@fitlab-ai/agent-infra 0.11.0 → 0.11.1

package/dist/lib/internal/manual-validation.js

@@ -23,6 +23,7 @@ function printFailure(format, error) {
     process.exitCode = 1;
 }
 const MANUAL_VALIDATION_STATUS_SECTION = /^###\s+(?:⚠️\s+(?:需人工校验|Manual Validation Required)|✅\s+(?:人工验证已通过|无需人工校验|Manual Validation Passed|No Manual Validation Required)|⏳\s+(?:人工验证待收尾|Manual Validation Pending))\s*$[\s\S]*?(?=^#{1,3}\s|(?![\s\S]))/gmu;
+const TRAILING_CANONICAL_REPORT_PLACEHOLDER = /\n*<!--\s*canonical-pr-change-report\s*-->\s*$/u;
 function manualSummaryBody(body, phase, transactionId, receiptDigest = '', evidenceDigest = '', prHeadSha = '') {
     const chinese = /###\s+(?:⚠️\s+需人工校验|✅\s+(?:人工验证已通过|无需人工校验)|⏳\s+人工验证待收尾)\s*$/mu.test(body);
     const section = phase === 'pending'
@@ -33,11 +34,14 @@ function manualSummaryBody(body, phase, transactionId, receiptDigest = '', evide
             ? `### ✅ 人工验证已通过\n\n人工验证已通过；transaction=${transactionId}; receipt=${receiptDigest}; evidence=${evidenceDigest}; head=${prHeadSha}.`
             : `### ✅ Manual Validation Passed\n\nManual validation passed; transaction=${transactionId}; receipt=${receiptDigest}; evidence=${evidenceDigest}; head=${prHeadSha}.`;
     let inserted = false;
-    const updated = body.replace(MANUAL_VALIDATION_STATUS_SECTION, () => {
+    const updated = body.replace(MANUAL_VALIDATION_STATUS_SECTION, (matched) => {
         if (inserted)
             return '';
         inserted = true;
-        return `${section}\n\n`;
+        const trailingPlaceholder = TRAILING_CANONICAL_REPORT_PLACEHOLDER.exec(matched)?.[0];
+        return trailingPlaceholder
+            ? `${trailingPlaceholder.trim()}\n\n${section}\n\n`
+            : `${section}\n\n`;
     });
     return inserted ? `${updated.replace(/\s+$/u, '')}\n` : `${body.replace(/\s+$/u, '')}\n\n${section}\n`;
 }

package/dist/lib/platform/issues.js

@@ -538,11 +538,10 @@ async function syncPlatformIssue(taskRef, options) {
     if (failure)
         return result('failed', base.resolved.taskId, base.issueNumber, { issue: snapshot, operations: plan.operations, error: { code: failure.reasonCode || 'ISSUE_SYNC_FAILED', message: `Operation ${failure.name} failed`, retryable: false } });
     const planned = plan.operations.filter((operation) => operation.status === 'planned');
-    const skipped = plan.operations.some((operation) => operation.status === 'skipped');
     if (options.dryRun)
-        return result(planned.length ? 'planned' : skipped ? 'degraded' : 'no-op', base.resolved.taskId, base.issueNumber, { issue: snapshot, operations: plan.operations, error: null });
+        return result(planned.length ? 'planned' : 'no-op', base.resolved.taskId, base.issueNumber, { issue: snapshot, operations: plan.operations, error: null });
     if (planned.length === 0)
-        return result(skipped ? 'degraded' : 'no-op', base.resolved.taskId, base.issueNumber, { issue: snapshot, operations: plan.operations, error: null });
+        return result('no-op', base.resolved.taskId, base.issueNumber, { issue: snapshot, operations: plan.operations, error: null });
     const payload = applyRestOperations(snapshot, planned);
     const updated = base.provider.issues?.update
         ? await base.provider.issues.update({ context: providerOperationContext(base.loadedContext), target: base.issueIdentity, currentLabels: snapshot.labels, patch: payload, mutation: { idempotencyKey: `issue:update:${base.resolved.taskId}` } })
@@ -577,7 +576,7 @@ async function syncPlatformIssue(taskRef, options) {
                 error: { code: 'IN_LABEL_SYNC_PARTIAL', message: 'Issue labels did not converge after update', retryable: true }
             });
     }
-    return result(skipped ? 'degraded' : 'applied', base.resolved.taskId, base.issueNumber, {
+    return result('applied', base.resolved.taskId, base.issueNumber, {
         changed: updated.value.changed, platform: base.context.platform, capabilities: base.context.capabilities,
         resource: { kind: 'issue', number: base.issueNumber, identity: base.issueIdentity }, issue: finalIssue,
         operations: plan.operations.map((operation) => operation.status === 'planned' ? { ...operation, status: 'applied' } : operation), error: null

package/dist/lib/platform/verification-sync.js

@@ -1,3 +1,4 @@
+import { normalizeVerificationRecord, platformAuditPolicy } from "../task/gate-policy.js";
 import fs from "node:fs";
 import path from "node:path";
 import process from "node:process";
@@ -49,8 +50,21 @@ function sanitizeCommentContent(content) {
     const result = sanitizeMarkdownDocument(content, { reservedMarkers: [CONTROL_MARKER_PATTERN] });
     return result.ok ? result.value : null;
 }
-export async function check({ taskDir, config, artifactFile }, shared) {
