@fitlab-ai/agent-infra 0.10.0 → 0.11.1

package/lib/platform/verification-sync.ts

@@ -1,4 +1,5 @@
 import type { VerificationShared } from "../task/verification-types.ts";
+import { normalizeVerificationRecord, platformAuditPolicy, type PlatformAuditId } from "../task/gate-policy.ts";
 import fs from "node:fs";
 import path from "node:path";
 import process from "node:process";
@@ -12,7 +13,7 @@ import { planInLabelUpdate, validateInLabelMapping } from "./in-label-sync.ts";
 import { readPrDeliveryFact } from "../task/pr-delivery-fact.ts";
 import { providerError, providerOperationContext, resourceIdentityNumber, unsupportedProviderOperation } from "./provider-bridge.ts";
 import { taskIssueIdentity } from "./task-identities.ts";
-import { isTaskCommentTooLarge } from "./issue-comments.ts";
+import { renderTaskCommentResult } from "./issue-comments.ts";
 import {
   CONTROL_MARKER_PATTERN,
   canonicalizeCommentBody,
@@ -60,8 +61,23 @@ function sanitizeCommentContent(content: string): string | null {
   return result.ok ? result.value : null;
 }
 
-export async function check({ taskDir, config, artifactFile }: any, shared: VerificationShared): Promise<any> {
-  const context = await buildSyncContext({ taskDir, config, artifactFile }, shared);
+function infoResult(message: string): any {
+  return {
+    type: CHECK_TYPE,
+    status: 'pass',
+    message,
+    classification: 'info',
+    reason: 'NOT_APPLICABLE',
+    action: 'No action required'
+  };
+}
+
+function hardResult(result: any): any {
+  return { ...result, classification: 'hard' };
+}
+
+export async function check({ taskDir, config, artifactFile, skillName }: any, shared: VerificationShared): Promise<any> {
+  const context = await buildSyncContext({ taskDir, config, artifactFile, skillName }, shared);
   if (context.earlyReturn) {
     return context.earlyReturn;
   }
@@ -72,35 +88,36 @@ export async function check({ taskDir, config, artifactFile }: any, shared: Veri
   }
 
   const subChecks = [
-    checkClosedIssueStatusLabels,
-    checkStatusLabel,
-    checkCommentMarker,
-    checkPrCommentMarker,
-    checkPrCommentLastCommit,
-    checkPrCommentRequiredPatterns,
-    checkCommentContent,
-    checkTaskCommentContent,
-    checkInLabelsComputed,
-    checkPrTypeLabel,
-    checkInLabelsMatchPr,
-    checkPrAssignee,
-    checkSyncedRequirements,
-    checkIssueType,
-    checkIssueFields,
-    checkMilestone
-  ];
-
-  for (const subCheck of subChecks) {
-    const result = subCheck(context, remoteData, shared);
-    if (result) {
-      return result;
-    }
-  }
-
-  return shared.passResult(CHECK_TYPE, `Platform sync checks passed for Issue ${context.issueNumber || "identity"}`);
+    ['closed-status-labels', checkClosedIssueStatusLabels], ['status-label', checkStatusLabel],
+    ['comment-marker', checkCommentMarker], ['pr-comment-marker', checkPrCommentMarker],
+    ['pr-comment-last-commit', checkPrCommentLastCommit], ['pr-comment-content', checkPrCommentRequiredPatterns],
+    ['comment-content', checkCommentContent], ['task-comment-content', checkTaskCommentContent],
+    ['in-labels-computed', checkInLabelsComputed], ['pr-type-label', checkPrTypeLabel],
+    ['in-labels-match-pr', checkInLabelsMatchPr], ['pr-assignee', checkPrAssignee],
+    ['requirements', checkSyncedRequirements], ['issue-type', checkIssueType],
+    ['issue-fields', checkIssueFields], ['milestone', checkMilestone]
+  ] as const;
+  const results = subChecks.map(([id, subCheck]) => {
+    const audit = platformAuditPolicy(id as PlatformAuditId, context);
+    const result = subCheck({ ...context, audit }, remoteData, shared) ?? infoResult(`Platform audit '${id}' was not evaluated`);
+    return { ...result, checkId: `platform.${id}`, classification: result.classification ?? audit.classification };
+  });
+  const blocking = results.map(normalizeVerificationRecord).find((result) => result.effectiveStatus !== 'pass');
+  return {
+    ...(blocking
+      ? {
+          type: CHECK_TYPE,
+          status: blocking.effectiveStatus,
+          message: blocking.message,
+          ...(blocking.fail_type ? { fail_type: blocking.fail_type } : {}),
+          classification: 'hard'
+        }
+      : shared.passResult(CHECK_TYPE, `Platform sync audits completed for Issue ${context.issueNumber || "identity"}`)),
+    subchecks: results
+  };
 }
 
