@fitlab-ai/agent-infra 0.11.0 → 0.11.2

package/dist/lib/task/finalization.js

@@ -1,7 +1,10 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { randomUUID } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { syncPlatformComment } from '../platform/issue-comments.js';
+import { canonicalizeSummaryBody } from '../platform/comment-safety.js';
+import { taskIssueIdentity } from '../platform/task-identities.js';
+import { parseTaskFrontmatter } from './frontmatter.js';
 import { applyTaskLifecycle } from './lifecycle.js';
 import { resolveTaskRef } from './resolve-ref.js';
 import { inspectShortIdRegistry } from './short-id.js';
@@ -9,8 +12,8 @@ import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-
 import { verifyTaskEvent } from './verification.js';
 import { projectFinalizationWarning } from './workflow-warning-intents.js';
 import { mergeOperationWarnings } from './operation-outcome.js';
-const RECEIPT_VERSION = 2;
-const FINALIZATION_STEPS = ['lifecycle', 'task-comment', 'verification'];
+const RECEIPT_VERSION = 3;
+const FINALIZATION_STEPS = ['lifecycle', 'task-comment', 'verification', 'summary', 'post-summary-verification'];
 function finalizationRoot(repoRoot) {
     return path.join(repoRoot, '.agents', 'workspace', '.task-finalization');
 }
@@ -34,6 +37,8 @@ function failed(taskId, error, overrides = {}) {
         lifecycle: null,
         taskComment: null,
         verification: null,
+        summary: null,
+        postSummaryVerification: null,
         completedSteps: [],
         pendingSteps: [...FINALIZATION_STEPS],
         result: error.retryable ? 'blocked' : 'failed',
@@ -52,8 +57,11 @@ function emptyReceipt(taskId, controlBinding) {
         lifecycle: 'pending',
         taskComment: 'pending',
         verification: 'pending',
+        summary: 'pending',
+        postSummaryVerification: 'pending',
         warningProjection: 'done',
         warnings: [],
+        summarySha256: null,
         ...(controlBinding ? { controlBinding } : {}),
         updatedAt: now(),
         lastError: null
@@ -88,8 +96,11 @@ function validateReceipt(value, taskId) {
         || !states.includes(String(receipt.lifecycle))
         || !states.includes(String(receipt.taskComment))
         || !states.includes(String(receipt.verification))
+        || !states.includes(String(receipt.summary))
+        || !states.includes(String(receipt.postSummaryVerification))
         || !['pending', 'done'].includes(String(receipt.warningProjection))
         || !Array.isArray(receipt.warnings) || receipt.warnings.some((warning) => !validWarning(warning))
+        || (receipt.summarySha256 !== null && (typeof receipt.summarySha256 !== 'string' || !/^[a-f0-9]{64}$/u.test(receipt.summarySha256)))
         || typeof receipt.updatedAt !== 'string'
         || (receipt.lastError !== null && (typeof receipt.lastError !== 'object' || Array.isArray(receipt.lastError)))
         || (receipt.controlBinding !== undefined && (!controlBinding || typeof controlBinding !== 'object'
@@ -109,10 +120,6 @@ function readReceipt(repoRoot, taskId) {
 function readTaskFinalizationReceipt(repoRoot, taskId) {
     return readReceipt(path.resolve(repoRoot), taskId);
 }
-function controlBindingMatches(receipt, binding) {
-    return receipt.controlBinding?.generation === binding.generation
-        && receipt.controlBinding.requestId === binding.requestId;
-}
 function writeReceipt(repoRoot, receipt) {
     const directory = finalizationRoot(repoRoot);
     fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
@@ -132,20 +139,24 @@ function writeReceipt(repoRoot, receipt) {
 }
 function updateReceipt(repoRoot, receipt, patch) {
     const current = readReceipt(repoRoot, receipt.taskId);
-    if (!current || current.receiptId !== receipt.receiptId || current.revision !== receipt.revision) {
-        const error = new Error('finalization receipt revision is stale');
-        Object.assign(error, { code: 'FINALIZATION_CAPABILITY_STALE' });
-        throw error;
-    }
+    if (!current || current.receiptId !== receipt.receiptId)
+        throw capabilityError('FINALIZATION_SCOPE_INVALID', 'finalization receipt does not belong to the current task');
     const next = { ...current, ...patch, revision: current.revision + 1, updatedAt: now() };
     writeReceipt(repoRoot, next);
     return next;
 }