-    const context = await buildSyncContext({ taskDir, config, artifactFile }, shared);
+function infoResult(message) {
+    return {
+        type: CHECK_TYPE,
+        status: 'pass',
+        message,
+        classification: 'info',
+        reason: 'NOT_APPLICABLE',
+        action: 'No action required'
+    };
+}
+function hardResult(result) {
+    return { ...result, classification: 'hard' };
+}
+export async function check({ taskDir, config, artifactFile, skillName }, shared) {
+    const context = await buildSyncContext({ taskDir, config, artifactFile, skillName }, shared);
     if (context.earlyReturn) {
         return context.earlyReturn;
     }
@@ -59,32 +73,35 @@ export async function check({ taskDir, config, artifactFile }, shared) {
         return remoteData.earlyReturn;
     }
     const subChecks = [
-        checkClosedIssueStatusLabels,
-        checkStatusLabel,
-        checkCommentMarker,
-        checkPrCommentMarker,
-        checkPrCommentLastCommit,
-        checkPrCommentRequiredPatterns,
-        checkCommentContent,
-        checkTaskCommentContent,
-        checkInLabelsComputed,
-        checkPrTypeLabel,
-        checkInLabelsMatchPr,
-        checkPrAssignee,
-        checkSyncedRequirements,
-        checkIssueType,
-        checkIssueFields,
-        checkMilestone
+        ['closed-status-labels', checkClosedIssueStatusLabels], ['status-label', checkStatusLabel],
+        ['comment-marker', checkCommentMarker], ['pr-comment-marker', checkPrCommentMarker],
+        ['pr-comment-last-commit', checkPrCommentLastCommit], ['pr-comment-content', checkPrCommentRequiredPatterns],
+        ['comment-content', checkCommentContent], ['task-comment-content', checkTaskCommentContent],
+        ['in-labels-computed', checkInLabelsComputed], ['pr-type-label', checkPrTypeLabel],
+        ['in-labels-match-pr', checkInLabelsMatchPr], ['pr-assignee', checkPrAssignee],
+        ['requirements', checkSyncedRequirements], ['issue-type', checkIssueType],
+        ['issue-fields', checkIssueFields], ['milestone', checkMilestone]
     ];
-    for (const subCheck of subChecks) {
-        const result = subCheck(context, remoteData, shared);
-        if (result) {
-            return result;
-        }
-    }
-    return shared.passResult(CHECK_TYPE, `Platform sync checks passed for Issue ${context.issueNumber || "identity"}`);
+    const results = subChecks.map(([id, subCheck]) => {
+        const audit = platformAuditPolicy(id, context);
+        const result = subCheck({ ...context, audit }, remoteData, shared) ?? infoResult(`Platform audit '${id}' was not evaluated`);
+        return { ...result, checkId: `platform.${id}`, classification: result.classification ?? audit.classification };
+    });
+    const blocking = results.map(normalizeVerificationRecord).find((result) => result.effectiveStatus !== 'pass');
+    return {
+        ...(blocking
+            ? {
+                type: CHECK_TYPE,
+                status: blocking.effectiveStatus,
+                message: blocking.message,
+                ...(blocking.fail_type ? { fail_type: blocking.fail_type } : {}),
+                classification: 'hard'
+            }
+            : shared.passResult(CHECK_TYPE, `Platform sync audits completed for Issue ${context.issueNumber || "identity"}`)),
+        subchecks: results
+    };
 }
-async function buildSyncContext({ taskDir, config, artifactFile }, shared) {
+async function buildSyncContext({ taskDir, config, artifactFile, skillName }, shared) {
     const task = shared.loadTask(taskDir);
     if (!task.ok) {
         return { earlyReturn: shared.failResult(CHECK_TYPE, task.message) };
@@ -120,7 +137,8 @@ async function buildSyncContext({ taskDir, config, artifactFile }, shared) {
         }
         return { earlyReturn: shared.passResult(CHECK_TYPE, `Skipped: ${platformContext.error?.message || "platform unavailable"}`) };
     }
-    const expectedValues = resolveExpectedValues(config);
+    const effectiveSkillName = skillName || config.skillName || "code-task";
+    const expectedValues = resolveExpectedValues(effectiveSkillName, artifactFile);
     if (!expectedValues.ok) {
         return { earlyReturn: shared.failResult(CHECK_TYPE, expectedValues.message, "check_failed") };
     }
@@ -135,6 +153,7 @@ async function buildSyncContext({ taskDir, config, artifactFile }, shared) {
         task,
         taskDir,
         config,
+        skillName: effectiveSkillName,
         artifactFile,
         artifactPath,
         issueIdentity,
@@ -152,52 +171,20 @@ async function buildSyncContext({ taskDir, config, artifactFile }, shared) {
         loadedContext: loaded.ok ? loaded.value : null
     };
 }
-function resolveExpectedValues(config) {
