@fitlab-ai/agent-infra 0.11.1 → 0.11.3

package/dist/lib/task/local-artifact-finalization.js

@@ -1,57 +1,18 @@
 import fs from 'node:fs';
+import path from 'node:path';
 import { inspectDecisionDetailDuplicates } from './decision-details.js';
 import { scanVisibleMarkdown } from './markdown.js';
 import { parseArtifactName } from './artifact-name.js';
-import { hasOpenArtifactRound, validateArtifactPublication, validateCompletedArtifact } from './artifact-lifecycle.js';
+import { hasOpenArtifactRound, } from './artifact-lifecycle.js';
 import { resolveTaskRef } from './resolve-ref.js';
 import { expectedQualificationRelations, validateQualificationAudit } from './qualification-audit.js';
 import { canonicalSemanticDigest, inspectArtifactPatterns, inspectArtifactStructure, sha256Content } from './artifact-operations.js';
 import { getArtifactSchema } from './artifact-schema.js';
-import { readArtifactRecoveryIntent } from './artifact-repair-intent.js';
-import { beginArtifactRecovery, commitArtifactRecovery, consumeArtifactRecovery, prepareArtifactRecoveryFinal, prepareArtifactRecoveryCommit, recordArtifactRecoveryPassed, reconcileArtifactRecovery, recoveryContextFromIntent, stageArtifactCandidate } from './artifact-recovery.js';
-import { consumeLifecycleRecoveryAttestation, lifecycleRecoveryAttestationDigest, validateLifecycleRecoveryAttestation } from './control-authority.js';
 const LOCAL_ARTIFACT_REQUIRED_SECTIONS = {
     analysis: getArtifactSchema('analysis').sections.map((section) => section.headings.zh),
     plan: getArtifactSchema('plan').sections.map((section) => section.headings.zh),
     code: getArtifactSchema('code').sections.map((section) => section.headings.zh)
 };
-function authorityDigest(authority) {
-    return lifecycleRecoveryAttestationDigest(authority);
-}
-function validFinalizerAuthority(authority, request, taskId) {
-    if (!authority)
-        return false;
-    try {
-        validateLifecycleRecoveryAttestation(authority);
-    }
-    catch {
-        return false;
-    }
-    return authority.version === 1
-        && authority.phase === 'artifact.finalize-local'
-        && authority.taskId === taskId
-        && authority.family === request.family
-        && authority.artifact === request.artifact
-        && authority.round === (parseArtifactName(request.artifact)?.round ?? 0)
-        && authority.requestId.length > 0
-        && authority.operationId.length > 0;
-}
-function recoveryInfo(context) {
-    return {
-        recoveryId: context.recoveryId,
-        candidatePath: context.stagingPath,
-        baselineSha256: context.baselineSha256,
-        baselineSemanticDigest: context.baselineSemanticDigest
-    };
-}
-function consumeLocalArtifactFinalizationIntent(repoRoot, intent, options = {}) {
-    if (intent.state === 'consumed')
-        return intent;
-    const resolved = resolveTaskRef(intent.taskId, { repoRoot });
-    if (!resolved.ok)
-        throw new Error(resolved.message);
-    return consumeArtifactRecovery(recoveryContextFromIntent(repoRoot, resolved.taskDir, intent), options);
-}
 function localDiagnosticCode(code) {
     const map = {
         ARTIFACT_EMPTY: 'LOCAL_ARTIFACT_EMPTY',
@@ -127,19 +88,7 @@ function failedFinalization(request, error, extra = {}) {
         diagnostics: [], error, ...extra
     };
 }
-function tupleFor(request, taskId, authority) {
-    const round = parseArtifactName(request.artifact)?.round ?? 0;
-    return {
-        taskId,
-        family: request.family,
-        artifact: request.artifact,
-        round,
-        requestId: authority?.lifecycleRequestId ?? `local-finalize:${taskId}:${request.family}:${round}`,
-        phase: authority?.phase ?? 'artifact.finalize-local',
-        authorityDigest: authority ? authorityDigest(authority) : null
-    };
-}
-function prepareLocalArtifact(request, candidate, authority, preflightOnly = false) {
+function prepareLocalArtifact(request, candidate) {
     const failed = (code, message, extra = {}) => ({