 function completedSteps(receipt) {
-    return FINALIZATION_STEPS.filter((step) => receipt[step === 'task-comment' ? 'taskComment' : step] !== 'pending');
+    return FINALIZATION_STEPS.filter((step) => stepState(receipt, step) !== 'pending');
 }
 function pendingSteps(receipt) {
-    return FINALIZATION_STEPS.filter((step) => receipt[step === 'task-comment' ? 'taskComment' : step] === 'pending');
+    return FINALIZATION_STEPS.filter((step) => stepState(receipt, step) === 'pending');
+}
+function stepState(receipt, step) {
+    if (step === 'task-comment')
+        return receipt.taskComment;
+    if (step === 'post-summary-verification')
+        return receipt.postSummaryVerification;
+    return receipt[step];
 }
 function lifecycleStep(result) {
     return {
@@ -234,9 +245,8 @@ function mutationKeys(value) {
     return Object.keys(value).sort();
 }
 function validateCapabilityMutation(current, capability, mutation, consumed) {
-    if (capability.receiptId !== current.receiptId || capability.baseRevision !== current.revision || consumed.has(capability.nonce)) {
-        throw capabilityError('FINALIZATION_CAPABILITY_STALE', 'finalization capability is stale or outside its scope');
-    }
+    if (capability.receiptId !== current.receiptId)
+        throw capabilityError('FINALIZATION_SCOPE_INVALID', 'finalization mutation belongs to a different task receipt');
     if (capability.scope !== mutation.scope) {
         throw capabilityError('FINALIZATION_SCOPE_INVALID', 'finalization capability mutation scope does not match its capability');
     }
@@ -403,9 +413,89 @@ async function syncPendingTaskComment(input) {
         return { receipt, step: { status: 'blocked', changed: false, error: detail }, changed: false, error: detail };
     }
 }
+function readDeliverySummary(taskDir, taskId) {
+    const file = path.join(taskDir, '.delivery-summary.json');
+    let value;
+    try {
+        value = JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        throw Object.assign(new Error('delivery summary staging record is unavailable'), { code: 'SUMMARY_STAGING_INVALID' });
+    }
+    if (value.taskId !== taskId || typeof value.body !== 'string' || typeof value.sha256 !== 'string') {
+        throw Object.assign(new Error('delivery summary staging record is invalid'), { code: 'SUMMARY_STAGING_INVALID' });
+    }
+    const canonical = canonicalizeSummaryBody(value.body);
+    if (!canonical.ok || canonical.value !== value.body) {
+        throw Object.assign(new Error('delivery summary staging body is not canonical'), { code: 'SUMMARY_STAGING_INVALID' });
+    }
+    const digest = createHash('sha256').update(canonical.value).digest('hex');
+    if (digest !== value.sha256)
+        throw Object.assign(new Error('delivery summary staging digest does not match body'), { code: 'SUMMARY_STAGING_INVALID' });
+    return { body: canonical.value, sha256: value.sha256 };
+}
+async function syncPendingSummary(input) {
+    let { receipt } = input;
+    if (receipt.summary !== 'pending') {
+        return { receipt, step: { status: receipt.summary === 'skipped' ? 'skipped' : 'no-op', changed: false, error: null }, changed: false, error: null };
+    }
+    try {
+        const resolved = resolveTaskRef(input.taskId, { repoRoot: input.repoRoot });
+        if (!resolved.ok || resolved.state !== 'completed')
+            throw Object.assign(new Error('completed task is unavailable for summary sync'), { code: 'SUMMARY_STAGING_INVALID' });
+        if (!taskIssueIdentity(parseTaskFrontmatter(fs.readFileSync(resolved.taskMdPath, 'utf8')))) {
+            receipt = updateReceipt(input.repoRoot, receipt, {
+                summary: 'skipped', postSummaryVerification: 'skipped', summarySha256: null, lastError: null
+            });
+            return { receipt, step: { status: 'skipped', changed: false, error: null }, changed: false, error: null };
+        }
+        const summary = readDeliverySummary(resolved.taskDir, input.taskId);
+        const result = await input.commentSync(input.taskId, {
+            kind: 'summary', agent: input.agent, body: summary.body, cwd: input.repoRoot,
+            summaryAuthorization: { sha256: summary.sha256 }
+        });
+        const step = commentStep(result);
+        if (result.status === 'applied' || result.status === 'no-op') {
