@fitlab-ai/agent-infra 0.11.0 → 0.11.2

package/dist/lib/platform/verification-sync.js

@@ -1,3 +1,4 @@
+import { normalizeVerificationRecord, platformAuditPolicy } from "../task/gate-policy.js";
 import fs from "node:fs";
 import path from "node:path";
 import process from "node:process";
@@ -10,7 +11,7 @@ import { planInLabelUpdate, validateInLabelMapping } from "./in-label-sync.js";
 import { readPrDeliveryFact } from "../task/pr-delivery-fact.js";
 import { providerError, providerOperationContext, resourceIdentityNumber, unsupportedProviderOperation } from "./provider-bridge.js";
 import { taskIssueIdentity } from "./task-identities.js";
-import { renderTaskCommentResult } from "./issue-comments.js";
+import { MARKERS, renderTaskCommentResult } from "./issue-comments.js";
 import { CONTROL_MARKER_PATTERN, canonicalizeCommentBody, renderSafeCodeFence, sanitizeMarkdownDocument } from "./comment-safety.js";
 const CHECK_TYPE = "platform-sync";
 const VERSION_LINE_REGEX = /^[0-9]+\.[0-9]+\.x$/;
@@ -49,8 +50,21 @@ function sanitizeCommentContent(content) {
     const result = sanitizeMarkdownDocument(content, { reservedMarkers: [CONTROL_MARKER_PATTERN] });
     return result.ok ? result.value : null;
 }
-export async function check({ taskDir, config, artifactFile }, shared) {
-    const context = await buildSyncContext({ taskDir, config, artifactFile }, shared);
+function infoResult(message) {
+    return {
+        type: CHECK_TYPE,
+        status: 'pass',
+        message,
+        classification: 'info',
+        reason: 'NOT_APPLICABLE',
+        action: 'No action required'
+    };
+}
+function hardResult(result) {
+    return { ...result, classification: 'hard' };
+}
+export async function check({ taskDir, config, artifactFile, skillName }, shared) {
+    const context = await buildSyncContext({ taskDir, config, artifactFile, skillName }, shared);
     if (context.earlyReturn) {
         return context.earlyReturn;
     }
@@ -59,32 +73,35 @@ export async function check({ taskDir, config, artifactFile }, shared) {
         return remoteData.earlyReturn;
     }
     const subChecks = [
-        checkClosedIssueStatusLabels,
-        checkStatusLabel,
-        checkCommentMarker,
-        checkPrCommentMarker,
-        checkPrCommentLastCommit,
-        checkPrCommentRequiredPatterns,
-        checkCommentContent,
-        checkTaskCommentContent,
-        checkInLabelsComputed,
-        checkPrTypeLabel,
-        checkInLabelsMatchPr,
-        checkPrAssignee,
-        checkSyncedRequirements,
-        checkIssueType,
-        checkIssueFields,
-        checkMilestone
+        ['closed-status-labels', checkClosedIssueStatusLabels], ['status-label', checkStatusLabel],
+        ['comment-marker', checkCommentMarker], ['pr-comment-marker', checkPrCommentMarker],
+        ['pr-comment-last-commit', checkPrCommentLastCommit], ['pr-comment-content', checkPrCommentRequiredPatterns],
+        ['comment-content', checkCommentContent], ['task-comment-content', checkTaskCommentContent],
+        ['in-labels-computed', checkInLabelsComputed], ['pr-type-label', checkPrTypeLabel],
+        ['in-labels-match-pr', checkInLabelsMatchPr], ['pr-assignee', checkPrAssignee],
+        ['requirements', checkSyncedRequirements], ['issue-type', checkIssueType],
+        ['issue-fields', checkIssueFields], ['milestone', checkMilestone]
     ];
-    for (const subCheck of subChecks) {
-        const result = subCheck(context, remoteData, shared);
-        if (result) {
-            return result;
-        }
-    }
-    return shared.passResult(CHECK_TYPE, `Platform sync checks passed for Issue ${context.issueNumber || "identity"}`);
+    const results = subChecks.map(([id, subCheck]) => {
+        const audit = platformAuditPolicy(id, context);
+        const result = subCheck({ ...context, audit }, remoteData, shared) ?? infoResult(`Platform audit '${id}' was not evaluated`);
+        return { ...result, checkId: `platform.${id}`, classification: result.classification ?? audit.classification };
+    });
+    const blocking = results.map(normalizeVerificationRecord).find((result) => result.effectiveStatus !== 'pass');
+    return {
+        ...(blocking
+            ? {
+                type: CHECK_TYPE,
+                status: blocking.effectiveStatus,
+                message: blocking.message,
+                ...(blocking.fail_type ? { fail_type: blocking.fail_type } : {}),
+                classification: 'hard'
+            }