+function resolveExpectedValues(skillName, artifactFile) {
     const defaults = getDefaults();
-    const statusLabel = resolveDefaultValue({
-        collection: defaults.statusLabels,
-        key: config.expected_status_label_key,
-        value: config.expected_status_label,
-        configKey: "expected_status_label_key"
-    });
-    if (!statusLabel.ok) {
-        return statusLabel;
-    }
-    const commentMarker = resolveDefaultValue({
-        collection: defaults.markers,
-        key: config.expected_comment_marker_key,
-        value: config.expected_comment_marker,
-        configKey: "expected_comment_marker_key"
-    });
-    if (!commentMarker.ok) {
-        return commentMarker;
-    }
-    const prCommentMarker = resolveDefaultValue({
-        collection: defaults.markers,
-        key: config.expected_pr_comment_marker_key,
-        value: config.expected_pr_comment_marker,
-        configKey: "expected_pr_comment_marker_key"
-    });
-    if (!prCommentMarker.ok) {
-        return prCommentMarker;
-    }
+    const statusPolicy = platformAuditPolicy('status-label', { skillName, artifactFile });
+    const commentPolicy = platformAuditPolicy('comment-marker', { skillName, artifactFile });
+    const prCommentPolicy = ['pr-comment-marker', 'pr-comment-last-commit', 'pr-comment-content']
+        .map((id) => platformAuditPolicy(id, { skillName, artifactFile }))
+        .find((policy) => policy.enabled && policy.expectedPrCommentMarkerKey);
     return {
         ok: true,
-        statusLabel: statusLabel.value,
-        commentMarker: commentMarker.value,
-        prCommentMarker: prCommentMarker.value
+        statusLabel: statusPolicy.enabled ? statusPolicy.expectedStatusLabel || null : null,
+        commentMarker: commentPolicy.enabled && commentPolicy.expectedCommentMarkerKey ? defaults.markers[commentPolicy.expectedCommentMarkerKey] : null,
+        prCommentMarker: prCommentPolicy?.expectedPrCommentMarkerKey ? defaults.markers[prCommentPolicy.expectedPrCommentMarkerKey] : null
     };
 }
-function resolveDefaultValue({ collection, key, value, configKey }) {
-    if (!key) {
-        return { ok: true, value: value || null };
-    }
-    const resolvedValue = collection[key];
-    if (!resolvedValue) {
-        return { ok: false, message: `Unknown ${configKey}: ${key}` };
-    }
-    return { ok: true, value: resolvedValue };
-}
 async function fetchRemoteData(context, shared) {
     const provider = context.provider;
     const operationContext = providerOperationContext(context.loadedContext, context.taskDir);
@@ -207,8 +194,8 @@ async function fetchRemoteData(context, shared) {
             taskId: context.task?.metadata?.id || context.task?.id || "",
             ...(context.issueIdentity ? { issue: context.issueIdentity } : {}),
             ...(context.prIdentity ? { changeRequest: context.prIdentity } : {}),
-            includeComments: shouldFetchComments(context.config),
-            includeFields: Boolean(context.config.verify_issue_fields)
+            includeComments: shouldFetchIssueComments(context),
+            includeFields: true
         })
         : unsupportedProviderOperation(provider, "verification.fetchRemoteFacts");
     if (!facts.ok) {
@@ -228,7 +215,7 @@ async function fetchRemoteData(context, shared) {
         }
         : null;
     let issueFields;
-    if (context.config.verify_issue_fields && issueSnapshot?.issueType) {
+    if (issueSnapshot?.issueType) {
         const fieldKinds = new Map(issueSnapshot.issueType.fields.map((field) => [field.name, field.kind]));
         issueFields = {
             pinnedNames: new Set(issueSnapshot.issueType.fields.map((field) => field.name)),
@@ -236,7 +223,7 @@ async function fetchRemoteData(context, shared) {
         };
     }
     let prComments = null;
-    if (context.prMarker && context.prIdentity && shouldFetchComments(context.config) && provider?.comments?.list) {
+    if (context.prMarker && context.prIdentity && shouldFetchPrComments(context) && provider?.comments?.list) {
         const listed = await provider.comments.list({ context: operationContext, parent: context.prIdentity });
         if (!listed.ok)
             return {
@@ -249,7 +236,7 @@ async function fetchRemoteData(context, shared) {
     const changeRequest = facts.value.changeRequest;
     let inLabelMapping = {};
     let repositoryLabels = [];
-    if (context.config.verify_in_labels_computed && context.hasTriage) {
+    if (platformAuditPolicy('in-labels-computed', context).enabled && context.hasTriage) {
         const mapping = loadInLabelMapping(shared);
         if (!mapping.ok)
             return { earlyReturn: shared.failResult(CHECK_TYPE, mapping.message, "check_failed") };
