@fitlab-ai/agent-infra 0.11.11 → 0.11.13

package/dist/lib/task/control-authority.js

@@ -1,223 +1,13 @@
 import path from 'node:path';
-import crypto from 'node:crypto';
 import { normalizeAgentToken } from '../agent-clients/tokens.js';
 import { isAgentClientId } from '../agent-clients/types.js';
 import { getAgentClientAdapter } from '../agent-clients/registry.js';
 import { activateMatchingOrchestrationDelegation, activateOrchestrationDelegation, advanceOrchestration, awaitOrchestrationDelegationActivation, beginOrResumeOrchestration, dispatchOrchestrationDelegation, OrchestrationStateError, pauseOrchestration, prepareOrchestrationDelegation, recoverPreparedOrchestrationDelegation, routeOrchestration, sealMatchingOrchestrationDelegation, sealOrchestrationDelegation, statusOrchestration } from './orchestration.js';
 import { applyTaskFinalization } from './finalization.js';
-import { applyTaskLifecycle, taskLifecycleFailure } from './lifecycle.js';
-import { resolveTaskRef, TASK_ID_RE } from './resolve-ref.js';
+import { applyTaskLifecycle, applyTaskLifecycleWithinTaskLock, taskLifecycleFailure } from './lifecycle.js';
+import { resolveTaskContext, resolveTaskRef, TASK_ID_RE } from './resolve-ref.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.js';
 import { verifyTaskEvent } from './verification.js';
-import { createCodexCapabilityStore } from '../agent-clients/adapters/codex-lifecycle/capability-store.js';
-import { computeLifecycleBuildIdentity } from '../agent-clients/adapters/codex-lifecycle/build-identity.js';
-const lifecycleAuthorityPhases = [
-    'orchestration.prepare', 'artifact.finalize-local', 'task-event.completed'
-];
-const lifecycleAuthorityFamilies = ['analysis', 'plan', 'code'];
-const lifecycleAuthorityArtifact = /^(?:analysis|plan|code)(?:-r[1-9]\d*)?\.md$/u;
-const lifecycleAuthorityDigest = (value) => crypto.createHash('sha256').update(value, 'utf8').digest('hex');
-const lifecycleAuthorityBuildDigest = (value) => lifecycleAuthorityDigest(JSON.stringify(value));
-export function lifecycleRecoveryAttestationDigest(value) {
-    return lifecycleAuthorityDigest(JSON.stringify(value));
-}
-function authorityExactKeys(value, keys) {
-    return Object.keys(value).sort().join(',') === [...keys].sort().join(',');
-}
-export function validateLifecycleAuthorityRequest(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        throw new Error('LIFECYCLE_AUTHORITY_REQUEST_INVALID');
-    const request = value;
-    if (!authorityExactKeys(request, [
-        'artifact', 'authorityRef', 'expectedBuildIdentityDigest', 'expectedControlGeneration',
-        'expectedControllerInstanceDigest', 'expectedHookDefinitionHash', 'family', 'lifecycleRequestId',
-        'operationId', 'phase', 'requestId', 'round', 'taskId', 'version'
-    ])
-        || request.version !== 1
-        || typeof request.requestId !== 'string' || !/^[a-f0-9-]{16,64}$/u.test(request.requestId)
-        || typeof request.operationId !== 'string' || !/^[a-f0-9-]{16,64}$/u.test(request.operationId)
-        || !lifecycleAuthorityPhases.includes(request.phase)
-        || typeof request.taskId !== 'string' || !/^TASK-\d{8}-\d{6}$/u.test(request.taskId)
-        || !lifecycleAuthorityFamilies.includes(request.family)
-        || typeof request.artifact !== 'string' || !lifecycleAuthorityArtifact.test(request.artifact)
-        || !Number.isSafeInteger(request.round) || request.round < 1
-        || typeof request.lifecycleRequestId !== 'string' || !request.lifecycleRequestId || /[\r\n]/u.test(request.lifecycleRequestId)
-        || typeof request.authorityRef !== 'string' || !request.authorityRef || /[\r\n]/u.test(request.authorityRef)
-        || typeof request.expectedControlGeneration !== 'string' || !request.expectedControlGeneration
-        || typeof request.expectedControllerInstanceDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(request.expectedControllerInstanceDigest)