+            : shared.passResult(CHECK_TYPE, `Platform sync audits completed for Issue ${context.issueNumber || "identity"}`)),
+        subchecks: results
+    };
 }
-async function buildSyncContext({ taskDir, config, artifactFile }, shared) {
+async function buildSyncContext({ taskDir, config, artifactFile, skillName }, shared) {
     const task = shared.loadTask(taskDir);
     if (!task.ok) {
         return { earlyReturn: shared.failResult(CHECK_TYPE, task.message) };
@@ -120,7 +137,8 @@ async function buildSyncContext({ taskDir, config, artifactFile }, shared) {
         }
         return { earlyReturn: shared.passResult(CHECK_TYPE, `Skipped: ${platformContext.error?.message || "platform unavailable"}`) };
     }
-    const expectedValues = resolveExpectedValues(config);
+    const effectiveSkillName = skillName || config.skillName || "code-task";
+    const expectedValues = resolveExpectedValues(effectiveSkillName, artifactFile);
     if (!expectedValues.ok) {
         return { earlyReturn: shared.failResult(CHECK_TYPE, expectedValues.message, "check_failed") };
     }
@@ -135,6 +153,7 @@ async function buildSyncContext({ taskDir, config, artifactFile }, shared) {
         task,
         taskDir,
         config,
+        skillName: effectiveSkillName,
         artifactFile,
         artifactPath,
         issueIdentity,
@@ -152,52 +171,20 @@ async function buildSyncContext({ taskDir, config, artifactFile }, shared) {
         loadedContext: loaded.ok ? loaded.value : null
     };
 }
-function resolveExpectedValues(config) {
+function resolveExpectedValues(skillName, artifactFile) {
     const defaults = getDefaults();
-    const statusLabel = resolveDefaultValue({
-        collection: defaults.statusLabels,
-        key: config.expected_status_label_key,
-        value: config.expected_status_label,
-        configKey: "expected_status_label_key"
-    });
-    if (!statusLabel.ok) {
-        return statusLabel;
-    }
-    const commentMarker = resolveDefaultValue({
-        collection: defaults.markers,
-        key: config.expected_comment_marker_key,
-        value: config.expected_comment_marker,
-        configKey: "expected_comment_marker_key"
-    });
-    if (!commentMarker.ok) {
-        return commentMarker;
-    }
-    const prCommentMarker = resolveDefaultValue({
-        collection: defaults.markers,
-        key: config.expected_pr_comment_marker_key,
-        value: config.expected_pr_comment_marker,
-        configKey: "expected_pr_comment_marker_key"
-    });
-    if (!prCommentMarker.ok) {
-        return prCommentMarker;
-    }
+    const statusPolicy = platformAuditPolicy('status-label', { skillName, artifactFile });
+    const commentPolicy = platformAuditPolicy('comment-marker', { skillName, artifactFile });
+    const prCommentPolicy = ['pr-comment-marker', 'pr-comment-last-commit', 'pr-comment-content']
+        .map((id) => platformAuditPolicy(id, { skillName, artifactFile }))
+        .find((policy) => policy.enabled && policy.expectedPrCommentMarkerKey);
     return {
         ok: true,
-        statusLabel: statusLabel.value,
-        commentMarker: commentMarker.value,
-        prCommentMarker: prCommentMarker.value
+        statusLabel: statusPolicy.enabled ? statusPolicy.expectedStatusLabel || null : null,
+        commentMarker: commentPolicy.enabled && commentPolicy.expectedCommentMarkerKey ? defaults.markers[commentPolicy.expectedCommentMarkerKey] : null,
+        prCommentMarker: prCommentPolicy?.expectedPrCommentMarkerKey ? defaults.markers[prCommentPolicy.expectedPrCommentMarkerKey] : null
     };
 }
-function resolveDefaultValue({ collection, key, value, configKey }) {
-    if (!key) {
-        return { ok: true, value: value || null };
-    }
-    const resolvedValue = collection[key];
-    if (!resolvedValue) {
-        return { ok: false, message: `Unknown ${configKey}: ${key}` };
-    }
-    return { ok: true, value: resolvedValue };
-}
 async function fetchRemoteData(context, shared) {
     const provider = context.provider;
     const operationContext = providerOperationContext(context.loadedContext, context.taskDir);
@@ -207,8 +194,8 @@ async function fetchRemoteData(context, shared) {
             taskId: context.task?.metadata?.id || context.task?.id || "",
             ...(context.issueIdentity ? { issue: context.issueIdentity } : {}),
             ...(context.prIdentity ? { changeRequest: context.prIdentity } : {}),
-            includeComments: shouldFetchComments(context.config),
-            includeFields: Boolean(context.config.verify_issue_fields)
