@fitlab-ai/agent-infra 0.11.1 → 0.11.2

package/lib/task/review-finalization.ts

@@ -1,7 +1,9 @@
 import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
 
 import { parseArtifactName } from './artifact-name.ts';
-import { validateCompletedArtifact, hasOpenArtifactRound, validateArtifactPublication } from './artifact-lifecycle.ts';
+import { validateCompletedArtifact, validateArtifactPublication } from './artifact-lifecycle.ts';
 import { LEDGER_SECTION_MISSING_CODE, LEDGER_SECTION_MISSING_MESSAGE, parseLedgerDocument, summarizeLedgerStage, validateLedgerRows } from './ledger.ts';
 import type { LedgerStageStatus, ReviewStage } from './ledger.ts';
 import { finalizeReviewSummaryContent } from './review-artifacts.ts';
@@ -15,17 +17,6 @@ import type { ManualOverrideCapability } from './guard-override.ts';
 import { getArtifactSchema } from './artifact-schema.ts';
 import { canonicalSemanticDigest, inspectArtifactContract, sha256Content } from './artifact-operations.ts';
 import { expectedQualificationRelations, validateQualificationAudit } from './qualification-audit.ts';
-import { readArtifactRecoveryIntent } from './artifact-repair-intent.ts';
-import {
-  beginArtifactRecovery,
-  commitArtifactRecovery,
-  prepareArtifactRecoveryFinal,
-  prepareArtifactRecoveryCommit,
-  reconcileArtifactRecovery,
-  recoveryContextFromIntent,
-  stageArtifactCandidate
-} from './artifact-recovery.ts';
-import type { ArtifactRecoveryContext } from './artifact-recovery.ts';
 
 type ReviewFinalizationErrorCode =
   | ResolveTaskRefErrorCode
@@ -51,7 +42,6 @@ type ReviewFinalizationRequest = {
   artifact: string;
   orchestrated?: boolean;
   dryRun?: boolean;
-  recoveryId?: string;
 };
 type ReviewFinalizationResult = {
   status: 'planned' | 'applied' | 'no-op' | 'failed';
@@ -64,12 +54,6 @@ type ReviewFinalizationResult = {
   stageStatus: LedgerStageStatus | null;
   artifactSha256: string | null;
   semanticDigest: string | null;
-  recovery?: Readonly<{
-    recoveryId: string;
-    candidatePath: string;
-    baselineSha256: string;
-    baselineSemanticDigest: string;
-  }>;
   operations: readonly {
     kind: 'artifact';
     artifact: string;
@@ -90,7 +74,6 @@ type ReviewFinalizationOptions = {
   fileSystem?: Partial<ReviewFileSystem>;
   manualOverride?: ManualOverrideCapability;
   lockAlreadyHeld?: boolean;
-  startRecovery?: boolean;
 };
 
 const STAGES: Record<ReviewStage, { family: 'review-analysis' | 'review-plan' | 'review-code' }> = {
@@ -143,7 +126,7 @@ function preflightFailed(
   };
 }
 
-/** Validate and seal a review draft before any finding-ledger write. */
+/** Validate the current review draft before any finding-ledger write. */
 function preflightReviewSummaryUnlocked(
   request: ReviewFinalizationRequest,
   options: ReviewFinalizationOptions = {}
@@ -162,28 +145,13 @@ function preflightReviewSummaryUnlocked(
 
   let taskContent: string;
   let content: string;
-  let recovery: ArtifactRecoveryContext | undefined;
   try {
     taskContent = fs.readFileSync(resolved.taskMdPath, 'utf8');
-    if (request.recoveryId) {
-      const intent = readArtifactRecoveryIntent(resolved.repoRoot, resolved.taskId, spec.family, request.artifact);
-      if (!intent || intent.recoveryOperationId !== request.recoveryId) return preflightFailed(request, 'REVIEW_PROVENANCE_INVALID', 'recovery id does not match the artifact journal', resolved.taskId);
-      if (!['awaiting-preflight-recovery', 'preflight-ready'].includes(intent.state)) return preflightFailed(request, 'REVIEW_PROVENANCE_INVALID', `recovery journal is in '${intent.state}' state`, resolved.taskId);
-      recovery = recoveryContextFromIntent(resolved.repoRoot, resolved.taskDir, intent);
-      content = fs.existsSync(recovery.stagingPath)
-        ? fs.readFileSync(recovery.stagingPath, 'utf8')
-        : fs.readFileSync(recovery.formalPath, 'utf8');
-    } else {
-      const validated = validateCompletedArtifact(resolved.taskDir, spec.family, request.artifact);
-      if (!validated.ok) return preflightFailed(request, validated.error.code === 'ARTIFACT_NOT_REGULAR' ? 'REVIEW_ARTIFACT_NOT_REGULAR' : 'REVIEW_ARTIFACT_IDENTITY_INVALID', validated.error.message, resolved.taskId);
-      content = fs.readFileSync(validated.artifact.path, 'utf8');
-      const intent = readArtifactRecoveryIntent(resolved.repoRoot, resolved.taskId, spec.family, request.artifact);
-      if (intent?.state === 'preflight-ready') recovery = recoveryContextFromIntent(resolved.repoRoot, resolved.taskDir, intent);
-      if (intent?.state === 'consumed') return preflightFailed(request, 'REVIEW_PROVENANCE_INVALID', 'review artifact was already finalized', resolved.taskId);
-    }
+    const validated = validateCompletedArtifact(resolved.taskDir, spec.family, request.artifact);
+    if (!validated.ok) return preflightFailed(request, validated.error.code === 'ARTIFACT_NOT_REGULAR' ? 'REVIEW_ARTIFACT_NOT_REGULAR' : 'REVIEW_ARTIFACT_IDENTITY_INVALID', validated.error.message, resolved.taskId);
+    content = fs.readFileSync(validated.artifact.path, 'utf8');
   } catch (error) { return preflightFailed(request, 'REVIEW_ARTIFACT_NOT_REGULAR', String(error), resolved.taskId); }
 
