@fitlab-ai/agent-infra 0.11.14 → 0.12.0

package/bin/cli.ts

@@ -31,7 +31,7 @@ Commands:
   run             Schedule a lifecycle skill in the task sandbox tmux session
   sandbox, s      Manage Docker-based AI sandboxes
   server          Run the local AI collaboration daemon (start/stop/status/logs)
-  task, t         Read-only views of .agents/workspace tasks
+  task, t         Read-only views of project task workspaces
   sync            Update seed files and sync file registry for an existing project
   update          Update the agent-infra CLI itself
   version         Show version

package/dist/bin/cli.js

@@ -31,7 +31,7 @@ Commands:
   run             Schedule a lifecycle skill in the task sandbox tmux session
   sandbox, s      Manage Docker-based AI sandboxes
   server          Run the local AI collaboration daemon (start/stop/status/logs)
-  task, t         Read-only views of .agents/workspace tasks
+  task, t         Read-only views of project task workspaces
   sync            Update seed files and sync file registry for an existing project
   update          Update the agent-infra CLI itself
   version         Show version

package/dist/bin/internal-cli.js

@@ -60,7 +60,7 @@ if (!taskViewGuardFailed && !markerlessHelp && (taskControlCommand || taskWorkfl
         }
         case 'direct-host':
             // The host CLI is the direct-host authority. Domain handlers retain their
-            // task locks, atomic writes, and operation-specific recovery facts.
+            // atomic writes and operation-specific recovery facts.
             break;
         case 'sandbox-local': {
             break;
@@ -185,6 +185,11 @@ if (!controlRouted && !taskViewGuardFailed && internalRouteRegistered)
             taskContext(process.argv.slice(3));
             break;
         }
+        case 'task-workspace': {
+            const { taskWorkspace } = await import('../lib/internal/task-workspace.js');
+            taskWorkspace(process.argv.slice(3));
+            break;
+        }
         case 'task-ledger': {
             const { taskLedger } = await import('../lib/internal/task-ledger.js');
             await taskLedger(process.argv.slice(3));

package/dist/lib/agent-clients/adapters/codex-lifecycle/recovery.js

@@ -6,7 +6,7 @@ import { locateActivityLog, pairEntries, appendActivityEntry } from '../../../ta
 import { captureTaskWriteMetadata, writeTask } from '../../../task/write.js';
 import { parseTypedTaskFrontmatter } from '../../../task/frontmatter.js';
 import { resolveTaskRef } from '../../../task/resolve-ref.js';
-import { recoverActivatedOrchestrationDelegationUnderLock, readRun } from '../../../task/orchestration.js';
+import { recoverActivatedOrchestrationDelegation, readRun } from '../../../task/orchestration.js';
 const ACTIONS = {
     analysis: 'Analyze Task',
     'review-analysis': 'Review Analysis',
@@ -175,7 +175,7 @@ function appendRecoveryLog(request, taskId, section, candidate, repoRoot, writer
         taskId, receiptId: candidate.receipt.id, childId: candidate.receipt.childId
     });
 }
-function recoverStartedLifecycleUnderLock(request, options = {}) {
+function recoverStartedLifecycle(request, options = {}) {
     if (!request || request.intent !== 'recover-started' || request.auto !== true || normalizeAgentToken(request.agent) !== 'codex') {
         return failure(request, 'conflict', 'RECOVERY_PAYLOAD_INVALID', 'automatic recovery requires a task and the Codex agent');
     }
@@ -259,7 +259,7 @@ function consumeRecoveryEvidence(request, taskId, repoRoot, pending, options) {
     let consumed = stored;
     if (stored.consumer === null) {
         try {
-            consumed = store.consumeWithinTaskLock(pending.childId, pending.id, stored.state.startEvidence?.hookDefinitionHash, {
+            consumed = store.consume(pending.childId, pending.id, stored.state.startEvidence?.hookDefinitionHash, {
                 taskId: pending.taskId, runId: pending.runId, receiptId: pending.id
             });
         }
@@ -272,7 +272,7 @@ function consumeRecoveryEvidence(request, taskId, repoRoot, pending, options) {
         : { result: failure(request, 'owner-unknown', 'RECOVERY_EVIDENCE_INVALID', 'consumed stop evidence has no timestamp', { taskId, receiptId: pending.id, childId: pending.childId }) };
 }
 function finishActiveRecovery(request, taskId, section, repoRoot, pending, row, options) {
-    const recovered = recoverActivatedOrchestrationDelegationUnderLock(taskId, {
+    const recovered = recoverActivatedOrchestrationDelegation(taskId, {
         receiptId: pending.id,
         stage: pending.stage,
         round: pending.round,
@@ -286,7 +286,7 @@ function finishActiveRecovery(request, taskId, section, repoRoot, pending, row,
     return appendRecoveryLog(request, taskId, section, { receipt: recovered.run.receipts.at(-1), row }, repoRoot, options.writeTask ?? writeTask);
 }
 function recoverStartedLifecycleFromAdapter(request, options = {}) {
-    return recoverStartedLifecycleUnderLock(request, options);
+    return recoverStartedLifecycle(request, options);
 }
-export { recoverStartedLifecycleFromAdapter, recoverStartedLifecycleUnderLock };
+export { recoverStartedLifecycle, recoverStartedLifecycleFromAdapter };
 //# sourceMappingURL=recovery.js.map