@@ -290,116 +277,117 @@ async function fetchRemoteData(context, shared) {
 function mapTaskTypeToLabel(taskType) {
     return taskTypeLabel(taskType);
 }
-function shouldFetchComments(config) {
-    return Boolean(config.expected_comment_marker
-        || config.expected_comment_marker_key
-        || config.expected_pr_comment_marker
-        || config.expected_pr_comment_marker_key
-        || config.verify_pr_comment_last_commit_matches_head
-        || config.verify_comment_content
-        || config.verify_task_comment_content);
+function hasEnabledAudit(context, auditIds) {
+    return auditIds
+        .some((id) => platformAuditPolicy(id, context).enabled);
+}
+function shouldFetchIssueComments(context) {
+    return hasEnabledAudit(context, ['comment-marker', 'comment-content', 'task-comment-content']);
+}
+function shouldFetchPrComments(context) {
+    return hasEnabledAudit(context, ['pr-comment-marker', 'pr-comment-last-commit', 'pr-comment-content']);
 }
 function checkStatusLabel(context, remoteData, shared) {
     if (!context.expectedStatusLabel || !context.hasTriage) {
-        return null;
+        return infoResult('Status label audit is not applicable because no expected label or triage capability is available');
     }
     if (String(remoteData.issue.state || "").toUpperCase() !== "OPEN") {
-        return null;
+        return infoResult('Status label audit is not applicable because the Issue is closed');
     }
     const labels = extractLabelNames(remoteData.issue.labels);
     if (labels.includes(context.expectedStatusLabel)) {
-        return null;
+        return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} has expected status label '${context.expectedStatusLabel}'`);
     }
     return shared.failResult(CHECK_TYPE, `Expected label '${context.expectedStatusLabel}' not found on Issue #${context.issueNumber}`, "check_failed");
 }
 function checkClosedIssueStatusLabels(context, remoteData, shared) {
-    if (!context.config.verify_closed_issue_has_no_status_labels) {
-        return null;
+    if (!context.audit.enabled) {
+        return infoResult('Closed Issue status-label audit is not enabled for this workflow');
     }
     if (String(remoteData.issue.state || "").toUpperCase() !== "CLOSED") {
-        return null;
+        return infoResult('Closed Issue status-label audit is not applicable because the Issue is open');
     }
     const statusLabels = extractLabelNames(remoteData.issue.labels)
         .filter((label) => label.startsWith("status:"));
     if (statusLabels.length === 0) {
-        return null;
+        return shared.passResult(CHECK_TYPE, `Closed Issue #${context.issueNumber} has no status labels`);
     }
     return shared.failResult(CHECK_TYPE, `Closed Issue #${context.issueNumber} retains status labels: ${statusLabels.join(", ")}`, "check_failed");
 }
 function checkCommentMarker(context, remoteData, shared) {
-    if (!context.marker) {
-        return null;
+    if (!context.audit.enabled || !context.marker) {
+        return infoResult('Issue comment-marker audit is not applicable because no marker is configured');
     }
     const comment = findCommentByMarker(remoteData.comments, context.marker);
     if (comment) {
-        return null;
+        return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} has expected comment marker`);
     }
     return shared.failResult(CHECK_TYPE, `Expected comment marker '${context.marker}' not found on Issue #${context.issueNumber}`, "check_failed");
 }
 function checkPrCommentMarker(context, remoteData, shared) {
-    if (!context.prMarker) {
-        return null;
+    if (!context.audit.enabled || !context.prMarker) {
+        return infoResult('PR comment-marker audit is not applicable because no marker is configured');
     }
     const comment = findCommentByMarker(remoteData.prComments, context.prMarker);
     if (comment) {
-        return null;
+        return shared.passResult(CHECK_TYPE, `PR #${context.prNumber} has expected comment marker`);
     }
     return shared.failResult(CHECK_TYPE, `Expected PR comment marker '${context.prMarker}' not found on PR #${context.prNumber}`, "check_failed");
 }
 function checkPrCommentLastCommit(context, remoteData, shared) {
-    if (!context.config.verify_pr_comment_last_commit_matches_head) {
-        return null;
+    if (!context.audit.enabled) {
+        return infoResult('PR last-commit audit is not enabled for this workflow');
     }
     if (!context.prMarker) {
-        return shared.failResult(CHECK_TYPE, "verify_pr_comment_last_commit_matches_head requires expected_pr_comment_marker", "check_failed");
+        return hardResult(shared.failResult(CHECK_TYPE, "verify_pr_comment_last_commit_matches_head requires expected_pr_comment_marker", "check_failed"));