-async function buildSyncContext({ taskDir, config, artifactFile }: any, shared: VerificationShared): Promise<any> {
+async function buildSyncContext({ taskDir, config, artifactFile, skillName }: any, shared: VerificationShared): Promise<any> {
   const task = shared.loadTask(taskDir);
   if (!task.ok) {
     return { earlyReturn: shared.failResult(CHECK_TYPE, task.message) };
@@ -139,7 +156,8 @@ async function buildSyncContext({ taskDir, config, artifactFile }: any, shared:
     }
     return { earlyReturn: shared.passResult(CHECK_TYPE, `Skipped: ${platformContext.error?.message || "platform unavailable"}`) };
   }
-  const expectedValues = resolveExpectedValues(config);
+  const effectiveSkillName = skillName || config.skillName || "code-task";
+  const expectedValues = resolveExpectedValues(effectiveSkillName, artifactFile);
   if (!expectedValues.ok) {
     return { earlyReturn: shared.failResult(CHECK_TYPE, expectedValues.message, "check_failed") };
   }
@@ -156,6 +174,7 @@ async function buildSyncContext({ taskDir, config, artifactFile }: any, shared:
     task,
     taskDir,
     config,
+    skillName: effectiveSkillName,
     artifactFile,
     artifactPath,
     issueIdentity,
@@ -174,59 +193,21 @@ async function buildSyncContext({ taskDir, config, artifactFile }: any, shared:
   };
 }
 
-function resolveExpectedValues(config: any): any {
+function resolveExpectedValues(skillName: string, artifactFile: string | undefined): any {
   const defaults = getDefaults();
-  const statusLabel = resolveDefaultValue({
-    collection: defaults.statusLabels,
-    key: config.expected_status_label_key,
-    value: config.expected_status_label,
-    configKey: "expected_status_label_key"
-  });
-  if (!statusLabel.ok) {
-    return statusLabel;
-  }
-
-  const commentMarker = resolveDefaultValue({
-    collection: defaults.markers,
-    key: config.expected_comment_marker_key,
-    value: config.expected_comment_marker,
-    configKey: "expected_comment_marker_key"
-  });
-  if (!commentMarker.ok) {
-    return commentMarker;
-  }
-
-  const prCommentMarker = resolveDefaultValue({
-    collection: defaults.markers,
-    key: config.expected_pr_comment_marker_key,
-    value: config.expected_pr_comment_marker,
-    configKey: "expected_pr_comment_marker_key"
-  });
-  if (!prCommentMarker.ok) {
-    return prCommentMarker;
-  }
-
+  const statusPolicy = platformAuditPolicy('status-label', { skillName, artifactFile });
+  const commentPolicy = platformAuditPolicy('comment-marker', { skillName, artifactFile });
+  const prCommentPolicy = ['pr-comment-marker', 'pr-comment-last-commit', 'pr-comment-content']
+    .map((id) => platformAuditPolicy(id as PlatformAuditId, { skillName, artifactFile }))
+    .find((policy) => policy.enabled && policy.expectedPrCommentMarkerKey);
   return {
     ok: true,
-    statusLabel: statusLabel.value,
-    commentMarker: commentMarker.value,
-    prCommentMarker: prCommentMarker.value
+    statusLabel: statusPolicy.enabled ? statusPolicy.expectedStatusLabel || null : null,
+    commentMarker: commentPolicy.enabled && commentPolicy.expectedCommentMarkerKey ? defaults.markers[commentPolicy.expectedCommentMarkerKey] : null,
+    prCommentMarker: prCommentPolicy?.expectedPrCommentMarkerKey ? defaults.markers[prCommentPolicy.expectedPrCommentMarkerKey] : null
   };
 }
 