package/dist/lib/agent-clients/adapters/codex-lifecycle/store.js

@@ -1,6 +1,6 @@
 import crypto from 'node:crypto';
 import path from 'node:path';
-import { mutateDelegationAdapterEvidence, mutateDelegationAdapterEvidenceWithinTaskLock, readRun } from '../../../task/orchestration.js';
+import { mutateDelegationAdapterEvidence, readRun } from '../../../task/orchestration.js';
 import { resolveTaskRef } from '../../../task/resolve-ref.js';
 import { createCodexLifecycleState, expireCodexLifecycleState, reduceCodexLifecycleEvent } from './evidence.js';
 function readCodexLifecycleActivationEvidence(receipt) {
@@ -111,10 +111,9 @@ function createCodexLifecycleStore(options) {
         }
         return matches[0];
     }
-    function update(binding, key, mutate, taskLockHeld = false) {
+    function update(binding, key, mutate) {
         let result = null;
-        const updateState = taskLockHeld ? mutateDelegationAdapterEvidenceWithinTaskLock : mutateDelegationAdapterEvidence;
-        updateState(options.taskId, binding.receiptId, 'codex', (value) => {
+        mutateDelegationAdapterEvidence(options.taskId, binding.receiptId, 'codex', (value) => {
             const currentState = storedEvidence(value);
             const current = currentState.records[key] ?? null;
             result = mutate(current);
@@ -215,7 +214,7 @@ function createCodexLifecycleStore(options) {
             throw new Error(`Codex lifecycle child '${childThreadId}' was not found uniquely`);
         return matches[0];
     }
-    function consumeWithLockMode(childThreadId, consumer, expectedHookDefinitionHash, expectedTaskBinding, taskLockHeld) {
+    function consume(childThreadId, consumer, expectedHookDefinitionHash, expectedTaskBinding) {
         if (!consumer.trim())
             throw new Error('Codex lifecycle consumer is required');
         const current = read(childThreadId);
@@ -223,11 +222,8 @@ function createCodexLifecycleStore(options) {
         if (!binding)
             throw new Error('Codex lifecycle task receipt binding is missing');
         const spawn = current.state.spawn;
-        if (!spawn) {
-            throw new Error(taskLockHeld
-                ? 'Codex lifecycle task receipt binding is missing'
-                : 'Codex lifecycle spawn evidence is missing');
-        }
+        if (!spawn)
+            throw new Error('Codex lifecycle spawn evidence is missing');
         const key = recordKey(spawn.sessionId, spawn.turnId, spawn.toolUseId);
         return update(binding, key, (latest) => {
             if (!latest || expectedTaskBinding && JSON.stringify(latest.taskBinding) !== JSON.stringify(expectedTaskBinding)) {
@@ -244,13 +240,7 @@ function createCodexLifecycleStore(options) {
             if (latest.consumer)
                 return latest;
             return Object.freeze({ ...latest, revision: latest.revision + 1, consumer, consumedAt: now(), updatedAt: now() });
-        }, taskLockHeld);
-    }
-    function consume(childThreadId, consumer, expectedHookDefinitionHash, expectedTaskBinding) {
-        return consumeWithLockMode(childThreadId, consumer, expectedHookDefinitionHash, expectedTaskBinding, false);
-    }
-    function consumeWithinTaskLock(childThreadId, consumer, expectedHookDefinitionHash, expectedTaskBinding) {
-        return consumeWithLockMode(childThreadId, consumer, expectedHookDefinitionHash, expectedTaskBinding, true);
+        });
     }
     function expireBefore(cutoff) {
         let changed = 0;
@@ -271,7 +261,7 @@ function createCodexLifecycleStore(options) {
         }
         return changed;
     }
-    return Object.freeze({ taskId: options.taskId, root: path.join(taskDir, '.runtime'), apply, applyToSpawn, consume, consumeWithinTaskLock, expireBefore, findByParent, findByTaskBinding, read });
+    return Object.freeze({ taskId: options.taskId, root: path.join(taskDir, '.runtime'), apply, applyToSpawn, consume, expireBefore, findByParent, findByTaskBinding, read });
 }
 export { createCodexLifecycleStore, hasActiveCodexLifecycleEvidence, readCodexLifecycleActivationEvidence };
 //# sourceMappingURL=store.js.map