+            includeComments: shouldFetchIssueComments(context),
+            includeFields: true
         })
         : unsupportedProviderOperation(provider, "verification.fetchRemoteFacts");
     if (!facts.ok) {
@@ -228,7 +215,7 @@ async function fetchRemoteData(context, shared) {
         }
         : null;
     let issueFields;
-    if (context.config.verify_issue_fields && issueSnapshot?.issueType) {
+    if (issueSnapshot?.issueType) {
         const fieldKinds = new Map(issueSnapshot.issueType.fields.map((field) => [field.name, field.kind]));
         issueFields = {
             pinnedNames: new Set(issueSnapshot.issueType.fields.map((field) => field.name)),
@@ -236,7 +223,7 @@ async function fetchRemoteData(context, shared) {
         };
     }
     let prComments = null;
-    if (context.prMarker && context.prIdentity && shouldFetchComments(context.config) && provider?.comments?.list) {
+    if (context.prMarker && context.prIdentity && shouldFetchPrComments(context) && provider?.comments?.list) {
         const listed = await provider.comments.list({ context: operationContext, parent: context.prIdentity });
         if (!listed.ok)
             return {
@@ -249,7 +236,7 @@ async function fetchRemoteData(context, shared) {
     const changeRequest = facts.value.changeRequest;
     let inLabelMapping = {};
     let repositoryLabels = [];
-    if (context.config.verify_in_labels_computed && context.hasTriage) {
+    if (platformAuditPolicy('in-labels-computed', context).enabled && context.hasTriage) {
         const mapping = loadInLabelMapping(shared);
         if (!mapping.ok)
             return { earlyReturn: shared.failResult(CHECK_TYPE, mapping.message, "check_failed") };
@@ -271,7 +258,9 @@ async function fetchRemoteData(context, shared) {
     }
     return {
         issue,
-        comments: facts.value.comments.map((comment) => ({ id: comment.id, body: comment.body })),
+        comments: facts.value.comments.map((comment) => ({
+            id: comment.id, body: comment.body, createdSequence: comment.createdSequence
+        })),
         prComments,
         prLabels: changeRequest?.labels || null,
         issueType: issueSnapshot
@@ -290,116 +279,132 @@ async function fetchRemoteData(context, shared) {
 function mapTaskTypeToLabel(taskType) {
     return taskTypeLabel(taskType);
 }
-function shouldFetchComments(config) {
-    return Boolean(config.expected_comment_marker
-        || config.expected_comment_marker_key
-        || config.expected_pr_comment_marker
-        || config.expected_pr_comment_marker_key
-        || config.verify_pr_comment_last_commit_matches_head
-        || config.verify_comment_content
-        || config.verify_task_comment_content);
+function hasEnabledAudit(context, auditIds) {
+    return auditIds
+        .some((id) => platformAuditPolicy(id, context).enabled);
+}
+function shouldFetchIssueComments(context) {
+    return hasEnabledAudit(context, ['comment-marker', 'comment-content', 'task-comment-content']);
+}
+function shouldFetchPrComments(context) {
+    return hasEnabledAudit(context, ['pr-comment-marker', 'pr-comment-last-commit', 'pr-comment-content']);
 }
 function checkStatusLabel(context, remoteData, shared) {
     if (!context.expectedStatusLabel || !context.hasTriage) {
-        return null;
+        return infoResult('Status label audit is not applicable because no expected label or triage capability is available');
     }
     if (String(remoteData.issue.state || "").toUpperCase() !== "OPEN") {
-        return null;
+        return infoResult('Status label audit is not applicable because the Issue is closed');
     }
     const labels = extractLabelNames(remoteData.issue.labels);
     if (labels.includes(context.expectedStatusLabel)) {
-        return null;
+        return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} has expected status label '${context.expectedStatusLabel}'`);
     }
     return shared.failResult(CHECK_TYPE, `Expected label '${context.expectedStatusLabel}' not found on Issue #${context.issueNumber}`, "check_failed");
 }
 function checkClosedIssueStatusLabels(context, remoteData, shared) {
-    if (!context.config.verify_closed_issue_has_no_status_labels) {
-        return null;
+    if (!context.audit.enabled) {
+        return infoResult('Closed Issue status-label audit is not enabled for this workflow');
     }
     if (String(remoteData.issue.state || "").toUpperCase() !== "CLOSED") {
-        return null;
