@cassiomc1/forgeloop 1.10.0 → 1.10.2

package/src/adapters/ripwire/provider.js

@@ -0,0 +1,245 @@
+import path from "node:path";
+
+import { assertSafePath } from "../../core/filesystem.js";
+import {
+  normalizeAdvisoryRecallOptions,
+} from "../../core/advisory-context/constants.js";
+import {
+  E_ADVISORY_CONTEXT_PROVIDER_INVALID,
+  E_ADVISORY_CONTEXT_PROVIDER_UNAVAILABLE,
+  E_ADVISORY_CONTEXT_RESULT_INVALID,
+  E_ADVISORY_CONTEXT_TIMEOUT,
+} from "../../core/error-codes.js";
+import {
+  RIPWIRE_PROCESS_LIMITS,
+  parseRipwireVersion,
+  runRipwireCommand,
+} from "./process.js";
+import {
+  extractCandidateRows,
+  getRipwireRowPath,
+  normalizeReportedPath,
+  normalizeRipwireResult,
+} from "./normalize.js";
+
+function providerError(code, message) {
+  const error = new Error(message);
+  error.name = "RipwireAdvisoryProviderError";
+  error.code = code;
+  return error;
+}
+
+function assertAbsoluteExecutablePath(value) {
+  if (typeof value !== "string" || value.trim() === "" || !path.isAbsolute(value) || /\p{Cc}/u.test(value)) {
+    throw providerError(E_ADVISORY_CONTEXT_PROVIDER_INVALID, "Ripwire executablePath must be an absolute portable path");
+  }
+  return value;
+}
+
+function assertExpectedVersion(value) {
+  if (
+    typeof value !== "string"
+    || value.trim() === ""
+    || value.length > 64
+    || !/^[A-Za-z0-9][A-Za-z0-9._+-]*$/u.test(value)
+  ) {
+    throw providerError(E_ADVISORY_CONTEXT_PROVIDER_INVALID, "Ripwire expectedVersion must be a qualified version token under 64 characters");
+  }
+  return value;
+}
+
+function assertProcessLimit(value, maximum, label) {
+  if (!Number.isSafeInteger(value) || value < 1 || value > maximum) {
+    throw providerError(E_ADVISORY_CONTEXT_PROVIDER_INVALID, `${label} must be an integer between 1 and ${maximum}`);
+  }
+  return value;
+}
+
+function remainingTimeout(deadline) {
+  const remaining = deadline - Date.now();
+  if (remaining < 1) {
+    throw providerError(E_ADVISORY_CONTEXT_TIMEOUT, "Ripwire advisory recall deadline expired");
+  }
+  return remaining;
+}
+
+function reportTransport(callback, payload) {
+  if (typeof callback !== "function") return;
+  try {
+    callback(Object.freeze({ ...payload }));
+  } catch {
+    // Observability hooks cannot change advisory correctness or failure mapping.
+  }
+}
+
+async function runAndReport(executablePath, args, {
+  cwd,
+  timeoutMs,
+  spawnImpl,
+  env,
+  maxStdoutBytes,
+  maxStderrBytes,
+  onTransport,
+  kind,
+} = {}) {
+  const result = await runRipwireCommand(executablePath, args, {
+    cwd,
+    timeoutMs,
+    spawnImpl,
+    env,
+    maxStdoutBytes,
+    maxStderrBytes,
+  });
+  reportTransport(onTransport, {
+    kind,
+    stdoutBytes: result.stdoutBytes,
+    stderrBytes: result.stderrBytes,
+    durationMs: result.durationMs,
+  });
+  return result;
+}
+
+function queryArguments(projectPath, query) {
+  return [
+    projectPath,
+    `--for=${query}`,
+    "--signatures-only",
+    "--json",
+    "--no-cache",
+    "--exclude=.forgeloop",
+  ];
+}
+
+/**
+ * Create an optional host-injected Ripwire adapter.
+ *
+ * Construction is inert: it validates the explicit executable/version pair
+ * but does not discover binaries, spawn processes, access the network, or
+ * write lifecycle state. Version qualification is repeated lazily before a
+ * query so a changed executable cannot silently change the provider identity.
+ */
+export function createRipwireAdvisoryContextProvider({
+  executablePath,
+  expectedVersion,
+  spawnImpl,
+  env,
+  maxStdoutBytes = RIPWIRE_PROCESS_LIMITS.maxStdoutBytes,
+  maxStderrBytes = RIPWIRE_PROCESS_LIMITS.maxStderrBytes,
+  onTransport,
+} = {}) {
+  const qualifiedExecutablePath = assertAbsoluteExecutablePath(executablePath);
+  const qualifiedExpectedVersion = assertExpectedVersion(expectedVersion);
+  const qualifiedStdoutLimit = assertProcessLimit(maxStdoutBytes, RIPWIRE_PROCESS_LIMITS.maxStdoutBytes, "Ripwire stdout limit");
+  const qualifiedStderrLimit = assertProcessLimit(maxStderrBytes, RIPWIRE_PROCESS_LIMITS.maxStderrBytes, "Ripwire stderr limit");