+            const skipped = result.error?.code === 'ISSUE_NOT_LINKED';
+            const resolvedWarning = receipt.warnings.some((warning) => warning.step === 'summary' && warning.status === 'open');
+            const warnings = resolveStepWarnings(receipt, 'summary');
+            receipt = updateReceipt(input.repoRoot, receipt, {
+                summary: skipped ? 'skipped' : 'done', postSummaryVerification: skipped ? 'skipped' : receipt.postSummaryVerification,
+                summarySha256: skipped ? null : summary.sha256,
+                taskComment: resolvedWarning ? 'pending' : receipt.taskComment,
+                warningProjection: warnings.some((warning) => warning.status === 'open') ? 'pending' : 'done',
+                warnings,
+                lastError: null
+            });
+            return { receipt, step: skipped ? { ...step, status: 'skipped' } : step, changed: result.changed, error: null };
+        }
+        const error = step.error ?? { code: 'SUMMARY_SYNC_FAILED', message: 'delivery summary synchronization failed', retryable: true };
+        const warning = warningFromError('summary', error);
+        const alreadyOpen = receipt.warnings.some((item) => item.step === warning.step && item.code === warning.code && item.target === warning.target && item.status === 'open');
+        const warnings = replaceWarning(receipt, warning, 'open');
+        receipt = updateReceipt(input.repoRoot, receipt, { summary: 'pending', taskComment: alreadyOpen ? receipt.taskComment : 'pending', warningProjection: 'pending', warnings, lastError: error });
+        return { receipt, step, changed: result.changed, error };
+    }
+    catch (cause) {
+        const error = errorOf(cause, 'SUMMARY_SYNC_FAILED', true);
+        try {
+            const warning = warningFromError('summary', error);
+            const alreadyOpen = receipt.warnings.some((item) => item.step === warning.step && item.code === warning.code && item.target === warning.target && item.status === 'open');
+            const warnings = replaceWarning(receipt, warning, 'open');
+            receipt = updateReceipt(input.repoRoot, receipt, { summary: 'pending', taskComment: alreadyOpen ? receipt.taskComment : 'pending', warningProjection: 'pending', warnings, lastError: error });
+        }
+        catch { /* preserve primary error */ }
+        return { receipt, step: { status: 'blocked', changed: false, error }, changed: false, error };
+    }
+}
+function clearDeliverySummary(taskDir) {
+    const file = path.join(taskDir, '.delivery-summary.json');
+    if (fs.existsSync(file))
+        fs.unlinkSync(file);
+}
 function terminalResult(taskId, receipt, steps, changed, error = null) {
     const pending = pendingSteps(receipt);
-    const blocked = [steps.lifecycle, steps.taskComment, steps.verification].some((step) => step?.status === 'blocked');
+    const blocked = [steps.lifecycle, steps.taskComment, steps.verification, steps.summary, steps.postSummaryVerification].some((step) => step?.status === 'blocked');
     const warnings = openWarnings(receipt);
     const postLifecyclePending = receipt.lifecycle === 'done' && (pending.some((step) => step !== 'lifecycle') || receipt.warningProjection === 'pending');
     const hardError = error?.code.startsWith('FINALIZATION_') || error?.code === 'TASK_FINALIZATION_RECEIPT_INVALID';
@@ -413,13 +503,17 @@ function terminalResult(taskId, receipt, steps, changed, error = null) {
         status: hardError ? (error?.retryable ? 'blocked' : 'failed') : pending.length === 0 ? 'completed' : postLifecyclePending ? 'completed' : blocked ? 'blocked' : 'failed',
         changed,
         taskId,
-        ...steps,
+        lifecycle: steps.lifecycle ?? null,
+        taskComment: steps.taskComment ?? null,
+        verification: steps.verification ?? null,
+        summary: steps.summary ?? null,
+        postSummaryVerification: steps.postSummaryVerification ?? null,
         completedSteps: completedSteps(receipt),
         pendingSteps: pending,
-        result: postLifecyclePending && (warnings.length > 0 || receipt.warningProjection === 'pending')
-            ? 'completed_with_warnings'
-            : hardError
-                ? (error?.retryable ? 'blocked' : 'failed')
+        result: hardError
+            ? (error?.retryable ? 'blocked' : 'failed')