-  if (!hasOpenArtifactRound(taskContent, spec.family, parsed.round)) return preflightFailed(request, 'REVIEW_ARTIFACT_IDENTITY_INVALID', `${request.artifact} does not have one matching open started review event`, resolved.taskId);
   const execution = validateLifecycleExecution(request.taskRef, {
     mode: request.orchestrated ? 'orchestrated' : 'standalone',
     identity: { stage: spec.family, round: parsed.round, artifact: request.artifact, role: 'reviewer' },
@@ -204,14 +172,6 @@ function preflightReviewSummaryUnlocked(
   });
   const qualificationError = qualification.ok ? null : qualification;
   if (!detail.ok || !structure.ok || qualificationError) {
-    if (!recovery && !request.dryRun) {
-      try {
-        recovery = beginArtifactRecovery({
-          taskId: resolved.taskId, family: spec.family, artifact: request.artifact, round: parsed.round,
-          requestId: `review-preflight:${resolved.taskId}:${stage}:${parsed.round}`
-        }, Buffer.from(content, 'utf8'), { repoRoot: resolved.repoRoot, taskDir: resolved.taskDir, lockAlreadyHeld: options.lockAlreadyHeld });
-      } catch (error) { return preflightFailed(request, 'REVIEW_PROVENANCE_INVALID', String(error), resolved.taskId); }
-    }
     const diagnostics = [
       ...(!detail.ok ? [`${detail.code}: ${detail.message}`] : []),
       ...structure.diagnostics.map((item) => `${item.code}: ${item.message}`),
@@ -219,27 +179,18 @@ function preflightReviewSummaryUnlocked(
     ].join('; ');
     return preflightFailed(request, !detail.ok ? 'REVIEW_DECISION_DETAIL_INVALID' : !structure.ok ? 'REVIEW_ARTIFACT_STRUCTURE_INVALID' : 'REVIEW_ARTIFACT_QUALIFICATION_INVALID', diagnostics, resolved.taskId, {
       artifactSha256, semanticDigest,
-      ...(recovery ? { recovery: recoveryInfo(recovery) } : {})
     });
   }
-  if (request.dryRun || recovery && readArtifactRecoveryIntent(resolved.repoRoot, resolved.taskId, spec.family, request.artifact)?.state === 'preflight-ready') {
+  if (request.dryRun) {
     return {
-      ...preflightFailed(request, 'REVIEW_ARTIFACT_CONFLICT', '', resolved.taskId, { artifactSha256, semanticDigest, ...(recovery ? { recovery: recoveryInfo(recovery) } : {}) }),
+      ...preflightFailed(request, 'REVIEW_ARTIFACT_CONFLICT', '', resolved.taskId, { artifactSha256, semanticDigest }),
       status: 'passed', changed: false, error: null
     };
   }
-  try {
-    recovery ??= beginArtifactRecovery({
-      taskId: resolved.taskId, family: spec.family, artifact: request.artifact, round: parsed.round,
-      requestId: `review-preflight:${resolved.taskId}:${stage}:${parsed.round}`
-    }, Buffer.from(content, 'utf8'), { repoRoot: resolved.repoRoot, taskDir: resolved.taskDir, lockAlreadyHeld: options.lockAlreadyHeld });
-    const staged = stageArtifactCandidate(recovery, Buffer.from(content, 'utf8'), { lockAlreadyHeld: options.lockAlreadyHeld });
-    prepareArtifactRecoveryCommit(recovery, staged.candidateSha256, staged.semanticDigest, { lockAlreadyHeld: options.lockAlreadyHeld });
-    return {
-      ...preflightFailed(request, 'REVIEW_ARTIFACT_CONFLICT', '', resolved.taskId, { artifactSha256, semanticDigest, recovery: recoveryInfo(recovery) }),
-      status: 'passed', changed: false, error: null
-    };
-  } catch (error) { return preflightFailed(request, 'REVIEW_PROVENANCE_INVALID', String(error), resolved.taskId, { artifactSha256, semanticDigest }); }
+  return {
+    ...preflightFailed(request, 'REVIEW_ARTIFACT_CONFLICT', '', resolved.taskId, { artifactSha256, semanticDigest }),
+    status: 'passed', changed: false, error: null
+  };
 }
 