     }
     const comment = findCommentByMarker(remoteData.prComments, context.prMarker);
     if (!comment) {
-        return shared.failResult(CHECK_TYPE, `Expected PR comment marker '${context.prMarker}' not found on PR #${context.prNumber}`, "check_failed");
+        return hardResult(shared.failResult(CHECK_TYPE, `Expected PR comment marker '${context.prMarker}' not found on PR #${context.prNumber}`, "check_failed"));
     }
     const match = String(comment.body || "").match(/<!--\s*last-commit:\s*([0-9a-f]{7,40})\s*-->/i);
     if (!match) {
-        return shared.failResult(CHECK_TYPE, `PR #${context.prNumber} summary comment is missing '<!-- last-commit: <sha> -->' metadata`, "check_failed");
+        return hardResult(shared.failResult(CHECK_TYPE, `PR #${context.prNumber} summary comment is missing '<!-- last-commit: <sha> -->' metadata`, "check_failed"));
     }
     const expectedHead = String(remoteData.prHeadSha || "").trim();
     if (!expectedHead)
-        return shared.blockedResult(CHECK_TYPE, "Unable to resolve the PR head SHA", "network_error");
+        return hardResult(shared.blockedResult(CHECK_TYPE, "Unable to resolve the PR head SHA", "network_error"));
     const actualHead = match[1].trim();
     if (expectedHead === actualHead) {
-        return null;
+        return shared.passResult(CHECK_TYPE, `PR #${context.prNumber} summary comment last-commit matches HEAD`);
     }
-    return shared.failResult(CHECK_TYPE, `PR #${context.prNumber} summary comment last-commit metadata mismatch: expected ${expectedHead}, got ${actualHead}`, "check_failed");
+    return hardResult(shared.failResult(CHECK_TYPE, `PR #${context.prNumber} summary comment last-commit metadata mismatch: expected ${expectedHead}, got ${actualHead}`, "check_failed"));
 }
 function checkPrCommentRequiredPatterns(context, remoteData, shared) {
-    const patterns = context.config.expected_pr_comment_required_patterns || [];
+    const patterns = context.audit.enabled ? context.config.expected_pr_comment_required_patterns || [] : [];
     if (!Array.isArray(patterns) || patterns.length === 0) {
-        return null;
+        return infoResult('PR comment-content audit is not enabled for this workflow');
     }
     if (!context.prMarker) {
-        return shared.failResult(CHECK_TYPE, "expected_pr_comment_required_patterns requires expected_pr_comment_marker", "check_failed");
+        return hardResult(shared.failResult(CHECK_TYPE, "expected_pr_comment_required_patterns requires expected_pr_comment_marker", "check_failed"));
     }
     const comment = findCommentByMarker(remoteData.prComments, context.prMarker);
     if (!comment) {
-        return shared.failResult(CHECK_TYPE, `Expected PR comment marker '${context.prMarker}' not found on PR #${context.prNumber}`, "check_failed");
+        return hardResult(shared.failResult(CHECK_TYPE, `Expected PR comment marker '${context.prMarker}' not found on PR #${context.prNumber}`, "check_failed"));
     }
     const body = String(comment.body || "");
     for (const pattern of patterns) {
         const regex = new RegExp(pattern, "m");
         if (!regex.test(body)) {
-            return shared.failResult(CHECK_TYPE, `PR #${context.prNumber} summary comment is missing required pattern: ${pattern}`, "check_failed");
+            return hardResult(shared.failResult(CHECK_TYPE, `PR #${context.prNumber} summary comment is missing required pattern: ${pattern}`, "check_failed"));
         }
     }
-    return null;
+    return shared.passResult(CHECK_TYPE, `PR #${context.prNumber} summary comment has all required patterns`);
 }
 function checkCommentContent(context, remoteData, shared) {
-    if (!context.config.verify_comment_content) {
-        return null;
+    if (!context.audit.enabled) {
+        return infoResult('Artifact comment-content audit is not enabled for this workflow');
     }
     if (!context.marker) {
-        return shared.failResult(CHECK_TYPE, "verify_comment_content requires expected_comment_marker", "check_failed");
+        return hardResult(shared.failResult(CHECK_TYPE, "Artifact comment-content audit requires an expected comment marker", "check_failed"));
     }
     if (!context.artifactPath || !shared.safeStat(context.artifactPath)) {
-        return shared.failResult(CHECK_TYPE, `Artifact not found for comment verification: ${context.artifactFile || "(missing artifactFile)"}`, "check_failed");
+        return hardResult(shared.failResult(CHECK_TYPE, `Artifact not found for comment verification: ${context.artifactFile || "(missing artifactFile)"}`, "check_failed"));
     }
     const comment = findCommentByMarker(remoteData.comments, context.marker);
     let localContent;
@@ -408,25 +396,25 @@ function checkCommentContent(context, remoteData, shared) {