+            : postLifecyclePending && (warnings.length > 0 || receipt.warningProjection === 'pending')
+                ? 'completed_with_warnings'
                 : pending.length === 0 || postLifecyclePending
                     ? 'completed'
                     : blocked
@@ -446,17 +540,9 @@ async function applyUnderLock(request, taskId, options) {
     catch (error) {
         return failed(taskId, errorOf(error, 'TASK_FINALIZATION_RECEIPT_INVALID'));
     }
-    if (options.controlBinding && !controlBindingMatches(receipt, options.controlBinding)) {
-        const error = {
-            code: 'TASK_FINALIZATION_CONTROL_BINDING_CONFLICT',
-            message: 'finalization receipt belongs to a different sandbox request or generation',
-            retryable: false
-        };
-        return failed(taskId, error, {
-            completedSteps: completedSteps(receipt),
-            pendingSteps: pendingSteps(receipt)
-        });
-    }
+    if (options.controlBinding && (receipt.controlBinding?.generation !== options.controlBinding.generation
+        || receipt.controlBinding.requestId !== options.controlBinding.requestId))
+        receipt = updateReceipt(repoRoot, receipt, { controlBinding: options.controlBinding });
     const preflightState = resolveTaskRef(taskId, { repoRoot });
     if (options.preflight && preflightState.ok && preflightState.state === 'active') {
         try {
@@ -546,13 +632,11 @@ async function applyUnderLock(request, taskId, options) {
     let verification = null;
     try {
         receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
-        if (receipt.verification !== 'pending') {
-            verification = { status: 'no-op', changed: false, error: null };
-        }
-        else {
-            const result = await verify({ taskRef: taskId, event: 'complete-task.completed' }, { repoRoot });
-            verification = verificationStep(result);
-            if (result.status === 'pass') {
+        const verificationPending = receipt.verification === 'pending';
+        const result = await verify({ taskRef: taskId, event: 'complete-task.completed' }, { repoRoot });
+        verification = verificationStep(result);
+        if (result.status === 'pass') {
+            if (verificationPending) {
                 const capability = issueCapability(receipt, 'verification');
                 receipt = applyFinalizationReceiptMutationUnderLock(repoRoot, receipt, capability, {
                     scope: 'verification', operation: 'succeeded'
@@ -570,30 +654,170 @@ async function applyUnderLock(request, taskId, options) {
                 }
             }
             else {
-                const detail = verification.error ?? { code: 'VERIFY_FAILED', message: 'verification failed', retryable: true };
+                receipt = updateReceipt(repoRoot, receipt, { lastError: null });
+            }
+        }
+        else {
+            const detail = verification.error ?? { code: 'VERIFY_FAILED', message: 'verification failed', retryable: true };
+            if (verificationPending) {
                 const capability = issueCapability(receipt, 'verification');
                 receipt = applyFinalizationReceiptMutationUnderLock(repoRoot, receipt, capability, {
                     scope: 'verification', operation: 'failed', error: detail
                 }, consumedCapabilities);
                 receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
-                return terminalResult(taskId, receipt, { lifecycle: lifecycleResult, taskComment, verification }, changed, verification.error);
             }
+            else {
+                const warnings = replaceWarning(receipt, warningFromError('verification', detail), 'open');
+                receipt = updateReceipt(repoRoot, receipt, {
+                    verification: 'pending', taskComment: 'pending', warningProjection: 'pending', warnings, lastError: detail
+                });
+                receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
+                const warningComment = await syncPendingTaskComment({ repoRoot, taskId, agent: request.agent, receipt, commentSync, consumedCapabilities });
+                receipt = warningComment.receipt;
+                if (warningComment.step.status !== 'no-op')
+                    taskComment = warningComment.step;
+                changed = changed || warningComment.changed;