+        return infoResult('Closed Issue status-label audit is not applicable because the Issue is open');
     }
     const statusLabels = extractLabelNames(remoteData.issue.labels)
         .filter((label) => label.startsWith("status:"));
     if (statusLabels.length === 0) {
-        return null;
+        return shared.passResult(CHECK_TYPE, `Closed Issue #${context.issueNumber} has no status labels`);
     }
     return shared.failResult(CHECK_TYPE, `Closed Issue #${context.issueNumber} retains status labels: ${statusLabels.join(", ")}`, "check_failed");
 }
 function checkCommentMarker(context, remoteData, shared) {
-    if (!context.marker) {
-        return null;
+    if (!context.audit.enabled || !context.marker) {
+        return infoResult('Issue comment-marker audit is not applicable because no marker is configured');
     }
     const comment = findCommentByMarker(remoteData.comments, context.marker);
     if (comment) {
-        return null;
+        if (context.marker === MARKERS.summary(context.task.metadata.id)) {
+            const managed = remoteData.comments.filter((candidate) => {
+                const first = String(candidate.body || '').replace(/\r\n/g, '\n').split('\n', 1)[0] || '';
+                return first === MARKERS.task(context.task.metadata.id)
+                    || first === MARKERS.summary(context.task.metadata.id)
+                    || first.startsWith(`<!-- sync-issue:${context.task.metadata.id}:`);
+            });
+            if (managed.some((candidate) => !Number.isSafeInteger(candidate.createdSequence) || candidate.createdSequence < 1)) {
+                return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} summary comment ordering is not provable`, "check_failed");
+            }
+            const summarySequence = comment.createdSequence;
+            if (!managed.every((candidate) => summarySequence >= candidate.createdSequence)) {
+                return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} summary comment is not last among task-managed comments`, "check_failed");
+            }
+        }
+        return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} has expected comment marker`);
     }
     return shared.failResult(CHECK_TYPE, `Expected comment marker '${context.marker}' not found on Issue #${context.issueNumber}`, "check_failed");
 }
 function checkPrCommentMarker(context, remoteData, shared) {
-    if (!context.prMarker) {
-        return null;
+    if (!context.audit.enabled || !context.prMarker) {
+        return infoResult('PR comment-marker audit is not applicable because no marker is configured');
     }
     const comment = findCommentByMarker(remoteData.prComments, context.prMarker);
     if (comment) {
-        return null;
+        return shared.passResult(CHECK_TYPE, `PR #${context.prNumber} has expected comment marker`);
     }
     return shared.failResult(CHECK_TYPE, `Expected PR comment marker '${context.prMarker}' not found on PR #${context.prNumber}`, "check_failed");
 }
 function checkPrCommentLastCommit(context, remoteData, shared) {
-    if (!context.config.verify_pr_comment_last_commit_matches_head) {
-        return null;
+    if (!context.audit.enabled) {
+        return infoResult('PR last-commit audit is not enabled for this workflow');
     }
     if (!context.prMarker) {
-        return shared.failResult(CHECK_TYPE, "verify_pr_comment_last_commit_matches_head requires expected_pr_comment_marker", "check_failed");
+        return hardResult(shared.failResult(CHECK_TYPE, "verify_pr_comment_last_commit_matches_head requires expected_pr_comment_marker", "check_failed"));
     }
     const comment = findCommentByMarker(remoteData.prComments, context.prMarker);
     if (!comment) {
-        return shared.failResult(CHECK_TYPE, `Expected PR comment marker '${context.prMarker}' not found on PR #${context.prNumber}`, "check_failed");
+        return hardResult(shared.failResult(CHECK_TYPE, `Expected PR comment marker '${context.prMarker}' not found on PR #${context.prNumber}`, "check_failed"));
     }
     const match = String(comment.body || "").match(/<!--\s*last-commit:\s*([0-9a-f]{7,40})\s*-->/i);
     if (!match) {
-        return shared.failResult(CHECK_TYPE, `PR #${context.prNumber} summary comment is missing '<!-- last-commit: <sha> -->' metadata`, "check_failed");
+        return hardResult(shared.failResult(CHECK_TYPE, `PR #${context.prNumber} summary comment is missing '<!-- last-commit: <sha> -->' metadata`, "check_failed"));
     }
     const expectedHead = String(remoteData.prHeadSha || "").trim();