 function preflightReviewSummary(
@@ -265,19 +216,9 @@ function preflightReviewSummary(
 type ReviewSummaryCandidatePreparation = Readonly<{
   result: ReviewFinalizationResult;
   content: string;
-  recovery?: ArtifactRecoveryContext;
   lockAlreadyHeld?: boolean;
 }>;
 
-function recoveryInfo(recovery: ArtifactRecoveryContext): NonNullable<ReviewFinalizationResult['recovery']> {
-  return {
-    recoveryId: recovery.recoveryId,
-    candidatePath: recovery.stagingPath,
-    baselineSha256: recovery.baselineSha256,
-    baselineSemanticDigest: recovery.baselineSemanticDigest
-  };
-}
-
 /** Prepare domain validation, summary bytes and provenance before any publication. */
 function prepareReviewSummaryCandidate(
   request: ReviewFinalizationRequest,
@@ -306,36 +247,9 @@ function prepareReviewSummaryCandidate(
   let taskContent: string;
   try { taskContent = (options.fileSystem?.readFileSync ?? DEFAULT_FILE_SYSTEM.readFileSync)(resolved.taskMdPath); }
   catch (error) { return reject('REVIEW_ARTIFACT_NOT_REGULAR', String(error)); }
-  let recovery: ArtifactRecoveryContext | undefined;
-  if (request.recoveryId) {
-    try {
-      const intent = readArtifactRecoveryIntent(resolved.repoRoot, taskId!, spec.family, request.artifact);
-      if (!intent || intent.recoveryOperationId !== request.recoveryId) return reject('REVIEW_PROVENANCE_INVALID', 'recovery id does not match the artifact journal');
-      if (!['awaiting-preflight-recovery', 'preflight-ready', 'preflight-commit-started', 'preflight-passed', 'full-finalizer-ready', 'commit-started'].includes(intent.state)) return reject('REVIEW_PROVENANCE_INVALID', `recovery journal is in '${intent.state}' state`);
-      recovery = recoveryContextFromIntent(resolved.repoRoot, resolved.taskDir, intent);
-      artifactContent = fs.existsSync(recovery.stagingPath)
-        ? fs.readFileSync(recovery.stagingPath, 'utf8')
-        : fs.readFileSync(recovery.formalPath, 'utf8');
-    } catch (error) { return reject('REVIEW_PROVENANCE_INVALID', String(error)); }
-  }
   const artifactSha256 = sha256Content(artifactContent);
   const semanticDigest = canonicalSemanticDigest(artifactContent);
   const digests = { artifactSha256, semanticDigest };
-  let repairIntent;
-  try { repairIntent = readArtifactRecoveryIntent(resolved.repoRoot, taskId!, spec.family, request.artifact); }
-  catch (error) { return reject('REVIEW_PROVENANCE_INVALID', String(error), digests); }
-  if (repairIntent?.state === 'consumed') {
-    if (repairIntent.finalArtifactSha256 !== artifactSha256 || repairIntent.finalSemanticDigest !== semanticDigest) {
-      return reject('REVIEW_PROVENANCE_INVALID', 'the review artifact changed after its finalization provenance was recorded', digests);
-    }
-  }
-  if (repairIntent?.state === 'passed'
-    && (repairIntent.finalArtifactSha256 !== artifactSha256 || repairIntent.finalSemanticDigest !== semanticDigest)) {
-    repairIntent = undefined;
-  }
-  if (!hasOpenArtifactRound(taskContent, spec.family, parsed.round)) {
-    return reject('REVIEW_ARTIFACT_IDENTITY_INVALID', `${request.artifact} does not have one matching open started review event`);
-  }
   const execution = validateLifecycleExecution(request.taskRef, {
     mode: request.orchestrated ? 'orchestrated' : 'standalone',
     identity: { stage: spec.family, round: parsed.round, artifact: request.artifact, role: 'reviewer' },
@@ -356,59 +270,15 @@ function prepareReviewSummaryCandidate(
   const schema = getArtifactSchema(spec.family)!;
   const structure = inspectArtifactContract(artifactContent, schema);
   if (!structure.ok) {
-    if (!recovery && !request.dryRun && options.startRecovery) {
-      try {
-        recovery = beginArtifactRecovery({
-          taskId: taskId!, family: spec.family, artifact: request.artifact, round: parsed.round,
-          requestId: `review-finalize:${taskId!}:${stage}:${parsed.round}`
-        }, Buffer.from(artifactContent, 'utf8'), { repoRoot: resolved.repoRoot, taskDir: resolved.taskDir, lockAlreadyHeld: options.lockAlreadyHeld });
-      } catch (error) { return reject('REVIEW_PROVENANCE_INVALID', String(error), digests); }
-    }
-    return {
-      ...reject('REVIEW_ARTIFACT_STRUCTURE_INVALID', structure.diagnostics.map((item) => `${item.code}: ${item.message}`).join('; '), {
-        artifactSha256, semanticDigest: structure.semanticDigest,
-        ...(recovery ? { recovery: {
-          recoveryId: recovery.recoveryId,
-          candidatePath: recovery.stagingPath,
-          baselineSha256: recovery.baselineSha256,
-          baselineSemanticDigest: recovery.baselineSemanticDigest
-        } } : {})
-      }),
-      ...(recovery ? { recovery } : {})
-    };
+    return reject('REVIEW_ARTIFACT_STRUCTURE_INVALID', structure.diagnostics.map((item) => `${item.code}: ${item.message}`).join('; '), {
+      artifactSha256, semanticDigest: structure.semanticDigest
+    });
   }
   const transformed = finalizeReviewSummaryContent(artifactContent, stageStatus.unresolvedFindingCounts, {
-    refreshNumericCounts: Boolean(request.recoveryId && recovery)
+    refreshNumericCounts: true
   });
   if (!transformed.ok) return reject(transformed.code, transformed.message);
   const finalDigests = { artifactSha256: sha256Content(transformed.content), semanticDigest: canonicalSemanticDigest(transformed.content) };
