@fitlab-ai/agent-infra 0.11.11 → 0.11.13

package/dist/lib/task/runtime-paths.js

@@ -0,0 +1,10 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { resolveTaskRef } from './resolve-ref.js';
+export function resolveTaskRuntimeRoot(taskRef, options = {}) {
+    const resolved = resolveTaskRef(taskRef, options);
+    if (!resolved.ok)
+        throw new Error(`${resolved.code}: ${resolved.message}`);
+    return path.join(fs.realpathSync.native(resolved.taskDir), '.runtime');
+}
+//# sourceMappingURL=runtime-paths.js.map

package/dist/lib/task/short-id.js

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { parseTypedTaskFrontmatter } from './frontmatter.js';
 const REGISTRY_NAME = '.short-ids.json';
 const LOCK_NAME = '.short-ids.json.lock';
 function normalizeShortIdInput(input, opts) {
@@ -90,20 +91,33 @@ function resolveShortIdReadOnly(input, repoRoot, opts) {
     const taskId = ids[key];
     if (!taskId) {
         const message = Object.keys(ids).length === 0
-            ? `short id '${key}' not found; active task registry is empty.`
-            : `short id '${key}' not found in active task registry (it may have been cleaned up after archival; check 'task-short-id.js list').`;
+            ? `short id '${key}' not found; task short-id registry is empty.`
+            : `short id '${key}' not found in task short-id registry.`;
         return shortIdFailure('SHORT_ID_NOT_FOUND', message);
     }
-    const taskMdPath = path.join(repoRoot, '.agents', 'workspace', 'active', taskId, 'task.md');
-    if (!fs.existsSync(taskMdPath)) {
-        const remainingActiveEntries = Object.values(ids).filter((candidateTaskId) => fs.existsSync(path.join(repoRoot, '.agents', 'workspace', 'active', candidateTaskId, 'task.md')));
-        const message = remainingActiveEntries.length === 0
-            ? `short id '${key}' not found; active task registry is empty.`
-            : `short id '${key}' not found in active task registry (it may have been cleaned up after archival; check 'task-short-id.js list').`;
-        return shortIdFailure('SHORT_ID_STALE', message, taskId);
+    const activeTask = path.join(repoRoot, '.agents', 'workspace', 'active', taskId, 'task.md');
+    const completedTask = path.join(repoRoot, '.agents', 'workspace', 'completed', taskId, 'task.md');
+    let isValidCompletedTask = false;
+    try {
+        const task = parseTypedTaskFrontmatter(fs.readFileSync(completedTask, 'utf8'));
+        isValidCompletedTask = task.id === taskId && task.status === 'completed';
+    }
+    catch { /* a mapping is valid only while its task content is present */ }
+    if (!fs.existsSync(activeTask) && !isValidCompletedTask) {
+        return shortIdFailure('SHORT_ID_STALE', `short id '${key}' points to no active or completed task content.`, taskId);
     }
     return { ok: true, taskId };
 }
+function hasRetainedCompletedTask(activeDir, taskId) {
+    try {
+        const taskPath = path.join(path.dirname(activeDir), 'completed', taskId, 'task.md');
+        const task = parseTypedTaskFrontmatter(fs.readFileSync(taskPath, 'utf8'));
+        return task.id === taskId && task.status === 'completed';
+    }
+    catch {
+        return false;
+    }
+}
 function configuredShortIdLength(repoRoot) {
     try {
         const config = JSON.parse(fs.readFileSync(path.join(repoRoot, '.agents', '.airc.json'), 'utf8'));
@@ -206,7 +220,8 @@ function mutateShortIdRegistryAt(activeDir, width, taskId, requested, onlyReleas
         const original = JSON.stringify(registry.ids);
         if (pruneOrphans) {
             for (const [key, candidate] of Object.entries(registry.ids)) {
-                if (candidate !== taskId && !fs.existsSync(path.join(activeDir, candidate, 'task.md')))
+                if (candidate !== taskId && !fs.existsSync(path.join(activeDir, candidate, 'task.md'))
+                    && !hasRetainedCompletedTask(activeDir, candidate))
                     delete registry.ids[key];
             }
         }
@@ -277,34 +292,29 @@ function executeShortIdCommand(request) {
             if (normalized.kind !== 'shortId') {
                 throw Object.assign(new Error(`invalid short id format '${request.argument}'`), { code: 'SHORT_ID_FORMAT_INVALID' });
             }
-            return withRegistryLock(request.activeDir, () => {
-                const registry = readRegistryStrict(registryPath, request.shortIdLength);
-                let changed = false;
-                for (const [key, taskId] of Object.entries(registry.ids)) {
-                    if (!fs.existsSync(path.join(request.activeDir, taskId, 'task.md'))) {
-                        delete registry.ids[key];
-                        changed = true;
-                    }
-                }
-                if (changed)
-                    writeRegistry(registryPath, registry);
-                const taskId = registry.ids[normalized.value];
-                if (!taskId)
-                    throw Object.assign(new Error(`short id '${normalized.value}' not found in active task registry`), { code: 'SHORT_ID_NOT_FOUND' });
-                return { status: changed ? 'applied' : 'no-op', changed, output: taskId, error: null };
-            });
+            const registry = readRegistryStrict(registryPath, request.shortIdLength);
+            const taskId = registry.ids[normalized.value];
+            if (!taskId)
+                throw Object.assign(new Error(`short id '${normalized.value}' not found in task short-id registry`), { code: 'SHORT_ID_NOT_FOUND' });
+            if (!fs.existsSync(path.join(request.activeDir, taskId, 'task.md'))
+                && !hasRetainedCompletedTask(request.activeDir, taskId)) {
+                throw Object.assign(new Error(`short id '${normalized.value}' points to a task without active or completed task content`), { code: 'SHORT_ID_STALE' });
+            }
+            return { status: 'no-op', changed: false, output: taskId, error: null };
         }
         const registry = readRegistryStrict(registryPath, request.shortIdLength);
         if (request.verify) {
             const active = fs.existsSync(request.activeDir)
                 ? fs.readdirSync(request.activeDir).filter((entry) => /^TASK-\d{8}-\d{6}$/.test(entry) && fs.existsSync(path.join(request.activeDir, entry, 'task.md')))
                 : [];
+            const retained = Object.values(registry.ids).filter((taskId) => hasRetainedCompletedTask(request.activeDir, taskId));
+            const validTasks = new Set([...active, ...retained]);
             const registered = new Map();
             for (const [key, taskId] of Object.entries(registry.ids))
                 registered.set(taskId, [...(registered.get(taskId) ?? []), key]);
             const diff = {
                 missing_in_registry: active.filter((taskId) => !registered.has(taskId)).map((taskId) => ({ taskId })),
-                orphans_in_registry: Object.entries(registry.ids).filter(([, taskId]) => !active.includes(taskId)).map(([key, taskId]) => ({ key, taskId })),
+                orphans_in_registry: Object.entries(registry.ids).filter(([, taskId]) => !validTasks.has(taskId)).map(([key, taskId]) => ({ key, taskId })),
                 duplicate_registry_keys: [...registered.entries()].filter(([, keys]) => keys.length > 1).map(([taskId, keys]) => ({ taskId, keys }))
             };
             const clean = Object.values(diff).every((items) => items.length === 0);