     if (!expectedHead)
-        return shared.blockedResult(CHECK_TYPE, "Unable to resolve the PR head SHA", "network_error");
+        return hardResult(shared.blockedResult(CHECK_TYPE, "Unable to resolve the PR head SHA", "network_error"));
     const actualHead = match[1].trim();
     if (expectedHead === actualHead) {
-        return null;
+        return shared.passResult(CHECK_TYPE, `PR #${context.prNumber} summary comment last-commit matches HEAD`);
     }
-    return shared.failResult(CHECK_TYPE, `PR #${context.prNumber} summary comment last-commit metadata mismatch: expected ${expectedHead}, got ${actualHead}`, "check_failed");
+    return hardResult(shared.failResult(CHECK_TYPE, `PR #${context.prNumber} summary comment last-commit metadata mismatch: expected ${expectedHead}, got ${actualHead}`, "check_failed"));
 }
 function checkPrCommentRequiredPatterns(context, remoteData, shared) {
-    const patterns = context.config.expected_pr_comment_required_patterns || [];
+    const patterns = context.audit.enabled ? context.config.expected_pr_comment_required_patterns || [] : [];
     if (!Array.isArray(patterns) || patterns.length === 0) {
-        return null;
+        return infoResult('PR comment-content audit is not enabled for this workflow');
     }
     if (!context.prMarker) {
-        return shared.failResult(CHECK_TYPE, "expected_pr_comment_required_patterns requires expected_pr_comment_marker", "check_failed");
+        return hardResult(shared.failResult(CHECK_TYPE, "expected_pr_comment_required_patterns requires expected_pr_comment_marker", "check_failed"));
     }
     const comment = findCommentByMarker(remoteData.prComments, context.prMarker);
     if (!comment) {
-        return shared.failResult(CHECK_TYPE, `Expected PR comment marker '${context.prMarker}' not found on PR #${context.prNumber}`, "check_failed");
+        return hardResult(shared.failResult(CHECK_TYPE, `Expected PR comment marker '${context.prMarker}' not found on PR #${context.prNumber}`, "check_failed"));
     }
     const body = String(comment.body || "");
     for (const pattern of patterns) {
         const regex = new RegExp(pattern, "m");
         if (!regex.test(body)) {
-            return shared.failResult(CHECK_TYPE, `PR #${context.prNumber} summary comment is missing required pattern: ${pattern}`, "check_failed");
+            return hardResult(shared.failResult(CHECK_TYPE, `PR #${context.prNumber} summary comment is missing required pattern: ${pattern}`, "check_failed"));
         }
     }
-    return null;
+    return shared.passResult(CHECK_TYPE, `PR #${context.prNumber} summary comment has all required patterns`);
 }
 function checkCommentContent(context, remoteData, shared) {
-    if (!context.config.verify_comment_content) {
-        return null;
+    if (!context.audit.enabled) {
+        return infoResult('Artifact comment-content audit is not enabled for this workflow');
     }
     if (!context.marker) {
-        return shared.failResult(CHECK_TYPE, "verify_comment_content requires expected_comment_marker", "check_failed");
+        return hardResult(shared.failResult(CHECK_TYPE, "Artifact comment-content audit requires an expected comment marker", "check_failed"));
     }
     if (!context.artifactPath || !shared.safeStat(context.artifactPath)) {
-        return shared.failResult(CHECK_TYPE, `Artifact not found for comment verification: ${context.artifactFile || "(missing artifactFile)"}`, "check_failed");
+        return hardResult(shared.failResult(CHECK_TYPE, `Artifact not found for comment verification: ${context.artifactFile || "(missing artifactFile)"}`, "check_failed"));
     }
     const comment = findCommentByMarker(remoteData.comments, context.marker);
     let localContent;
@@ -408,25 +413,25 @@ function checkCommentContent(context, remoteData, shared) {
         const localCanonical = canonicalizeCommentBody(fs.readFileSync(context.artifactPath, "utf8"));
         const commentCanonical = canonicalizeCommentBody(extractCommentBody(comment?.body || ""));
         if (!localCanonical.ok) {
-            return shared.failResult(CHECK_TYPE, `Comment content cannot be canonicalized for '${path.basename(context.artifactPath, path.extname(context.artifactPath))}': ${localCanonical.error.message}`, "check_failed");
+            return hardResult(shared.failResult(CHECK_TYPE, `Comment content cannot be canonicalized for '${path.basename(context.artifactPath, path.extname(context.artifactPath))}': ${localCanonical.error.message}`, "check_failed"));