-function resolveDefaultValue({ collection, key, value, configKey }: any): any {
-  if (!key) {
-    return { ok: true, value: value || null };
-  }
-
-  const resolvedValue = collection[key];
-  if (!resolvedValue) {
-    return { ok: false, message: `Unknown ${configKey}: ${key}` };
-  }
-
-  return { ok: true, value: resolvedValue };
-}
-
 async function fetchRemoteData(context: any, shared: VerificationShared): Promise<any> {
   const provider = context.provider;
   const operationContext = providerOperationContext(context.loadedContext, context.taskDir);
@@ -236,8 +217,8 @@ async function fetchRemoteData(context: any, shared: VerificationShared): Promis
       taskId: context.task?.metadata?.id || context.task?.id || "",
       ...(context.issueIdentity ? { issue: context.issueIdentity } : {}),
       ...(context.prIdentity ? { changeRequest: context.prIdentity } : {}),
-      includeComments: shouldFetchComments(context.config),
-      includeFields: Boolean(context.config.verify_issue_fields)
+      includeComments: shouldFetchIssueComments(context),
+      includeFields: true
     })
     : unsupportedProviderOperation(provider, "verification.fetchRemoteFacts");
   if (!facts.ok) {
@@ -257,7 +238,7 @@ async function fetchRemoteData(context: any, shared: VerificationShared): Promis
     }
     : null;
   let issueFields: any;
-  if (context.config.verify_issue_fields && issueSnapshot?.issueType) {
+  if (issueSnapshot?.issueType) {
     const fieldKinds = new Map(issueSnapshot.issueType.fields.map((field: { name: string; kind: string }) => [field.name, field.kind]));
     issueFields = {
       pinnedNames: new Set(issueSnapshot.issueType.fields.map((field: { name: string }) => field.name)),
@@ -265,7 +246,7 @@ async function fetchRemoteData(context: any, shared: VerificationShared): Promis
     };
   }
   let prComments = null;
-  if (context.prMarker && context.prIdentity && shouldFetchComments(context.config) && provider?.comments?.list) {
+  if (context.prMarker && context.prIdentity && shouldFetchPrComments(context) && provider?.comments?.list) {
     const listed = await provider.comments.list({ context: operationContext, parent: context.prIdentity });
     if (!listed.ok) return {
       earlyReturn: listed.error.retryable
@@ -277,7 +258,7 @@ async function fetchRemoteData(context: any, shared: VerificationShared): Promis
   const changeRequest = facts.value.changeRequest;
   let inLabelMapping: Record<string, string[]> = {};
   let repositoryLabels: string[] = [];
-  if (context.config.verify_in_labels_computed && context.hasTriage) {
+  if (platformAuditPolicy('in-labels-computed', context).enabled && context.hasTriage) {
     const mapping = loadInLabelMapping(shared);
     if (!mapping.ok) return { earlyReturn: shared.failResult(CHECK_TYPE, mapping.message, "check_failed") };
     inLabelMapping = mapping.value;
@@ -319,30 +300,31 @@ function mapTaskTypeToLabel(taskType: any): any {
   return taskTypeLabel(taskType);
 }
 
-function shouldFetchComments(config: any): any {
-  return Boolean(
-    config.expected_comment_marker
-    || config.expected_comment_marker_key
-    || config.expected_pr_comment_marker
-    || config.expected_pr_comment_marker_key
-    || config.verify_pr_comment_last_commit_matches_head
-    || config.verify_comment_content
-    || config.verify_task_comment_content
-  );
+function hasEnabledAudit(context: any, auditIds: PlatformAuditId[]): boolean {
+  return auditIds
+    .some((id) => platformAuditPolicy(id as PlatformAuditId, context).enabled);
+}
+
+function shouldFetchIssueComments(context: any): boolean {
+  return hasEnabledAudit(context, ['comment-marker', 'comment-content', 'task-comment-content']);
+}
+
+function shouldFetchPrComments(context: any): boolean {
+  return hasEnabledAudit(context, ['pr-comment-marker', 'pr-comment-last-commit', 'pr-comment-content']);
 }
 
 function checkStatusLabel(context: any, remoteData: any, shared: VerificationShared): any {
   if (!context.expectedStatusLabel || !context.hasTriage) {
-    return null;
+    return infoResult('Status label audit is not applicable because no expected label or triage capability is available');
   }
 
   if (String(remoteData.issue.state || "").toUpperCase() !== "OPEN") {
-    return null;
+    return infoResult('Status label audit is not applicable because the Issue is closed');
   }
 
   const labels = extractLabelNames(remoteData.issue.labels);
   if (labels.includes(context.expectedStatusLabel)) {
-    return null;
+    return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} has expected status label '${context.expectedStatusLabel}'`);
   }
 
   return shared.failResult(CHECK_TYPE,
@@ -352,18 +334,18 @@ function checkStatusLabel(context: any, remoteData: any, shared: VerificationSha
 }
 
 function checkClosedIssueStatusLabels(context: any, remoteData: any, shared: VerificationShared): any {
-  if (!context.config.verify_closed_issue_has_no_status_labels) {
-    return null;
+  if (!context.audit.enabled) {
+    return infoResult('Closed Issue status-label audit is not enabled for this workflow');
   }
 