package/dist/lib/task/verification-engine.js

@@ -31,6 +31,7 @@ import { manualValidationFinalSummaryProjectionMatches } from "./manual-validati
 import { readManualValidationCompletion } from "./manual-validation-completion.js";
 import { sha256File } from "./artifact-receipts.js";
 import { inspectArtifactDirectory } from "./artifact-lifecycle.js";
+import { getAgentClientAdapter } from "../agent-clients/registry.js";
 import { parseArtifactName } from "./artifact-name.js";
 import { summaryCommentState } from "../platform/pr-summary.js";
 import { taskIssueIdentity } from "../platform/task-identities.js";
@@ -124,7 +125,7 @@ async function runCheck(type, context, shared) {
     }
 }
 function checkOrchestrationState({ taskDir }) {
-    const file = path.join(taskDir, 'orchestration.json');
+    const file = path.join(taskDir, '.runtime', 'orchestration.json');
     const stat = safeStat(file);
     if (!stat?.isFile())
         return failResult('orchestration-state', 'orchestration.json is missing');
@@ -139,18 +140,16 @@ function checkOrchestrationState({ taskDir }) {
     if (!run || !['paused', 'completed'].includes(run.status)) {
         return failResult('orchestration-state', `Expected paused or completed run, received '${run?.status ?? 'missing'}'`);
     }
+    const adapterEvidenceError = validateAdapterReceiptEvidence(run);
+    if (adapterEvidenceError)
+        return failResult('orchestration-state', adapterEvidenceError);
     if (run.status === 'paused' && (!run.pause?.code || !run.pause?.message)) {
         return failResult('orchestration-state', 'Paused run requires a stable pause code and message');
     }
     if (run.status === 'completed') {
-        if (run.completionEvidence != null) {
-            const evidenceError = validateCleanCompletionEvidence(run);
-            if (evidenceError)
-                return failResult('orchestration-state', evidenceError);
-        }
-        else if (run.pendingDelegation !== null || !run.commitAuthorization?.consumedAt) {
-            return failResult('orchestration-state', 'Completed run must consume commit authorization and clear pending delegation');
-        }
+        const evidenceError = validateCleanCompletionEvidence(run);
+        if (evidenceError)
+            return failResult('orchestration-state', evidenceError);
     }
     else if (run.completionEvidence != null) {
         return failResult('orchestration-state', 'Clean completion evidence requires a completed run');
@@ -182,15 +181,23 @@ function validateCleanCompletionEvidence(run) {
     }
     if (run.status !== 'completed'
         || run.pendingDelegation !== null
-        || run.commitAuthorization?.issuedAt !== null
-        || run.commitAuthorization?.consumedAt !== null
         || run.receipts.some((receipt) => receipt.stage === 'commit')) {
-        return 'Clean completion evidence conflicts with commit delegation state';
+        return 'Clean completion evidence conflicts with pending delegation or commit receipt state';
+    }
+    return null;
+}
+function validateAdapterReceiptEvidence(run) {
+    const receipts = [...run.receipts, ...(run.pendingDelegation ? [run.pendingDelegation] : [])];
+    for (const receipt of receipts) {
+        const validate = getAgentClientAdapter(receipt.client).orchestrationAdapter?.validateReceiptEvidence;
+        if (validate && !validate(receipt)) {
+            return `Receipt '${receipt.id}' has invalid evidence from its agent adapter`;
+        }
     }
     return null;
 }
 function checkOrchestrationEvidence({ taskDir }) {
-    const file = path.join(taskDir, 'orchestration.json');
+    const file = path.join(taskDir, '.runtime', 'orchestration.json');
     const stat = safeStat(file);
     if (!stat?.isFile())
         return failResult('orchestration-evidence', 'orchestration.json is missing');
@@ -204,6 +211,9 @@ function checkOrchestrationEvidence({ taskDir }) {
     }
     if (!run)
         return failResult('orchestration-evidence', 'orchestration.json is missing');
+    const adapterEvidenceError = validateAdapterReceiptEvidence(run);
