Bad mental model:
  Find file, edit file, run test.

Better mental model:
  Change creates a propagation frontier. Agent must discover, constrain,
  repair, verify, and stop before crossing unsafe boundaries.

// before
User findUser(String id);

// after
Optional<User> findUser(UserId id);

Change frontier:
  Himpunan node/file/symbol yang perlu dievaluasi karena root change.

Autonomous agent may apply root, derived, guard, and mechanical changes.
Autonomous agent must justify or block opportunistic changes.
Boundary-crossing changes require explicit task scope or approval.

{
  "root_change": {
    "symbol": "UserRepository.findUser",
    "from": "User findUser(String id)",
    "to": "Optional<User> findUser(UserId id)"
  },
  "expected_frontier": [
    "UserService",
    "UserController",
    "UserRepositoryTest",
    "UserServiceTest"
  ],
  "boundary_risks": [
    "UserController public response semantics may change"
  ],
  "repair_strategy": "compile-driven iterative repair",
  "stop_condition": "compile and targeted tests pass; no unresolved references to old signature"
}

{
  "file": "src/main/java/com/acme/user/UserService.java",
  "line": 42,
  "symbol": "findUser",
  "error_type": "method_signature_mismatch",
  "message": "method findUser in interface UserRepository cannot be applied to given types",
  "expected": "UserId",
  "actual": "String",
  "suggested_repair": "wrap String id with UserId.of(id)"
}

Raw errors:
  87 call sites pass String to UserId
  14 tests expect User instead of Optional<User>
  3 imports unused
  2 mapper methods return null

Clusters:
  C1: convert String id to UserId at call sites
  C2: unwrap Optional with explicit not-found handling
  C3: update tests for Optional result
  C4: cleanup imports

function clusterCompileErrors(errors: CompileError[]): ErrorCluster[] {
  return groupBy(errors, e => [
    e.errorType,
    e.symbol,
    e.expectedType,
    e.actualType
  ].join("|"));
}

type FrontierItem = {
  file: string;
  symbol?: string;
  reason: "root" | "reference" | "compile_error" | "test_failure" | "schema_dependency";
  risk: "low" | "medium" | "high";
  allowedActions: string[];
};

Add file to frontier if:
  - it directly references changed symbol,
  - compiler reports error in file,
  - targeted test fails due to changed behavior,
  - schema/config artifact explicitly depends on changed type.

Do not add file if:
  - only similar text appears in comment,
  - change would cross contract boundary not in task scope,
  - file is generated and source generator not updated,
  - owner boundary requires approval.

If root change modifies internal private method:
  repair callers autonomously.

If root change modifies public API:
  require compatibility strategy or explicit breaking-change approval.

public interface UserRepository {
    User findUser(String id);
}

public interface UserRepository {
    Optional<User> findUser(UserId id);
}

public interface UserRepository {
    Optional<User> findUser(UserId id);

    @Deprecated(forRemoval = false)
    default User findUser(String id) {
        return findUser(UserId.of(id)).orElse(null);
    }
}

Is this API public to other modules/repositories?
Can all callers be updated in one PR?
What compatibility behavior must remain?

# compile affected module
mvn -pl user-domain compile

# compile affected module plus dependents when known
mvn -pl user-domain,user-service,user-api -am compile

# targeted tests
mvn -pl user-service -Dtest=UserServiceTest test

# broader verification
mvn -pl user-domain,user-service,user-api -am test

{
  "max_files_changed": 25,
  "max_lines_changed": 800,
  "max_compile_repair_iterations": 5,
  "max_boundary_crossings": 0,
  "requires_approval_above_risk": "medium"
}

NEEDS_SCOPE_SPLIT

C1: 87 call sites need UserId.of(id)
  -> deterministic AST rewrite if pattern clear.

C2: 14 tests expect User but method returns Optional<User>
  -> agentic repair because semantics differ per test.

C3: public controller not-found behavior
  -> human/judge escalation because API semantics may change.

You are performing a bounded multi-file code migration.

Root change:
- ROOT_CHANGE

Allowed derived changes:
- Update direct call sites.
- Update imports caused by changed call sites.
- Update tests directly covering changed behavior.
- Add regression tests for changed behavior.

Forbidden unless explicitly approved:
- Public API breaking changes outside ROOT_CHANGE.
- Deleting tests.
- Disabling tests.
- Large unrelated refactors.
- Updating generated files without updating their source generator.
- Changing database/schema/config contracts outside task scope.

Process:
1. Inspect frontier.
2. Apply minimal patch.
3. Run verifier.
4. Use verifier errors to expand frontier.
5. Stop when verifier passes or budget is exceeded.

Output:
- Patch.
- Frontier report.
- Verification report.
- Boundary risk report.