   if (String(remoteData.issue.state || "").toUpperCase() !== "CLOSED") {
-    return null;
+    return infoResult('Closed Issue status-label audit is not applicable because the Issue is open');
   }
 
   const statusLabels = extractLabelNames(remoteData.issue.labels)
     .filter((label: any) => label.startsWith("status:"));
   if (statusLabels.length === 0) {
-    return null;
+    return shared.passResult(CHECK_TYPE, `Closed Issue #${context.issueNumber} has no status labels`);
   }
 
   return shared.failResult(CHECK_TYPE,
@@ -373,13 +355,13 @@ function checkClosedIssueStatusLabels(context: any, remoteData: any, shared: Ver
 }
 
 function checkCommentMarker(context: any, remoteData: any, shared: VerificationShared): any {
-  if (!context.marker) {
-    return null;
+  if (!context.audit.enabled || !context.marker) {
+    return infoResult('Issue comment-marker audit is not applicable because no marker is configured');
   }
 
   const comment = findCommentByMarker(remoteData.comments, context.marker);
   if (comment) {
-    return null;
+    return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} has expected comment marker`);
   }
 
   return shared.failResult(CHECK_TYPE,
@@ -389,13 +371,13 @@ function checkCommentMarker(context: any, remoteData: any, shared: VerificationS
 }
 
 function checkPrCommentMarker(context: any, remoteData: any, shared: VerificationShared): any {
-  if (!context.prMarker) {
-    return null;
+  if (!context.audit.enabled || !context.prMarker) {
+    return infoResult('PR comment-marker audit is not applicable because no marker is configured');
   }
 
   const comment = findCommentByMarker(remoteData.prComments, context.prMarker);
   if (comment) {
-    return null;
+    return shared.passResult(CHECK_TYPE, `PR #${context.prNumber} has expected comment marker`);
   }
 
   return shared.failResult(CHECK_TYPE,
@@ -405,95 +387,95 @@ function checkPrCommentMarker(context: any, remoteData: any, shared: Verificatio
 }
 
 function checkPrCommentLastCommit(context: any, remoteData: any, shared: VerificationShared): any {
-  if (!context.config.verify_pr_comment_last_commit_matches_head) {
-    return null;
+  if (!context.audit.enabled) {
+    return infoResult('PR last-commit audit is not enabled for this workflow');
   }
 
   if (!context.prMarker) {
-    return shared.failResult(CHECK_TYPE,
+    return hardResult(shared.failResult(CHECK_TYPE,
       "verify_pr_comment_last_commit_matches_head requires expected_pr_comment_marker",
       "check_failed"
-    );
+    ));
   }
 
   const comment = findCommentByMarker(remoteData.prComments, context.prMarker);
   if (!comment) {
-    return shared.failResult(CHECK_TYPE,
+    return hardResult(shared.failResult(CHECK_TYPE,
       `Expected PR comment marker '${context.prMarker}' not found on PR #${context.prNumber}`,
       "check_failed"
-    );
+    ));
   }
 
   const match = String(comment.body || "").match(/<!--\s*last-commit:\s*([0-9a-f]{7,40})\s*-->/i);
   if (!match) {
-    return shared.failResult(CHECK_TYPE,
+    return hardResult(shared.failResult(CHECK_TYPE,
       `PR #${context.prNumber} summary comment is missing '<!-- last-commit: <sha> -->' metadata`,
       "check_failed"
-    );
+    ));
   }
 
   const expectedHead = String(remoteData.prHeadSha || "").trim();
-  if (!expectedHead) return shared.blockedResult(CHECK_TYPE, "Unable to resolve the PR head SHA", "network_error");
+  if (!expectedHead) return hardResult(shared.blockedResult(CHECK_TYPE, "Unable to resolve the PR head SHA", "network_error"));
   const actualHead = match[1]!.trim();
   if (expectedHead === actualHead) {
-    return null;
+    return shared.passResult(CHECK_TYPE, `PR #${context.prNumber} summary comment last-commit matches HEAD`);
   }
 