package/dist/lib/agent-clients/adapters/codex-orchestration.js

@@ -347,7 +347,7 @@ async function sealCodexOrchestrationDelegation(childThreadId, options = {}) {
         }
         return sealMatchingOrchestrationDelegation('codex', { nativeAgent: record.state.startEvidence.nativeAgent, childId: childThreadId }, coreOptions(options), () => {
             try {
-                const consumed = store.consumeWithinTaskLock(childThreadId, current.receipt.id, existing.state.spawn?.hookDefinitionHash, existing.taskBinding ?? undefined);
+                const consumed = store.consume(childThreadId, current.receipt.id, existing.state.spawn?.hookDefinitionHash, existing.taskBinding ?? undefined);
                 return consumed.consumer === current.receipt.id && consumed.consumedAt
                     ? null
                     : bridgeFailure('ORCHESTRATION_CODEX_RECONCILIATION_FAILED', 'Codex lifecycle evidence was not consumed by the active receipt');

package/dist/lib/decide.js

@@ -3,7 +3,6 @@ import { parseTaskScope } from './task/command-options.js';
 import { applyHumanDecision } from './task/decision-intents.js';
 import { canonicalTimestamp } from './task/write.js';
 import { resolveTaskContext } from './task/resolve-ref.js';
-import { TaskExecutionLockError, withTaskExecutionLock } from './task/task-execution-lock.js';
 function parseDecisionParts(parts) {
     const decision = [];
     let needsImplementation;
@@ -81,17 +80,13 @@ export async function decide(args, options = {}) {
             repoRoot: resolved.repoRoot,
             metadataProvider: () => ({ timestamp: now, agentInfraVersion: options.version ?? VERSION })
         };
-        let result;
-        const execute = async () => applyHumanDecision(request, writeOptions);
-        result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, 'task-decision', execute);
+        const result = await applyHumanDecision(request, writeOptions);
         if (result.error)
             throw new Error(result.error.message);
         return 0;
     }
     catch (error) {
-        const message = error instanceof TaskExecutionLockError
-            ? `${error.code}: ${error.message}`
-            : error instanceof Error ? error.message : String(error);
+        const message = error instanceof Error ? error.message : String(error);
         process.stderr.write(`Error: ${message}\n`);
         return 1;
     }

package/dist/lib/internal/cli-route-inventory.js

@@ -49,6 +49,7 @@ export const INTERNAL_HANDLER_ROUTE_SELECTORS = Object.freeze({
     'pr-review-grade': ['decide', 'resolve-host', 'verify-artifact'],
     'platform-checks': ['inspect', 'watch', 'resolve-run', 'logs'],
     'task-context': ['resolve'],
+    'task-workspace': ['resolve'],
     'task-ledger': ['decision-next-id', 'stage-status', 'finding-upsert', 'finding-respond', 'finding-review', 'decision-upsert', 'rework-intent-upsert', 'rework-intent-rebuild'],
     'task-warning': ['list', 'add', 'set-status'],
     'task-activity': ['pr-review-inspect', 'pr-review-start', 'pr-review-complete', 'pr-review-terminate'],
@@ -115,6 +116,8 @@ export function internalRouteSelector(command, args) {
         return args[1] ?? '';
     if (command === 'task-context')
         return first(args);
+    if (command === 'task-workspace')
+        return first(args);
     return first(args);
 }
 export function isInternalHandlerRoute(command, args) {