{
  "root_change": "UserRepository.findUser(String) -> findUser(UserId)",
  "changed_files": [
    {
      "path": "UserRepository.java",
      "classification": "root",
      "reason": "method signature migration"
    },
    {
      "path": "UserService.java",
      "classification": "derived",
      "reason": "direct caller compile error"
    },
    {
      "path": "UserServiceTest.java",
      "classification": "guard",
      "reason": "test expectation updated and regression case added"
    }
  ],
  "boundary_risks": [
    {
      "path": "UserController.java",
      "risk": "public HTTP not-found behavior",
      "decision": "preserved existing 404 behavior"
    }
  ]
}

{
  "verdict": "fail",
  "findings": [
    {
      "severity": "high",
      "path": "src/main/java/com/acme/payment/PaymentService.java",
      "message": "File does not reference changed symbol and no verifier error pointed to it. Change appears unrelated."
    }
  ]
}

If generated file changes:
  require source generator input change or generated artifact regeneration command.

Allowed:
  - update test setup for new type/signature,
  - add regression test,
  - update expectation only when behavior intentionally changed and evidence exists.

Blocked or escalated:
  - remove assertion,
  - loosen assertion,
  - delete failing test,
  - disable test,
  - update snapshot with no semantic explanation.

// before
User user = repository.findUser("u-1");
assertThat(user.name()).isEqualTo("Ana");

// after
User user = repository.findUser(UserId.of("u-1")).orElseThrow();
assertThat(user.name()).isEqualTo("Ana");

// after
Optional<User> user = repository.findUser(UserId.of("u-1"));
assertThat(user).isPresent();

{
  "repair": "change controller not-found handling",
  "classification": "semantic",
  "risk": "high",
  "requires": "explicit behavior decision"
}

async function performCascadingChange(task: Task): Promise<RunResult> {
  const plan = await planner.createMultiFilePlan(task);
  const frontier = new Frontier(plan.rootFiles);

  await applyRootChange(plan.rootChange);

  for (let i = 0; i < plan.maxIterations; i++) {
    const verification = await verifier.compile(frontier.affectedModules());

    if (verification.passed) {
      const tests = await verifier.runTargetedTests(frontier.relatedTests());
      if (tests.passed) {
        return await finalizeWithBroaderVerification(frontier);
      }
      const testRepairs = await classifyTestFailures(tests.failures);
      await applyAllowedRepairs(testRepairs, frontier);
      continue;
    }

    const clusters = clusterCompileErrors(verification.errors);
    const repairs = await proposeRepairs(clusters, frontier, plan.policy);

    const policy = await policyEngine.evaluateRepairs(repairs);
    if (!policy.allowed) {
      return await stopForApproval(policy, frontier);
    }

    await applyRepairs(repairs);
    frontier.expandFromRepairs(repairs);

    if (frontier.exceedsBudget(plan.budget)) {
      return await stopForScopeSplit(frontier);
    }
  }

  return await stopForIterationLimit(frontier);
}

Continue editing until something works.

Stop, summarize unresolved frontier, ask for scope split or approval.

## Root Change

Migrated `UserRepository.findUser(String)` to `findUser(UserId)` internally.

## Derived Changes

Updated direct call sites in:
- `UserService`
- `UserController`
- `UserRepositoryTest`
- `UserServiceTest`

## Boundary Decisions

- Preserved HTTP 404 behavior for missing users.
- Did not change OpenAPI response schema.
- Kept deprecated compatibility overload for callers outside this module.

## Regression Guard

Added:
- `UserServiceTest#returnsNotFoundWhenUserMissingAfterUserIdMigration`

## Verification

- `mvn -pl user-domain,user-service -am compile` ✅
- `mvn -pl user-service -Dtest=UserServiceTest test` ✅
- `mvn -pl user-domain,user-service -am test` ✅

## Frontier Report

See `artifact://runs/456/frontier-report.json`.

public enum CaseStatus {
    OPEN,
    CLOSED
}

public enum CaseStatus {
    DRAFT,
    ACTIVE,
    RESOLVED,
    CLOSED
}

{
  "risk": "high",
  "reason": "Enum is serialized and persisted",
  "autonomous_allowed": false,
  "required_plan": [
    "compatibility mapping",
    "database migration",
    "OpenAPI update",
    "consumer rollout",
    "rollback behavior"
  ]
}

Money toMoney(BigDecimal amount, String currency)

Money toMoney(BigDecimal amount, CurrencyCode currency)

create table run_frontier_item (
  id uuid primary key,
  run_id uuid not null,
  path text not null,
  symbol text,
  reason text not null,
  risk text not null,
  status text not null,
  created_at timestamptz not null default now()
);

create table run_repair_cluster (
  id uuid primary key,
  run_id uuid not null,
  error_type text not null,
  symbol text,
  file_count int not null,
  risk text not null,
  decision text not null,
  created_at timestamptz not null default now()
);

artifact://runs/{runId}/frontier-report.json
artifact://runs/{runId}/compile-errors.json
artifact://runs/{runId}/repair-clusters.json
artifact://runs/{runId}/boundary-risk-report.json

Keeps editing until build passes.

Understands the root change, tracks the propagation frontier,
classifies derived changes, respects boundaries, uses compiler/test feedback,
and stops when the change becomes unsafe or too large.