-  return shared.failResult(CHECK_TYPE,
+  return hardResult(shared.failResult(CHECK_TYPE,
     `PR #${context.prNumber} summary comment last-commit metadata mismatch: expected ${expectedHead}, got ${actualHead}`,
     "check_failed"
-  );
+  ));
 }
 
 function checkPrCommentRequiredPatterns(context: any, remoteData: any, shared: VerificationShared): any {
-  const patterns = context.config.expected_pr_comment_required_patterns || [];
+  const patterns = context.audit.enabled ? context.config.expected_pr_comment_required_patterns || [] : [];
   if (!Array.isArray(patterns) || patterns.length === 0) {
-    return null;
+    return infoResult('PR comment-content audit is not enabled for this workflow');
   }
 
   if (!context.prMarker) {
-    return shared.failResult(CHECK_TYPE,
+    return hardResult(shared.failResult(CHECK_TYPE,
       "expected_pr_comment_required_patterns requires expected_pr_comment_marker",
       "check_failed"
-    );
+    ));
   }
 
   const comment = findCommentByMarker(remoteData.prComments, context.prMarker);
   if (!comment) {
-    return shared.failResult(CHECK_TYPE,
+    return hardResult(shared.failResult(CHECK_TYPE,
       `Expected PR comment marker '${context.prMarker}' not found on PR #${context.prNumber}`,
       "check_failed"
-    );
+    ));
   }
 
   const body = String(comment.body || "");
   for (const pattern of patterns) {
     const regex = new RegExp(pattern, "m");
     if (!regex.test(body)) {
-      return shared.failResult(CHECK_TYPE,
+      return hardResult(shared.failResult(CHECK_TYPE,
         `PR #${context.prNumber} summary comment is missing required pattern: ${pattern}`,
         "check_failed"
-      );
+      ));
     }
   }
 
-  return null;
+  return shared.passResult(CHECK_TYPE, `PR #${context.prNumber} summary comment has all required patterns`);
 }
 
 function checkCommentContent(context: any, remoteData: any, shared: VerificationShared): any {
-  if (!context.config.verify_comment_content) {
-    return null;
+  if (!context.audit.enabled) {
+    return infoResult('Artifact comment-content audit is not enabled for this workflow');
   }
 
   if (!context.marker) {
-    return shared.failResult(CHECK_TYPE, "verify_comment_content requires expected_comment_marker", "check_failed");
+    return hardResult(shared.failResult(CHECK_TYPE, "Artifact comment-content audit requires an expected comment marker", "check_failed"));
   }
 
   if (!context.artifactPath || !shared.safeStat(context.artifactPath)) {
-    return shared.failResult(CHECK_TYPE,
+    return hardResult(shared.failResult(CHECK_TYPE,
       `Artifact not found for comment verification: ${context.artifactFile || "(missing artifactFile)"}`,
       "check_failed"
-    );
+    ));
   }
 
   const comment = findCommentByMarker(remoteData.comments, context.marker);
@@ -503,28 +485,28 @@ function checkCommentContent(context: any, remoteData: any, shared: Verification
     const localCanonical = canonicalizeCommentBody(fs.readFileSync(context.artifactPath, "utf8"));
     const commentCanonical = canonicalizeCommentBody(extractCommentBody(comment?.body || ""));
     if (!localCanonical.ok) {
-      return shared.failResult(CHECK_TYPE,
+      return hardResult(shared.failResult(CHECK_TYPE,
         `Comment content cannot be canonicalized for '${path.basename(context.artifactPath, path.extname(context.artifactPath))}': ${localCanonical.error.message}`,
         "check_failed"
-      );
+      ));
     }
     if (!commentCanonical.ok) {
-      return shared.failResult(CHECK_TYPE,
+      return hardResult(shared.failResult(CHECK_TYPE,
         `Comment content cannot be canonicalized for '${path.basename(context.artifactPath, path.extname(context.artifactPath))}': ${commentCanonical.error.message}`,
         "check_failed"
-      );
+      ));
     }
     localContent = shared.normalizeContent(localCanonical.value);
     commentContent = shared.normalizeContent(commentCanonical.value);
   } catch (error) {
-    return shared.failResult(CHECK_TYPE,
+    return hardResult(shared.failResult(CHECK_TYPE,
       `Comment content cannot be read for '${path.basename(context.artifactPath, path.extname(context.artifactPath))}': ${error instanceof Error ? error.message : String(error)}`,
       "check_failed"
-    );
+    ));
   }
 
   if (localContent === commentContent) {
-    return null;
+    return shared.passResult(CHECK_TYPE, `Artifact comment content matches Issue #${context.issueNumber}`);
   }
 
   return shared.failResult(CHECK_TYPE,
@@ -539,13 +521,9 @@ function checkCommentContent(context: any, remoteData: any, shared: Verification
 }
 
 function checkTaskCommentContent(context: any, remoteData: any, shared: VerificationShared): any {
-  if (!context.config.verify_task_comment_content) {
-    return null;
+  if (!context.audit.enabled) {
+    return infoResult('Task comment-content audit is not enabled for this workflow');
   }
-  if (isTaskCommentTooLarge(context.task.content)) {
-    return null;
-  }
-
   const taskMarker = `<!-- sync-issue:${context.task.metadata.id}:task -->`;
   const comment = findCommentByMarker(remoteData.comments, taskMarker);
   if (!comment) {
@@ -555,18 +533,24 @@ function checkTaskCommentContent(context: any, remoteData: any, shared: Verifica
     );
   }
 