package/dist/lib/internal/manual-validation.js

@@ -3,7 +3,6 @@ import path from 'node:path';
 import { locateActivityLog, pairEntries } from '../task/activity-log.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { applyTaskEvent } from '../task/events.js';
-import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
 import { normalizeAgentToken } from '../agent-clients/tokens.js';
 import { MANUAL_VALIDATION_RECEIPT_PLACEHOLDER, createManualValidationReceipt, manualValidationFinalSummaryDigest, manualValidationFinalSummaryProjectionMatches, readManualValidationReceipt, writeManualValidationReceiptAtomic } from '../task/manual-validation-receipt.js';
 import { archiveManualValidationGeneration, createManualValidationTransaction, readManualValidationTransaction, retryManualValidationTransaction, summaryPreimageDigest, transitionManualValidationTransaction, validateManualValidationGenerationArchive, writeManualValidationTransactionAtomic } from '../task/manual-validation-transaction.js';
@@ -77,16 +76,9 @@ async function executeManualValidationTransaction(taskRef, values, cwd, options
     const resolved = resolveTaskRef(taskRef, { repoRoot: cwd });
     if (!resolved.ok)
         return result('failed', { code: resolved.code, message: resolved.message });
-    try {
-        return await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `manual-validation:${taskRef}`, () => executeManualValidationTransactionLocked(taskRef, values, cwd, resolved, agent, primaryResult, prepareOnly, options));
-    }
-    catch (error) {
-        if (error instanceof TaskExecutionLockError)
-            return result('failed', { code: error.code, message: error.message });
-        throw error;
-    }
+    return executeManualValidationTransactionAtResolvedTask(taskRef, values, cwd, resolved, agent, primaryResult, prepareOnly, options);
 }
-async function executeManualValidationTransactionLocked(taskRef, values, cwd, resolved, agent, primaryResult, prepareOnly, options) {
+async function executeManualValidationTransactionAtResolvedTask(taskRef, values, cwd, resolved, agent, primaryResult, prepareOnly, options) {
     const artifactPath = path.resolve(resolved.taskDir, values.artifact);
     if (!prepareOnly && !fs.existsSync(artifactPath))
         return result('failed', { code: 'MANUAL_VALIDATION_ARTIFACT_MISSING', message: `manual-validation artifact is missing: ${values.artifact}` });
@@ -151,7 +143,7 @@ async function executeManualValidationTransactionLocked(taskRef, values, cwd, re
     let startedEventApplied = false;
     if (!transactionResult.ok) {
         transaction = createTransaction();
-        const started = applyTaskEvent({ taskRef, event: 'manual-validation.started', agent, initiator: 'model', requestId: transactionId, reasonCode: 'user-request', transactionId }, { lockAlreadyHeld: true, repoRoot: cwd });
+        const started = applyTaskEvent({ taskRef, event: 'manual-validation.started', agent, initiator: 'model', requestId: transactionId, reasonCode: 'user-request', transactionId }, { repoRoot: cwd });
         if (started.status === 'failed')
             return result('failed', started.error ?? { code: 'MANUAL_VALIDATION_TRANSACTION_FAILED', message: 'manual-validation started event failed' });
         startedEventApplied = true;
@@ -176,7 +168,7 @@ async function executeManualValidationTransactionLocked(taskRef, values, cwd, re
         }
     }
     if (transaction.phase === 'prepared' && !startedEventApplied) {
-        const started = applyTaskEvent({ taskRef, event: 'manual-validation.started', agent, initiator: 'model', requestId: transaction.transactionId, reasonCode: 'user-request', transactionId: transaction.transactionId }, { lockAlreadyHeld: true, repoRoot: cwd });
+        const started = applyTaskEvent({ taskRef, event: 'manual-validation.started', agent, initiator: 'model', requestId: transaction.transactionId, reasonCode: 'user-request', transactionId: transaction.transactionId }, { repoRoot: cwd });
         if (started.status === 'failed')
             return result('failed', started.error ?? { code: 'MANUAL_VALIDATION_TRANSACTION_FAILED', message: 'manual-validation started event failed' });
     }
@@ -196,7 +188,7 @@ async function executeManualValidationTransactionLocked(taskRef, values, cwd, re
         if (transaction.phase === 'prepared') {
             const staged = await syncPullRequestSummary(taskRef, {
                 cwd, client: options.client, agent, body: pendingBody, changeReportFile: path.resolve(cwd, values.changeReportFile), primaryResult: primaryResult, strict: true,
-                manualValidation: { phase: 'pending', transactionId: transaction.transactionId }, lockAlreadyHeld: true
+                manualValidation: { phase: 'pending', transactionId: transaction.transactionId }
             });
             if (!['applied', 'no-op'].includes(staged.status))
                 transactionFailure(staged.error ?? { code: 'MANUAL_VALIDATION_TRANSACTION_FAILED', message: 'pending summary staging failed' });
@@ -235,7 +227,7 @@ async function executeManualValidationTransactionLocked(taskRef, values, cwd, re
             transitionAndPersist('receipt-committed', { committedReceipt: receipt.receiptDigest });
         }
         if (transaction.phase === 'receipt-committed' && !transaction.eventAppended) {
-            const completed = applyTaskEvent({ taskRef, event: 'manual-validation.completed', agent, initiator: 'model', requestId: transaction.transactionId, reasonCode: 'user-request', artifact: values.artifact, summaryResult: 'human-confirmed validation and committed receipt', transactionId: transaction.transactionId, receiptDigest: receipt.receiptDigest, prHeadSha: receipt.prHeadSha }, { lockAlreadyHeld: true, repoRoot: cwd });
+            const completed = applyTaskEvent({ taskRef, event: 'manual-validation.completed', agent, initiator: 'model', requestId: transaction.transactionId, reasonCode: 'user-request', artifact: values.artifact, summaryResult: 'human-confirmed validation and committed receipt', transactionId: transaction.transactionId, receiptDigest: receipt.receiptDigest, prHeadSha: receipt.prHeadSha }, { repoRoot: cwd });
             if (completed.status === 'failed')
                 transactionFailure(completed.error ?? { code: 'MANUAL_VALIDATION_TRANSACTION_FAILED', message: 'manual-validation completion event failed' });
             transitionAndPersist('receipt-committed', { eventAppended: true });
@@ -245,7 +237,7 @@ async function executeManualValidationTransactionLocked(taskRef, values, cwd, re
         }
         const promoted = await syncPullRequestSummary(taskRef, {
             cwd, client: options.client, agent, body: manualSummaryBody(finalBodyWithoutReceipt, 'final'), changeReportFile: path.resolve(cwd, values.changeReportFile), primaryResult, strict: true,
-            manualValidation: { phase: 'final', transactionId: transaction.transactionId, receiptDigest: receipt.receiptDigest, prHeadSha: receipt.prHeadSha, authority: 'coordinator' }, lockAlreadyHeld: true
+            manualValidation: { phase: 'final', transactionId: transaction.transactionId, receiptDigest: receipt.receiptDigest, prHeadSha: receipt.prHeadSha, authority: 'coordinator' }
         });
         if (!['applied', 'no-op'].includes(promoted.status))
             transactionFailure(promoted.error ?? { code: 'MANUAL_VALIDATION_TRANSACTION_RECOVERY_REQUIRED', message: 'final summary promotion failed' });
@@ -261,7 +253,7 @@ async function executeManualValidationTransactionLocked(taskRef, values, cwd, re
             try {
                 await syncPullRequestSummary(taskRef, {
                     cwd, client: options.client, agent, body: pendingBody, changeReportFile: path.resolve(cwd, values.changeReportFile), primaryResult: primaryResult, strict: true,
-                    manualValidation: { phase: 'pending', transactionId: transaction.transactionId }, lockAlreadyHeld: true
+                    manualValidation: { phase: 'pending', transactionId: transaction.transactionId }
                 });
             }
             catch {