-        || typeof request.expectedBuildIdentityDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(request.expectedBuildIdentityDigest)
-        || typeof request.expectedHookDefinitionHash !== 'string' || !/^[a-f0-9]{64}$/u.test(request.expectedHookDefinitionHash)) {
-        throw new Error('LIFECYCLE_AUTHORITY_REQUEST_INVALID');
-    }
-    const expectedArtifactFamily = request.artifact;
-    if (!expectedArtifactFamily.startsWith(request.family))
-        throw new Error('LIFECYCLE_AUTHORITY_REQUEST_INVALID');
-    return request;
-}
-export function validateLifecycleRecoveryAttestation(value, now = Date.now()) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        throw new Error('LIFECYCLE_AUTHORITY_ATTESTATION_INVALID');
-    const attestation = value;
-    if (!authorityExactKeys(attestation, [
-        'artifact', 'attestationId', 'authorityRefDigest', 'buildIdentityDigest', 'controlGeneration',
-        'controllerInstanceDigest', 'expiresAt', 'family', 'hookDefinitionHash', 'issuedAt',
-        'lifecycleRequestId', 'operationId', 'phase', 'requestId', 'round', 'sessionId',
-        'taskId', 'toolUseId', 'turnId', 'version'
-    ])
-        || attestation.version !== 1
-        || typeof attestation.attestationId !== 'string' || !/^[a-f0-9-]{16,64}$/u.test(attestation.attestationId)
-        || typeof attestation.authorityRefDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(attestation.authorityRefDigest)
-        || typeof attestation.operationId !== 'string' || !/^[a-f0-9-]{16,64}$/u.test(attestation.operationId)
-        || !lifecycleAuthorityPhases.includes(attestation.phase)
-        || typeof attestation.requestId !== 'string' || !/^[a-f0-9-]{16,64}$/u.test(attestation.requestId)
-        || typeof attestation.lifecycleRequestId !== 'string' || !attestation.lifecycleRequestId
-        || typeof attestation.taskId !== 'string' || !/^TASK-\d{8}-\d{6}$/u.test(attestation.taskId)
-        || !lifecycleAuthorityFamilies.includes(attestation.family)
-        || typeof attestation.artifact !== 'string' || !lifecycleAuthorityArtifact.test(attestation.artifact)
-        || !Number.isSafeInteger(attestation.round) || attestation.round < 1
-        || typeof attestation.controlGeneration !== 'string' || !attestation.controlGeneration
-        || typeof attestation.controllerInstanceDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(attestation.controllerInstanceDigest)
-        || typeof attestation.sessionId !== 'string' || !attestation.sessionId
-        || typeof attestation.turnId !== 'string' || !attestation.turnId
-        || typeof attestation.toolUseId !== 'string' || !attestation.toolUseId
-        || typeof attestation.buildIdentityDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(attestation.buildIdentityDigest)
-        || typeof attestation.hookDefinitionHash !== 'string' || !/^[a-f0-9]{64}$/u.test(attestation.hookDefinitionHash)
-        || !Number.isSafeInteger(attestation.issuedAt) || !Number.isSafeInteger(attestation.expiresAt)
-        || attestation.expiresAt <= attestation.issuedAt
-        || attestation.expiresAt <= now) {
-        throw new Error('LIFECYCLE_AUTHORITY_ATTESTATION_INVALID');
-    }
-    return attestation;
-}
-const authorityOperationMap = new WeakMap();
-const authorityRecords = new Map();
-const consumedAuthorityPhases = new Set();
-export function issueLifecycleRecoveryAttestation(input, options = {}) {
-    let request;
-    try {
-        request = validateLifecycleAuthorityRequest(input);
-    }
-    catch (error) {
-        return { version: 1, requestId: String(input?.requestId ?? ''), operationId: String(input?.operationId ?? ''), phase: input?.phase ?? 'artifact.finalize-local', status: 'rejected', attestation: null, error: { code: 'LIFECYCLE_AUTHORITY_REQUEST_INVALID', message: error instanceof Error ? error.message : String(error) } };