         }
         if (!commentCanonical.ok) {
-            return shared.failResult(CHECK_TYPE, `Comment content cannot be canonicalized for '${path.basename(context.artifactPath, path.extname(context.artifactPath))}': ${commentCanonical.error.message}`, "check_failed");
+            return hardResult(shared.failResult(CHECK_TYPE, `Comment content cannot be canonicalized for '${path.basename(context.artifactPath, path.extname(context.artifactPath))}': ${commentCanonical.error.message}`, "check_failed"));
         }
         localContent = shared.normalizeContent(localCanonical.value);
         commentContent = shared.normalizeContent(commentCanonical.value);
     }
     catch (error) {
-        return shared.failResult(CHECK_TYPE, `Comment content cannot be read for '${path.basename(context.artifactPath, path.extname(context.artifactPath))}': ${error instanceof Error ? error.message : String(error)}`, "check_failed");
+        return hardResult(shared.failResult(CHECK_TYPE, `Comment content cannot be read for '${path.basename(context.artifactPath, path.extname(context.artifactPath))}': ${error instanceof Error ? error.message : String(error)}`, "check_failed"));
     }
     if (localContent === commentContent) {
-        return null;
+        return shared.passResult(CHECK_TYPE, `Artifact comment content matches Issue #${context.issueNumber}`);
     }
     return shared.failResult(CHECK_TYPE, buildCommentContentMismatchMessage(path.basename(context.artifactPath, path.extname(context.artifactPath)), context.issueNumber, localContent, commentContent), "check_failed");
 }
 function checkTaskCommentContent(context, remoteData, shared) {
-    if (!context.config.verify_task_comment_content) {
-        return null;
+    if (!context.audit.enabled) {
+        return infoResult('Task comment-content audit is not enabled for this workflow');
     }
     const taskMarker = `<!-- sync-issue:${context.task.metadata.id}:task -->`;
     const comment = findCommentByMarker(remoteData.comments, taskMarker);
@@ -438,34 +443,34 @@ function checkTaskCommentContent(context, remoteData, shared) {
         renderedTask = renderTaskCommentResult(context.task.content, context.task.metadata.id, loadProjectLanguage(shared));
     }
     catch {
-        return shared.failResult(CHECK_TYPE, "Task content cannot be rendered safely for comment verification", "check_failed");
+        return hardResult(shared.failResult(CHECK_TYPE, "Task content cannot be rendered safely for comment verification", "check_failed"));
     }
     if (renderedTask.byteLength > 60_000) {
-        return shared.failResult(CHECK_TYPE, "Task comment exceeds the platform byte limit", "check_failed");
+        return hardResult(shared.failResult(CHECK_TYPE, "Task comment exceeds the platform byte limit", "check_failed"));
     }
     const expectedBody = shared.normalizeContent(extractCommentBody(renderedTask.body));
     const commentBody = shared.normalizeContent(extractCommentBody(comment.body || ""));
     if (expectedBody === commentBody) {
-        return null;
+        return shared.passResult(CHECK_TYPE, `Task comment content matches Issue #${context.issueNumber}`);
     }
     return shared.failResult(CHECK_TYPE, buildCommentContentMismatchMessage("task", context.issueNumber, expectedBody, commentBody), "check_failed");
 }
 function checkPrTypeLabel(context, remoteData, shared) {
-    if (!context.config.verify_pr_type_label || !context.hasTriage || !context.prNumber || !remoteData.prLabels) {
-        return null;
+    if (!context.audit.enabled || !context.hasTriage || !context.prNumber || !remoteData.prLabels) {
+        return infoResult('PR type-label audit is not applicable because the required PR metadata or capability is unavailable');
     }
     const expectedLabel = mapTaskTypeToLabel(context.task.metadata.type);
     if (!expectedLabel) {
-        return null;
+        return infoResult('PR type-label audit is not applicable because the task type has no label mapping');
     }
     if (remoteData.prLabels.includes(expectedLabel)) {
-        return null;
+        return shared.passResult(CHECK_TYPE, `PR #${context.prNumber} has expected type label '${expectedLabel}'`);
     }
     return shared.failResult(CHECK_TYPE, `Expected type label '${expectedLabel}' not found on PR #${context.prNumber}`, "check_failed");
 }
 function checkInLabelsMatchPr(context, remoteData, shared) {
-    if (!context.config.verify_in_labels_match_pr || !context.hasTriage || !context.prNumber || !remoteData.prLabels) {