package/dist/lib/internal/platform-comment.js

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { resolveProjectTaskWorkspaceRoot } from '../task/workspace-root.js';
 import { createHash, randomUUID } from 'node:crypto';
 import { normalizeAgentToken, AGENT_USAGE_HINT } from '../agent-clients/tokens.js';
 import { checkPlatformCommentOwner, listPlatformComments, syncPlatformComment } from '../platform/issue-comments.js';
@@ -115,14 +116,14 @@ async function platformComment(args = []) {
             return;
         }
         const outputPath = path.resolve(cwd, output);
-        const workspaceDir = path.resolve(cwd, '.agents', 'workspace');
+        const workspaceDir = resolveProjectTaskWorkspaceRoot(cwd);
         const stagingDir = path.dirname(outputPath);
         const stagingParent = fs.existsSync(stagingDir) ? path.dirname(fs.realpathSync(stagingDir)) : '';
         const realWorkspace = fs.existsSync(workspaceDir) ? fs.realpathSync(workspaceDir) : '';
         if (path.basename(outputPath) !== 'task.md' || stagingParent !== realWorkspace
             || !path.basename(stagingDir).startsWith('.restore-staging-') || !fs.existsSync(stagingDir)
             || !fs.lstatSync(stagingDir).isDirectory() || fs.existsSync(outputPath)) {
-            fail('recover output must be a new task.md inside an existing .agents/workspace/.restore-staging-* directory');
+            fail('recover output must be a new task.md inside an existing task-workspace/.restore-staging-* directory');
             return;
         }
         const listed = await listPlatformComments(issue, cwd);

package/dist/lib/internal/task-activity.js

@@ -1,6 +1,5 @@
 import { applyPrReviewActivityIntent, inspectPrReviewActivity } from '../task/activity-intent.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
-import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal task-activity <task-ref> pr-review-inspect
        agent-infra-internal task-activity <task-ref> pr-review-start --agent <agent> --artifact <canonical.md> --head <40hex> [--dry-run]
@@ -112,17 +111,7 @@ async function taskActivity(args = []) {
         usageFailure(resolved.message);
         return;
     }
-    let result;
-    try {
-        result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-activity.${kind}`, async () => applyPrReviewActivityIntent(values, { lockAlreadyHeld: true }));
-    }
-    catch (error) {
-        if (!(error instanceof TaskExecutionLockError))
-            throw error;
-        process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: error.code, message: error.message } })}\n`);
-        process.exitCode = 1;
-        return;
-    }
+    const result = await applyPrReviewActivityIntent(values);
     process.stdout.write(`${JSON.stringify(result)}\n`);
     if (result.status === 'failed')
         process.exitCode = 1;

package/dist/lib/internal/task-event.js

@@ -1,7 +1,6 @@
 import { normalizeAgentToken, AGENT_USAGE_HINT } from '../agent-clients/tokens.js';
 import { applyTaskEvent, eventCatalog } from '../task/events.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
-import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal task-event <N | TASK-id> <event> --agent <agent> [event options] [--orchestrated] [--dry-run]
 
