Qwen Code · model/模型 kimi-k3 · CLI 0.24.7

@qwen-code /triage

👋 Takeover released: the autofix loop will no longer engage this PR (an in-flight round, if any, completes its bounded work). Re-apply autofix/takeover (or comment @qwen-code /takeover) to re-engage.

Maintainer real-environment verification (Linux) — head b1754087cd

Verdict: all green. Independently re-verified on a Linux box against the current head (main at e8fc540be7), covering every item of the reviewer test plan that is checkable before the routes are mapped. Evidence (logs + harness + screenshots) is preserved on the assets branch: wenshao/qwen-code@assets-pr12998 → pr12998/linux-b1754087/.

Environment: Linux x86_64 · Node v24.14.0 · pnpm 11.24.0 (corepack, --frozen-lockfile) · Temurin JDK 21.0.12.1 · Maven · Ajv 8.20.0 (draft 2020-12).

1. Build & static gates

• corepack pnpm install --frozen-lockfile passed; the prepare lifecycle completed the full build and bundle.
• Root typecheck ✅, focused eslint ✅, prettier --check on all changed files ✅.

2. Java contract suites — 29/29 (PR body says 15; head has grown)

mvn test -Dtest='*Contract*' in packages/sdk-java/managed-agent-server:

Checkstyle: 0 violations.

3. WebShell contract generation — 2/2 tests, zero drift

• managed-agent-api.test.ts: 2/2 passed.
• generate:managed-agent-api re-run: byte-identical to the committed client (no drift).
• Planned surface confirmed excluded from the published client: 0 x-qwen-implementation-status markers, no WebShellTaskEventPage, no WebShellTaskCancelRequest; the only published task paths remain tasks/get and tasks/query.

4. Before/after: the four task_cancel tightenings (Ajv, independent of the Java suite)

Key instances validated against main's contract (v1.22.0) vs the PR contract (v1.23.0), through PublicCommandOperation and the PublicOperation union:

5. Independent schema validation — 90 + 90 checks, 10/10 mutations caught

A self-contained Ajv harness (validate.mjs) ran 90 behavioral checks with per-version expectations against both contracts — both operation unions plus the camelCase WebShell mirrors, task state invariants, artifact_refs 100/101/duplicate bounds, event unknown-field rejection, per-type field totality probes, and empty-page cursor rules (null/missing next_cursor rejected; empty page keeping its position accepted). 90/90 pass on the baseline and 90/90 on the updated contract. Separately, 10 hand-written schema mutations (drop the whole outcome conditional, allow cancelled, drop failure_code requirement, drop each settled-state pin, open additionalProperties, drop the output/state prohibition, drop uniqueItems, …) were all caught (10/10) by the corresponding behavioral assertion.

6. Published client structure: identical to main

Regenerated the client from main's spec and from the PR spec and diffed: exactly 4 changed lines, all inside the two shared @description strings — zero structural change, matching the PR's claim.

7. Design docs

EN/ZH decisions synchronized: identical section structure (16/16 numbered sections), both pinned to contract v1.23.0.

Screenshots

Notes for the author (non-blocking)

• The PR body is stale relative to head: it says "15 Java tests" (head runs 29 across the contract suites) and "contract 1.22.0 on top of main's 1.21.0" (actual: 1.23.0 on main's 1.22.0). Consider refreshing the Evidence section when convenient.
• Runtime task-event / task-cancel E2E remains unverifiable by design (routes unmapped, still planned) — consistent with the PR's declared scope; the cursor-floor and backpressure semantics were verified at the contract level only.

🤖 Generated with Claude Code