+            }
+            return terminalResult(taskId, receipt, { lifecycle: lifecycleResult, taskComment, verification }, changed, detail);
         }
     }
     catch (error) {
         const detail = errorOf(error, 'VERIFY_FAILED', true);
         try {
-            const capability = issueCapability(receipt, 'verification');
-            receipt = applyFinalizationReceiptMutationUnderLock(repoRoot, receipt, capability, {
-                scope: 'verification', operation: 'failed', error: detail
-            }, consumedCapabilities);
+            if (receipt.verification === 'pending') {
+                const capability = issueCapability(receipt, 'verification');
+                receipt = applyFinalizationReceiptMutationUnderLock(repoRoot, receipt, capability, {
+                    scope: 'verification', operation: 'failed', error: detail
+                }, consumedCapabilities);
+            }
+            else {
+                const warnings = replaceWarning(receipt, warningFromError('verification', detail), 'open');
+                receipt = updateReceipt(repoRoot, receipt, {
+                    verification: 'pending', taskComment: 'pending', warningProjection: 'pending', warnings, lastError: detail
+                });
+            }
             receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
         }
+        catch (writeError) {
+            const persistence = errorOf(writeError, 'FINALIZATION_RECEIPT_WRITE_FAILED', true);
+            const hardError = {
+                code: 'FINALIZATION_RECEIPT_WRITE_FAILED',
+                message: `Unable to persist verification failure (${detail.code}: ${detail.message}): ${persistence.message}`,
+                retryable: true
+            };
+            return terminalResult(taskId, receipt, {
+                lifecycle: lifecycleResult, taskComment, verification: { status: 'blocked', changed: false, error: detail }
+            }, changed, hardError);
+        }
+        try {
+            const warningComment = await syncPendingTaskComment({ repoRoot, taskId, agent: request.agent, receipt, commentSync, consumedCapabilities });
+            receipt = warningComment.receipt;
+            if (warningComment.step.status !== 'no-op')
+                taskComment = warningComment.step;
+            changed = changed || warningComment.changed;
+        }
         catch { /* preserve the primary error */ }
         return terminalResult(taskId, receipt, { lifecycle: lifecycleResult, taskComment, verification: { status: 'blocked', changed: false, error: detail } }, changed, detail);
     }
+    const summary = await syncPendingSummary({ repoRoot, taskId, agent: request.agent, receipt, commentSync });
+    receipt = summary.receipt;
+    changed = changed || summary.changed;
+    if (summary.error) {
+        receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
+        const warningComment = await syncPendingTaskComment({
+            repoRoot, taskId, agent: request.agent, receipt, commentSync, consumedCapabilities
+        });
+        receipt = warningComment.receipt;
+        if (warningComment.step.status !== 'no-op')
+            taskComment = warningComment.step;
+        changed = changed || warningComment.changed;
+        return terminalResult(taskId, receipt, { lifecycle: lifecycleResult, taskComment, verification, summary: summary.step }, changed, summary.error);
+    }
+    let postSummaryVerification = null;
+    if (receipt.postSummaryVerification === 'skipped') {
+        postSummaryVerification = { status: 'skipped', changed: false, error: null };
+    }
+    else if (receipt.postSummaryVerification !== 'pending') {
+        const replay = await commentSync(taskId, {
+            kind: 'summary', agent: request.agent, body: '', cwd: repoRoot, verifyOnly: true,
+            summaryAuthorization: { sha256: receipt.summarySha256 ?? '' }
+        });
+        postSummaryVerification = commentStep(replay);
+        if (replay.status !== 'applied' && replay.status !== 'no-op') {
+            const error = postSummaryVerification.error ?? { code: 'SUMMARY_VERIFICATION_FAILED', message: 'summary replay verification failed', retryable: true };
+            const warnings = replaceWarning(receipt, warningFromError('post-summary-verification', error), 'open');