-  if (!recovery && repairIntent?.state === 'commit-started') {
-    if (repairIntent.finalArtifactSha256 !== finalDigests.artifactSha256 || repairIntent.finalSemanticDigest !== finalDigests.semanticDigest) {
-      return reject('REVIEW_PROVENANCE_INVALID', 'formal review artifact does not match the interrupted recovery journal', finalDigests);
-    }
-    recovery = recoveryContextFromIntent(resolved.repoRoot, resolved.taskDir, repairIntent);
-  }
-  if (!recovery && (repairIntent?.state === 'passed' || repairIntent?.state === 'consumed')) {
-    if (transformed.changed) return reject('REVIEW_PROVENANCE_INVALID', 'the review artifact requires changes after its completed recovery was consumed', finalDigests);
-    return {
-      content: transformed.content,
-      result: {
-        ...failed(request, 'REVIEW_ARTIFACT_CONFLICT', '', taskId, stageStatus, finalDigests),
-        status: 'no-op',
-        changed: false,
-        error: null
-      },
-      lockAlreadyHeld: options.lockAlreadyHeld
-    };
-  }
-  if (!recovery && !request.dryRun && options.startRecovery) {
-    try {
-      recovery = beginArtifactRecovery({
-        taskId: taskId!, family: spec.family, artifact: request.artifact, round: parsed.round,
-        requestId: `review-finalize:${taskId!}:${stage}:${parsed.round}`
-      }, Buffer.from(artifactContent, 'utf8'), { repoRoot: resolved.repoRoot, taskDir: resolved.taskDir, lockAlreadyHeld: options.lockAlreadyHeld });
-    } catch (error) { return reject('REVIEW_PROVENANCE_INVALID', String(error), finalDigests); }
-  }
   return {
     content: transformed.content,
     result: {
@@ -418,7 +288,6 @@ function prepareReviewSummaryCandidate(
       operations: transformed.changed ? [{ kind: 'artifact', artifact: request.artifact, operation: 'update' }] : [],
       error: null
     },
-    ...(recovery ? { recovery } : {}),
     lockAlreadyHeld: options.lockAlreadyHeld
   };
 }
@@ -428,51 +297,18 @@ function commitReviewSummaryProvenance(
   repoRoot: string,
   options: Readonly<{ afterPublish?: () => void }> = {}
 ): ReviewFinalizationResult {
-  if (prepared.result.status === 'failed' || !prepared.recovery) return prepared.result;
+  return prepared.result;
+}
+
+function replaceCurrentArtifactAtomically(file: string, content: string): void {
+  const temporary = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${randomUUID()}.tmp`);
   try {
-    const intent = readArtifactRecoveryIntent(prepared.recovery.repoRoot, prepared.recovery.taskId, prepared.recovery.family, prepared.recovery.artifact);
-    if (!intent) throw new Error('ARTIFACT_RECOVERY_INTENT_MISSING');
-    let committed;
-    if (intent.state === 'passed' || intent.state === 'consumed') {
-      return {
-        ...prepared.result,
-        status: 'no-op',
-        changed: false,
-        artifactSha256: intent.finalArtifactSha256,
-        semanticDigest: intent.finalSemanticDigest,
-        error: null
-      };
-    } else if (intent.state === 'commit-started') {
-      const reconciled = reconcileArtifactRecovery(prepared.recovery, {
-        lockAlreadyHeld: prepared.lockAlreadyHeld,
-        afterPublish: options.afterPublish
-      });
-      committed = reconciled.intent;
-    } else if (intent.state === 'awaiting-preflight-recovery') {
-      const staged = stageArtifactCandidate(prepared.recovery, Buffer.from(prepared.content, 'utf8'), { lockAlreadyHeld: prepared.lockAlreadyHeld });
-      prepareArtifactRecoveryCommit(prepared.recovery, staged.candidateSha256, staged.semanticDigest, { lockAlreadyHeld: prepared.lockAlreadyHeld });
-      committed = commitArtifactRecovery(prepared.recovery, { lockAlreadyHeld: prepared.lockAlreadyHeld });
-    } else if (intent.state === 'preflight-ready' || intent.state === 'preflight-commit-started') {
-      committed = commitArtifactRecovery(prepared.recovery, { lockAlreadyHeld: prepared.lockAlreadyHeld });
+    fs.writeFileSync(temporary, content, { encoding: 'utf8', flag: 'wx' });
+    fs.renameSync(temporary, file);
+  } finally {
+    try { fs.unlinkSync(temporary); } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
     }
-    if (committed?.state === 'preflight-passed' || intent.state === 'preflight-passed') {
-      prepareArtifactRecoveryFinal(prepared.recovery, Buffer.from(prepared.content, 'utf8'), { lockAlreadyHeld: prepared.lockAlreadyHeld });
-      committed = commitArtifactRecovery(prepared.recovery, { lockAlreadyHeld: prepared.lockAlreadyHeld, afterPublish: options.afterPublish });
-    } else if (intent.state === 'full-finalizer-ready') {
-      committed = commitArtifactRecovery(prepared.recovery, { lockAlreadyHeld: prepared.lockAlreadyHeld, afterPublish: options.afterPublish });
-    }
-    if (!committed || committed.state !== 'passed') throw new Error(`ARTIFACT_RECOVERY_STATE_INVALID: commit ended in '${committed?.state ?? intent.state}'`);
-    return {
-      ...prepared.result,
-      artifactSha256: committed.finalArtifactSha256,
-      semanticDigest: committed.finalSemanticDigest,
-      error: null
-    };
-  } catch (error) {
-    if (error instanceof Error && error.message.startsWith('TASK_WORKFLOW_FAULT_INJECTED:')) throw error;
-    return { ...prepared.result, status: 'failed', error: {
-      code: 'REVIEW_RECOVERY_COMMIT_FAILED', message: `cannot publish review candidate: ${String(error)}`
-    } };
   }
 }
 