@@ -93,17 +92,7 @@ async function taskEvent(args = []) {
         process.exitCode = 1;
         return;
     }
-    let result;
-    try {
-        result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-event.${request.event}`, async () => applyTaskEvent(request, { lockAlreadyHeld: true }));
-    }
-    catch (error) {
-        if (!(error instanceof TaskExecutionLockError))
-            throw error;
-        process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: error.code, message: error.message } })}\n`);
-        process.exitCode = 1;
-        return;
-    }
+    const result = await applyTaskEvent(request);
     process.stdout.write(`${JSON.stringify(result)}\n`);
     if (result.status === 'failed')
         process.exitCode = 1;

package/dist/lib/internal/task-finalization.js

@@ -3,7 +3,7 @@ import { createDirectHostExecutionContext, dispatchTaskControlOperation, parseTa
 import { applyTaskFinalization } from '../task/finalization.js';
 import { detectRepoRoot, resolveTaskRef } from '../task/resolve-ref.js';
 import { resolveSandboxControlTransport } from './task-operation-registry.js';
-import { quiesceSandboxControlForTaskCompletion } from '../sandbox/control/lifecycle.js';
+import { validateSandboxControlTaskIdentity } from '../sandbox/control/lifecycle.js';
 import { loadSandboxControlLocation } from '../sandbox/config.js';
 import { serializeTaskFinalizationEnvelope } from '../task/finalization-envelope.js';
 import { verifyTaskEvent } from '../task/verification.js';
@@ -83,7 +83,7 @@ async function taskFinalization(args = []) {
             beforeLifecycle: async (currentTaskId) => {
                 if (currentTaskId !== taskId)
                     throw new Error('SANDBOX_CONTROL_IDENTITY_MISMATCH');
-                await quiesceSandboxControlForTaskCompletion(controlRoot, { taskId, generation, controlRootId, statusDir });
+                validateSandboxControlTaskIdentity(controlRoot, { taskId, generation, controlRootId, statusDir });
             },
             preflight: (request, options) => verifyTaskEvent({ ...request, event: 'complete-task.hard-preflight' }, options)
         });

package/dist/lib/internal/task-ledger.js

@@ -2,7 +2,6 @@ import fs from 'node:fs';
 import { applyLedgerIntent } from '../task/ledger-intents.js';
 import { LEDGER_SECTION_MISSING_CODE, LEDGER_SECTION_MISSING_MESSAGE, isReviewStage, parseLedgerDocument, summarizeLedgerStage, validateLedgerRows } from '../task/ledger.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
-import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal task-ledger <task-ref> <intent> [intent flags] [--dry-run]\n\nIntents: finding-upsert, finding-respond, finding-review, decision-next-id, decision-upsert, rework-intent-upsert, rework-intent-rebuild, stage-status\n`;
 const FLAGS = {
@@ -148,17 +147,7 @@ async function taskLedger(args = []) {
         usageFailure(lockResolved.message);
         return;
     }
-    let result;
-    try {
-        result = await withTaskExecutionLock(lockResolved.repoRoot, lockResolved.taskId, `task-ledger.${kind}`, async () => applyLedgerIntent(values));
-    }
-    catch (error) {
-        if (!(error instanceof TaskExecutionLockError))
-            throw error;
-        process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: error.code, message: error.message } })}\n`);
-        process.exitCode = 1;
-        return;
-    }
+    const result = await applyLedgerIntent(values);
     process.stdout.write(`${JSON.stringify(result)}\n`);
     if (result.status === 'failed')
         process.exitCode = 1;