+
+  const provider = {
+    id: "ripwire",
+    version: qualifiedExpectedVersion,
+    async recall({
+      projectPath,
+      taskId,
+      query,
+      limit,
+      maxItemChars,
+      maxTotalChars,
+      timeoutMs,
+    } = {}) {
+      if (typeof projectPath !== "string" || !path.isAbsolute(projectPath) || /\p{Cc}/u.test(projectPath)) {
+        throw providerError(E_ADVISORY_CONTEXT_PROVIDER_INVALID, "Ripwire projectPath must be an absolute path");
+      }
+      if (typeof taskId !== "string" || taskId.trim() === "") {
+        throw providerError(E_ADVISORY_CONTEXT_PROVIDER_INVALID, "Ripwire taskId must be a non-empty string");
+      }
+      if (typeof query !== "string" || query.trim() === "" || /\p{Cc}/u.test(query)) {
+        throw providerError(E_ADVISORY_CONTEXT_PROVIDER_INVALID, "Ripwire query must be a non-empty portable string");
+      }
+      const options = normalizeAdvisoryRecallOptions({ limit, maxItemChars, maxTotalChars, timeoutMs });
+      const projectRoot = path.resolve(projectPath);
+      try {
+        await assertSafePath(projectRoot, ".");
+      } catch {
+        throw providerError(E_ADVISORY_CONTEXT_PROVIDER_UNAVAILABLE, "Ripwire target directory is unavailable or unsafe");
+      }
+
+      const deadline = Date.now() + options.timeoutMs;
+      let versionResult;
+      try {
+        versionResult = await runAndReport(qualifiedExecutablePath, ["--version"], {
+          cwd: projectRoot,
+          timeoutMs: remainingTimeout(deadline),
+          spawnImpl,
+          env,
+          maxStdoutBytes: Math.min(qualifiedStdoutLimit, 64 * 1024),
+          maxStderrBytes: qualifiedStderrLimit,
+          onTransport,
+          kind: "version",
+        });
+      } catch (error) {
+        throw error.code ? error : providerError(E_ADVISORY_CONTEXT_PROVIDER_UNAVAILABLE, "Ripwire version probe failed");
+      }
+
+      let actualVersion;
+      try {
+        actualVersion = parseRipwireVersion(versionResult.stdout);
+      } catch {
+        throw providerError(E_ADVISORY_CONTEXT_PROVIDER_INVALID, "Ripwire version probe was not qualified");
+      }
+      if (actualVersion !== qualifiedExpectedVersion) {
+        throw providerError(
+          E_ADVISORY_CONTEXT_PROVIDER_INVALID,
+          "Ripwire executable version does not match the expected qualified version",
+        );
+      }
+
+      let queryResult;
+      try {
+        queryResult = await runAndReport(qualifiedExecutablePath, queryArguments(projectRoot, query), {
+          cwd: projectRoot,
+          timeoutMs: remainingTimeout(deadline),
+          spawnImpl,
+          env,
+          maxStdoutBytes: qualifiedStdoutLimit,
+          maxStderrBytes: qualifiedStderrLimit,
+          onTransport,
+          kind: "query",
+        });
+      } catch (error) {
+        throw error.code ? error : providerError(E_ADVISORY_CONTEXT_PROVIDER_UNAVAILABLE, "Ripwire query failed");
+      }
+
+      let raw;
+      try {
+        raw = JSON.parse(queryResult.stdout);
+      } catch {
+        throw providerError(E_ADVISORY_CONTEXT_RESULT_INVALID, "Ripwire query did not return valid JSON");
+      }
+
+      if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        throw providerError(E_ADVISORY_CONTEXT_RESULT_INVALID, "Ripwire query JSON root must be an object");
+      }
+
+      const safeSourcePaths = new Set();
+      const rows = extractCandidateRows(raw) ?? [];
+      for (const row of rows) {
+        const relativePath = normalizeReportedPath(getRipwireRowPath(row), projectRoot);
+        if (!relativePath) continue;
+        try {
+          await assertSafePath(projectRoot, relativePath);
+          safeSourcePaths.add(relativePath);
+        } catch {
+          // The normalizer will disclose and drop this candidate.
+        }
+      }
+
+      return normalizeRipwireResult(raw, {
+        projectPath: projectRoot,
+        ...options,
+        sourcePathValidator: (relativePath) => safeSourcePaths.has(relativePath),
+      });
+    },
+  };
+
+  return Object.freeze(provider);
+}
+
+export { queryArguments };