-        return null;
+    if (!context.audit.enabled || !context.hasTriage || !context.prNumber || !remoteData.prLabels) {
+        return infoResult('PR in: label audit is not applicable because the required PR metadata or capability is unavailable');
     }
     const issueInLabels = extractLabelNames(remoteData.issue.labels)
         .filter((label) => label.startsWith("in:"))
@@ -474,13 +479,13 @@ function checkInLabelsMatchPr(context, remoteData, shared) {
         .filter((label) => label.startsWith("in:"))
         .sort();
     if (arraysEqual(issueInLabels, prInLabels)) {
-        return null;
+        return shared.passResult(CHECK_TYPE, `PR #${context.prNumber} in: labels match Issue #${context.issueNumber}`);
     }
     return shared.failResult(CHECK_TYPE, `in: labels mismatch — PR #${context.prNumber} has [${formatLabelList(prInLabels)}], Issue #${context.issueNumber} has [${formatLabelList(issueInLabels)}]`, "check_failed");
 }
 function checkInLabelsComputed(context, remoteData, shared) {
-    if (!context.config.verify_in_labels_computed || !context.hasTriage) {
-        return null;
+    if (!context.audit.enabled || !context.hasTriage) {
+        return infoResult('Computed in: label audit is not applicable because it is disabled or triage capability is unavailable');
     }
     const expectedInLabels = computeExpectedInLabels(context.taskDir, remoteData.repositoryLabels, remoteData.inLabelMapping, shared);
     if (!expectedInLabels.ok) {
@@ -489,49 +494,49 @@ function checkInLabelsComputed(context, remoteData, shared) {
             : shared.blockedResult(CHECK_TYPE, expectedInLabels.message, expectedInLabels.type);
     }
     if (expectedInLabels.mode === "skipped") {
-        return null;
+        return infoResult('Computed in: label audit is not applicable because no mapped changed path exists');
     }
     const actualInLabels = extractLabelNames(remoteData.issue.labels)
         .filter((label) => label.startsWith("in:"))
         .sort();
     if (arraysEqual(expectedInLabels.labels, actualInLabels)) {
-        return null;
+        return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} in: labels match committed changes`);
     }
     return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} in: labels do not match committed changes: expected [${formatLabelList(expectedInLabels.labels)}], got [${formatLabelList(actualInLabels)}]`, "check_failed");
 }
 function checkSyncedRequirements(context, remoteData, shared) {
-    if (!context.config.sync_checked_requirements || !context.hasTriage) {
-        return null;
+    if (!context.audit.enabled || !context.hasTriage) {
+        return infoResult('Requirements audit is not applicable because it is disabled or triage capability is unavailable');
     }
     const checkedRequirements = shared.getCheckedRequirements(context.task.content);
     if (checkedRequirements.length === 0) {
-        return null;
+        return infoResult('Requirements audit is not applicable because the task has no checked requirements');
     }
     const issueBody = remoteData.issue.body || "";
     const resolution = resolveRequirementSection(issueBody, requirementSectionAnchors(shared.repoRoot, context.task.metadata.type || "task"));
     if (resolution.status === "missing") {
-        return null;
+        return infoResult('Requirements audit is not applicable because the Issue has no requirements section');
     }
     if (resolution.status === "ambiguous") {
-        return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} requirements section is ambiguous`, "check_failed");
+        return hardResult(shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} requirements section is ambiguous`, "check_failed"));
     }
     const requirementBody = issueBody.slice(resolution.bodyStart, resolution.bodyEnd);
     const missingRequirements = checkedRequirements.filter((item) => !hasCheckedRequirement(requirementBody, item));
     if (missingRequirements.length === 0) {
-        return null;
+        return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} contains all checked requirements`);
     }
     return shared.failResult(CHECK_TYPE, `Issue body is missing checked requirements: ${missingRequirements.join(", ")}`, "check_failed");
 }
 function checkIssueType(context, remoteData, shared) {
-    if (!context.config.verify_issue_type || !context.hasPush) {
-        return null;
+    if (!context.hasPush) {
+        return infoResult('Issue Type audit is not applicable because push capability is unavailable');