-    }
-    const binding = options.controllerBinding ?? null;
-    if (!binding)
-        return authorityRejected(request, 'LOCAL_EXECUTION_AUTHORITY_UNAVAILABLE', 'current controller authority is unavailable');
-    if (binding.controlGeneration !== request.expectedControlGeneration
-        || binding.instanceDigest !== request.expectedControllerInstanceDigest) {
-        return authorityRejected(request, 'LIFECYCLE_AUTHORITY_CONTROLLER_MISMATCH', 'current controller binding does not match the request');
-    }
-    const buildIdentity = options.buildIdentity ?? computeLifecycleBuildIdentity(process.cwd());
-    if (lifecycleAuthorityBuildDigest(buildIdentity) !== request.expectedBuildIdentityDigest) {
-        return authorityRejected(request, 'LIFECYCLE_AUTHORITY_BUILD_MISMATCH', 'current lifecycle build does not match the request');
-    }
-    const store = options.capabilityStore ?? createCodexCapabilityStore();
-    const registry = options.operationAttestations ?? authorityOperationMap.get(store) ?? new Map();
-    authorityOperationMap.set(store, registry);
-    const key = `${request.requestId}\0${request.operationId}\0${request.phase}`;
-    const prior = registry.get(key);
-    if (prior)
-        return { version: 1, requestId: request.requestId, operationId: request.operationId, phase: request.phase, status: 'already-completed', attestation: prior, error: null };
-    try {
-        const expected = {
-            taskId: request.taskId,
-            hookDefinitionHash: request.expectedHookDefinitionHash,
-            buildIdentity,
-            controller: binding
-        };
-        const record = store.reserveReference(request.authorityRef, request.operationId, expected);
-        if (!record.sessionId || !record.turnId || !record.toolUseId)
-            throw new Error('CODEX_CAPABILITY_IDENTITY_INVALID: capability hook attestation is incomplete');
-        const now = (options.now ?? Date.now)();
-        const attestation = validateLifecycleRecoveryAttestation({
-            version: 1,
-            attestationId: crypto.randomUUID(),
-            authorityRefDigest: lifecycleAuthorityDigest(request.authorityRef),
-            operationId: request.operationId,
-            phase: request.phase,
-            requestId: request.requestId,
-            lifecycleRequestId: request.lifecycleRequestId,
-            taskId: request.taskId,
-            family: request.family,
-            artifact: request.artifact,
-            round: request.round,
-            controlGeneration: binding.controlGeneration,
-            controllerInstanceDigest: binding.instanceDigest,
-            sessionId: record.sessionId,
-            turnId: record.turnId,
-            toolUseId: record.toolUseId,
-            buildIdentityDigest: lifecycleAuthorityBuildDigest(buildIdentity),
-            hookDefinitionHash: request.expectedHookDefinitionHash,
-            issuedAt: now,
-            expiresAt: Math.min(record.expiresAt, now + 30_000)
-        }, now);
-        store.reserveRecoveryPhase(request.authorityRef, request.operationId, request.phase, request.requestId, expected);
-        registry.set(key, attestation);
-        authorityRecords.set(attestation.attestationId, { store, capabilityRef: request.authorityRef, expected });
-        return { version: 1, requestId: request.requestId, operationId: request.operationId, phase: request.phase, status: 'issued', attestation, error: null };
-    }
-    catch (error) {
-        return authorityRejected(request, error instanceof Error && error.name.startsWith('CODEX_') ? error.name : 'LIFECYCLE_AUTHORITY_REJECTED', error instanceof Error ? error.message : String(error));
-    }
-}
-export function consumeLifecycleRecoveryAttestation(value, now = Date.now()) {
-    const attestation = validateLifecycleRecoveryAttestation(value, now);
-    if (consumedAuthorityPhases.has(attestation.attestationId))