         result: failedFinalization(request, { code, message }, extra), content: candidate ?? ''
     });
@@ -149,39 +98,20 @@ function prepareLocalArtifact(request, candidate, authority, preflightOnly = fal
     const parsed = parseArtifactName(request.artifact);
     if (!parsed || parsed.family !== request.family)
         return failed('ARTIFACT_IDENTITY_INVALID', `artifact '${request.artifact}' does not match ${request.family}`);
-    if (authority && !validFinalizerAuthority(authority, request, resolved.taskId)) {
-        return failed('LOCAL_EXECUTION_AUTHORITY_INVALID', 'finalizer authority does not match the artifact tuple');
-    }
     let taskContent;
     let content;
-    let recovery;
-    let recoveryState;
     try {
         taskContent = fs.readFileSync(resolved.taskMdPath, 'utf8');
-        if (request.recoveryId) {
-            const intent = readArtifactRecoveryIntent(resolved.repoRoot, resolved.taskId, request.family, request.artifact);
-            if (!intent || intent.recoveryOperationId !== request.recoveryId)
-                return failed('LOCAL_RECOVERY_PROVENANCE_CONFLICT', 'recovery id does not match the artifact journal');
-            if (!['awaiting-preflight-recovery', 'preflight-ready', 'preflight-commit-started', 'preflight-passed', 'full-finalizer-ready', 'commit-started'].includes(intent.state))
-                return failed('LOCAL_RECOVERY_PROVENANCE_CONFLICT', `recovery journal is in '${intent.state}' state`);
-            recoveryState = intent.state;
-            recovery = recoveryContextFromIntent(resolved.repoRoot, resolved.taskDir, intent);
-            content = fs.existsSync(recovery.stagingPath)
-                ? fs.readFileSync(recovery.stagingPath, 'utf8')
-                : fs.readFileSync(recovery.formalPath, 'utf8');
-        }
-        else {
-            const validated = validateCompletedArtifact(resolved.taskDir, request.family, request.artifact, parsed.round);
-            if (!validated.ok)
-                return failed(validated.error.code, validated.error.message);
-            content = candidate ?? fs.readFileSync(validated.artifact.path, 'utf8');
-        }
+        const artifactPath = path.join(resolved.taskDir, request.artifact);
+        if (!fs.statSync(artifactPath).isFile())
+            return failed('ARTIFACT_NOT_REGULAR', `artifact '${request.artifact}' is not a regular file`);
+        content = candidate ?? fs.readFileSync(artifactPath, 'utf8');
     }
     catch (error) {
         return failed('ARTIFACT_NOT_READABLE', String(error));
     }
-    if (resolved.state !== 'active' || !hasOpenArtifactRound(taskContent, request.family, parsed.round)) {
-        return failed('ARTIFACT_IDENTITY_INVALID', 'candidate must match one open started round in an active task');
+    if (resolved.state !== 'active') {
+        return failed('ARTIFACT_IDENTITY_INVALID', 'artifact finalization requires an active task');
     }
     const validation = validateLocalArtifact(content, {
         family: request.family, requiredSections: request.requiredSections, taskContent, artifact: request.artifact
@@ -194,173 +124,26 @@ function prepareLocalArtifact(request, candidate, authority, preflightOnly = fal
         taskId: resolved.taskId, taskDir: resolved.taskDir, artifactSha256,
         semanticDigest: validation.semanticDigest, diagnostics: validation.diagnostics
     });
-    if (request.recoveryId) {
-        if (!validation.ok)
-            return { result, content, repoRoot: resolved.repoRoot, recovery, authority, lockAlreadyHeld: request.lockAlreadyHeld };
-        if (preflightOnly && recovery && recoveryState === 'awaiting-preflight-recovery') {
-            const staged = stageArtifactCandidate(recovery, Buffer.from(content, 'utf8'), { lockAlreadyHeld: request.lockAlreadyHeld });
-            prepareArtifactRecoveryCommit(recovery, staged.candidateSha256, staged.semanticDigest, { lockAlreadyHeld: request.lockAlreadyHeld });
-        }
-        return {