-  const expectedTaskBody = buildExpectedTaskBody(context.task.content, shared);
-  if (expectedTaskBody === null) {
-    return shared.failResult(CHECK_TYPE,
-      "Task content cannot be rendered safely for comment verification",
-      "check_failed"
+  let renderedTask: { body: string; byteLength: number };
+  try {
+    renderedTask = renderTaskCommentResult(
+      context.task.content,
+      context.task.metadata.id,
+      loadProjectLanguage(shared)
     );
+  } catch {
+    return hardResult(shared.failResult(CHECK_TYPE, "Task content cannot be rendered safely for comment verification", "check_failed"));
+  }
+  if (renderedTask.byteLength > 60_000) {
+    return hardResult(shared.failResult(CHECK_TYPE, "Task comment exceeds the platform byte limit", "check_failed"));
   }
-  const expectedBody = shared.normalizeContent(expectedTaskBody);
+  const expectedBody = shared.normalizeContent(extractCommentBody(renderedTask.body));
   const commentBody = shared.normalizeContent(extractCommentBody(comment.body || ""));
 
   if (expectedBody === commentBody) {
-    return null;
+    return shared.passResult(CHECK_TYPE, `Task comment content matches Issue #${context.issueNumber}`);
   }
 
   return shared.failResult(CHECK_TYPE,
@@ -576,17 +560,17 @@ function checkTaskCommentContent(context: any, remoteData: any, shared: Verifica
 }
 
 function checkPrTypeLabel(context: any, remoteData: any, shared: VerificationShared): any {
-  if (!context.config.verify_pr_type_label || !context.hasTriage || !context.prNumber || !remoteData.prLabels) {
-    return null;
+  if (!context.audit.enabled || !context.hasTriage || !context.prNumber || !remoteData.prLabels) {
+    return infoResult('PR type-label audit is not applicable because the required PR metadata or capability is unavailable');
   }
 
   const expectedLabel = mapTaskTypeToLabel(context.task.metadata.type);
   if (!expectedLabel) {
-    return null;
+    return infoResult('PR type-label audit is not applicable because the task type has no label mapping');
   }
 
   if (remoteData.prLabels.includes(expectedLabel)) {
-    return null;
+    return shared.passResult(CHECK_TYPE, `PR #${context.prNumber} has expected type label '${expectedLabel}'`);
   }
 
   return shared.failResult(CHECK_TYPE,
@@ -596,8 +580,8 @@ function checkPrTypeLabel(context: any, remoteData: any, shared: VerificationSha
 }
 
 function checkInLabelsMatchPr(context: any, remoteData: any, shared: VerificationShared): any {
-  if (!context.config.verify_in_labels_match_pr || !context.hasTriage || !context.prNumber || !remoteData.prLabels) {
-    return null;
+  if (!context.audit.enabled || !context.hasTriage || !context.prNumber || !remoteData.prLabels) {
+    return infoResult('PR in: label audit is not applicable because the required PR metadata or capability is unavailable');
   }
 
   const issueInLabels = extractLabelNames(remoteData.issue.labels)
@@ -608,7 +592,7 @@ function checkInLabelsMatchPr(context: any, remoteData: any, shared: Verificatio
     .sort();
 
   if (arraysEqual(issueInLabels, prInLabels)) {
-    return null;
+    return shared.passResult(CHECK_TYPE, `PR #${context.prNumber} in: labels match Issue #${context.issueNumber}`);
   }
 
   return shared.failResult(CHECK_TYPE,
@@ -618,8 +602,8 @@ function checkInLabelsMatchPr(context: any, remoteData: any, shared: Verificatio
 }
 
 function checkInLabelsComputed(context: any, remoteData: any, shared: VerificationShared): any {
-  if (!context.config.verify_in_labels_computed || !context.hasTriage) {
-    return null;
+  if (!context.audit.enabled || !context.hasTriage) {
+    return infoResult('Computed in: label audit is not applicable because it is disabled or triage capability is unavailable');
   }
 