     }
     if (remoteData.issueType === undefined) {
-        return null;
+        return infoResult('Issue Type audit is not applicable because the provider does not expose Issue Type');
     }
     if (!remoteData.issueType) {
         if (context.repoOwnerType === "User") {
-            return null;
+            return infoResult('Issue Type audit is not applicable for a user-owned repository');
         }
         return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} has no Issue Type set`, "check_failed");
     }
@@ -539,14 +544,14 @@ function checkIssueType(context, remoteData, shared) {
     if (expectedType && remoteData.issueType !== expectedType) {
         return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} has type '${remoteData.issueType}', expected '${expectedType}' (from task type '${context.task.metadata.type}')`, "check_failed");
     }
-    return null;
+    return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} has the expected Issue Type`);
 }
 function checkIssueFields(context, remoteData, shared) {
-    if (!context.config.verify_issue_fields || !context.hasPush) {
-        return null;
+    if (!context.hasPush) {
+        return infoResult('Issue field audit is not applicable because push capability is unavailable');
     }
     if (remoteData.issueFields === undefined) {
-        return null;
+        return infoResult('Issue field audit is not applicable because the provider does not expose Issue fields');
     }
     for (const [metadataKey, fieldName] of Object.entries(FRONTMATTER_FIELD_MAP)) {
         const expectedRaw = context.task.metadata[metadataKey];
@@ -565,20 +570,20 @@ function checkIssueFields(context, remoteData, shared) {
             return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} field '${fieldName}' is '${actual.value}', expected '${expected.value}'`, "check_failed");
         }
     }
-    return null;
+    return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} fields match task metadata`);
 }
 function checkPrAssignee(context, remoteData, shared) {
-    if (!context.config.verify_pr_assignee || !context.hasPush || !context.prNumber) {
-        return null;
+    if (!context.audit.enabled || !context.hasPush || !context.prNumber) {
+        return infoResult('PR assignee audit is not applicable because it is disabled or required PR metadata/capability is unavailable');
     }
     if (!remoteData.prAssignees || remoteData.prAssignees.length === 0) {
         return shared.failResult(CHECK_TYPE, `PR #${context.prNumber} has no assignee`, "check_failed");
     }
-    return null;
+    return shared.passResult(CHECK_TYPE, `PR #${context.prNumber} has an assignee`);
 }
 function checkMilestone(context, remoteData, shared) {
-    if (!context.config.verify_milestone || !context.hasTriage) {
-        return null;
+    if (!context.hasTriage) {
+        return infoResult('Milestone audit is not applicable because triage capability is unavailable');
     }
     if (!remoteData.issue?.milestone?.title) {
         return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} has no milestone set`, "check_failed");
@@ -586,7 +591,7 @@ function checkMilestone(context, remoteData, shared) {
     if (context.prNumber && remoteData.prMilestone !== undefined && !remoteData.prMilestone?.title) {
         return shared.failResult(CHECK_TYPE, `PR #${context.prNumber} has no milestone set`, "check_failed");
     }
-    if (context.config.verify_milestone_specific) {
+    if (context.audit.requireSpecificMilestone) {
         const issueTitle = remoteData.issue.milestone.title;
         if (VERSION_LINE_REGEX.test(issueTitle)) {
             return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} milestone '${issueTitle}' is a release line; narrow to a specific version (e.g. ${issueTitle.replace(/\.x$/, ".N")}) before continuing`, "check_failed");
@@ -595,7 +600,7 @@ function checkMilestone(context, remoteData, shared) {
             return shared.failResult(CHECK_TYPE, `PR #${context.prNumber} milestone '${remoteData.prMilestone.title}' is a release line; narrow to a specific version before continuing`, "check_failed");
         }
     }
-    return null;
+    return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} milestone satisfies the configured policy`);
 }
 function findCommentByMarker(comments, marker) {
     return (comments || []).find((comment) => typeof comment.body === "string" && comment.body.includes(marker)) || null;