-            result: { ...result, status: 'passed', changed: false, error: null, recovery: recoveryInfo(recovery) },
-            content, repoRoot: resolved.repoRoot, recovery, authority, lockAlreadyHeld: request.lockAlreadyHeld
-        };
-    }
-    const existing = readArtifactRecoveryIntent(resolved.repoRoot, resolved.taskId, request.family, request.artifact);
-    if (existing?.state === 'passed' || existing?.state === 'consumed') {
-        if (existing.state === 'consumed' && (existing.finalArtifactSha256 !== artifactSha256 || existing.finalSemanticDigest !== validation.semanticDigest)) {
-            return { ...failed('LOCAL_RECOVERY_PROVENANCE_CONFLICT', 'formal artifact does not match its completed recovery journal'), content, repoRoot: resolved.repoRoot, authority, lockAlreadyHeld: request.lockAlreadyHeld };
-        }
-        if (existing.finalArtifactSha256 === artifactSha256 && existing.finalSemanticDigest === validation.semanticDigest) {
-            const context = recoveryContextFromIntent(resolved.repoRoot, resolved.taskDir, existing);
-            return {
-                result: { ...result, status: 'passed', error: null, recovery: recoveryInfo(context) },
-                content, repoRoot: resolved.repoRoot, recovery: context, authority, lockAlreadyHeld: request.lockAlreadyHeld
-            };
-        }
-    }
-    if (existing && ['preflight-ready', 'preflight-commit-started', 'preflight-passed', 'full-finalizer-ready'].includes(existing.state)) {
-        const context = recoveryContextFromIntent(resolved.repoRoot, resolved.taskDir, existing);
-        return {
-            result: { ...result, status: 'passed', changed: false, error: null, recovery: recoveryInfo(context) },
-            content, repoRoot: resolved.repoRoot, recovery: context, authority, lockAlreadyHeld: request.lockAlreadyHeld
-        };
-    }
-    if (existing?.state === 'commit-started') {
-        if (existing.finalArtifactSha256 !== artifactSha256 || existing.finalSemanticDigest !== validation.semanticDigest) {
-            return { ...failed('LOCAL_RECOVERY_PROVENANCE_CONFLICT', 'formal artifact does not match the interrupted recovery journal'), content, repoRoot: resolved.repoRoot, authority, lockAlreadyHeld: request.lockAlreadyHeld };
-        }
-        const context = recoveryContextFromIntent(resolved.repoRoot, resolved.taskDir, existing);
-        const reconciled = reconcileArtifactRecovery(context, {
-            lockAlreadyHeld: request.lockAlreadyHeld,
-            validateFinal: () => validation.semanticDigest === existing.finalSemanticDigest
-        });
-        if (reconciled.status !== 'passed') {
-            return { ...failed('LOCAL_RECOVERY_PROVENANCE_CONFLICT', `interrupted recovery could not be reconciled: ${reconciled.status}`), content, repoRoot: resolved.repoRoot, recovery: context, authority, lockAlreadyHeld: request.lockAlreadyHeld };
-        }
-        return {
-            result: { ...result, status: 'passed', changed: false, error: null, recovery: recoveryInfo(context) },
-            content, repoRoot: resolved.repoRoot, recovery: context, authority, lockAlreadyHeld: request.lockAlreadyHeld
-        };
-    }
-    try {
-        if (validation.ok) {
-            if (preflightOnly) {
-                const context = beginArtifactRecovery(tupleFor(request, resolved.taskId, authority), Buffer.from(content, 'utf8'), {
-                    repoRoot: resolved.repoRoot, taskDir: resolved.taskDir,
-                    ...(authority ? { recoveryId: authority.operationId } : {}), lockAlreadyHeld: request.lockAlreadyHeld
-                });
-                const staged = stageArtifactCandidate(context, Buffer.from(content, 'utf8'), { lockAlreadyHeld: request.lockAlreadyHeld });
-                prepareArtifactRecoveryCommit(context, staged.candidateSha256, staged.semanticDigest, { lockAlreadyHeld: request.lockAlreadyHeld });