package/src/commands/doctor.js

@@ -116,16 +116,7 @@ async function adoptAdapters({ target, manifest, adoptPaths, findings }) {
 
 export async function runDoctor({ target, packageRoot, adoptPaths = [], strict = false, fix = false }) {
   const findings = [];
-  const incompleteTransactions = await findIncompleteTransactions(target);
-  for (const transaction of incompleteTransactions) {
-    findings.push(finding(
-      "E_TRANSACTION_INCOMPLETE",
-      "error",
-      `.forgeloop/.txn/${transaction.transactionId}`,
-      `Transaction ${transaction.transactionId} is ${transaction.status} and requires inspection or deterministic recovery.`,
-      "Run forgeloop doctor --fix only after ensuring no active process owns the task lock.",
-    ));
-  }
+  let incompleteTransactions = await findIncompleteTransactions(target);
   if (fix && incompleteTransactions.some((transaction) => transaction.status === "COMMITTING")) {
     const recovered = await recoverIncompleteTransactions(target);
     for (const transaction of recovered) {
@@ -136,6 +127,16 @@ export async function runDoctor({ target, packageRoot, adoptPaths = [], strict =
         `Transaction recovery result: ${transaction.status}.`,
       ));
     }
+    incompleteTransactions = await findIncompleteTransactions(target);
+  }
+  for (const transaction of incompleteTransactions) {
+    findings.push(finding(
+      "E_TRANSACTION_INCOMPLETE",
+      "error",
+      `.forgeloop/.txn/${transaction.transactionId}`,
+      `Transaction ${transaction.transactionId} is ${transaction.status} and requires inspection or deterministic recovery.`,
+      "Run forgeloop doctor --fix only after ensuring no active process owns the task lock.",
+    ));
   }
   let manifest = null;
   let manifestChanged = false;

package/src/core/actions.js

@@ -1,7 +1,7 @@
 import { mkdir, readdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 
-import { getActiveTaskTransaction, withTaskTransaction } from "./transaction.js";
+import { getTaskTransaction, withTaskTransaction } from "./transaction.js";
 import { appendProtocolEvent, readEvents } from "./events.js";
 import {
   canonicalActionFingerprint,
@@ -63,7 +63,7 @@ async function writeActionFile(target, packageRoot, taskId, action) {
   const relPath = taskActionPath(taskId, action.actionId);
   await assertSafePath(target, relPath);
   const serialized = `${JSON.stringify(action, null, 2)}\n`;
-  const activeTransaction = getActiveTaskTransaction();
+  const activeTransaction = (await getTaskTransaction(target));
   if (activeTransaction) {
     await activeTransaction.stageText(relPath, serialized);
   } else {

package/src/core/advisory-context/service.js

@@ -20,6 +20,8 @@ import {
   E_PORTABLE_CONTEXT_INVALID,
 } from "../error-codes.js";
 
+const PROVIDER_CLEANUP_GRACE_MS = 1000;
+
 function serviceError(code, message, cause) {
   const error = new Error(message, cause !== undefined ? { cause } : undefined);
   error.name = "AdvisoryContextServiceError";
@@ -106,30 +108,50 @@ export async function recallAdvisoryContext({
   }
 