         const localCanonical = canonicalizeCommentBody(fs.readFileSync(context.artifactPath, "utf8"));
         const commentCanonical = canonicalizeCommentBody(extractCommentBody(comment?.body || ""));
         if (!localCanonical.ok) {
-            return shared.failResult(CHECK_TYPE, `Comment content cannot be canonicalized for '${path.basename(context.artifactPath, path.extname(context.artifactPath))}': ${localCanonical.error.message}`, "check_failed");
+            return hardResult(shared.failResult(CHECK_TYPE, `Comment content cannot be canonicalized for '${path.basename(context.artifactPath, path.extname(context.artifactPath))}': ${localCanonical.error.message}`, "check_failed"));
         }
         if (!commentCanonical.ok) {
-            return shared.failResult(CHECK_TYPE, `Comment content cannot be canonicalized for '${path.basename(context.artifactPath, path.extname(context.artifactPath))}': ${commentCanonical.error.message}`, "check_failed");
+            return hardResult(shared.failResult(CHECK_TYPE, `Comment content cannot be canonicalized for '${path.basename(context.artifactPath, path.extname(context.artifactPath))}': ${commentCanonical.error.message}`, "check_failed"));
         }
         localContent = shared.normalizeContent(localCanonical.value);
         commentContent = shared.normalizeContent(commentCanonical.value);
     }
     catch (error) {
-        return shared.failResult(CHECK_TYPE, `Comment content cannot be read for '${path.basename(context.artifactPath, path.extname(context.artifactPath))}': ${error instanceof Error ? error.message : String(error)}`, "check_failed");
+        return hardResult(shared.failResult(CHECK_TYPE, `Comment content cannot be read for '${path.basename(context.artifactPath, path.extname(context.artifactPath))}': ${error instanceof Error ? error.message : String(error)}`, "check_failed"));
     }
     if (localContent === commentContent) {
-        return null;
+        return shared.passResult(CHECK_TYPE, `Artifact comment content matches Issue #${context.issueNumber}`);
     }
     return shared.failResult(CHECK_TYPE, buildCommentContentMismatchMessage(path.basename(context.artifactPath, path.extname(context.artifactPath)), context.issueNumber, localContent, commentContent), "check_failed");
 }
 function checkTaskCommentContent(context, remoteData, shared) {
-    if (!context.config.verify_task_comment_content) {
-        return null;
+    if (!context.audit.enabled) {
+        return infoResult('Task comment-content audit is not enabled for this workflow');
     }
     const taskMarker = `<!-- sync-issue:${context.task.metadata.id}:task -->`;
     const comment = findCommentByMarker(remoteData.comments, taskMarker);
@@ -438,34 +426,34 @@ function checkTaskCommentContent(context, remoteData, shared) {
         renderedTask = renderTaskCommentResult(context.task.content, context.task.metadata.id, loadProjectLanguage(shared));
     }
     catch {
-        return shared.failResult(CHECK_TYPE, "Task content cannot be rendered safely for comment verification", "check_failed");
+        return hardResult(shared.failResult(CHECK_TYPE, "Task content cannot be rendered safely for comment verification", "check_failed"));
     }
     if (renderedTask.byteLength > 60_000) {
-        return shared.failResult(CHECK_TYPE, "Task comment exceeds the platform byte limit", "check_failed");
+        return hardResult(shared.failResult(CHECK_TYPE, "Task comment exceeds the platform byte limit", "check_failed"));
     }
     const expectedBody = shared.normalizeContent(extractCommentBody(renderedTask.body));
     const commentBody = shared.normalizeContent(extractCommentBody(comment.body || ""));
     if (expectedBody === commentBody) {
-        return null;
+        return shared.passResult(CHECK_TYPE, `Task comment content matches Issue #${context.issueNumber}`);
     }
     return shared.failResult(CHECK_TYPE, buildCommentContentMismatchMessage("task", context.issueNumber, expectedBody, commentBody), "check_failed");
 }
 function checkPrTypeLabel(context, remoteData, shared) {
-    if (!context.config.verify_pr_type_label || !context.hasTriage || !context.prNumber || !remoteData.prLabels) {
-        return null;
+    if (!context.audit.enabled || !context.hasTriage || !context.prNumber || !remoteData.prLabels) {
+        return infoResult('PR type-label audit is not applicable because the required PR metadata or capability is unavailable');
     }
     const expectedLabel = mapTaskTypeToLabel(context.task.metadata.type);
     if (!expectedLabel) {
-        return null;
+        return infoResult('PR type-label audit is not applicable because the task type has no label mapping');
     }
     if (remoteData.prLabels.includes(expectedLabel)) {