-                return { result: { ...result, status: 'passed', error: null, recovery: recoveryInfo(context) }, content, repoRoot: resolved.repoRoot, recovery: context, authority, lockAlreadyHeld: request.lockAlreadyHeld };
-            }
-            const context = recordArtifactRecoveryPassed(tupleFor(request, resolved.taskId, authority), {
-                repoRoot: resolved.repoRoot,
-                taskDir: resolved.taskDir,
-                expectedFinalSha256: artifactSha256,
-                expectedFinalSemanticDigest: validation.semanticDigest,
-                ...(authority ? { recoveryId: authority.operationId } : {}),
-                lockAlreadyHeld: request.lockAlreadyHeld
-            });
-            recovery = context;
-            return { result: { ...result, status: 'passed', changed: false, error: null, recovery: recoveryInfo(context) }, content, repoRoot: resolved.repoRoot, recovery, authority, lockAlreadyHeld: request.lockAlreadyHeld };
-        }
-        const context = beginArtifactRecovery(tupleFor(request, resolved.taskId, authority), Buffer.from(content, 'utf8'), {
-            repoRoot: resolved.repoRoot,
-            taskDir: resolved.taskDir,
-            ...(authority ? { recoveryId: authority.operationId } : {}),
-            lockAlreadyHeld: request.lockAlreadyHeld
-        });
-        recovery = context;
-        return {
-            result: { ...result, recovery: recoveryInfo(context) },
-            content, repoRoot: resolved.repoRoot, recovery, authority, lockAlreadyHeld: request.lockAlreadyHeld
-        };
-    }
-    catch (error) {
-        return { ...failed('LOCAL_RECOVERY_PROVENANCE_CONFLICT', String(error)), content, repoRoot: resolved.repoRoot, authority, lockAlreadyHeld: request.lockAlreadyHeld };
-    }
+    // Trusted local operators edit the canonical artifact directly.  A
+    // finalization result is a fresh observation of those bytes, never a
+    // capability minted by an earlier recovery attempt or generation.
+    return {
+        result: validation.ok ? { ...result, status: 'passed', error: null } : result,
+        content,
+        repoRoot: resolved.repoRoot,
+        lockAlreadyHeld: request.lockAlreadyHeld
+    };
 }
-function commitLocalArtifactProvenance(prepared, options = {}) {
-    if (!prepared.recovery || !prepared.repoRoot || prepared.result.status === 'failed' && !prepared.result.recovery)
-        return prepared.result;
-    if (prepared.result.status === 'failed')
-        return prepared.result;
-    try {
-        const intent = readArtifactRecoveryIntent(prepared.repoRoot, prepared.recovery.taskId, prepared.recovery.family, prepared.recovery.artifact);
-        if (!intent)
-            throw new Error('ARTIFACT_RECOVERY_INTENT_MISSING');
-        let committed;
-        if (intent.state === 'passed' || intent.state === 'consumed') {
-            return {
-                ...prepared.result,
-                changed: false,
-                artifactSha256: intent.finalArtifactSha256,
-                semanticDigest: intent.finalSemanticDigest,
-                error: null
-            };
-        }
-        else if (intent.state === 'commit-started') {
-            const reconciled = reconcileArtifactRecovery(prepared.recovery, {
-                lockAlreadyHeld: prepared.lockAlreadyHeld,
-                afterPublish: options.afterPublish
-            });
-            committed = reconciled.intent;
-        }
-        else if (intent.state === 'awaiting-preflight-recovery') {
-            const staged = stageArtifactCandidate(prepared.recovery, Buffer.from(prepared.content, 'utf8'), { lockAlreadyHeld: prepared.lockAlreadyHeld });
-            prepareArtifactRecoveryCommit(prepared.recovery, staged.candidateSha256, staged.semanticDigest, { lockAlreadyHeld: prepared.lockAlreadyHeld });
-            committed = commitArtifactRecovery(prepared.recovery, { lockAlreadyHeld: prepared.lockAlreadyHeld });
-        }
-        if (intent.state === 'preflight-ready' || intent.state === 'preflight-commit-started') {