   let timer;
+  let cleanupTimer;
+  const timeoutError = serviceError(
+    E_ADVISORY_CONTEXT_TIMEOUT,
+    `Advisory recall from provider "${providerName}" timed out after ${effectiveOptions.timeoutMs}ms`,
+  );
+  const recallPromise = Promise.resolve(
+    provider.recall({
+      projectPath: path.resolve(target),
+      taskId,
+      query: normalizedQuery,
+      ...effectiveOptions,
+    }),
+  );
+  let timedOut = false;
+  const guardedRecallPromise = recallPromise.then(
+    (value) => timedOut ? new Promise(() => {}) : value,
+    (error) => {
+      if (timedOut) return new Promise(() => {});
+      throw error;
+    },
+  );
   const timeoutPromise = new Promise((_, reject) => {
     timer = setTimeout(() => {
-      reject(
-        serviceError(
-          E_ADVISORY_CONTEXT_TIMEOUT,
-          `Advisory recall from provider "${providerName}" timed out after ${effectiveOptions.timeoutMs}ms`,
-        ),
+      timedOut = true;
+      cleanupTimer = setTimeout(() => reject(timeoutError), PROVIDER_CLEANUP_GRACE_MS);
+      recallPromise.then(
+        () => {
+          clearTimeout(cleanupTimer);
+          reject(timeoutError);
+        },
+        () => {
+          clearTimeout(cleanupTimer);
+          reject(timeoutError);
+        },
       );
     }, effectiveOptions.timeoutMs);
   });
 
   let rawResult;
   try {
-    const recallPromise = Promise.resolve(
-      provider.recall({
-        projectPath: path.resolve(target),
-        taskId,
-        query: normalizedQuery,
-        ...effectiveOptions,
-      }),
-    );
-    rawResult = await Promise.race([recallPromise, timeoutPromise]);
+    rawResult = await Promise.race([guardedRecallPromise, timeoutPromise]);
   } finally {
     clearTimeout(timer);
+    clearTimeout(cleanupTimer);
   }
 
   return normalizeAdvisoryContextResult(rawResult, {

package/src/core/approvals.js

@@ -1,7 +1,7 @@
 import { mkdir, readdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 
-import { getActiveTaskTransaction, withTaskTransaction } from "./transaction.js";
+import { getTaskTransaction, withTaskTransaction } from "./transaction.js";
 import { appendProtocolEvent } from "./events.js";
 import { canonicalFingerprint } from "./artifacts.js";
 import {
@@ -49,7 +49,7 @@ async function writeApprovalFile(target, taskId, approval) {
   const relPath = taskApprovalPath(taskId, approval.approvalId);
   await assertSafePath(target, relPath);
   const serialized = `${JSON.stringify(approval, null, 2)}\n`;
-  const activeTransaction = getActiveTaskTransaction();
+  const activeTransaction = (await getTaskTransaction(target));
   if (activeTransaction) {
     await activeTransaction.stageText(relPath, serialized);
   } else {

package/src/core/artifacts.js

@@ -5,7 +5,7 @@ import { assertSecretFree } from "./receipt.js";
 import { assertJsonBytes, assertJsonLimits } from "./json-safety.js";
 import { assertSchema, readSchema } from "./schema-validation.js";
 import { getPackageRoot } from "./templates.js";
-import { getActiveTaskTransaction, withTaskTransaction } from "./transaction.js";
+import { getTaskTransaction, withTaskTransaction } from "./transaction.js";
 
 export const ARTIFACT_PATHS = Object.freeze({
   contract: ".forgeloop/current-contract.json",
@@ -76,7 +76,7 @@ export async function readJsonArtifact(
   }
 
   const artifactPath = ensureWithin(target, relativePath);
-  const transaction = getActiveTaskTransaction();
+  const transaction = (await getTaskTransaction(target));
   const stagedText = transaction ? await transaction.readText(relativePath) : null;
   if (stagedText === null && !(await fileExists(artifactPath))) {
     throw new ArtifactError(
@@ -124,7 +124,7 @@ export async function writeJsonArtifact(
   } catch (error) {
     throw artifactError("ARTIFACT_PATH_INVALID", relativePath, error);
   }
-  const activeTransaction = getActiveTaskTransaction();
+  const activeTransaction = (await getTaskTransaction(target));
   if (!activeTransaction && taskId && !dryRun) {
     return withTaskTransaction({ target, taskId, operation, packageRoot }, async () => (
       writeJsonArtifact(target, relativePath, value, schemaName, packageRoot, { dryRun, taskId, operation })