+    if (adapterEvidenceError)
+        return failResult('orchestration-evidence', adapterEvidenceError);
     // readRun validates the persisted schema, receipt identities and client provenance.
     const policy = run.modelPolicy;
     if (run.completionEvidence != null) {
@@ -228,20 +238,22 @@ function checkOrchestrationEvidence({ taskDir }) {
         }
         const activated = ['activated', 'stage-completed', 'sealed', 'consumed'].includes(receipt.status);
         if (activated) {
-            const isClaudeCode = receipt.client === 'claude-code';
-            if (!isClaudeCode) {
+            const evidencePolicy = getAgentClientAdapter(receipt.client).delegationEvidence;
+            if (evidencePolicy.actualModelRequired !== false) {
                 if (!exactText(receipt.actualModel)) {
                     return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has no host-observed actual model`);
                 }
+            }
+            if (evidencePolicy.actualReasoningEffortRequired !== false) {
                 if (!exactText(receipt.actualReasoningEffort)) {
                     return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has no host-observed actual reasoning effort`);
                 }
             }
-            if (!isClaudeCode && receipt.spawnMode !== 'fresh') {
+            if (evidencePolicy.spawnModeRequired !== false && receipt.spawnMode !== 'fresh') {
                 return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has invalid fresh delegation identity`);
             }
             if (receipt.actualModel != null && receipt.actualModel !== receipt.requestedModel) {
-                if (!isClaudeCode && !exactText(receipt.modelFallbackReason)) {
+                if (evidencePolicy.fallbackReasonRequired !== false && !exactText(receipt.modelFallbackReason)) {
                     return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' model fallback is not justified`);
                 }
             }
@@ -250,7 +262,7 @@ function checkOrchestrationEvidence({ taskDir }) {
                 return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has an unrelated model fallback reason`);
             }
             if (receipt.actualReasoningEffort != null && receipt.actualReasoningEffort !== receipt.requestedReasoningEffort) {
-                if (!isClaudeCode && !exactText(receipt.reasoningEffortFallbackReason)) {
+                if (evidencePolicy.fallbackReasonRequired !== false && !exactText(receipt.reasoningEffortFallbackReason)) {
                     return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' reasoning-effort fallback is not justified`);
                 }
             }
@@ -700,7 +712,6 @@ function checkActivityLog({ taskDir, config, skillName, artifactFile }) {
     const entries = section.entries;
     if (entries.length === 0)
         return failResult("activity-log", "Activity Log has no entries");
-    let previousTimestamp = "";
     let latestAction = "";
     let latestTimestamp = "";
     const doneActions = [];
@@ -708,13 +719,8 @@ function checkActivityLog({ taskDir, config, skillName, artifactFile }) {
         if (!entry.note.trim())
             return failResult("activity-log", "Activity Log entry note is required");
         const { time: timestamp, step: action } = entry;
-        if (previousTimestamp && timestamp < previousTimestamp) {
-            return failResult("activity-log", "Activity Log timestamps are not in ascending order");
-        }
-        previousTimestamp = timestamp;
-        // Ascending order is checked over every entry, but a `[started]` marker is
-        // not a terminal action: keep latestAction/latestTimestamp on the most
-        // recent done entry so expected_action_pattern sees it.
+        // A `[started]` marker is not a terminal action: keep latestAction/latestTimestamp
+        // on the most recent done entry so expected_action_pattern sees it.
         if (!ACTIVITY_LOG_STARTED_RE.test(action)) {
             latestTimestamp = timestamp;
             latestAction = action;