-            committed = commitArtifactRecovery(prepared.recovery, { lockAlreadyHeld: prepared.lockAlreadyHeld });
-        }
-        if (committed?.state === 'preflight-passed' || intent.state === 'preflight-passed') {
-            prepareArtifactRecoveryFinal(prepared.recovery, Buffer.from(prepared.content, 'utf8'), { lockAlreadyHeld: prepared.lockAlreadyHeld });
-            committed = commitArtifactRecovery(prepared.recovery, { lockAlreadyHeld: prepared.lockAlreadyHeld, afterPublish: options.afterPublish });
-        }
-        else if (intent.state === 'full-finalizer-ready') {
-            committed = commitArtifactRecovery(prepared.recovery, { lockAlreadyHeld: prepared.lockAlreadyHeld, afterPublish: options.afterPublish });
-        }
-        if (!committed || committed.state !== 'passed')
-            throw new Error(`ARTIFACT_RECOVERY_STATE_INVALID: commit ended in '${committed?.state ?? intent.state}'`);
-        return {
-            ...prepared.result,
-            status: 'passed',
-            changed: false,
-            artifactSha256: committed.finalArtifactSha256,
-            semanticDigest: committed.finalSemanticDigest,
-            error: null
-        };
-    }
-    catch (error) {
-        if (error instanceof Error && error.message.startsWith('TASK_WORKFLOW_FAULT_INJECTED:'))
-            throw error;
-        return { ...prepared.result, status: 'failed', error: {
-                code: 'LOCAL_RECOVERY_COMMIT_FAILED', message: String(error)
-            } };
-    }
+function commitLocalArtifactProvenance(prepared) {
+    return prepared.result;
 }
-function finalizeLocalArtifact(request, authority, options = {}) {
-    const prepared = prepareLocalArtifact(request, undefined, authority);
-    const result = commitLocalArtifactProvenance(prepared);
-    if (authority && !options.deferLifecycleRecoveryConsumption && result.status === 'passed') {
-        try {
-            consumeLifecycleRecoveryAttestation(authority);
-        }
-        catch (error) {
-            return { ...result, status: 'failed', error: {
-                    code: 'LOCAL_EXECUTION_AUTHORITY_CONSUME_FAILED',
-                    message: error instanceof Error ? error.message : String(error)
-                } };
-        }
-    }
-    return result;
+function finalizeLocalArtifact(request) {
+    return prepareLocalArtifact(request).result;
 }
 /** Validate and seal an immutable preflight generation without publishing the formal artifact. */
-function preflightLocalArtifact(request, authority) {
-    const prepared = prepareLocalArtifact(request, undefined, authority, true);
+function preflightLocalArtifact(request) {
+    const prepared = prepareLocalArtifact(request);
     return prepared.result;
 }
-export { LOCAL_ARTIFACT_REQUIRED_SECTIONS, consumeLocalArtifactFinalizationIntent, finalizeLocalArtifact, preflightLocalArtifact, prepareLocalArtifact, commitLocalArtifactProvenance, readArtifactRecoveryIntent as readLocalArtifactFinalizationIntent, canonicalSemanticDigest as semanticDigest, sha256Content, validateLocalArtifact };
+export { LOCAL_ARTIFACT_REQUIRED_SECTIONS, finalizeLocalArtifact, preflightLocalArtifact, prepareLocalArtifact, commitLocalArtifactProvenance, canonicalSemanticDigest as semanticDigest, sha256Content, validateLocalArtifact };
 //# sourceMappingURL=local-artifact-finalization.js.map

package/dist/lib/task/manual-validation-receipt.js

@@ -4,6 +4,7 @@ import { createHash } from 'node:crypto';
 import { MANUAL_VALIDATION_ARTIFACT as ARTIFACT, MANUAL_VALIDATION_SHA40 as SHA40, MANUAL_VALIDATION_SHA64 as SHA64, MANUAL_VALIDATION_TASK_ID as TASK_ID, exactKeys, isRecord, validTimestamp, writeJsonAtomic } from './manual-validation-shared.js';
 const MANUAL_VALIDATION_RECEIPT_SCHEMA = 'agent-infra/manual-validation-receipt';
 const MANUAL_VALIDATION_RECEIPT_VERSION = 1;
+const MANUAL_VALIDATION_RECEIPT_PLACEHOLDER = '[[manual-validation-receipt]]';
 function invalid(message) {
     return { ok: false, error: { code: 'MANUAL_VALIDATION_RECEIPT_INVALID', message } };