-        return;
-    const record = authorityRecords.get(attestation.attestationId);
-    if (!record)
-        throw new Error('LIFECYCLE_AUTHORITY_ATTESTATION_UNKNOWN');
-    record.store.consumeRecoveryPhase(record.capabilityRef, attestation.operationId, attestation.phase, attestation.requestId, record.expected);
-    if (attestation.phase === 'task-event.completed') {
-        record.store.consumeReference(record.capabilityRef, attestation.operationId, record.expected);
-    }
-    consumedAuthorityPhases.add(attestation.attestationId);
-}
-export function queryLifecycleRecoveryOperation(operationId, options = {}) {
-    if (!/^[a-f0-9-]{16,64}$/u.test(operationId)) {
-        throw new Error('LIFECYCLE_RECOVERY_OPERATION_INVALID');
-    }
-    const store = options.capabilityStore ?? createCodexCapabilityStore();
-    const registry = authorityOperationMap.get(store);
-    const known = [...(registry?.values() ?? [])].filter((value) => value.operationId === operationId);
-    const capabilities = store.findByRecoveryOperation(operationId);
-    const phaseMap = new Map();
-    for (const capability of capabilities) {
-        for (const phase of capability.recoveryPhases) {
-            phaseMap.set(`${phase.phase}\0${phase.requestId}`, {
-                phase: phase.phase,
-                requestId: phase.requestId,
-                attestationId: null,
-                state: phase.state === 'consumed' ? 'consumed' : 'observed'
-            });
-        }
-    }
-    for (const attestation of known) {
-        const key = `${attestation.phase}\0${attestation.requestId}`;
-        const durable = phaseMap.get(key);
-        phaseMap.set(key, {
-            phase: attestation.phase,
-            requestId: attestation.requestId,
-            attestationId: attestation.attestationId,
-            state: durable?.state === 'consumed' || consumedAuthorityPhases.has(attestation.attestationId)
-                ? 'consumed' : 'issued'
-        });
-    }
-    const capabilityState = capabilities.some((record) => record.recoveryState === 'consumed')
-        ? 'consumed'
-        : capabilities.some((record) => record.recoveryState === 'reserved') ? 'reserved' : 'unknown';
-    const committed = capabilityState === 'consumed';
-    return {
-        version: 1,
-        operationId,
-        status: committed ? 'committed' : capabilityState === 'reserved' || phaseMap.size > 0 ? 'in-progress' : 'unknown',
-        capabilityState,
-        phases: Object.freeze([...phaseMap.values()])
-    };
-}
-function authorityRejected(request, code, message) {
-    return { version: 1, requestId: request.requestId, operationId: request.operationId, phase: request.phase, status: 'rejected', attestation: null, error: { code, message } };
-}
 export function taskControlOperationKey(operation) {
     if (operation.family === 'task-finalization')
         return 'complete';
@@ -250,10 +40,6 @@ export function createDirectHostExecutionContext(params) {
         repoRoot: absolute('repoRoot', params.repoRoot),
         ...(params.runtimeDir === undefined ? {} : { runtimeDir: absolute('runtimeDir', params.runtimeDir) }),
         ...(params.controllerBinding === undefined ? {} : { controllerBinding: binding(params.controllerBinding) }),
-        ...(params.lifecycleRecoveryAttestation === undefined ? {} : {
-            lifecycleRecoveryAttestation: params.lifecycleRecoveryAttestation === null
-                ? null : validateLifecycleRecoveryAttestation(params.lifecycleRecoveryAttestation)
-        })
     };
 }
 export function createSandboxExecutorExecutionContext(params) {
@@ -275,10 +61,6 @@ export function createSandboxExecutorExecutionContext(params) {
         manifestPath: absolute('manifestPath', params.manifestPath),
         requestId: params.requestId,
         ...(params.controllerBinding === undefined ? {} : { controllerBinding: binding(params.controllerBinding) }),