package/dist/lib/task/workspace-snapshot.js

@@ -45,7 +45,7 @@ function taskFileFingerprints(stateRoot, taskId) {
         }
         if (!stat.isFile() && !stat.isSymbolicLink())
             return;
-        if (relative.startsWith('.agents/workspace/active/') && path.posix.basename(relative) === 'orchestration.json')
+        if (/^\.agents\/workspace\/(?:active|blocked|completed)\/TASK-[0-9]{8}-[0-9]{6}\/\.runtime\/orchestration\.json$/u.test(relative))
             return;
         const content = stat.isSymbolicLink()
             ? Buffer.from(fs.readlinkSync(absolute))

package/dist/lifecycle-build-manifest.json

@@ -1,6 +1,6 @@
 {
   "protocolVersion": 3,
-  "packageVersion": "0.11.11",
-  "sourceInputHash": "576098e3f88ceca11a0a0f94573a3ceca2b14c97b29a6b934ae07849e214c889",
-  "internalExecutableBuildHash": "065375c31d3564a65236fc43bad9947395ea0873ae2531d9b05f42956ef30f1e"
+  "packageVersion": "0.11.13",
+  "sourceInputHash": "70e89f362895c1f8f976011715a86b47e06c105ca4285eacbb3fa51d0459a282",
+  "internalExecutableBuildHash": "f183e6d39ba985dbb2962eb951b4019af9594361ca3c46b88bf65fff325d7ad4"
 }

package/lib/agent-clients/adapter.ts

@@ -23,6 +23,27 @@ import type {
   SandboxTool,
   SandboxToolContext
 } from '../sandbox/tool-types.ts';
+import type { SandboxControlManifest } from '../sandbox/control/protocol.ts';
+
+type AgentClientSandboxControlOperation = Readonly<{
+  validate: (params: Readonly<{
+    operation: string;
+    payload: Record<string, unknown>;
+    manifest: SandboxControlManifest;
+  }>) => void;
+  execute: (params: Readonly<{
+    operation: string;
+    payload: Record<string, unknown>;
+    manifest: SandboxControlManifest;
+    manifestPath: string;
+  }>) => Promise<Readonly<{ exitCode: number; stdout: string; stderr: string }>>;
+  recover?: (params: Readonly<{
+    operation: string;
+    manifest: SandboxControlManifest;
+    manifestPath: string;
+    stdout: string | null;
+  }>) => Readonly<Record<string, unknown>>;
+}>;
 
 type AgentClientCapabilities = AgentClientCapabilityMap;
 
