@fitlab-ai/agent-infra 0.11.1 → 0.11.2

package/lib/sandbox/control/finalization-response.ts

@@ -4,9 +4,15 @@ import type { SandboxControlResponse } from './protocol.ts';
 export function finalizationTerminalResponse(taskId: string, requestId: string, receipt: TaskFinalizationReceipt): SandboxControlResponse {
   const pendingSteps = [
     receipt.taskComment === 'pending' ? 'task-comment' : null,
-    receipt.verification === 'pending' ? 'verification' : null
+    receipt.verification === 'pending' ? 'verification' : null,
+    receipt.summary === 'pending' ? 'summary' : null,
+    receipt.postSummaryVerification === 'pending' ? 'post-summary-verification' : null
   ].filter((step): step is string => step !== null);
-  const completedSteps = ['lifecycle', receipt.taskComment === 'pending' ? null : 'task-comment', receipt.verification === 'pending' ? null : 'verification']
+  const completedSteps = [
+    'lifecycle', receipt.taskComment === 'pending' ? null : 'task-comment',
+    receipt.verification === 'pending' ? null : 'verification', receipt.summary === 'pending' ? null : 'summary',
+    receipt.postSummaryVerification === 'pending' ? null : 'post-summary-verification'
+  ]
     .filter((step): step is string => step !== null);
   const warnings = receipt.warnings
     .filter((warning) => warning.status === 'open')
@@ -16,6 +22,8 @@ export function finalizationTerminalResponse(taskId: string, requestId: string,
     lifecycle: { status: 'no-op', changed: false, error: null },
     taskComment: receipt.taskComment === 'pending' ? null : { status: 'no-op', changed: false, error: null },
     verification: receipt.verification === 'pending' ? null : { status: 'no-op', changed: false, error: null },
+    summary: receipt.summary === 'pending' ? null : { status: 'no-op', changed: false, error: null },
+    postSummaryVerification: receipt.postSummaryVerification === 'pending' ? null : { status: 'no-op', changed: false, error: null },
     completedSteps, pendingSteps,
     result: pendingSteps.length > 0 || receipt.warningProjection === 'pending' || warnings.length > 0
       ? 'completed_with_warnings' : 'completed',

package/lib/sandbox/control/task-view.ts

@@ -56,9 +56,11 @@ function receiptIdentity(value: unknown, generation: string, requestId?: string)
   const binding = receipt.controlBinding;
   if (!binding || typeof binding !== 'object' || Array.isArray(binding)) return null;
   const controlBinding = binding as Record<string, unknown>;
-  if (receipt.version !== 2 || typeof receipt.receiptId !== 'string' || receipt.receiptId.length === 0
+  if (receipt.version !== 3 || typeof receipt.receiptId !== 'string' || receipt.receiptId.length === 0
     || !Number.isSafeInteger(receipt.revision) || (receipt.revision as number) < 0
     || receipt.lifecycle !== 'done'
+    || !['pending', 'done', 'skipped'].includes(String(receipt.summary))
+    || !['pending', 'done', 'skipped'].includes(String(receipt.postSummaryVerification))
     || controlBinding.generation !== generation
     || typeof controlBinding.requestId !== 'string'
     || !/^[a-f0-9-]{16,64}$/u.test(controlBinding.requestId)

package/lib/sandbox/control/workflow-executor.ts

@@ -1,3 +1,7 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+
 import { TASK_WORKFLOW_COMMANDS } from '../../task/workflow-command.ts';
 
 import { parseArtifactCommand, executeArtifactCommand } from '../../task/artifact-command.ts';
@@ -5,10 +9,8 @@ import { parseReviewCommand } from '../../task/review-command.ts';
 import { prepareLocalArtifact, preflightLocalArtifact, commitLocalArtifactProvenance } from '../../task/local-artifact-finalization.ts';
 import {
   prepareReviewSummaryCandidate,
-  commitReviewSummaryProvenance,
   preflightReviewSummary
 } from '../../task/review-finalization.ts';
-import { readArtifactRecoveryIntent } from '../../task/artifact-repair-intent.ts';
 import { withTaskExecutionLock } from '../../task/task-execution-lock.ts';
 import { dispatchWorkflowCommand } from '../../task/workflow-dispatch.ts';
 import { assertSandboxTaskSource } from '../workspace-view.ts';
@@ -37,6 +39,18 @@ function executionResult(result: Record<string, unknown>): SandboxControlExecuti
   return { exitCode: result.status === 'failed' || result.status === 'refused' ? 1 : 0, stdout: `${JSON.stringify(result)}\n`, stderr: '' };
 }
 