 }
@@ -33,12 +34,16 @@ function manualValidationFinalSummaryDigest(body) {
     const projection = heading
         ? body.slice(heading.index, heading.index + heading[0].length + (nextSection?.index ?? afterHeading.length)).replace(/\s+$/u, '')
         : body;
-    const preimage = projection.replace(/receipt=(?:[a-f0-9]{64}|<receipt>)/gu, 'receipt=<receipt>');
+    const preimage = projection
+        .replace(/\n*<!--\s*canonical-pr-change-report\s*-->\s*/gu, '')
+        .replace(/<!--\s*manual-validation-receipt:\s*[\s\S]*?-->/gu, MANUAL_VALIDATION_RECEIPT_PLACEHOLDER)
+        .replace(/receipt=(?:[a-f0-9]{64}|<receipt>)/gu, 'receipt=<receipt>');
     return createHash('sha256').update(preimage, 'utf8').digest('hex');
 }
 function manualValidationFinalSummaryProjectionMatches(body, receipt) {
     const identity = `transaction=${receipt.transactionId}; receipt=${receipt.receiptDigest}; evidence=${receipt.evidenceDigest}; head=${receipt.prHeadSha}`;
-    return body.includes(identity) && manualValidationFinalSummaryDigest(body) === receipt.finalSummaryDigest;
+    return (body.includes(identity) || body.includes(MANUAL_VALIDATION_RECEIPT_PLACEHOLDER))
+        && manualValidationFinalSummaryDigest(body) === receipt.finalSummaryDigest;
 }
 function validateManualValidationReceipt(value, expected) {
     if (!isRecord(value))
@@ -101,5 +106,5 @@ function readManualValidationReceipt(taskDir, expected) {
     }
     return validateManualValidationReceipt(value, expected);
 }
-export { MANUAL_VALIDATION_RECEIPT_SCHEMA, MANUAL_VALIDATION_RECEIPT_VERSION, createManualValidationReceipt, manualValidationFinalSummaryDigest, manualValidationFinalSummaryProjectionMatches, manualValidationReceiptDigest, manualValidationReceiptPath, readManualValidationReceipt, validateManualValidationReceipt, writeManualValidationReceiptAtomic };
+export { MANUAL_VALIDATION_RECEIPT_SCHEMA, MANUAL_VALIDATION_RECEIPT_VERSION, MANUAL_VALIDATION_RECEIPT_PLACEHOLDER, createManualValidationReceipt, manualValidationFinalSummaryDigest, manualValidationFinalSummaryProjectionMatches, manualValidationReceiptDigest, manualValidationReceiptPath, readManualValidationReceipt, validateManualValidationReceipt, writeManualValidationReceiptAtomic };
 //# sourceMappingURL=manual-validation-receipt.js.map

package/dist/lib/task/orchestration.js

@@ -682,16 +682,6 @@ function prepareOrchestrationDelegationUnlocked(taskRef, input, options = {}) {
     if (!validModel(input.requestedReasoningEffort)) {
         return failed('ORCHESTRATION_REQUESTED_REASONING_EFFORT_REQUIRED', 'prepare requires the exact requested reasoning effort', resolved.taskId);
     }
-    if (input.client === 'codex' && !input.lifecycleProvenance) {
-        return failed('ORCHESTRATION_CODEX_PROVENANCE_REQUIRED', 'Codex prepare requires lifecycle provenance', resolved.taskId);
-    }
-    if (input.lifecycleRecoveryAttestation
-        && (input.lifecycleRecoveryAttestation.phase !== 'orchestration.prepare'
-            || input.lifecycleRecoveryAttestation.taskId !== resolved.taskId
-            || input.lifecycleRecoveryAttestation.artifact !== next.artifact
-            || input.lifecycleRecoveryAttestation.round !== next.round)) {
-        return failed('LIFECYCLE_AUTHORITY_TUPLE_MISMATCH', 'orchestration authority does not match the routed stage', resolved.taskId);
-    }
     const expectedPolicy = run.modelPolicy[next.role];
     if (input.requestedModel !== expectedPolicy.model) {
         return failed('ORCHESTRATION_REQUESTED_MODEL_MISMATCH', `requested model does not match the persisted ${next.role} model`, resolved.taskId);
@@ -699,10 +689,6 @@ function prepareOrchestrationDelegationUnlocked(taskRef, input, options = {}) {
     if (input.requestedReasoningEffort !== expectedPolicy.reasoningEffort) {
         return failed('ORCHESTRATION_REQUESTED_REASONING_EFFORT_MISMATCH', `requested reasoning effort does not match the persisted ${next.role} policy`, resolved.taskId);