-        ...(params.lifecycleRecoveryAttestation === undefined ? {} : {
-            lifecycleRecoveryAttestation: params.lifecycleRecoveryAttestation === null
-                ? null : validateLifecycleRecoveryAttestation(params.lifecycleRecoveryAttestation)
-        })
     };
 }
 export function assertTaskControlExecutionContext(context) {
@@ -289,8 +71,6 @@ export function assertTaskControlExecutionContext(context) {
         if (context.runtimeDir !== undefined)
             absolute('runtimeDir', context.runtimeDir);
         binding(context.controllerBinding);
-        if (context.lifecycleRecoveryAttestation)
-            validateLifecycleRecoveryAttestation(context.lifecycleRecoveryAttestation);
         return;
     }
     if (context.mode !== 'task-bound-sandbox' || !/^TASK-\d{8}-\d{6}$/u.test(context.taskId)
@@ -305,13 +85,17 @@ export function assertTaskControlExecutionContext(context) {
         invalidContext('runtimeDir is not bound to the manifest control root');
     }
     binding(context.controllerBinding);
-    if (context.lifecycleRecoveryAttestation)
-        validateLifecycleRecoveryAttestation(context.lifecycleRecoveryAttestation);
 }
-function operationTaskId(context, taskRef) {
-    if (context.source === 'sandbox-executor' && taskRef !== context.taskId) {
-        throw new Error('TASK_CONTROL_CONTEXT_TASK_MISMATCH: operation task does not match the sandbox manifest');
-    }
+function boundTaskRef(context, taskRef) {
+    return context.source === 'sandbox-executor' ? context.taskId : taskRef;
+}
+function autoTaskOptions(context, options) {
+    if (context.source === 'sandbox-executor')
+        return { ...options, taskId: context.taskId };
+    const resolved = resolveTaskContext(undefined, { repoRoot: context.repoRoot });
+    if (!resolved.ok)
+        throw new Error(`${resolved.code}: ${resolved.message}`);
+    return { ...options, taskId: resolved.taskId };
 }
 function domainOptions(context, options) {
     return {
@@ -331,7 +115,7 @@ function lifecycleTaskId(request, repoRoot) {
     }
 }
 async function applyLifecycleWithAuthority(context, request) {
-    const execute = async () => {
+    const execute = async (underTaskLock = false) => {
         if (request.intent === 'recover-started') {
             const adapter = isAgentClientId(request.agent)
                 ? getAgentClientAdapter(request.agent).orchestrationAdapter
@@ -345,13 +129,15 @@ async function applyLifecycleWithAuthority(context, request) {
             }
             return adapter.recoverStarted(request, { repoRoot: context.repoRoot });
         }
-        return applyTaskLifecycle(request, { repoRoot: context.repoRoot });
+        return underTaskLock
+            ? applyTaskLifecycleWithinTaskLock(request, { repoRoot: context.repoRoot }, taskId)
+            : applyTaskLifecycle(request, { repoRoot: context.repoRoot });
     };
     const taskId = lifecycleTaskId(request, context.repoRoot);
     if (!taskId)
         return await execute();
     try {
-        return await withTaskExecutionLock(context.repoRoot, taskId, `task-lifecycle.${request.intent}`, execute);
+        return await withTaskExecutionLock(context.repoRoot, taskId, `task-lifecycle.${request.intent}`, () => execute(true));
     }
     catch (error) {
         if (!(error instanceof TaskExecutionLockError))
@@ -368,52 +154,52 @@ async function applyLifecycleWithAuthority(context, request) {
     }
 }
 function orchestration(context, operation) {
-    operationTaskId(context, operation.taskRef);
+    const taskRef = boundTaskRef(context, operation.taskRef);
     const input = operation.input;
     const options = domainOptions(context, operation.options);
     switch (operation.intent) {
         case 'begin-or-resume':
-            return beginOrResumeOrchestration(operation.taskRef, {
+            return beginOrResumeOrchestration(taskRef, {