+function replaceCurrentArtifactAtomically(file: string, content: string): void {
+  const temporary = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${randomUUID()}.tmp`);
+  try {
+    fs.writeFileSync(temporary, content, { encoding: 'utf8', flag: 'wx' });
+    fs.renameSync(temporary, file);
+  } finally {
+    try { fs.unlinkSync(temporary); } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+    }
+  }
+}
+
 /** The broker already authorized this host executor; domain operations own validation. */
 export async function executeTaskWorkflow(
   manifest: SandboxControlManifest,
@@ -45,25 +59,6 @@ export async function executeTaskWorkflow(
   options: TaskWorkflowExecutionOptions = {}
 ): Promise<SandboxControlExecutionResult> {
   let publicationCommitted = false;
-  let recoveryObservation: Readonly<{
-    family: 'analysis' | 'plan' | 'code' | 'review-analysis' | 'review-plan' | 'review-code';
-    artifact: string;
-    wasPassed: boolean;
-  }> | null = null;
-  const observeRecoveryPublication = (): void => {
-    if (!recoveryObservation || recoveryObservation.wasPassed) return;
-    const intent = readArtifactRecoveryIntent(
-      manifest.repoRoot,
-      request.taskId,
-      recoveryObservation.family,
-      recoveryObservation.artifact
-    );
-    publicationCommitted ||= intent?.state === 'preflight-ready'
-      || intent?.state === 'preflight-commit-started'
-      || intent?.state === 'preflight-passed'
-      || intent?.state === 'passed'
-      || intent?.state === 'commit-started';
-  };
   let faultTriggered = false;
   const fault = (window: TaskWorkflowFaultWindow): void => {
     if (faultTriggered || options.faultWindow !== window) return;
@@ -125,47 +120,26 @@ export async function executeTaskWorkflow(
       if ('operation' in input) {
         const { family } = input;
         if (family !== 'analysis' && family !== 'plan' && family !== 'code') throw new Error('ARTIFACT_IDENTITY_INVALID');
-        const local = { taskRef: request.taskId, family, artifact: input.artifact, repoRoot: manifest.repoRoot, recoveryId: input.recoveryId, lockAlreadyHeld: true } as const;
+        const local = { taskRef: request.taskId, family, artifact: input.artifact, repoRoot: manifest.repoRoot, lockAlreadyHeld: true } as const;
         if (input.operation === 'preflight') {
-          // Preflight only seals a verified generation. It must not publish the
-          // formal artifact, set publicationStarted, or append finalizer audit.
           const result = preflightLocalArtifact(local);
-          recoveryObservation = { family, artifact: input.artifact, wasPassed: false };
-          observeRecoveryPublication();
           return response(result);
         }
-        recoveryObservation = {
-          family,
-          artifact: input.artifact,
-          wasPassed: readArtifactRecoveryIntent(manifest.repoRoot, request.taskId, family, input.artifact)?.state === 'passed'
-        };
-        const prepared = prepareLocalArtifact(local, content, lifecycleRecoveryAttestation ?? undefined);
-        observeRecoveryPublication();
-        const commitOptions = { afterPublish: () => fault('after-atomic-rename') };
-        if (prepared.result.status === 'failed') return executionResult(commitLocalArtifactProvenance(prepared, commitOptions));
-        result = commitLocalArtifactProvenance(prepared, commitOptions);
+        const prepared = prepareLocalArtifact(local, content);
+        result = commitLocalArtifactProvenance(prepared);
       } else {
         if (input.overrideTicket) throw new Error('TASK_WORKFLOW_OVERRIDE_UNSUPPORTED');
         const family = `review-${input.stage}` as 'review-analysis' | 'review-plan' | 'review-code';
         if (request.operation === 'review-preflight') {
           const result = preflightReviewSummary(input, { repoRoot: manifest.repoRoot, lockAlreadyHeld: true });
-          recoveryObservation = { family, artifact: input.artifact, wasPassed: false };
-          observeRecoveryPublication();
           return response(result);
         }
-        recoveryObservation = {
-          family,
-          artifact: input.artifact,
-          wasPassed: readArtifactRecoveryIntent(manifest.repoRoot, request.taskId, family, input.artifact)?.state === 'passed'
-        };
-        const prepared = prepareReviewSummaryCandidate(input, content, { repoRoot: manifest.repoRoot, lockAlreadyHeld: true, startRecovery: true });
-        observeRecoveryPublication();
+        const prepared = prepareReviewSummaryCandidate(input, content, { repoRoot: manifest.repoRoot, lockAlreadyHeld: true });
         if (input.dryRun || prepared.result.status === 'planned') return executionResult(prepared.result);
-        const commitOptions = { afterPublish: () => fault('after-atomic-rename') };
-        if (prepared.result.status === 'failed') return executionResult(commitReviewSummaryProvenance(prepared, manifest.repoRoot, commitOptions));
-        result = commitReviewSummaryProvenance(prepared, manifest.repoRoot, commitOptions);
+        if (prepared.result.status === 'failed') return executionResult(prepared.result);
+        if (prepared.result.changed) replaceCurrentArtifactAtomically(path.join(taskDir, input.artifact), prepared.content);
+        result = prepared.result;
       }
-      observeRecoveryPublication();
       publicationCommitted ||= result.changed === true;
       if (result.status !== 'failed') appendDiagnosticAudit(manifest, 'task-workflow-artifact-finalized', {
         requestId: request.id, sandboxTaskId: request.taskId, workflowOperation: request.operation,
@@ -175,7 +149,6 @@ export async function executeTaskWorkflow(
       return response(result);
     });
   } catch (error) {
-    observeRecoveryPublication();
     const message = error instanceof Error ? error.message : String(error);
     const code = (error as { code?: string })?.code ?? /^([A-Z][A-Z0-9_]+)/u.exec(message)?.[1] ?? 'TASK_WORKFLOW_REQUEST_INVALID';
     return executionResult({ status: 'failed', changed: publicationCommitted ? null : false, error: { code, message } });