+            receipt = updateReceipt(repoRoot, receipt, { postSummaryVerification: 'pending', taskComment: 'pending', warningProjection: 'pending', warnings, lastError: error });
+            receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
+            return terminalResult(taskId, receipt, { lifecycle: lifecycleResult, taskComment, verification, summary: summary.step, postSummaryVerification }, changed, error);
+        }
+    }
+    else {
+        try {
+            const summaryVerification = await commentSync(taskId, {
+                kind: 'summary', agent: request.agent, body: '', cwd: repoRoot, verifyOnly: true,
+                summaryAuthorization: { sha256: receipt.summarySha256 ?? '' }
+            });
+            if (summaryVerification.status !== 'applied' && summaryVerification.status !== 'no-op') {
+                const error = commentStep(summaryVerification).error ?? { code: 'SUMMARY_VERIFICATION_FAILED', message: 'summary verification failed', retryable: true };
+                const warnings = replaceWarning(receipt, warningFromError('post-summary-verification', error), 'open');
+                receipt = updateReceipt(repoRoot, receipt, { postSummaryVerification: 'pending', taskComment: 'pending', warningProjection: 'pending', warnings, lastError: error });
+                receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
+                const warningComment = await syncPendingTaskComment({ repoRoot, taskId, agent: request.agent, receipt, commentSync, consumedCapabilities });
+                receipt = warningComment.receipt;
+                if (warningComment.step.status !== 'no-op')
+                    taskComment = warningComment.step;
+                changed = changed || warningComment.changed;
+                return terminalResult(taskId, receipt, { lifecycle: lifecycleResult, taskComment, verification, summary: summary.step, postSummaryVerification: commentStep(summaryVerification) }, changed, error);
+            }
+            const result = await verify({ taskRef: taskId, event: 'complete-task.completed' }, { repoRoot });
+            postSummaryVerification = verificationStep(result);
+            if (result.status === 'pass') {
+                const resolvedWarning = receipt.warnings.some((warning) => warning.step === 'post-summary-verification' && warning.status === 'open');
+                const warnings = resolveStepWarnings(receipt, 'post-summary-verification');
+                receipt = updateReceipt(repoRoot, receipt, {
+                    postSummaryVerification: 'done', taskComment: resolvedWarning ? 'pending' : receipt.taskComment,
+                    warningProjection: warnings.some((warning) => warning.status === 'open') ? 'pending' : 'done', warnings, lastError: null
+                });
+                receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
+                const warningComment = await syncPendingTaskComment({ repoRoot, taskId, agent: request.agent, receipt, commentSync, consumedCapabilities });
+                receipt = warningComment.receipt;
+                if (warningComment.step.status !== 'no-op')
+                    taskComment = warningComment.step;
+                changed = changed || warningComment.changed;
+            }
+            else {
+                const error = postSummaryVerification.error ?? { code: 'VERIFY_FAILED', message: 'post-summary verification failed', retryable: true };
+                const warnings = replaceWarning(receipt, warningFromError('post-summary-verification', error), 'open');
+                receipt = updateReceipt(repoRoot, receipt, { postSummaryVerification: 'pending', taskComment: 'pending', warningProjection: 'pending', warnings, lastError: error });
+                receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
+                const warningComment = await syncPendingTaskComment({ repoRoot, taskId, agent: request.agent, receipt, commentSync, consumedCapabilities });
+                receipt = warningComment.receipt;
+                if (warningComment.step.status !== 'no-op')
+                    taskComment = warningComment.step;
+                changed = changed || warningComment.changed;
+                return terminalResult(taskId, receipt, { lifecycle: lifecycleResult, taskComment, verification, summary: summary.step, postSummaryVerification }, changed, error);