                 ...options,
                 client: input.client,
                 maxSteps: input.maxSteps,
                 modelPolicy: input.modelPolicy
             });
-        case 'route': return routeOrchestration(operation.taskRef, options);
-        case 'status': return statusOrchestration(operation.taskRef, options);
-        case 'prepare': {
-            const prepareInput = {
-                client: input.client,
-                requestedModel: input.requestedModel,
-                requestedReasoningEffort: input.requestedReasoningEffort,
-            };
-            const prepareDelegation = getAgentClientAdapter(prepareInput.client)
-                .orchestrationAdapter?.prepareDelegation;
-            if (prepareDelegation) {
-                return prepareDelegation(operation.taskRef, prepareInput, {
-                    repoRoot: context.repoRoot,
-                    orchestrationOptions: options,
-                });
-            }
-            return prepareOrchestrationDelegation(operation.taskRef, prepareInput, options);
-        }
-        case 'dispatch': return dispatchOrchestrationDelegation(operation.taskRef, options);
+        case 'route': return routeOrchestration(taskRef, options);
+        case 'status': return statusOrchestration(taskRef, options);
+        case 'prepare': return prepareTaskOrchestration(context, { ...operation, taskRef }, options);
+        case 'dispatch': return dispatchOrchestrationDelegation(taskRef, options);
         case 'await-activation':
-            return awaitOrchestrationDelegationActivation(operation.taskRef, input.event, options);
-        case 'recover-prepared': return recoverPreparedOrchestrationDelegation(operation.taskRef, options);
+            return awaitOrchestrationDelegationActivation(taskRef, input.event, options);
+        case 'recover-prepared': return recoverPreparedOrchestrationDelegation(taskRef, options);
         case 'hook-start':
             return input.auto === true
-                ? activateMatchingOrchestrationDelegation(input.client, input.event, options)
-                : activateOrchestrationDelegation(operation.taskRef, input.event, options);
+                ? activateMatchingOrchestrationDelegation(input.client, input.event, autoTaskOptions(context, options))
+                : activateOrchestrationDelegation(taskRef, input.event, options);
         case 'hook-stop':
             return input.auto === true
-                ? sealMatchingOrchestrationDelegation(input.client, input.event, options)
-                : sealOrchestrationDelegation(operation.taskRef, input.event, options);
-        case 'advance': return advanceOrchestration(operation.taskRef, options);
+                ? sealMatchingOrchestrationDelegation(input.client, input.event, autoTaskOptions(context, options))
+                : sealOrchestrationDelegation(taskRef, input.event, undefined, options);
+        case 'advance': return advanceOrchestration(taskRef, options);
         case 'pause':
-            return pauseOrchestration(operation.taskRef, input.code, input.message, input.recoverable, options);
+            return pauseOrchestration(taskRef, input.code, input.message, input.recoverable, options);
     }
 }
+function prepareTaskOrchestration(context, operation, options) {
+    const input = operation.input;
+    const prepareInput = {
+        client: input.client,
+        requestedModel: input.requestedModel,
+        requestedReasoningEffort: input.requestedReasoningEffort,
+    };
+    const prepareDelegation = getAgentClientAdapter(prepareInput.client).orchestrationAdapter?.prepareDelegation;
+    return prepareDelegation
+        ? prepareDelegation(operation.taskRef, prepareInput, {
+            repoRoot: context.repoRoot,
+            orchestrationOptions: options,
+        })
+        : prepareOrchestrationDelegation(operation.taskRef, prepareInput, options);