package/lib/task/artifact-command.ts

@@ -13,7 +13,6 @@ export type ArtifactCommand = Readonly<{
   family: string;
   artifact: string;
   locale?: 'zh-CN' | 'en';
-  recoveryId?: string;
 }>;
 
 /** One option contract for the CLI and trusted projection executor. */
@@ -26,8 +25,8 @@ export function parseArtifactCommand(args: readonly string[]): ArtifactCommand {
   const allowed = {
     inspect: ['--family'],
     init: ['--family', '--artifact', '--locale'],
-    'preflight': ['--family', '--artifact', '--recovery-id'],
-    'finalize-local': ['--family', '--artifact', '--recovery-id']
+    'preflight': ['--family', '--artifact'],
+    'finalize-local': ['--family', '--artifact']
   }[operation as ArtifactCommand['operation']];
   for (let index = 2; index < args.length; index += 1) {
     const flag = args[index]!;
@@ -43,7 +42,7 @@ export function parseArtifactCommand(args: readonly string[]): ArtifactCommand {
   if (locale !== undefined && locale !== 'zh-CN' && locale !== 'en') throw new Error("option '--locale' must be 'zh-CN' or 'en'");
   return {
     taskRef, operation: operation as ArtifactCommand['operation'], family: fields['--family'],
-    artifact: fields['--artifact'] ?? '', locale, recoveryId: fields['--recovery-id']
+    artifact: fields['--artifact'] ?? '', locale
   };
 }
 /** Resolve authoritative task metadata separately from a trusted candidate directory. */
@@ -51,7 +50,7 @@ export function executeArtifactCommand(
   command: ArtifactCommand,
   options: Readonly<{ repoRoot?: string; artifactDir?: string }> = {}
 ): Record<string, unknown> {
-  const { taskRef, operation, family, artifact, locale, recoveryId } = command;
+  const { taskRef, operation, family, artifact, locale } = command;
   const fail = (code: string, message: string) => ({ status: 'failed', changed: false, error: { code, message } });
   if (operation === 'inspect') {
     const result = resolveArtifactContext(taskRef, family, { repoRoot: options.repoRoot });
@@ -82,6 +81,6 @@ export function executeArtifactCommand(
   if (family !== 'analysis' && family !== 'plan' && family !== 'code') {
     return fail('ARTIFACT_PAYLOAD_INVALID', "preflight and finalize-local only support 'analysis', 'plan', and 'code'");
   }
-  if (operation === 'preflight') return { ...preflightLocalArtifact({ taskRef, family, artifact, repoRoot: resolved.repoRoot, recoveryId }) };
-  return { ...finalizeLocalArtifact({ taskRef, family, artifact, repoRoot: resolved.repoRoot, recoveryId }) };
+  if (operation === 'preflight') return { ...preflightLocalArtifact({ taskRef, family, artifact, repoRoot: resolved.repoRoot }) };
+  return { ...finalizeLocalArtifact({ taskRef, family, artifact, repoRoot: resolved.repoRoot }) };
 }