+            }
+        }
+        catch (error) {
+            const detail = errorOf(error, 'POST_SUMMARY_VERIFY_FAILED', true);
+            const warnings = replaceWarning(receipt, warningFromError('post-summary-verification', detail), 'open');
+            receipt = updateReceipt(repoRoot, receipt, { postSummaryVerification: 'pending', taskComment: 'pending', warningProjection: 'pending', warnings, lastError: detail });
+            receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
+            const warningComment = await syncPendingTaskComment({ repoRoot, taskId, agent: request.agent, receipt, commentSync, consumedCapabilities });
+            receipt = warningComment.receipt;
+            if (warningComment.step.status !== 'no-op')
+                taskComment = warningComment.step;
+            changed = changed || warningComment.changed;
+            return terminalResult(taskId, receipt, { lifecycle: lifecycleResult, taskComment, verification, summary: summary.step, postSummaryVerification: { status: 'blocked', changed: false, error: detail } }, changed, detail);
+        }
+    }
     receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
-    return terminalResult(taskId, receipt, { lifecycle: lifecycleResult, taskComment, verification }, changed);
+    if (receipt.summary !== 'pending' && receipt.postSummaryVerification !== 'pending' && receipt.warningProjection === 'done' && openWarnings(receipt).length === 0) {
+        const resolved = resolveTaskRef(taskId, { repoRoot });
+        if (resolved.ok && resolved.state === 'completed')
+            clearDeliverySummary(resolved.taskDir);
+    }
+    return terminalResult(taskId, receipt, { lifecycle: lifecycleResult, taskComment, verification, summary: summary.step, postSummaryVerification }, changed);
 }
 async function applyTaskFinalization(request, options) {
     if (request.intent !== 'complete' || !request.taskRef || !request.agent) {
@@ -613,5 +837,5 @@ async function applyTaskFinalization(request, options) {
         return failed(resolved.taskId, detail);
     }
 }
-export { applyFinalizationReceiptMutation, applyTaskFinalization, issueCapability as createFinalizationCapability, readTaskFinalizationReceipt };
+export { applyFinalizationReceiptMutation, applyTaskFinalization, issueCapability as createFinalizationCapability, readTaskFinalizationReceipt, terminalResult };
 //# sourceMappingURL=finalization.js.map

package/dist/lib/task/gate-policy.js

@@ -0,0 +1,94 @@
+const OPTIONAL_PLATFORM_AUDITS = new Set([
+    'closed-status-labels', 'status-label', 'comment-marker', 'pr-comment-marker',
+    'pr-comment-last-commit', 'pr-comment-content', 'comment-content', 'task-comment-content',
+    'in-labels-computed', 'pr-type-label', 'in-labels-match-pr', 'pr-assignee',
+    'requirements', 'issue-type', 'issue-fields', 'milestone'
+]);
+const STATUS_LABELS = {
+    'create-task': 'status: waiting-for-triage',
+    'analyze-task': 'status: pending-design-work',
+    'review-analysis': 'status: pending-design-work',
+    'plan-task': 'status: pending-design-work',
+    'review-plan': 'status: pending-design-work',
+    'code-task': 'status: in-progress',
+    'review-code': 'status: in-progress'
+};
+const ARTIFACT_COMMENT_SKILLS = new Set([
+    'analyze-task', 'plan-task', 'review-analysis', 'review-plan', 'code-task',
+    'review-code', 'review-pr', 'run-manual-validation'
+]);
+const PR_AUDIT_SKILLS = new Set(['create-pr']);
+const IN_LABEL_AUDIT_SKILLS = new Set(['code-task', 'commit', 'create-pr']);
+export function platformAuditPolicy(checkId, context) {
+    const skillName = context.skillName || '';
+    const artifactComment = Boolean(context.artifactFile) && ARTIFACT_COMMENT_SKILLS.has(skillName);
+    const prAudit = PR_AUDIT_SKILLS.has(skillName);
+    const inLabelAudit = IN_LABEL_AUDIT_SKILLS.has(skillName);
+    switch (checkId) {
+        case 'status-label':
+            return { classification: 'soft', enabled: Boolean(STATUS_LABELS[skillName]), expectedStatusLabel: STATUS_LABELS[skillName] };
+        case 'comment-marker':
+            return {
+                classification: 'soft',
+                enabled: artifactComment || skillName === 'complete-task',
+                ...(artifactComment ? { expectedCommentMarkerKey: 'artifact' } : skillName === 'complete-task' ? { expectedCommentMarkerKey: 'summary' } : {})