+}
 function orchestrationFailure(error) {
     if (error instanceof OrchestrationStateError) {
         return {
@@ -427,12 +213,16 @@ export function dispatchTaskControlOperation(context, operation) {
     assertTaskControlExecutionContext(context);
     assertTaskControlOperation(operation);
     if (operation.family === 'task-lifecycle') {
-        operationTaskId(context, operation.request.taskRef);
-        return applyLifecycleWithAuthority(context, operation.request);
+        return applyLifecycleWithAuthority(context, {
+            ...operation.request,
+            taskRef: boundTaskRef(context, operation.request.taskRef)
+        });
     }
     if (operation.family === 'task-finalization') {
-        operationTaskId(context, operation.request.taskRef);
-        return applyTaskFinalization(operation.request, {
+        return applyTaskFinalization({
+            ...operation.request,
+            taskRef: boundTaskRef(context, operation.request.taskRef)
+        }, {
             repoRoot: context.repoRoot,
             ...(context.source === 'sandbox-executor' ? {
                 controlBinding: { generation: context.generation, requestId: context.requestId },
@@ -530,6 +320,8 @@ export function parseTaskControlOperation(family, args) {
     const taskRef = args[0];
     const intent = args[1];
     if (family === 'task-lifecycle') {
+        if (intent === 'complete')
+            operationInvalid('complete must use task-finalization');
         const values = parseValues(args, 2, LIFECYCLE_FLAGS);
         const agent = normalizeAgentToken(value(values, '--agent') ?? '');
         if (!agent)

package/dist/lib/task/control-recovery.js

@@ -16,12 +16,11 @@ export function parseControlOutput(output) {
 export const SANDBOX_CONTROL_REQUIRED_COMPLETION_PHASES = Object.freeze([
     'completed', 'evidence-written', 'publish-authorized'
 ]);
-const LIFECYCLE_INTENTS = ['block', 'activate', 'cancel', 'complete', 'close-codescan', 'close-dependabot', 'restore', 'recover-started'];
+const LIFECYCLE_INTENTS = ['block', 'activate', 'cancel', 'close-codescan', 'close-dependabot', 'restore', 'recover-started'];
 export const SANDBOX_CONTROL_RECOVERY_OPERATIONS = Object.freeze([
     ...LIFECYCLE_INTENTS.map((intent) => ({ family: 'task-lifecycle', intent, class: 'lifecycle-mutation' })),
-    { family: 'task-finalization', intent: 'complete', class: 'finalization' },
     { family: 'task-create', intent: 'create', class: 'task-create' },
-    ...['open', 'close', 'verify'].map((intent) => ({ family: 'codex-controller', intent, class: 'codex-controller' }))
+    ...['controller.close', 'controller.verify'].map((intent) => ({ family: 'agent-client', intent, class: 'agent-client-operation' }))
 ]);
 export function digestControlRecoveryIntent(family, intent) {
     return createHash('sha256').update(`${family}\0${intent}`, 'utf8').digest('hex');

package/dist/lib/task/create.js

@@ -10,7 +10,7 @@ import { buildUnboundFact, encodePrDeliveryFact } from './pr-delivery-fact.js';
 import { CANDIDATE_COLUMNS, CONSTRAINT_COLUMNS, parseTaskQualification } from './qualification-audit.js';
 import { enumerateAllTaskDirs } from './resolve-ref.js';
 import { parseTaskFrontmatter } from './frontmatter.js';
-const AGENTS = ['claude', 'codex', 'antigravity', 'opencode', 'cursor'];
+import { AGENT_TOKEN_VALUES } from '../agent-clients/tokens.js';
 const TYPES = ['feature', 'bugfix', 'refactor', 'docs', 'chore'];
 const PRIORITIES = ['Urgent', 'High', 'Medium', 'Low'];
 const EFFORTS = ['High', 'Medium', 'Low'];
@@ -91,7 +91,7 @@ function validateTaskCreateCandidate(value) {
     return {
         version: 1,
         idempotencyKey,
-        agent: enumValue(candidate.agent, AGENTS, 'agent'),
+        agent: enumValue(candidate.agent, AGENT_TOKEN_VALUES, 'agent'),
         title,
         type: enumValue(candidate.type, TYPES, 'type'),
         branchSlug,