   const expectedInLabels = computeExpectedInLabels(context.taskDir, remoteData.repositoryLabels, remoteData.inLabelMapping, shared);
@@ -630,7 +614,7 @@ function checkInLabelsComputed(context: any, remoteData: any, shared: Verificati
   }
 
   if (expectedInLabels.mode === "skipped") {
-    return null;
+    return infoResult('Computed in: label audit is not applicable because no mapped changed path exists');
   }
 
   const actualInLabels = extractLabelNames(remoteData.issue.labels)
@@ -638,7 +622,7 @@ function checkInLabelsComputed(context: any, remoteData: any, shared: Verificati
     .sort();
 
   if (arraysEqual(expectedInLabels.labels, actualInLabels)) {
-    return null;
+    return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} in: labels match committed changes`);
   }
 
   return shared.failResult(
@@ -649,13 +633,13 @@ function checkInLabelsComputed(context: any, remoteData: any, shared: Verificati
 }
 
 function checkSyncedRequirements(context: any, remoteData: any, shared: VerificationShared): any {
-  if (!context.config.sync_checked_requirements || !context.hasTriage) {
-    return null;
+  if (!context.audit.enabled || !context.hasTriage) {
+    return infoResult('Requirements audit is not applicable because it is disabled or triage capability is unavailable');
   }
 
   const checkedRequirements = shared.getCheckedRequirements(context.task.content);
   if (checkedRequirements.length === 0) {
-    return null;
+    return infoResult('Requirements audit is not applicable because the task has no checked requirements');
   }
 
   const issueBody = remoteData.issue.body || "";
@@ -664,20 +648,20 @@ function checkSyncedRequirements(context: any, remoteData: any, shared: Verifica
     requirementSectionAnchors(shared.repoRoot, context.task.metadata.type || "task")
   );
   if (resolution.status === "missing") {
-    return null;
+    return infoResult('Requirements audit is not applicable because the Issue has no requirements section');
   }
   if (resolution.status === "ambiguous") {
-    return shared.failResult(CHECK_TYPE,
+    return hardResult(shared.failResult(CHECK_TYPE,
       `Issue #${context.issueNumber} requirements section is ambiguous`,
       "check_failed"
-    );
+    ));
   }
   const requirementBody = issueBody.slice(resolution.bodyStart, resolution.bodyEnd);
   const missingRequirements = checkedRequirements.filter(
     (item: any) => !hasCheckedRequirement(requirementBody, item)
   );
   if (missingRequirements.length === 0) {
-    return null;
+    return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} contains all checked requirements`);
   }
 
   return shared.failResult(CHECK_TYPE,
@@ -687,17 +671,17 @@ function checkSyncedRequirements(context: any, remoteData: any, shared: Verifica
 }
 
 function checkIssueType(context: any, remoteData: any, shared: VerificationShared): any {
-  if (!context.config.verify_issue_type || !context.hasPush) {
-    return null;
+  if (!context.hasPush) {
+    return infoResult('Issue Type audit is not applicable because push capability is unavailable');
   }
 
   if (remoteData.issueType === undefined) {
-    return null;
+    return infoResult('Issue Type audit is not applicable because the provider does not expose Issue Type');
   }
 
   if (!remoteData.issueType) {
     if (context.repoOwnerType === "User") {
-      return null;
+      return infoResult('Issue Type audit is not applicable for a user-owned repository');
     }
 
     return shared.failResult(CHECK_TYPE,
@@ -714,16 +698,16 @@ function checkIssueType(context: any, remoteData: any, shared: VerificationShare
     );
   }
 
-  return null;
+  return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} has the expected Issue Type`);
 }
 
 function checkIssueFields(context: any, remoteData: any, shared: VerificationShared): any {
-  if (!context.config.verify_issue_fields || !context.hasPush) {
-    return null;
+  if (!context.hasPush) {
+    return infoResult('Issue field audit is not applicable because push capability is unavailable');
   }
 
   if (remoteData.issueFields === undefined) {
-    return null;
+    return infoResult('Issue field audit is not applicable because the provider does not expose Issue fields');
   }
 
   for (const [metadataKey, fieldName] of Object.entries(FRONTMATTER_FIELD_MAP)) {
@@ -753,12 +737,12 @@ function checkIssueFields(context: any, remoteData: any, shared: VerificationSha
     }
   }
 