+            };
+        case 'pr-comment-marker':
+            return {
+                classification: 'soft',
+                enabled: skillName === 'commit' || prAudit,
+                ...(skillName === 'commit' || prAudit ? { expectedPrCommentMarkerKey: 'prSummary' } : {})
+            };
+        case 'pr-comment-last-commit':
+            return {
+                classification: 'soft',
+                enabled: skillName === 'commit',
+                ...(skillName === 'commit' ? { expectedPrCommentMarkerKey: 'prSummary' } : {})
+            };
+        case 'pr-comment-content':
+            return {
+                classification: 'soft',
+                enabled: skillName === 'complete-manual-validation',
+                ...(skillName === 'complete-manual-validation' ? { expectedPrCommentMarkerKey: 'prSummary' } : {})
+            };
+        case 'comment-content':
+            return { classification: 'soft', enabled: artifactComment, expectedCommentMarkerKey: 'artifact' };
+        case 'task-comment-content':
+            return { classification: 'soft', enabled: true };
+        case 'in-labels-computed':
+            return { classification: 'soft', enabled: inLabelAudit };
+        case 'pr-type-label':
+        case 'in-labels-match-pr':
+        case 'pr-assignee':
+            return { classification: 'soft', enabled: prAudit };
+        case 'requirements':
+            return { classification: 'soft', enabled: skillName === 'complete-task' };
+        case 'milestone':
+            return { classification: 'soft', enabled: true, requireSpecificMilestone: skillName === 'code-task' };
+        case 'closed-status-labels':
+        case 'issue-type':
+        case 'issue-fields':
+            return { classification: 'soft', enabled: true };
+    }
+}
+export function classificationForCheck(checkId) {
+    return checkId.startsWith('platform.') && OPTIONAL_PLATFORM_AUDITS.has(checkId.slice('platform.'.length))
+        ? 'soft'
+        : 'hard';
+}
+export function effectiveStatus(status, classification) {
+    return classification === 'hard' ? status : 'pass';
+}
+export function normalizeVerificationRecord(record) {
+    const checkId = record.checkId ?? record.type;
+    const classification = record.classification ?? classificationForCheck(checkId);
+    return {
+        ...record,
+        checkId,
+        classification,
+        effectiveStatus: record.effectiveStatus ?? effectiveStatus(record.status, classification),
+        reason: record.reason ?? record.fail_type ?? (classification === 'info' ? 'NOT_APPLICABLE' : record.status === 'pass' ? 'OK' : 'CHECK_FAILED'),
+        action: record.action ?? (classification === 'info' || record.status === 'pass' ? 'No action required' : 'Review the check evidence and retry after correction')
+    };
+}
+//# sourceMappingURL=gate-policy.js.map

package/dist/lib/task/lifecycle-execution.js

@@ -1,4 +1,4 @@
-import { inspectOrchestrationStage, pauseOrchestration, planOrchestrationStageCompletion, readRun } from './orchestration.js';
+import { inspectOrchestrationStage, pauseOrchestration, planOrchestrationStageCompletion } from './orchestration.js';
 import { resolveTaskRef } from './resolve-ref.js';
 function failure(mode, code, message) {
     return { ok: false, mode, completionPlan: null, error: { code, message } };
@@ -8,16 +8,7 @@ function inspectLifecycleExecution(taskRef, request, options = {}) {
     if (!resolved.ok)
         return failure(request.mode, resolved.code, resolved.message);
     if (request.mode === 'standalone') {
-        try {
-            const run = readRun(resolved.taskDir);
-            if (run?.pendingDelegation) {
-                return failure(request.mode, 'ORCHESTRATION_STANDALONE_BUSY', 'standalone lifecycle execution is blocked by a pending orchestration delegation');
-            }
-            return { ok: true, mode: request.mode, completionPlan: null, error: null };
-        }
-        catch (error) {
-            return failure(request.mode, 'ORCHESTRATION_STATE_INVALID', error instanceof Error ? error.message : String(error));
-        }
+        return { ok: true, mode: request.mode, completionPlan: null, error: null };
     }
     if (request.agent) {
         const planned = planOrchestrationStageCompletion(taskRef, {