package/lib/task/codex-orchestration.ts

@@ -5,21 +5,10 @@ import {
   resolveCodexThread
 } from '../agent-clients/adapters/codex-lifecycle/app-server.ts';
 import { createCodexLifecycleStore } from '../agent-clients/adapters/codex-lifecycle/store.ts';
-import {
-  createCodexCapabilityStore,
-  isCodexCapabilityProvenanceDetail
-} from '../agent-clients/adapters/codex-lifecycle/capability-store.ts';
-import type { CodexCapabilityProvenanceDetail } from '../agent-clients/adapters/codex-lifecycle/capability-store.ts';
 import {
   computeLifecycleBuildIdentity,
-  verifyLifecycleBuildIdentity,
   type LifecycleBuildIdentity,
-  type LifecycleIdentityWarning
 } from '../agent-clients/adapters/codex-lifecycle/build-identity.ts';
-import { verifyCodexSandboxControllerContextWithWarnings as verifySandboxControllerWithWarnings } from '../agent-clients/adapters/codex-lifecycle/sandbox-controller.ts';
-import {
-  verifyCodexSandboxControllerContextWithWarnings as verifyControllerContextFileWithWarnings
-} from '../agent-clients/adapters/codex-lifecycle/controller-context.ts';
 import type { AgentClientId } from '../agent-clients/types.ts';
 import { resolveTaskRef } from './resolve-ref.ts';
 import {
@@ -29,32 +18,20 @@ import {
   OrchestrationStateError,
   pauseMatchingOrchestrationDelegation,
   prepareOrchestrationDelegation,
-  routeOrchestration,
   reconcileMatchingOrchestrationDelegation,
   sealMatchingOrchestrationDelegationWithHostEvidence
 } from './orchestration.ts';
-import { randomUUID, createHash } from 'node:crypto';
 import type { OrchestrationOptions, OrchestrationResult } from './orchestration.ts';
-import {
-  consumeLifecycleRecoveryAttestation,
-  issueLifecycleRecoveryAttestation,
-  validateLifecycleRecoveryAttestation,
-  type LifecycleRecoveryAttestationV1
-} from './control-authority.ts';
 
 type LifecycleStore = ReturnType<typeof createCodexLifecycleStore>;
-type CapabilityStore = ReturnType<typeof createCodexCapabilityStore>;
 type CodexBridgeOptions = Readonly<{
   repoRoot?: string;
   store?: LifecycleStore;
   preflight?: typeof preflightCodexLifecycleEvidence;
   resolveThread?: typeof resolveCodexThread;
   resolveTerminal?: typeof resolveCodexTerminal;
-  capabilityStore?: CapabilityStore;
   buildIdentity?: LifecycleBuildIdentity;
   orchestrationOptions?: OrchestrationOptions;
-  controllerBinding?: Readonly<{ instanceDigest: string; controlGeneration: string }>;
-  deferLifecycleRecoveryConsumption?: boolean;
 }>;
 
 type CodexSpawnIdentity = Readonly<{
@@ -68,35 +45,14 @@ type CodexSpawnIdentity = Readonly<{
   requestedReasoningEffort?: string;
 }>;
 
-function buildIdentityDigest(value: LifecycleBuildIdentity): string {
-  return createHash('sha256').update(JSON.stringify(value), 'utf8').digest('hex');
-}
-
 function coreOptions(options: CodexBridgeOptions): OrchestrationOptions {
   return { ...options.orchestrationOptions, repoRoot: options.repoRoot ?? options.orchestrationOptions?.repoRoot };
 }
 