@@ -494,14 +330,30 @@ function finalizeReviewSummaryUnlocked(
   catch (error) { return failed(request, 'REVIEW_ARTIFACT_NOT_REGULAR', String(error), resolved.taskId); }
   const prepared = prepareReviewSummaryCandidate(request, content, options);
   if (request.dryRun) return prepared.result;
-  return commitReviewSummaryProvenance(prepared, resolved.repoRoot);
+  if (prepared.result.status === 'failed' || !prepared.result.changed) return prepared.result;
+  try {
+    replaceCurrentArtifactAtomically(validated.artifact.path, prepared.content);
+    return {
+      ...prepared.result,
+      status: 'applied',
+      artifactSha256: sha256Content(prepared.content),
+      semanticDigest: canonicalSemanticDigest(prepared.content)
+    };
+  } catch (error) {
+    return failed(
+      request,
+      'REVIEW_RECOVERY_COMMIT_FAILED',
+      `cannot update current review artifact: ${error instanceof Error ? error.message : String(error)}`,
+      resolved.taskId
+    );
+  }
 }
 
 function finalizeReviewSummary(
   request: ReviewFinalizationRequest,
   options: ReviewFinalizationOptions = {}
 ): ReviewFinalizationResult {
-  const effectiveOptions = { ...options, startRecovery: !request.dryRun };
+  const effectiveOptions = options;
   if (request.dryRun || options.lockAlreadyHeld) return finalizeReviewSummaryUnlocked(request, effectiveOptions);
   const resolved = resolveTaskRef(request.taskRef, { repoRoot: options.repoRoot });
   if (!resolved.ok) return finalizeReviewSummaryUnlocked(request, effectiveOptions);