@@ -46,6 +67,10 @@ type AgentClientModelSelectionContext =
 type AgentClientDelegationEvidence = Readonly<{
   actualModel: 'host-event' | 'app-server' | 'unavailable';
   actualReasoningEffort: 'host-event' | 'app-server' | 'spawn-ack' | 'unavailable';
+  spawnModeRequired?: boolean;
+  actualModelRequired?: boolean;
+  actualReasoningEffortRequired?: boolean;
+  fallbackReasonRequired?: boolean;
 }>;
 
 type AgentClientLifecycleRecoveryRequest = Readonly<{
@@ -68,6 +93,12 @@ type AgentClientLifecycleRecoveryResult = Readonly<{
 }>;
 
 type AgentClientOrchestrationAdapter = Readonly<{
+  validateActivationEvidence?: (evidence: unknown, parentId: string) => boolean;
+  validateReceiptEvidence?: (receipt: unknown) => boolean;
+  createLaunchCarrier?: (
+    adapterContext: string,
+    identity: Readonly<{ stage: string; round: number; role: string }>
+  ) => Readonly<Record<string, string>>;
   prepareDelegation?: (
     taskRef: string,
     input: Readonly<{
@@ -116,6 +147,7 @@ type AgentClientAdapter = Readonly<{
   modelSelection: AgentClientModelSelectionContext;
   delegationEvidence: AgentClientDelegationEvidence;
   orchestrationAdapter?: AgentClientOrchestrationAdapter;
+  sandboxControlOperation?: AgentClientSandboxControlOperation;
   project: AgentClientProjectDescriptor;
   sandbox: AgentClientSandboxDescriptor;
 }>;
@@ -395,6 +427,9 @@ function defineAgentClientAdapter(
     !evidence
     || !['host-event', 'app-server', 'unavailable'].includes(evidence.actualModel)
     || !['host-event', 'app-server', 'spawn-ack', 'unavailable'].includes(evidence.actualReasoningEffort)
+    || ['spawnModeRequired', 'actualModelRequired', 'actualReasoningEffortRequired', 'fallbackReasonRequired']
+      .some((key) => evidence[key as keyof AgentClientDelegationEvidence] !== undefined
+        && typeof evidence[key as keyof AgentClientDelegationEvidence] !== 'boolean')
   ) {
     throw new Error(`Agent Client '${candidate.id}' has invalid delegation evidence`);
   }
@@ -693,6 +728,9 @@ function defineAgentClientAdapter(
     ...(candidate.orchestrationAdapter === undefined
       ? {}
       : { orchestrationAdapter: Object.freeze({ ...candidate.orchestrationAdapter }) }),
+    ...(candidate.sandboxControlOperation === undefined
+      ? {}
+      : { sandboxControlOperation: Object.freeze({ ...candidate.sandboxControlOperation }) }),
     project: Object.freeze({
       ownedPathPrefixes: Object.freeze(paths),
       ...projectAssets,
@@ -715,6 +753,7 @@ export type {
   AgentClientCapabilities,
   AgentClientCustomCommandDescriptor,
   AgentClientDelegationEvidence,
+  AgentClientSandboxControlOperation,
   AgentClientLifecycleRecoveryRequest,
   AgentClientLifecycleRecoveryResult,
   AgentClientOrchestrationAdapter,