package/dist/lib/internal/task-operation-registry.js

@@ -77,6 +77,7 @@ function internalTaskRoutes() {
         descriptor('internal', 'platform-checks', 'resolve-run', 'conditional', 'diagnostic'),
         descriptor('internal', 'platform-checks', 'logs', 'conditional', 'diagnostic'),
         descriptor('internal', 'task-context', 'resolve', 'task-bound', 'diagnostic'),
+        descriptor('internal', 'task-workspace', 'resolve', 'non-task', 'diagnostic', 'none'),
         descriptor('internal', 'task-ledger', 'decision-next-id', 'task-bound', 'diagnostic'),
         descriptor('internal', 'task-ledger', 'stage-status', 'task-bound', 'diagnostic'),
         descriptor('internal', 'task-ledger', 'finding-upsert', 'task-bound', 'progress'),
@@ -176,7 +177,7 @@ export const INTERNAL_DISPATCHER_ROUTES = Object.freeze([
     'task-create', 'task-qualification', 'sandbox-control', 'agent-client', 'codex-lifecycle',
     'git-workflow', 'task-delivery', 'release-workflow', 'platform-release-notes', 'platform-security', 'platform-metadata', 'platform-context',
     'platform-comment', 'platform-issue', 'platform-pr', 'platform-pr-review', 'pr-review-grade',
-    'platform-checks', 'task-context', 'task-ledger', 'task-warning', 'task-activity', 'task-artifact',
+    'platform-checks', 'task-context', 'task-workspace', 'task-ledger', 'task-warning', 'task-activity', 'task-artifact',
     'task-orchestration', 'task-review', 'task-event', 'task-lifecycle',
     'task-finalization', 'task-platform-recovery', 'task-short-id', 'task-snapshot', 'task-verify', 'task-validate', 'manual-validation'
 ]);

package/dist/lib/internal/task-qualification.js

@@ -2,7 +2,6 @@ import fs from 'node:fs';
 import { applyQualificationConfirmation } from '../task/qualification-confirmation.js';
 import { applyQualificationProposal } from '../task/qualification-intents.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
-import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal task-qualification <task-ref> <proposal|confirm|supersede|revoke> --input <json-file> [--dry-run]\n`;
 function fail(message, code = 'QUALIFICATION_PROPOSAL_INVALID') {
@@ -71,20 +70,12 @@ async function taskQualification(args = []) {
         fail(resolved.message, resolved.code);
         return;
     }
-    try {
-        const result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-qualification.${operation}`, () => operation === 'proposal'
-            ? applyQualificationProposal({ ...payload, taskRef: resolved.taskId, dryRun }, { repoRoot: resolved.repoRoot })
-            : applyQualificationConfirmation({ ...payload, taskRef: resolved.taskId, operation, dryRun }, { repoRoot: resolved.repoRoot }));
-        process.stdout.write(`${JSON.stringify(result)}\n`);
-        if (result.status === 'failed')
-            process.exitCode = 1;
-    }
-    catch (error) {
-        if (error instanceof TaskExecutionLockError)
-            fail(`${error.code}: ${error.message}`, error.code);
-        else
-            throw error;
-    }
+    const result = await (operation === 'proposal'
+        ? applyQualificationProposal({ ...payload, taskRef: resolved.taskId, dryRun }, { repoRoot: resolved.repoRoot })
+        : applyQualificationConfirmation({ ...payload, taskRef: resolved.taskId, operation, dryRun }, { repoRoot: resolved.repoRoot }));
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+    if (result.status === 'failed')
+        process.exitCode = 1;
 }
 export { taskQualification };
 //# sourceMappingURL=task-qualification.js.map

package/dist/lib/internal/task-review.js

@@ -1,7 +1,6 @@
 import { parseReviewCommand } from '../task/review-command.js';
 import { finalizeReviewSummary, preflightReviewSummary } from '../task/review-finalization.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
-import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
 import { ensureInternalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = 'Usage: agent-infra-internal task-review <task-ref> <preflight|finalize-summary> --stage <analysis|plan|code> --artifact <review-*.md> [--orchestrated] [--dry-run]\n';
 function failUsage(message) {
@@ -36,21 +35,9 @@ async function taskReview(args = []) {
         failUsage(resolved.message);
         return;
     }
-    let result;
-    try {
-        result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-review.${operation}`, async () => {
-            return operation === 'preflight'
-                ? preflightReviewSummary({ taskRef: args[0], stage, artifact, orchestrated, dryRun }, { lockAlreadyHeld: true })
-                : finalizeReviewSummary({ taskRef: args[0], stage, artifact, orchestrated, dryRun }, { lockAlreadyHeld: true });
-        });
-    }
-    catch (error) {
-        if (!(error instanceof TaskExecutionLockError))
-            throw error;
-        process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: error.code, message: error.message } })}\n`);
-        process.exitCode = 1;
-        return;
-    }
+    const result = operation === 'preflight'
+        ? preflightReviewSummary({ taskRef: args[0], stage, artifact, orchestrated, dryRun })
+        : finalizeReviewSummary({ taskRef: args[0], stage, artifact, orchestrated, dryRun });
     process.stdout.write(`${JSON.stringify(result)}\n`);
     if (result.status === 'failed')
         process.exitCode = 1;