-        return null;
+        return shared.passResult(CHECK_TYPE, `PR #${context.prNumber} has expected type label '${expectedLabel}'`);
     }
     return shared.failResult(CHECK_TYPE, `Expected type label '${expectedLabel}' not found on PR #${context.prNumber}`, "check_failed");
 }
 function checkInLabelsMatchPr(context, remoteData, shared) {
-    if (!context.config.verify_in_labels_match_pr || !context.hasTriage || !context.prNumber || !remoteData.prLabels) {
-        return null;
+    if (!context.audit.enabled || !context.hasTriage || !context.prNumber || !remoteData.prLabels) {
+        return infoResult('PR in: label audit is not applicable because the required PR metadata or capability is unavailable');
     }
     const issueInLabels = extractLabelNames(remoteData.issue.labels)
         .filter((label) => label.startsWith("in:"))
@@ -474,13 +462,13 @@ function checkInLabelsMatchPr(context, remoteData, shared) {
         .filter((label) => label.startsWith("in:"))
         .sort();
     if (arraysEqual(issueInLabels, prInLabels)) {
-        return null;
+        return shared.passResult(CHECK_TYPE, `PR #${context.prNumber} in: labels match Issue #${context.issueNumber}`);
     }
     return shared.failResult(CHECK_TYPE, `in: labels mismatch — PR #${context.prNumber} has [${formatLabelList(prInLabels)}], Issue #${context.issueNumber} has [${formatLabelList(issueInLabels)}]`, "check_failed");
 }
 function checkInLabelsComputed(context, remoteData, shared) {
-    if (!context.config.verify_in_labels_computed || !context.hasTriage) {
-        return null;
+    if (!context.audit.enabled || !context.hasTriage) {
+        return infoResult('Computed in: label audit is not applicable because it is disabled or triage capability is unavailable');
     }
     const expectedInLabels = computeExpectedInLabels(context.taskDir, remoteData.repositoryLabels, remoteData.inLabelMapping, shared);
     if (!expectedInLabels.ok) {
@@ -489,49 +477,49 @@ function checkInLabelsComputed(context, remoteData, shared) {
             : shared.blockedResult(CHECK_TYPE, expectedInLabels.message, expectedInLabels.type);
     }
     if (expectedInLabels.mode === "skipped") {
-        return null;
+        return infoResult('Computed in: label audit is not applicable because no mapped changed path exists');
     }
     const actualInLabels = extractLabelNames(remoteData.issue.labels)
         .filter((label) => label.startsWith("in:"))
         .sort();
     if (arraysEqual(expectedInLabels.labels, actualInLabels)) {
-        return null;
+        return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} in: labels match committed changes`);
     }
     return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} in: labels do not match committed changes: expected [${formatLabelList(expectedInLabels.labels)}], got [${formatLabelList(actualInLabels)}]`, "check_failed");
 }
 function checkSyncedRequirements(context, remoteData, shared) {
-    if (!context.config.sync_checked_requirements || !context.hasTriage) {
-        return null;
+    if (!context.audit.enabled || !context.hasTriage) {
+        return infoResult('Requirements audit is not applicable because it is disabled or triage capability is unavailable');
     }
     const checkedRequirements = shared.getCheckedRequirements(context.task.content);
     if (checkedRequirements.length === 0) {
-        return null;
+        return infoResult('Requirements audit is not applicable because the task has no checked requirements');
     }
     const issueBody = remoteData.issue.body || "";
     const resolution = resolveRequirementSection(issueBody, requirementSectionAnchors(shared.repoRoot, context.task.metadata.type || "task"));
     if (resolution.status === "missing") {
-        return null;
+        return infoResult('Requirements audit is not applicable because the Issue has no requirements section');
     }
     if (resolution.status === "ambiguous") {
-        return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} requirements section is ambiguous`, "check_failed");
+        return hardResult(shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} requirements section is ambiguous`, "check_failed"));
     }
     const requirementBody = issueBody.slice(resolution.bodyStart, resolution.bodyEnd);
     const missingRequirements = checkedRequirements.filter((item) => !hasCheckedRequirement(requirementBody, item));
     if (missingRequirements.length === 0) {
-        return null;
+        return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} contains all checked requirements`);
     }
     return shared.failResult(CHECK_TYPE, `Issue body is missing checked requirements: ${missingRequirements.join(", ")}`, "check_failed");