package/lib/agent-clients/adapters/claude-code.ts

@@ -27,7 +27,11 @@ const claudeCodeAdapter = defineAgentClientAdapter({
   },
   delegationEvidence: {
     actualModel: 'host-event',
-    actualReasoningEffort: 'spawn-ack'
+    actualReasoningEffort: 'spawn-ack',
+    spawnModeRequired: false,
+    actualModelRequired: false,
+    actualReasoningEffortRequired: false,
+    fallbackReasonRequired: false
   },
   project: {
     ownedPathPrefixes: ['.claude/'],

package/lib/agent-clients/adapters/codex-lifecycle/app-server.ts

@@ -7,7 +7,9 @@ import semver from 'semver';
 
 import type { ChildProcessWithoutNullStreams } from 'node:child_process';
 import type { CodexLifecycleEvent } from './evidence.ts';
-import { resolveAgentRuntimeStoreRoot } from '../../../runtime/agent-runtime.ts';
+import { parseCodexLifecycleBinding } from './binding.ts';
+import { hasActiveCodexLifecycleEvidence } from './store.ts';
+import { resolveTaskContext, resolveTaskRef } from '../../../task/resolve-ref.ts';
 
 type JsonObject = Record<string, unknown>;
 type ThreadResolution = Readonly<{
@@ -71,26 +73,14 @@ function nonEmpty(value: unknown): string | null {
   return typeof value === 'string' && value.trim() ? value : null;
 }
 
-function resolveCodexSpawnedChild(
-  transcriptPath: string,
-  expected: Readonly<{
-    sessionId: string;
-    turnId: string;
-    toolUseId: string;
-    nativeAgent: string;
-    taskName: string;
-    requestedModel?: string;
-    requestedReasoningEffort?: string;
-  }>
-): string {
+function readRolloutRecords(transcriptPath: string, sessionId: string): JsonObject[] {
   const name = path.basename(transcriptPath);
-  if (!transcriptPath || (!name.endsWith(`-${expected.sessionId}.jsonl`) && name !== `${expected.sessionId}.jsonl`)) {
+  if (!transcriptPath || (!name.endsWith(`-${sessionId}.jsonl`) && name !== `${sessionId}.jsonl`)) {
     throw new Error('Codex parent rollout path is invalid');
   }
   const stat = fs.lstatSync(transcriptPath);
   if (!stat.isFile() || stat.isSymbolicLink()) throw new Error('Codex parent rollout is not a regular file');
-  const maxBytes = 8 * 1024 * 1024;
-  const offset = Math.max(0, stat.size - maxBytes);
+  const offset = Math.max(0, stat.size - 8 * 1024 * 1024);
   const buffer = Buffer.alloc(stat.size - offset);
   const descriptor = fs.openSync(transcriptPath, 'r');
   try {
@@ -100,37 +90,61 @@ function resolveCodexSpawnedChild(
   }
   let text = buffer.toString('utf8');
   if (offset) text = text.slice(text.indexOf('\n') + 1);
-  const records = text.split(/\r?\n/).filter(Boolean).map((line) => object(JSON.parse(line))).filter(Boolean);
-  const calls = records.filter((record) => {
-    const payload = object(record?.payload);
-    return record?.type === 'response_item'
-      && payload?.type === 'function_call'
-      && payload.call_id === expected.toolUseId
-      && payload.namespace === 'collaboration'
-      && payload.name === 'spawn_agent';
-  });
+  return text.split(/\r?\n/u).filter(Boolean).map((line) => object(JSON.parse(line))).filter((record): record is JsonObject => Boolean(record));
+}
+
+function isExpectedSpawnCall(record: JsonObject, expected: Parameters<typeof resolveCodexSpawnedChild>[1]): boolean {
+  const payload = object(record.payload);
+  return record.type === 'response_item'
+    && payload?.type === 'function_call'
+    && payload.call_id === expected.toolUseId
+    && payload.namespace === 'collaboration'
+    && payload.name === 'spawn_agent';
+}
+
+function spawnArgsMatch(args: JsonObject | null, expected: Parameters<typeof resolveCodexSpawnedChild>[1]): boolean {
+  return args?.agent_type === expected.nativeAgent
+    && args.task_name === expected.taskName
+    && (!expected.requestedModel || args.model === expected.requestedModel)
+    && (!expected.requestedReasoningEffort || args.reasoning_effort === expected.requestedReasoningEffort);
+}
+
+function isExpectedChildActivity(record: JsonObject, expected: Parameters<typeof resolveCodexSpawnedChild>[1]): boolean {
+  const payload = object(record.payload);
+  const item = object(payload?.item);
+  return record.type === 'event_msg'
+    && payload?.type === 'item_completed'
+    && payload.thread_id === expected.sessionId
+    && payload.turn_id === expected.turnId
+    && item?.type === 'SubAgentActivity'
+    && item.id === expected.toolUseId
+    && item.kind === 'started'
+    && item.agent_path === `/root/${expected.taskName}`
+    && Boolean(nonEmpty(item.agent_thread_id));
+}
+
+function resolveCodexSpawnedChild(
+  transcriptPath: string,
+  expected: Readonly<{
+    sessionId: string;
+    turnId: string;
+    toolUseId: string;
+    nativeAgent: string;
+    taskName: string;
+    requestedModel?: string;
+    requestedReasoningEffort?: string;
+  }>
+): string {
+  if (!parseCodexLifecycleBinding(expected.taskName)) {
+    throw new Error('Codex spawn task_name does not carry a valid lifecycle binding');
+  }
+  const records = readRolloutRecords(transcriptPath, expected.sessionId);
+  const calls = records.filter((record) => isExpectedSpawnCall(record, expected));
   if (calls.length !== 1) throw new Error('Codex parent rollout spawn call was not found uniquely');
   const call = object(calls[0]?.payload);
   const args = object(JSON.parse(nonEmpty(call?.arguments) ?? '{}'));
-  if (
-    args?.agent_type !== expected.nativeAgent
-    || args.task_name !== expected.taskName
-    || (expected.requestedModel && args.model !== expected.requestedModel)
-    || (expected.requestedReasoningEffort && args.reasoning_effort !== expected.requestedReasoningEffort)
-  ) throw new Error('Codex parent rollout spawn identity does not match the hook event');
-  const activities = records.filter((record) => {
-    const payload = object(record?.payload);
-    const item = object(payload?.item);
-    return record?.type === 'event_msg'
-      && payload?.type === 'item_completed'
-      && payload.thread_id === expected.sessionId
-      && payload.turn_id === expected.turnId
-      && item?.type === 'SubAgentActivity'
-      && item.id === expected.toolUseId
-      && item.kind === 'started'
-      && item.agent_path === `/root/${expected.taskName}`
-      && nonEmpty(item.agent_thread_id);
-  });
+  if (!spawnArgsMatch(args, expected)) throw new Error('Codex parent rollout spawn identity does not match the hook event');
+  const activities = records.filter((record) => isExpectedChildActivity(record, expected));
   if (activities.length !== 1) throw new Error('Codex parent rollout child activity was not found uniquely');
   return nonEmpty(object(object(activities[0]?.payload)?.item)?.agent_thread_id)!;
 }
@@ -198,30 +212,6 @@ function parseCodexHooksList(
   return Object.freeze(hooks);
 }
 