package/dist/lib/internal/task-short-id.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { detectRepoRoot } from '../task/resolve-ref.js';
+import { resolveProjectTaskWorkspaceRoot } from '../task/workspace-root.js';
 import { configuredShortIdLength, executeShortIdCommand } from '../task/short-id.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal task-short-id <alloc|release|resolve|list> [argument] [--active-dir <path>] [--short-id-length <N>] [--verify]\n`;
@@ -75,7 +76,7 @@ function taskShortId(args = []) {
         repoRoot = detectRepoRoot();
     }
     catch { /* custom active-dir mode */ }
-    const resolvedActiveDir = activeDir ?? (repoRoot ? path.join(repoRoot, '.agents', 'workspace', 'active') : null);
+    const resolvedActiveDir = activeDir ?? (repoRoot ? path.join(resolveProjectTaskWorkspaceRoot(repoRoot), 'active') : null);
     if (!resolvedActiveDir) {
         failure('cannot determine active task directory');
         return;

package/dist/lib/internal/task-verify.js

@@ -1,6 +1,5 @@
 import { renderTaskVerification, verifyTaskEvent } from '../task/verification.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
-import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = 'Usage: agent-infra-internal task-verify <N | TASK-id> <verification-event> [--artifact <canonical.md>] [--format json|text]\n';
 function fail(message) {
@@ -55,16 +54,7 @@ async function taskVerify(args = []) {
         fail(resolved.message);
         return;
     }
-    let result;
-    try {
-        result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-verify.${event}`, async () => verifyTaskEvent({ taskRef, event, ...(artifact ? { artifact } : {}) }));
-    }
-    catch (error) {
-        if (!(error instanceof TaskExecutionLockError))
-            throw error;
-        fail(`${error.code}: ${error.message}`);
-        return;
-    }
+    const result = await verifyTaskEvent({ taskRef, event, ...(artifact ? { artifact } : {}) });
     process.stdout.write(format === 'text' ? renderTaskVerification(result) : `${JSON.stringify(result)}\n`);
     process.exitCode = result.status === 'pass' ? 0 : result.status === 'blocked' ? 2 : 1;
 }

package/dist/lib/internal/task-warning.js

@@ -1,6 +1,5 @@
 import { applyWorkflowWarningIntent } from '../task/workflow-warning-intents.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
-import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal task-warning <task-ref> <add|set-status|list> [intent flags] [--dry-run]\n`;
 const FLAGS = {
@@ -79,17 +78,7 @@ async function taskWarning(args = []) {
         usageFailure(resolved.message);
         return;
     }
-    let result;
-    try {
-        result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-warning.${kind}`, async () => applyWorkflowWarningIntent(values));
-    }
-    catch (error) {
-        if (!(error instanceof TaskExecutionLockError))
-            throw error;
-        process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: error.code, message: error.message } })}\n`);
-        process.exitCode = 1;
-        return;
-    }
+    const result = await applyWorkflowWarningIntent(values);
     process.stdout.write(`${JSON.stringify(result)}\n`);
     if (result.status === 'failed')
         process.exitCode = 1;

package/dist/lib/internal/task-workspace.js

@@ -0,0 +1,43 @@
+import { detectRepoRoot } from '../task/resolve-ref.js';
+import { resolveProjectTaskWorkspaceLayout } from '../task/workspace-root.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
+const USAGE = `Usage: agent-infra-internal task-workspace resolve [--boundary host|container]\n`;
+function fail(code, message) {
+    process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code, message } })}\n`);
+    process.exitCode = 1;
+}
+function taskWorkspace(args = []) {
+    if (!ensureInternalHandlerRoute('task-workspace', args))
+        return;
+    const operation = args[0] ?? '';
+    if (operation === '--help' || operation === '-h') {
+        process.stdout.write(USAGE);
+        return;
+    }
+    if (!internalHandlerRoute('task-workspace', 'resolve', operation)) {
+        fail('TASK_WORKSPACE_PAYLOAD_INVALID', "operation must be 'resolve'");
+        return;
+    }
+    let boundary = 'host';
+    const options = args.slice(1);
+    if (options.length !== 0) {
+        if (options.length !== 2 || options[0] !== '--boundary') {
+            fail('TASK_WORKSPACE_PAYLOAD_INVALID', 'invalid or duplicate task-workspace option');
+            return;
+        }
+        boundary = options[1];
+    }
+    if (boundary !== 'host' && boundary !== 'container') {
+        fail('TASK_WORKSPACE_PAYLOAD_INVALID', 'resolve accepts only --boundary host|container');
+        return;
+    }
+    try {
+        const layout = resolveProjectTaskWorkspaceLayout(detectRepoRoot(), boundary);
+        process.stdout.write(`${JSON.stringify({ status: 'resolved', changed: false, projectKey: layout.projectKey, boundary: layout.boundary, root: layout.root, error: null })}\n`);
+    }
+    catch (error) {
+        fail('TASK_WORKSPACE_OPERATION_FAILED', error instanceof Error ? error.message : String(error));
+    }
+}
+export { taskWorkspace };
+//# sourceMappingURL=task-workspace.js.map