-function bridgeFailure(code: string, message: string, detail?: CodexCapabilityProvenanceDetail): OrchestrationResult {
+function bridgeFailure(code: string, message: string): OrchestrationResult {
   return {
     status: 'failed', changed: false, taskId: null, run: null, next: null,
-    error: { code, message, ...(detail ? { detail } : {}) }
-  };
-}
-
-function capabilityFailure(error: unknown): NonNullable<OrchestrationResult['error']> {
-  const detailValue = error instanceof Error
-    ? (error as Error & { detail?: unknown }).detail
-    : undefined;
-  return {
-    code: error instanceof Error && error.name.startsWith('CODEX_CAPABILITY_')
-      ? error.name
-      : 'ORCHESTRATION_CLIENT_PREFLIGHT_FAILED',
-    message: error instanceof Error ? error.message : String(error),
-    ...(error instanceof Error
-      && error.name === 'CODEX_CAPABILITY_PROVENANCE_MISMATCH'
-      && isCodexCapabilityProvenanceDetail(detailValue)
-      ? { detail: detailValue }
-      : {})
+    error: { code, message }
   };
 }
 
@@ -112,35 +68,12 @@ function requiredStore(options: CodexBridgeOptions): LifecycleStore {
   return options.store;
 }
 
-function brokerControllerBinding(): Readonly<{ instanceDigest: string; controlGeneration: string }> | null {
-  const raw = process.env.AGENT_INFRA_CONTROL_CONTROLLER_BINDING;
-  if (!raw) return null;
-  let value: unknown;
-  try {
-    value = JSON.parse(raw);
-  } catch {
-    throw new Error('CODEX_SANDBOX_CONTROLLER_BINDING_INVALID');
-  }
-  if (!value || typeof value !== 'object' || Array.isArray(value)) {
-    throw new Error('CODEX_SANDBOX_CONTROLLER_BINDING_INVALID');
-  }
-  const binding = value as Record<string, unknown>;
-  if (Object.keys(binding).sort().join(',') !== 'controlGeneration,instanceDigest'
-    || typeof binding.instanceDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(binding.instanceDigest)
-    || typeof binding.controlGeneration !== 'string' || binding.controlGeneration.length === 0) {
-    throw new Error('CODEX_SANDBOX_CONTROLLER_BINDING_INVALID');
-  }
-  return binding as { instanceDigest: string; controlGeneration: string };
-}
-
 async function prepareCodexOrchestrationDelegation(
   taskRef: string,
   input: Readonly<{
     client: AgentClientId;
     requestedModel?: string;
     requestedReasoningEffort?: string;
-    capabilityRef?: string;
-    lifecycleRecoveryAttestation?: LifecycleRecoveryAttestationV1 | null;
   }>,
   options: CodexBridgeOptions = {}
 ): Promise<OrchestrationResult> {
@@ -149,164 +82,11 @@ async function prepareCodexOrchestrationDelegation(
     const repoRoot = options.repoRoot ?? process.cwd();
     const resolved = resolveTaskRef(taskRef, { repoRoot });
     if (!resolved.ok) return bridgeFailure(resolved.code, resolved.message);
-    const preflight = await (options.preflight ?? preflightCodexLifecycleEvidence)(repoRoot);
-    const capabilityRef = input.capabilityRef;
-    if (!capabilityRef) {
-      return bridgeFailure(
-        'ORCHESTRATION_CODEX_CAPABILITY_REQUIRED',
-        'Codex prepare requires a current-session capability reference'
-      );
-    }
-    const buildIdentity = options.buildIdentity ?? computeLifecycleBuildIdentity(repoRoot);
-    const brokerController = options.controllerBinding ?? brokerControllerBinding();
-    const contextPath = process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT;
-    const contextVerification = contextPath
-      ? (brokerController
-        ? verifyControllerContextFileWithWarnings(contextPath, {
-            repoRoot,
-            generation: process.env.AGENT_INFRA_CONTROL_GENERATION ?? brokerController.controlGeneration
-          })
-        : verifySandboxControllerWithWarnings(contextPath, { repoRoot }))
-      : null;
-    const identityWarnings: LifecycleIdentityWarning[] = [...(contextVerification?.warnings ?? [])];
-    const localController = contextVerification?.context ?? null;
-    if (localController && brokerController
-      && (localController.controllerInstanceDigest !== brokerController.instanceDigest
-        || localController.controlGeneration !== brokerController.controlGeneration)) {
-      return bridgeFailure(
-        'CODEX_SANDBOX_CONTROLLER_BINDING_MISMATCH',
-        'broker and local controller bindings do not match'
-      );
-    }
-    const controller = brokerController ?? (localController ? {
-      instanceDigest: localController.controllerInstanceDigest,
-      controlGeneration: localController.controlGeneration
-    } : null);
-    const capabilityStore = options.capabilityStore ?? createCodexCapabilityStore();
-    const attested = capabilityStore.inspectReference(capabilityRef);
-    const capabilityIdentity = verifyLifecycleBuildIdentity(attested.buildIdentity, buildIdentity);
-    if (!capabilityIdentity.ok) {
-      return bridgeFailure(capabilityIdentity.code!, capabilityIdentity.message!);
-    }
-    identityWarnings.push(...capabilityIdentity.warnings);
-    const lifecycleProvenance = {
-      ...attested.buildIdentity,
-      hookDefinitionHash: preflight.hookDefinitionHash,
-      ...preflight.hookProvenance,
-      capabilitySessionId: attested.sessionId!,