package/lib/task/workflow-command.ts

@@ -9,10 +9,13 @@ export const TASK_WORKFLOW_COMMANDS = Object.freeze({
   'ledger-finding-response': ['task-ledger', 'finding-respond'],
   'ledger-finding-review': ['task-ledger', 'finding-review'],
   'ledger-finding-upsert': ['task-ledger', 'finding-upsert'],
+  'ledger-stage-status': ['task-ledger', 'stage-status'],
   'decision-next-id': ['task-ledger', 'decision-next-id'],
   'decision-upsert': ['task-ledger', 'decision-upsert'],
   'invalidation-reconcile': ['task-invalidation', 'reconcile'],
-  'warning-add': ['task-warning', 'add']
+  'warning-add': ['task-warning', 'add'],
+  'warning-list': ['task-warning', 'list'],
+  'warning-set-status': ['task-warning', 'set-status']
 } as const);
 export type TaskWorkflowOperation = keyof typeof TASK_WORKFLOW_COMMANDS;
 export const TASK_WORKFLOW_OPERATIONS = Object.freeze(Object.keys(TASK_WORKFLOW_COMMANDS) as TaskWorkflowOperation[]);

package/lib/task/workflow-dispatch.ts

@@ -1,6 +1,10 @@
+import fs from 'node:fs';
+
 import { reconcileTaskInvalidation } from './invalidation-command.ts';
 import { applyLedgerIntent } from './ledger-intents.ts';
 import type { LedgerIntent } from './ledger-intents.ts';
+import { isReviewStage, parseLedgerDocument, summarizeLedgerStage, validateLedgerRows } from './ledger.ts';
+import { resolveTaskRef } from './resolve-ref.ts';
 import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.ts';
 import type { TaskWorkflowOperation } from './workflow-command.ts';
 import { applyWorkflowWarningIntent } from './workflow-warning-intents.ts';
@@ -116,7 +120,24 @@ function ledgerIntent(operation: TaskWorkflowOperation, args: readonly string[])
 
 function warningIntent(args: readonly string[]): WorkflowWarningIntent | DispatchFailure {
   const [taskRef, kind] = args;
-  if (!taskRef || kind !== 'add') return failed('TASK_WORKFLOW_PAYLOAD_INVALID', 'task workflow warning request is invalid');
+  if (!taskRef || !['add', 'list', 'set-status'].includes(kind ?? '')) {
+    return failed('TASK_WORKFLOW_PAYLOAD_INVALID', 'task workflow warning request is invalid');
+  }
+  if (kind === 'list') {
+    const values = options(args, { '--status': 'status' });
+    if (isFailure(values)) return values;
+    return { kind, taskRef, ...(value(values, '--status') ? { status: value(values, '--status') as never } : {}) };
+  }
+  if (kind === 'set-status') {
+    const values = options(args, { '--id': 'id', '--status': 'status', '--resolution': 'resolution', '--dry-run': 'dryRun' });
+    if (isFailure(values)) return values;
+    const missing = required(values, ['--id', '--status', '--resolution']);
+    if (missing) return missing;
+    return {
+      kind, taskRef, id: value(values, '--id')!, status: value(values, '--status') as never,
+      resolution: value(values, '--resolution')!, ...(values['--dry-run'] === true ? { dryRun: true } : {})
+    };
+  }
   const values = options(args, {
     '--step': 'step', '--severity': 'severity', '--code': 'code', '--target': 'target',
     '--message': 'message', '--action': 'action', '--dry-run': 'dryRun'
@@ -131,6 +152,26 @@ function warningIntent(args: readonly string[]): WorkflowWarningIntent | Dispatc
   } as WorkflowWarningIntent;
 }
 