     }
-    const capabilityValidationError = options.validateLifecycleCapability?.();
-    if (capabilityValidationError) {
-        return failed(capabilityValidationError.code, capabilityValidationError.message, resolved.taskId, capabilityValidationError.detail ? { detail: capabilityValidationError.detail } : {});
-    }
     let beforeFingerprint;
     try {
         beforeFingerprint = (options.captureWorkspace ?? captureWorkspaceSnapshot)({
@@ -728,10 +714,6 @@ function prepareOrchestrationDelegationUnlocked(taskRef, input, options = {}) {
         lifecycleProvenance: input.lifecycleProvenance ?? null,
         beforeFingerprint
     }, { id: options.id, now: options.now, monotonicNow: options.monotonicNow });
-    const capabilityError = options.consumeLifecycleCapability?.();
-    if (capabilityError) {
-        return failed(capabilityError.code, capabilityError.message, resolved.taskId, capabilityError.detail ? { detail: capabilityError.detail } : {});
-    }
     const updated = withUpdatedRun(run, {
         nextStage: next.stage,
         pendingDelegation: receipt
@@ -1093,6 +1075,14 @@ function recoverPreparedOrchestrationDelegation(taskRef, options = {}) {
         return failed('ORCHESTRATION_PREPARED_RECOVERY_FAILED', error instanceof Error ? error.message : String(error), resolved.taskId);
     }
 }
+function recoveryReceiptMatches(receipt, taskId, event) {
+    return receipt.taskId === taskId
+        && receipt.stage === event.stage
+        && receipt.round === event.round
+        && receipt.artifact === event.artifact
+        && receipt.childId === event.childId
+        && normalizeAgentToken(event.startedAgent) === normalizeAgentToken(receipt.client);
+}
 function recoverActivatedOrchestrationDelegationUnderLock(taskRef, event, options = {}) {
     const resolved = resolveTaskRef(taskRef, { repoRoot: options.repoRoot });
     if (!resolved.ok)
@@ -1107,12 +1097,7 @@ function recoverActivatedOrchestrationDelegationUnderLock(taskRef, event, option
     const receipt = matches.find((candidate) => candidate.id === event.receiptId);
     if (!receipt)
         return failed('ORCHESTRATION_DELEGATION_MISSING', 'recovery receipt does not exist', resolved.taskId);
-    if (receipt.taskId !== resolved.taskId
-        || receipt.stage !== event.stage
-        || receipt.round !== event.round
-        || receipt.artifact !== event.artifact
-        || receipt.childId !== event.childId
-        || normalizeAgentToken(event.startedAgent) !== normalizeAgentToken(receipt.client)) {
+    if (!recoveryReceiptMatches(receipt, resolved.taskId, event)) {
         return failed('ORCHESTRATION_PROVENANCE_MISMATCH', 'recovery selector does not match the delegation receipt', resolved.taskId);
     }
     if (receipt.status === 'aborted' && run.pendingDelegation === null) {
@@ -1124,6 +1109,9 @@ function recoverActivatedOrchestrationDelegationUnderLock(taskRef, event, option
     if (run.receipts.some((candidate) => candidate.id === receipt.id)) {
         return failed('ORCHESTRATION_RECEIPT_DUPLICATE', 'recovery receipt already exists in the completed receipt history', resolved.taskId);
     }
+    if (run.status !== 'running' || run.pause !== null) {
+        return failed('ORCHESTRATION_RECOVERY_UNSAFE', 'activated recovery cannot replace an unrelated orchestration pause', resolved.taskId);
+    }
     const aborted = abortActivatedDelegation(receipt, {
         childId: event.childId,
         stopRevision: event.stopRevision,

package/dist/lib/task/review-command.js

@@ -4,7 +4,6 @@ export function parseReviewCommand(args) {
     const values = {};
     const flags = {
         '--stage': 'stage', '--artifact': 'artifact', '--orchestrated': 'orchestrated', '--dry-run': 'dryRun',
-        '--recovery-id': 'recoveryId',
         '--override-ticket': 'overrideTicket', '--override-target': 'overrideTarget', '--override-scope': 'overrideScope'
     };
     for (let index = 2; index < args.length; index += 1) {