package/src/core/checks.js

@@ -134,36 +134,3 @@ export function assertCheckList(value, label = "checks", options = {}) {
   });
   return value;
 }
-
-function requiredChecksSatisfiedBy(checks, requiredValues, selector, { allowInferred = false } = {}) {
-  assertCheckList(checks);
-  if (!Array.isArray(requiredValues)) throw checkError("E_CHECK_INVALID", "required values must be an array");
-  const errors = [];
-  for (const value of requiredValues) {
-    const candidates = checks.filter((check) => selector(check) === value);
-    const check = candidates.find((candidate) => candidate.status === "passed"
-      && (allowInferred || candidate.evidenceKind === "OBSERVED"))
-      ?? candidates.find((candidate) => candidate.status === "passed")
-      ?? candidates[0];
-    if (!check) {
-      errors.push(checkError("E_EVIDENCE_REQUIRED", `Required check is missing: ${value}`, [value]));
-      continue;
-    }
-    if (check.status !== "passed") {
-      errors.push(checkError("E_EVIDENCE_REQUIRED", `Required check is not passed: ${value}`, [value]));
-      continue;
-    }
-    if (!allowInferred && check.evidenceKind !== "OBSERVED") {
-      errors.push(checkError("E_EVIDENCE_KIND_INVALID", `Required check must be observed: ${value}`, [value]));
-    }
-  }
-  return errors;
-}
-
-export function requiredChecksSatisfied(checks, requiredIds, options = {}) {
-  return requiredChecksSatisfiedBy(checks, requiredIds, (check) => check.id, options);
-}
-
-export function requiredChecksSatisfiedForRequirements(checks, requiredRequirements, options = {}) {
-  return requiredChecksSatisfiedBy(checks, requiredRequirements, (check) => check.requirement, options);
-}

package/src/core/completion.js

@@ -17,7 +17,7 @@ import { listActions } from "./actions.js";
 import { readConfig } from "./config.js";
 import { resolveResponsibilityStatus } from "./responsibility.js";
 import { createCodeManifest, readCodeManifest, validateCodeManifestBindings, writeCodeManifest } from "./code-manifest.js";
-import { getActiveTaskTransaction, withTaskTransaction } from "./transaction.js";
+import { getTaskTransaction, withTaskTransaction } from "./transaction.js";
 import { validateStructuralQualityCheckProvenance } from "./structural-quality/service.js";
 
 async function attestationConfiguration(target, packageRoot, errors) {
@@ -856,7 +856,7 @@ async function runCompleteInternal({
 
 export async function runComplete(options = {}) {
   const taskId = options.taskId ?? null;
-  if (options.persist !== false && taskId && !getActiveTaskTransaction()) {
+  if (options.persist !== false && taskId && !(await getTaskTransaction(options.target))) {
     return withTaskTransaction({
       target: options.target,
       taskId,

package/src/core/events.js

@@ -11,7 +11,7 @@ import { PROTOCOL_VERSION } from "./protocol.js";
 import { isRecoverableCompletionEvidenceCode } from "./completion-recovery.js";
 
 import { taskArtifactPath } from "./task-paths.js";
-import { getActiveTaskTransaction, withTaskTransaction } from "./transaction.js";
+import { getTaskTransaction, withTaskTransaction } from "./transaction.js";
 
 import { assertDiagnosisDetails } from "./diagnosis-model.js";
 import {
@@ -311,7 +311,7 @@ export function buildProtocolEvent(input, { checkpoint } = {}) {
 }
 
 export async function previewProtocolEvent(target, input, packageRoot, options = {}) {
-  const activeTransaction = getActiveTaskTransaction();
+  const activeTransaction = (await getTaskTransaction(target));
   if (!activeTransaction) {
     return withTaskTransaction({
       target,
@@ -337,7 +337,7 @@ export async function readEvents(target, packageRoot, options = {}) {
   const relPath = options?.eventsPath ?? options?.relativePath ?? (options?.taskId ? taskArtifactPath(options.taskId, "events") : ARTIFACT_PATHS.events);
   await assertSafePath(target, relPath);
   const eventsPath = ensureWithin(target, relPath);
-  const transaction = getActiveTaskTransaction();
+  const transaction = (await getTaskTransaction(target));
   if (transaction) {
     const stagedText = await transaction.readText(relPath);
     if (stagedText !== null) return parseEventsText(stagedText, relPath, packageRoot);
@@ -355,7 +355,7 @@ export async function readEventTail(target, packageRoot, options = {}) {
   const relPath = options?.eventsPath ?? options?.relativePath ?? (options?.taskId ? taskArtifactPath(options.taskId, "events") : ARTIFACT_PATHS.events);
   await assertSafePath(target, relPath);
   const eventsPath = ensureWithin(target, relPath);
-  const transaction = getActiveTaskTransaction();
+  const transaction = (await getTaskTransaction(target));
   if (transaction) {
     const stagedText = await transaction.readText(relPath);
     if (stagedText !== null) {
@@ -411,7 +411,7 @@ async function parseEventsText(text, relPath, packageRoot) {
 }
 