+function stageStatus(repoRoot: string, args: readonly string[]): WorkflowDispatchResult {
+  const [taskRef, kind] = args;
+  if (!taskRef || kind !== 'stage-status') return failed('TASK_WORKFLOW_PAYLOAD_INVALID', 'task workflow ledger request is invalid');
+  const values = options(args, { '--stage': 'stage' });
+  if (isFailure(values)) return values;
+  const stage = value(values, '--stage');
+  if (!stage || !isReviewStage(stage)) return failed('TASK_WORKFLOW_PAYLOAD_INVALID', 'stage-status requires a valid review stage');
+  const resolved = resolveTaskRef(taskRef, { repoRoot });
+  if (!resolved.ok) return failed(resolved.code, resolved.message);
+  try {
+    const ledger = parseLedgerDocument(fs.readFileSync(resolved.taskMdPath, 'utf8'));
+    if (!ledger.present) return failed('LEDGER_SECTION_MISSING', 'review disagreement ledger section is missing');
+    const invalid = validateLedgerRows(ledger.rows);
+    if (invalid) return failed(invalid.code, invalid.message);
+    return { status: 'ready', changed: false, taskId: resolved.taskId, stageStatus: summarizeLedgerStage(ledger.rows, stage), error: null };
+  } catch (error) {
+    return failed('LEDGER_DOCUMENT_INVALID', error instanceof Error ? error.message : String(error));
+  }
+}
+
 /**
  * The caller has already selected and authorized the execution boundary.
  * This function deliberately invokes task domains in that process: starting a
@@ -157,10 +198,12 @@ export function dispatchWorkflowCommand(
         ...(values['--dry-run'] === true ? { dryRun: true } : {})
       }));
     }
-    if (operation === 'warning-add') {
+    if (operation === 'ledger-stage-status') return stageStatus(repoRoot, args);
+    if (operation === 'warning-add' || operation === 'warning-list' || operation === 'warning-set-status') {
       const intent = warningIntent(args);
       if (isFailure(intent)) return intent;
-      return withTaskExecutionLock(repoRoot, taskRef, 'task-warning.add', () => applyWorkflowWarningIntent(intent, { repoRoot }));
+      if (intent.kind === 'list') return applyWorkflowWarningIntent(intent, { repoRoot });
+      return withTaskExecutionLock(repoRoot, taskRef, `task-warning.${intent.kind}`, () => applyWorkflowWarningIntent(intent, { repoRoot }));
     }
     const intent = ledgerIntent(operation, args);
     if (isFailure(intent)) return intent;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fitlab-ai/agent-infra",
-  "version": "0.11.1",
+  "version": "0.11.2",
   "description": "Bootstrap tool for AI multi-tool collaboration infrastructure — works with Claude Code, Codex, Antigravity CLI, and OpenCode",
   "license": "MIT",
   "type": "module",
@@ -52,7 +52,7 @@
     "installer"
   ],
   "dependencies": {
-    "@clack/prompts": "1.7.0",
+    "@clack/prompts": "1.8.1",
     "@larksuiteoapi/node-sdk": "^1.68.0",
     "cross-spawn": "^7.0.6",
     "fs-native-extensions": "1.5.1",

package/templates/.agents/rules/lifecycle-orchestration.en.md

@@ -5,18 +5,18 @@
 - The orchestrator only routes and delegates. Stage skills remain the single source of truth for behavior and artifacts.
 - Every stage and rework round uses a fresh executor. Every review uses a fresh reviewer; follow-up reuse is forbidden.
 - A reviewer may only write its review artifact and core-generated task metadata. Business-code, HEAD, or index changes invalidate the receipt.
-- An active run has one pending delegation. The child must pass the activation barrier before any stage side effect. Missing, late, mismatched, forked, replayed, hook-less, or drifted evidence pauses the run (on the claude-code path, missing or mismatched model/effort evidence, and fork/spawn-mode evidence this host structurally does not provide, follow the recording rules in `.agents/skills/run-task/reference/host-validation.md` instead and are exempt from this; missing or mismatched `parentId`/`childId` still pauses). Cross-root package/build/contract or hook/profile content drift is a deliverable warning; the current receipt's hook/evidence binding remains hard.
+- An active run has one pending delegation. Keep the stage associated with the observed child and report actual start and terminal failures.
 - The first release ends after one existing safely gated `commit`; it does not create a PR, monitor checks, or complete the task.
 
-## Recovery
+## Current Execution Records
 
-`orchestration.json` is the detailed state source. A current run persists complete policy, append-only recovery, build/contract/hook-source/controller provenance, and activation monotonic timestamps. Readers accept only the complete structure emitted by the current writer; unknown fields, missing fields, invalid provenance, and old runs fail closed without rewriting. If the state cannot be recognized, preserve the file, advise rebuilding the sandbox or manually repairing it, do not migrate it, and do not create a follow-up task. Finish or clear every active run before upgrading agent-infra. An expired prepared orphan may be explicitly recovered only with the exact task fingerprint, no consumed authorization, and no matching unconsumed active lifecycle evidence.
+`orchestration.json` records stages, model policy, child identity, and actual outcomes. Records use the current structure; trusted local operators may correct them and rerun validation. Existing task write locks and atomic writes protect updates.
 