 }
 function checkIssueType(context, remoteData, shared) {
-    if (!context.config.verify_issue_type || !context.hasPush) {
-        return null;
+    if (!context.hasPush) {
+        return infoResult('Issue Type audit is not applicable because push capability is unavailable');
     }
     if (remoteData.issueType === undefined) {
-        return null;
+        return infoResult('Issue Type audit is not applicable because the provider does not expose Issue Type');
     }
     if (!remoteData.issueType) {
         if (context.repoOwnerType === "User") {
-            return null;
+            return infoResult('Issue Type audit is not applicable for a user-owned repository');
         }
         return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} has no Issue Type set`, "check_failed");
     }
@@ -539,14 +527,14 @@ function checkIssueType(context, remoteData, shared) {
     if (expectedType && remoteData.issueType !== expectedType) {
         return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} has type '${remoteData.issueType}', expected '${expectedType}' (from task type '${context.task.metadata.type}')`, "check_failed");
     }
-    return null;
+    return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} has the expected Issue Type`);
 }
 function checkIssueFields(context, remoteData, shared) {
-    if (!context.config.verify_issue_fields || !context.hasPush) {
-        return null;
+    if (!context.hasPush) {
+        return infoResult('Issue field audit is not applicable because push capability is unavailable');
     }
     if (remoteData.issueFields === undefined) {
-        return null;
+        return infoResult('Issue field audit is not applicable because the provider does not expose Issue fields');
     }
     for (const [metadataKey, fieldName] of Object.entries(FRONTMATTER_FIELD_MAP)) {
         const expectedRaw = context.task.metadata[metadataKey];
@@ -565,20 +553,20 @@ function checkIssueFields(context, remoteData, shared) {
             return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} field '${fieldName}' is '${actual.value}', expected '${expected.value}'`, "check_failed");
         }
     }
-    return null;
+    return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} fields match task metadata`);
 }
 function checkPrAssignee(context, remoteData, shared) {
-    if (!context.config.verify_pr_assignee || !context.hasPush || !context.prNumber) {
-        return null;
+    if (!context.audit.enabled || !context.hasPush || !context.prNumber) {
+        return infoResult('PR assignee audit is not applicable because it is disabled or required PR metadata/capability is unavailable');
     }
     if (!remoteData.prAssignees || remoteData.prAssignees.length === 0) {
         return shared.failResult(CHECK_TYPE, `PR #${context.prNumber} has no assignee`, "check_failed");
     }
-    return null;
+    return shared.passResult(CHECK_TYPE, `PR #${context.prNumber} has an assignee`);
 }
 function checkMilestone(context, remoteData, shared) {
-    if (!context.config.verify_milestone || !context.hasTriage) {
-        return null;
+    if (!context.hasTriage) {
+        return infoResult('Milestone audit is not applicable because triage capability is unavailable');
     }
     if (!remoteData.issue?.milestone?.title) {
         return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} has no milestone set`, "check_failed");
@@ -586,7 +574,7 @@ function checkMilestone(context, remoteData, shared) {
     if (context.prNumber && remoteData.prMilestone !== undefined && !remoteData.prMilestone?.title) {
         return shared.failResult(CHECK_TYPE, `PR #${context.prNumber} has no milestone set`, "check_failed");
     }
-    if (context.config.verify_milestone_specific) {
+    if (context.audit.requireSpecificMilestone) {
         const issueTitle = remoteData.issue.milestone.title;
         if (VERSION_LINE_REGEX.test(issueTitle)) {
             return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} milestone '${issueTitle}' is a release line; narrow to a specific version (e.g. ${issueTitle.replace(/\.x$/, ".N")}) before continuing`, "check_failed");
@@ -595,7 +583,7 @@ function checkMilestone(context, remoteData, shared) {
             return shared.failResult(CHECK_TYPE, `PR #${context.prNumber} milestone '${remoteData.prMilestone.title}' is a release line; narrow to a specific version before continuing`, "check_failed");
         }
     }
-    return null;
+    return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} milestone satisfies the configured policy`);
 }
 function findCommentByMarker(comments, marker) {
     return (comments || []).find((comment) => typeof comment.body === "string" && comment.body.includes(marker)) || null;