-      capabilityTurnId: attested.turnId!,
-      capabilityToolUseId: attested.toolUseId!,
-      controllerInstanceDigest: controller?.instanceDigest ?? null,
-      controlGeneration: controller?.controlGeneration ?? null
-    };
-    const capabilityExpected = {
-      taskId: resolved.taskId,
-      hookDefinitionHash: preflight.hookDefinitionHash,
-      buildIdentity,
-      ...(controller ? { controller: {
-        instanceDigest: controller.instanceDigest,
-        controlGeneration: controller.controlGeneration
-      } } : {})
-    };
-    if (input.lifecycleRecoveryAttestation) {
-      try { validateLifecycleRecoveryAttestation(input.lifecycleRecoveryAttestation); }
-      catch (error) {
-        return bridgeFailure(
-          'LIFECYCLE_AUTHORITY_ATTESTATION_INVALID',
-          error instanceof Error ? error.message : String(error)
-        );
-      }
-    }
-    let lifecycleRecoveryAttestation: LifecycleRecoveryAttestationV1 | null = input.lifecycleRecoveryAttestation ?? null;
-    const routed = input.capabilityRef && !lifecycleRecoveryAttestation
-      ? routeOrchestration(taskRef, coreOptions(options))
-      : null;
-    if (routed && !routed.next) return routed;
-    if (routed?.next && ['analysis', 'plan', 'code'].includes(routed.next.stage)) {
-      const recoveryRequest = {
-        version: 1 as const,
-        requestId: randomUUID(),
-        operationId: randomUUID(),
-        phase: 'orchestration.prepare' as const,
-        taskId: resolved.taskId,
-        family: routed.next.stage === 'analysis' ? 'analysis' as const
-          : routed.next.stage === 'plan' ? 'plan' as const : 'code' as const,
-        artifact: routed.next.artifact,
-        round: routed.next.round,
-        lifecycleRequestId: randomUUID(),
-        authorityRef: capabilityRef,
-        expectedControlGeneration: controller?.controlGeneration ?? '',
-        expectedControllerInstanceDigest: controller?.instanceDigest ?? '0'.repeat(64),
-        expectedBuildIdentityDigest: buildIdentityDigest(buildIdentity),
-        expectedHookDefinitionHash: preflight.hookDefinitionHash
-      };
-      const authority = issueLifecycleRecoveryAttestation(recoveryRequest, {
-        capabilityStore,
-        ...(controller ? { controllerBinding: controller } : {}),
-        buildIdentity
-      });
-      if (authority.status === 'rejected' || !authority.attestation) {
-        return bridgeFailure(
-          authority.error?.code ?? 'LIFECYCLE_AUTHORITY_REJECTED',
-          authority.error?.message ?? 'lifecycle authority was rejected'
-        );
-      }
-      lifecycleRecoveryAttestation = authority.attestation;
-    }
-    const prepared = prepareOrchestrationDelegation(taskRef, {
-      ...input,
-      lifecycleProvenance,
-      lifecycleRecoveryAttestation
-    }, {
-      ...coreOptions(options),
-      validateLifecycleCapability: () => {
-        try {
-          const validated = capabilityStore.validateReference(capabilityRef, capabilityExpected);
-          if (validated.sessionId !== attested.sessionId
-            || validated.turnId !== attested.turnId
-            || validated.toolUseId !== attested.toolUseId) {
-            return {
-              code: 'CODEX_CAPABILITY_IDENTITY_CHANGED',
-              message: 'capability identity changed during validation'
-            };
-          }
-          return null;
-        } catch (error) {
-          return capabilityFailure(error);
-        }
-      },
-      consumeLifecycleCapability: () => null
-    });
-    if (lifecycleRecoveryAttestation && !options.deferLifecycleRecoveryConsumption && prepared.status !== 'failed') {
-      try {
-        consumeLifecycleRecoveryAttestation(lifecycleRecoveryAttestation);
-      } catch (error) {
-        return bridgeFailure(
-          error instanceof Error ? error.name : 'LIFECYCLE_AUTHORITY_CONSUME_FAILED',
-          error instanceof Error ? error.message : String(error)
-        );
-      }
-    }
-    return identityWarnings.length > 0 && prepared.status !== 'failed'
-      ? { ...prepared, warnings: Object.freeze(identityWarnings) }
-      : prepared;
+    await (options.preflight ?? preflightCodexLifecycleEvidence)(repoRoot);
+    return prepareOrchestrationDelegation(taskRef, input, coreOptions(options));
   } catch (error) {
     if (error instanceof OrchestrationStateError) return bridgeFailure(error.code, error.message);
-    const detailValue = error instanceof Error
-      ? (error as Error & { detail?: unknown }).detail
-      : undefined;
-    const detail = error instanceof Error
-      && error.name === 'CODEX_CAPABILITY_PROVENANCE_MISMATCH'
-      && isCodexCapabilityProvenanceDetail(detailValue)
-      ? detailValue
-      : undefined;
-    return bridgeFailure(
-      error instanceof Error && error.name.startsWith('CODEX_CAPABILITY_')
-        ? error.name
-        : 'ORCHESTRATION_CLIENT_PREFLIGHT_FAILED',
-      error instanceof Error ? error.message : String(error),
-      detail
-    );
+    return bridgeFailure('ORCHESTRATION_CLIENT_PREFLIGHT_FAILED', error instanceof Error ? error.message : String(error));
   }
 }
 