-## Codex Host and Capability
+## Codex Host
 
-- Direct-host accepts only trusted project or managed lifecycle hooks. A task-bound sandbox requires a controlled nested controller and isolated `CODEX_HOME`; only user hooks bound to that controller context are accepted. Ordinary user/plugin hooks are not evidence. The actual hook/profile used by the run is the source of record; content drift is reported as a warning with rebuild guidance.
-- The controller starts a nested loop only after control generation, task binding, protocol version, profiles, and hook discovery pass. Build/contract and content drift is reported as a structured warning with rebuild guidance instead of blocking natural evolution. Both bypass flags are restricted to this task-bound launch path.
-- Every prepare arms a one-use capability attested by the current loop's real PostToolUse. Atomic consumption binds task/session/build/controller and retains only a redacted tombstone.
+- Use native spawn, wait, and App Server results from the current host; forward task operations through the existing broker.
+- Prepare validates the current task, model policy, and host preflight. Start and terminal records associate observed parent/child identity; failure must not be recorded as success.
+- Local execution does not require capability, controller attestation, or one-use consumption authority. Do not add automatic child discovery, spawn under a new lock protocol, orphan recovery, or a dedicated recovery protocol.
 
 ## Model Policy
 

package/templates/.agents/rules/lifecycle-orchestration.zh-CN.md

@@ -5,18 +5,18 @@
 - 总控只路由和委派；阶段技能仍是业务规则与产物格式的单一事实源。
 - 每个阶段和每轮返工都创建 fresh executor；每轮审查创建 fresh reviewer，禁止 follow-up 复用。
 - reviewer 只能写当前审查产物和核心生成的任务元数据。业务代码、HEAD 或暂存区变化会使 receipt 失效。
-- active run 中只有一个 pending delegation。child 必须在任何阶段副作用前通过 activation barrier；缺失、超时、错配、fork、重放、hook 不可用或工作区漂移一律暂停（claude-code 路径下 model/effort 证据的缺失或错配、以及该宿主结构上不提供的 fork/spawn-mode 证据，按 `.agents/skills/run-task/reference/host-validation.md` 的记录规则处理，不在此列；`parentId`/`childId` 的缺失或错配仍然暂停）。跨根 package/build/contract 或 hook/profile 内容漂移只输出可交付 warning；本轮 receipt 的 hook/evidence 绑定仍硬校验。
+- active run 中只有一个 pending delegation；阶段与实际 child 身份保持一致，启动和终态失败如实记录。
 - 首版成功终点是一次通过既有安全门禁的 `commit`；不创建 PR、不监控 checks、不执行 `complete-task`。
 
-## 恢复语义
+## 当前执行记录
 
-`orchestration.json` 是详细状态源。current run 保存完整策略、append-only 恢复历史、build/contract/hook source/controller provenance 与 activation 单调时钟。读取时只接受当前 writer 的完整结构；未知字段、缺失字段、非法 provenance 或旧 run 一律失败关闭且不改写。遇到无法识别的 `orchestration.json`，保留原文件并提示重建 sandbox 或人工修复后重试，不做 schema 迁移，也不创建 follow-up task。升级 agent-infra 前必须完成或清空所有 active run。prepared orphan 只允许在 deadline 已过、task fingerprint 精确不变、无 authorization 消耗且无匹配的未消费 active lifecycle evidence 时显式恢复。
+`orchestration.json` 记录阶段、模型策略、child 身份及实际执行结果。记录必须符合当前结构；本地操作者可直接修正后重新校验。已有任务写锁与原子写入继续保护写操作。
 
-## Codex 宿主与 capability
+## Codex 宿主
 
-- direct-host 只接受 trusted project 或 managed lifecycle hooks。task-bound sandbox 必须由受控 nested controller 建立隔离 `CODEX_HOME`，仅接受绑定 controller context 的 user hooks；普通 user/plugin hook 不得成为证据源。使用本轮实际加载的 hook/profile，内容漂移只记录 warning 并提示重建 sandbox。
-- controller 只有在 control generation、task binding、协议版本、profile 与 hook discovery 全部通过后才能启动 nested loop；build/contract 及内容漂移通过结构化 warning 告知并建议重建 sandbox，不阻塞自然演进。两个 bypass 参数只允许出现在该 task-bound 启动路径。
-- 每次 prepare 前必须 arm 一次性 capability，并由同一当前 loop 的真实 PostToolUse attestation；token 原子消费后保留去敏 tombstone，不能重放或跨 task/session/build/controller 使用。
+- 使用当前宿主的原生 spawn、wait 与 App Server 结果；任务操作通过现有 broker 转发。
+- prepare 校验当前任务、模型策略与宿主 preflight。启动和完成记录关联实际 parent/child 身份，失败不得写成成功。
+- 不要求 capability、controller attestation 或一次性消费授权本地实现；不新增 child 自动发现、锁内启动交接、孤立 child 恢复或专用恢复协议。
 
 ## 模型策略