 export async function appendProtocolEvent(target, input, packageRoot, options = {}) {
-  const activeTransaction = getActiveTaskTransaction();
+  const activeTransaction = (await getTaskTransaction(target));
   if (typeof input?.taskId !== "string" || !input.taskId) throw protocolError("E_EVENT_INVALID", "event taskId is required");
   if (typeof input?.event !== "string" || !input.event) throw protocolError("E_EVENT_INVALID", "event type is required");
   const relPath = options?.eventsPath ?? options?.relativePath ?? (options?.taskId ? taskArtifactPath(options.taskId, "events") : ARTIFACT_PATHS.events);

package/src/core/execution-profile.js

@@ -66,24 +66,37 @@ function contractCollections(contract) {
 
 function contractSignals(contract) {
   const collections = contractCollections(contract);
+  const obligations = [];
+  const types = new Set();
+  function collect(requirement) {
+    if (typeof requirement === "string") obligations.push(requirement);
+    else if (requirement && typeof requirement === "object") {
+      if (typeof requirement.text === "string") obligations.push(requirement.text);
+      types.add(requirement.type);
+      if (Array.isArray(requirement.requirements)) requirement.requirements.forEach(collect);
+    }
+  }
+  collections.successCriteria.forEach(collect);
+  if (Array.isArray(contract?.verification)) contract.verification.forEach(collect);
   const riskText = collections.risks.join(" ").toLowerCase();
+  // Constraints and stop conditions describe boundaries, not obligations.
+  // Declared route risks remain authoritative even when a constraint excludes
+  // an operation; do not try to interpret prose negation as authorization.
   const allText = [
     ...collections.deliverables,
-    ...collections.successCriteria,
-    ...collections.constraints,
-    ...collections.stopConditions,
+    ...obligations,
   ].join(" ").toLowerCase();
   const combinedText = `${riskText} ${allText}`;
   const signals = {
     secrets: /\bsecrets?\b|\bcredentials?\b|\bpasswords?\b|\bprivate keys?\b/.test(combinedText),
     personalData: /\bpersonal[- ]data\b|\bpii\b|\bsensitive data\b/.test(combinedText),
-    publication: /\bpublication\b|\bpublish(?:ing|ed)?\b|\bdeploy(?:ment|ed)?\b/.test(combinedText),
+    publication: types.has("PUBLICATION") || /\bpublication\b|\bpublish(?:ing|ed)?\b|\bdeploy(?:ment|ed)?\b/.test(combinedText),
     destructive: /\bdestructive\b|\birreversible\b|\bdrop database\b|\bdelete production\b/.test(combinedText),
     migration: /\bmigration\b|\bmigrate\b|\bschema change\b|\birreversible persistence\b/.test(combinedText),
     payment: /\bpayments?\b|\bcheckout\b|\bbilling\b/.test(combinedText),
     externalMutation: /\bexternal mutation\b|\bmutate(?:s|d)? external\b|\bpublish(?:ing|ed)?\b/.test(combinedText),
     authoritySensitiveExternalMutation: /\bauthority[- ]sensitive\b|\bhost[- ]authorized external\b|\bexternal mutation requiring authority\b/.test(combinedText),
-    broadProductionValidation: /\bbroad production validation\b|\bproduction validation\b|\bvalidate in production\b/.test(combinedText),
+    broadProductionValidation: types.has("PRODUCTION_READINESS") || /\bbroad production validation\b|\bproduction validation\b|\bvalidate in production\b/.test(combinedText),
   };
   return signals;
 }

package/src/core/handoff-acceptance.js

@@ -126,7 +126,7 @@ export async function acceptCanonicalHandoff(target, {
     assertPortableContextSafe(normalizedHarness, { label: "harness" });
   }
 
-  return withTaskTransaction(
+  const runAcceptance = () => withTaskTransaction(
     {
       target,
       taskId,
@@ -274,4 +274,13 @@ export async function acceptCanonicalHandoff(target, {
       };
     },
   );
+
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    try {
+      return await runAcceptance();
+    } catch (error) {
+      if (error?.code !== "E_TASK_LOCKED" || attempt === 2) throw error;
+      await new Promise((resolve) => setTimeout(resolve, 25 * (attempt + 1)));
+    }
+  }
 }