-function hasCodexRuntimeLiveness(
-  runtimeRoot: string,
-  hookDefinitionHash: string,
-  identity?: CodexRuntimeIdentity
-): boolean {
-  if (!identity || !fs.existsSync(runtimeRoot)) return false;
-  return fs.readdirSync(runtimeRoot)
-    .filter((name) => /^[a-f0-9]{64}\.json$/.test(name))
-    .some((name) => {
-      try {
-        const record = object(JSON.parse(fs.readFileSync(path.join(runtimeRoot, name), 'utf8')));
-        const state = object(record?.state);
-        const spawnEvent = object(state?.spawn);
-        return !['invalid', 'expired'].includes(String(state?.status))
-          && spawnEvent?.hookDefinitionHash === hookDefinitionHash
-          && spawnEvent.sessionId === identity.sessionId
-          && spawnEvent.turnId === identity.turnId
-          && spawnEvent.toolUseId === identity.toolUseId;
-      } catch {
-        return false;
-      }
-    });
-}
-
 function parseCodexThreadResolution(readValue: unknown, rolloutRecords: readonly unknown[]): ThreadResolution {
   const readRoot = object(readValue);
   const thread = object(readRoot?.thread);
@@ -278,6 +268,20 @@ function parseCodexThreadResolution(readValue: unknown, rolloutRecords: readonly
   });
 }
 