-  return null;
+  return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} fields match task metadata`);
 }
 
 function checkPrAssignee(context: any, remoteData: any, shared: VerificationShared): any {
-  if (!context.config.verify_pr_assignee || !context.hasPush || !context.prNumber) {
-    return null;
+  if (!context.audit.enabled || !context.hasPush || !context.prNumber) {
+    return infoResult('PR assignee audit is not applicable because it is disabled or required PR metadata/capability is unavailable');
   }
 
   if (!remoteData.prAssignees || remoteData.prAssignees.length === 0) {
@@ -768,12 +752,12 @@ function checkPrAssignee(context: any, remoteData: any, shared: VerificationShar
     );
   }
 
-  return null;
+  return shared.passResult(CHECK_TYPE, `PR #${context.prNumber} has an assignee`);
 }
 
 function checkMilestone(context: any, remoteData: any, shared: VerificationShared): any {
-  if (!context.config.verify_milestone || !context.hasTriage) {
-    return null;
+  if (!context.hasTriage) {
+    return infoResult('Milestone audit is not applicable because triage capability is unavailable');
   }
 
   if (!remoteData.issue?.milestone?.title) {
@@ -790,7 +774,7 @@ function checkMilestone(context: any, remoteData: any, shared: VerificationShare
     );
   }
 
-  if (context.config.verify_milestone_specific) {
+  if (context.audit.requireSpecificMilestone) {
     const issueTitle = remoteData.issue.milestone.title;
     if (VERSION_LINE_REGEX.test(issueTitle)) {
       return shared.failResult(CHECK_TYPE,
@@ -806,7 +790,7 @@ function checkMilestone(context: any, remoteData: any, shared: VerificationShare
     }
   }
 
-  return null;
+  return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} milestone satisfies the configured policy`);
 }
 
 function findCommentByMarker(comments: any, marker: any): any {
@@ -833,7 +817,7 @@ function extractCommentBody(commentBody: any): any {
     start += 1;
   }
 
-  if (start < lines.length && /^> \*\*.+\*\* · .+$/.test(lines[start]!.trim())) {
+  if (start < lines.length && (/^> \*\*.+\*\* · .+$/.test(lines[start]!.trim()) || /^> 任务同步 · .+$/.test(lines[start]!.trim()))) {
     start += 1;
   }
 
@@ -841,6 +825,16 @@ function extractCommentBody(commentBody: any): any {
     start += 1;
   }
 
+  if (lines[start]?.trim() === "<details><summary>恢复元数据</summary>") {
+    const metadataEnd = lines.indexOf("</details>", start + 1);
+    if (metadataEnd >= 0) {
+      start = metadataEnd + 1;
+      while (start < lines.length && lines[start]!.trim() === "") {
+        start += 1;
+      }
+    }
+  }
+
   let end = lines.length;
   for (let index = lines.length - 1; index >= start; index -= 1) {
     const trimmed = lines[index]!.trim();
@@ -1042,7 +1036,9 @@ function computeExpectedInLabels(taskDir: any, repositoryLabels: string[], mappi
   if (!baseRef) {
     return { ok: false, type: "check_failed", message: "Task has no delivery_base_ref for in-label evidence" };
   }
-  const changedFilesResult = gitText(["diff", `${baseRef}...HEAD`, "--name-only"], taskDir);
+  const branch = typeof task.metadata?.branch === "string" ? task.metadata.branch.trim() : "";
+  const gitCwd = branch ? worktreeForBranch(shared.repoRoot, branch) ?? taskDir : taskDir;
+  const changedFilesResult = gitText(["diff", `${baseRef}...HEAD`, "--name-only"], gitCwd);
   if (!changedFilesResult.ok) {
     return { ...changedFilesResult, type: "network_error" };
   }
@@ -1069,6 +1065,25 @@ function computeExpectedInLabels(taskDir: any, repositoryLabels: string[], mappi
   return { ok: true, labels: planned.target, mode: "mapped" };
 }
 
+function worktreeForBranch(repositoryRoot: string, branch: string): string | null {
+  try {
+    const records = execFileSync("git", ["worktree", "list", "--porcelain"], {
+      cwd: repositoryRoot,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim().split(/\r?\n\r?\n/);
+    const expectedRef = `refs/heads/${branch}`;
+    for (const record of records) {
+      const worktree = /^worktree (.+)$/m.exec(record)?.[1];
+      const branchRef = /^branch (.+)$/m.exec(record)?.[1];
+      if (worktree && branchRef === expectedRef) return worktree;
+    }
+  } catch {
+    // Fall back to taskDir so ordinary in-repository task workspaces retain their behavior.
+  }
+  return null;
+}
+
 function loadInLabelMapping(shared: VerificationShared): any {
   const configPath = path.join(shared.repoRoot, ".agents", ".airc.json");
   if (!fs.existsSync(configPath)) {