@@ -335,16 +115,6 @@ async function activateCodexOrchestrationDelegation(
       toolUseId: evidence.spawnToolUseId
     });
     const buildIdentity = options.buildIdentity ?? computeLifecycleBuildIdentity(repoRoot);
-    const contextPath = process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT;
-    const contextVerification = contextPath
-      ? verifySandboxControllerWithWarnings(contextPath, { repoRoot })
-      : null;
-    const controller = options.controllerBinding
-      ?? brokerControllerBinding()
-      ?? (contextVerification?.context ? {
-        instanceDigest: contextVerification.context.controllerInstanceDigest,
-        controlGeneration: contextVerification.context.controlGeneration
-      } : null);
     const activated = activateMatchingOrchestrationDelegation('codex', {
       nativeAgent: evidence.nativeAgent,
       childId: evidence.childThreadId,
@@ -366,14 +136,11 @@ async function activateCodexOrchestrationDelegation(
         capabilityTurnId: evidence.parentTurnId,
         spawnToolUseId: evidence.spawnToolUseId,
         spawnObservedAt: record.spawnObservedAt ?? undefined,
-        controllerInstanceDigest: controller?.instanceDigest ?? null,
-        controlGeneration: controller?.controlGeneration ?? null
+        controllerInstanceDigest: null,
+        controlGeneration: null
       }
     }, coreOptions(options));
-    const warnings = contextVerification?.warnings ?? [];
-    return warnings.length > 0 && activated.status !== 'failed'
-      ? { ...activated, warnings: Object.freeze(warnings) }
-      : activated;
+    return activated;
   } catch (error) {
     if (error instanceof OrchestrationStateError) return bridgeFailure(error.code, error.message);
     return pauseBridge('ORCHESTRATION_CODEX_START_FAILED', error instanceof Error ? error.message : String(error), options);

package/lib/task/commit-operation.ts

@@ -32,8 +32,6 @@ type CommitOperationInput = Readonly<{
   agent?: string;
   mode?: CommitExecutionMode;
   round?: number;
-  /** Permit one retry to rebase a prepared intent's expected tree while HEAD and intent identity remain unchanged. */
-  recoverPreparedIntent?: boolean;
   delivery?: Readonly<{
     mode: 'local' | 'push';
     remote: string;
@@ -282,20 +280,6 @@ function checkpointTimestamp(): string {
   return new Date().toISOString();
 }
 