+function resolvePreflightTaskDir(
+  repoRoot: string,
+  taskId?: string
+): string | undefined {
+  try {
+    const context = taskId
+      ? resolveTaskRef(taskId, { repoRoot })
+      : resolveTaskContext(undefined, { repoRoot });
+    return context.ok ? context.taskDir : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 function readCodexRolloutRecords(readValue: unknown, childThreadId: string): readonly unknown[] {
   const thread = object(object(readValue)?.thread);
   const rolloutPath = nonEmpty(thread?.path);
@@ -570,8 +574,27 @@ async function resolveCodexTerminal(
 
 async function preflightCodexLifecycleEvidence(
   repoRoot: string = process.cwd(),
-  runtimeIdentity?: CodexRuntimeIdentity
+  runtimeIdentity?: CodexRuntimeIdentity,
+  taskId?: string
 ) {
+  const { cliVersion, hooksRaw } = validateStaticCodexPreflight(repoRoot);
+  const hookDefinitionHash = crypto.createHash('sha256').update(hooksRaw).digest('hex');
+  const taskDir = resolvePreflightTaskDir(repoRoot, taskId);
+  const runtimeLiveness = Boolean(taskDir && runtimeIdentity
+    && hasActiveCodexLifecycleEvidence(taskDir, { hookDefinitionHash, identity: runtimeIdentity }));
+  const host = await discoverLifecycleHooks(repoRoot);
+  return Object.freeze({
+    cliVersion,
+    hookDefinitionHash,
+    staticReady: true,
+    discoveredHooks: host.discoveredHooks,
+    hookProvenance: host.hookProvenance,
+    runtimeLiveness,
+    diagnostics: host.diagnostics
+  });
+}
+
+function validateStaticCodexPreflight(repoRoot: string): Readonly<{ cliVersion: string; hooksRaw: string }> {
   const versionRun = spawnSync('codex', ['--version'], { encoding: 'utf8' });
   const match = /codex-cli\s+(\d+\.\d+\.\d+)/.exec(versionRun.stdout ?? '');
   if (versionRun.status !== 0 || !match?.[1] || !semver.gte(match[1], '0.147.0')) {
@@ -599,11 +622,18 @@ async function preflightCodexLifecycleEvidence(
   } finally {
     fs.rmSync(schemaDir, { recursive: true, force: true });
   }
+  return { cliVersion: match[1]!, hooksRaw };
+}
 
-  const hookDefinitionHash = crypto.createHash('sha256').update(hooksRaw).digest('hex');
-  const runtimeRoot = resolveAgentRuntimeStoreRoot({ repoRoot, store: 'lifecycle' });
-  const runtimeLiveness = hasCodexRuntimeLiveness(runtimeRoot, hookDefinitionHash, runtimeIdentity);
-
+async function discoverLifecycleHooks(repoRoot: string): Promise<Readonly<{
+  discoveredHooks: readonly DiscoveredHook[];
+  hookProvenance: Readonly<{
+    hookSource: 'isolated-user' | 'managed' | 'project';
+    hookSourcePathDigest: string;
+    hookSourceHash: string;
+  }>;
+  diagnostics: readonly unknown[];
+}>> {
   const transport = new CodexAppServerTransport();
   transport.start();
   let discoveredHooks: readonly DiscoveredHook[];
@@ -633,10 +663,7 @@ async function preflightCodexLifecycleEvidence(
   const hookSource = process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT
     ? 'isolated-user'
     : source === 'managed' ? 'managed' : 'project';
-  return Object.freeze({
-    cliVersion: match[1],
-    hookDefinitionHash,
-    staticReady: true,
+  return {
     discoveredHooks,
     hookProvenance: Object.freeze({
       hookSource,
@@ -648,14 +675,12 @@ async function preflightCodexLifecycleEvidence(
         currentHash: hook.currentHash
       })))).digest('hex')
     }),
-    runtimeLiveness,
     diagnostics: transport.diagnostics
-  });
+  };
 }
 
 export {
   CodexAppServerTransport,
-  hasCodexRuntimeLiveness,
   parseCodexModelReroute,
   parseCodexHooksList,
   parseCodexThreadResolution,