-function samePreparedCheckpointIdentity(
-  pending: NonNullable<ReturnType<typeof readCheckpointIntent>>,
-  identity: Parameters<typeof checkpointIntentDigest>[0]
-): boolean {
-  return pending.state === 'prepared'
-    && pending.taskId === identity.taskId
-    && pending.branch === identity.branch
-    && pending.mode === identity.mode
-    && pending.expectedHead === identity.expectedHead
-    && pending.message === identity.message
-    && pending.round === identity.round
-    && JSON.stringify(pending.paths) === JSON.stringify(identity.paths);
-}
-
 function executeUnlocked(input: CommitOperationInput, task: BoundTask | null, mode: CommitExecutionMode): CommitOperationResult {
   const inspected = inspectGitWorkflow(input.cwd);
   if (!inspected.snapshot) return failure(input, mode, task?.taskId ?? null, 'GIT_INSPECT_FAILED', 'Unable to inspect Git repository');
@@ -330,15 +314,11 @@ function executeUnlocked(input: CommitOperationInput, task: BoundTask | null, mo
         };
       }
       if (pendingIntent && !sameCheckpointIntent(pendingIntent, identity)) {
-        if (!input.recoverPreparedIntent || !samePreparedCheckpointIdentity(pendingIntent, identity)) return {
-          status: 'failed' as const, changed: false, snapshot: inspected.snapshot, operations: [],
-          error: { code: 'COMMIT_INTENT_CONFLICT', message: 'A different checkpoint intent is still pending for this task' }
-        };
+        const timestamp = checkpointTimestamp();
         pendingIntent = {
-          ...pendingIntent,
-          expectedTree: identity.expectedTree,
+          version: 1, ...identity,
           digest: checkpointIntentDigest(identity),
-          updatedAt: checkpointTimestamp()
+          state: 'prepared', committedHead: null, createdAt: timestamp, updatedAt: timestamp
         };
         try { writeCheckpointIntent(task!.repoRoot, pendingIntent); }
         catch (error) {

package/lib/task/control-authority.ts

@@ -789,17 +789,11 @@ function orchestration(
         client: input.client as AgentClientId,
         requestedModel: input.requestedModel as string | undefined,
         requestedReasoningEffort: input.requestedReasoningEffort as string | undefined,
-        ...(input.capabilityRef === undefined ? {} : { capabilityRef: input.capabilityRef as string }),
-        ...(context.lifecycleRecoveryAttestation === undefined
-          ? {}
-          : { lifecycleRecoveryAttestation: context.lifecycleRecoveryAttestation })
       };
       if (prepareInput.client === 'codex') {
         return prepareCodexOrchestrationDelegation(operation.taskRef, prepareInput, {
           repoRoot: context.repoRoot,
           orchestrationOptions: options,
-          deferLifecycleRecoveryConsumption: context.source === 'sandbox-executor',
-          ...(context.controllerBinding ? { controllerBinding: context.controllerBinding } : {})
         });
       }
       return prepareOrchestrationDelegation(operation.taskRef, prepareInput, options);
@@ -912,7 +906,7 @@ const FINALIZATION_FLAGS = new Set(['--agent']);
 const ORCHESTRATION_FLAGS = new Set([
   '--agent', '--max-steps', '--executor-model', '--executor-reasoning-effort', '--reviewer-model',
   '--reviewer-reasoning-effort', '--client', '--requested-model', '--requested-reasoning-effort',
-  '--capability-ref', '--parent-id', '--before-fingerprint', '--stage', '--round', '--artifact', '--role',
+  '--parent-id', '--before-fingerprint', '--stage', '--round', '--artifact', '--role',
   '--native-agent', '--child-id', '--spawn-mode', '--actual-model', '--actual-reasoning-effort',
   '--model-fallback-reason', '--reasoning-effort-fallback-reason', '--exit-code', '--after-fingerprint',
   '--changed-paths', '--code', '--message', '--recoverable', '--git-worktree-root'
@@ -1049,7 +1043,6 @@ export function parseTaskControlOperation(
   if (parsedIntent === 'prepare') {
     input.requestedModel = value(values, '--requested-model');
     input.requestedReasoningEffort = value(values, '--requested-reasoning-effort');
-    input.capabilityRef = value(values, '--capability-ref');
   }
   if (parsedIntent === 'await-activation') {
     required(values, ['--stage', '--round', '--artifact', '--role']);