@fitlab-ai/agent-infra 0.11.15 → 0.12.0

package/dist/lib/task/workspace-root.js

@@ -0,0 +1,59 @@
+import path from 'node:path';
+import fs from 'node:fs';
+import os from 'node:os';
+import { isSandbox } from '../sandbox/environment.js';
+/**
+ * Resolve the physical task-workspace boundary from the verified process
+ * execution context. Sandbox mode (task-bound / branch-only) does not affect
+ * the task workspace mount location.
+ */
+export function resolveTaskWorkspaceExecutionBoundary(env = process.env) {
+    if (env.AGENT_INFRA_SANDBOX !== '1')
+        return 'host';
+    const statusMountPath = env.AGENT_INFRA_CONTROL_STATUS_DIR;
+    if (!statusMountPath || !isSandbox(env, { statusMountPath })) {
+        throw new Error('task workspace boundary requires a verified sandbox execution context');
+    }
+    return 'container';
+}
+export function resolveTaskWorkspaceLayout(input) {
+    const { project, boundary } = input;
+    if (!project || project === '.' || project === '..' || /[\\/\u0000-\u001f\u007f]/u.test(project)) {
+        throw new TypeError('project must be a safe single path segment');
+    }
+    let root;
+    if (boundary === 'container') {
+        root = '/task-workspace';
+    }
+    else if (boundary === 'host') {
+        if (!input.home)
+            throw new TypeError('home is required for host task workspace resolution');
+        if (!path.isAbsolute(input.home))
+            throw new TypeError('home must be an absolute path for host task workspace resolution');
+        root = path.join(input.home, '.agent-infra', 'task-workspaces', project);
+    }
+    else {
+        throw new TypeError(`unsupported task workspace boundary: ${String(boundary)}`);
+    }
+    return {
+        projectKey: project,
+        boundary,
+        root,
+        active: path.join(root, 'active'),
+        blocked: path.join(root, 'blocked'),
+        completed: path.join(root, 'completed'),
+        archive: path.join(root, 'archive'),
+        shortIds: path.join(root, 'active', '.short-ids.json')
+    };
+}
+export function resolveProjectTaskWorkspaceLayout(repoRoot, boundary = resolveTaskWorkspaceExecutionBoundary()) {
+    const configPath = path.join(repoRoot, '.agents', '.airc.json');
+    const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+    if (typeof config.project !== 'string')
+        throw new TypeError(`project is missing from ${configPath}`);
+    return resolveTaskWorkspaceLayout({ project: config.project, boundary, home: process.env.HOME || os.homedir() });
+}
+export function resolveProjectTaskWorkspaceRoot(repoRoot) {
+    return resolveProjectTaskWorkspaceLayout(repoRoot).root;
+}
+//# sourceMappingURL=workspace-root.js.map

package/dist/lib/task/workspace-snapshot.js

@@ -3,6 +3,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { resolveProjectTaskWorkspaceRoot } from './workspace-root.js';
 function git(repoRoot, indexFile, args) {
     const env = indexFile ? { ...process.env, GIT_INDEX_FILE: indexFile } : process.env;
     const result = spawnSync('git', args, { cwd: repoRoot, env, encoding: 'utf8' });
@@ -32,7 +33,7 @@ function captureWorktreeTree(repoRoot, forcedPath) {
     }
 }
 function taskFileFingerprints(stateRoot, taskId) {
-    const activeRoot = path.join(stateRoot, '.agents', 'workspace', 'active');
+    const activeRoot = path.join(resolveProjectTaskWorkspaceRoot(stateRoot), 'active');
     const roots = taskId ? [path.join(activeRoot, taskId)] : [activeRoot];
     const records = [];
     const visit = (absolute, relative) => {
@@ -45,7 +46,7 @@ function taskFileFingerprints(stateRoot, taskId) {
         }
         if (!stat.isFile() && !stat.isSymbolicLink())
             return;
-        if (/^\.agents\/workspace\/(?:active|blocked|completed)\/TASK-[0-9]{8}-[0-9]{6}\/\.runtime\/orchestration\.json$/u.test(relative))
+        if (/^task-workspace\/(?:active|blocked|completed)\/TASK-[0-9]{8}-[0-9]{6}\/\.runtime\/orchestration\.json$/u.test(relative))
             return;
         const content = stat.isSymbolicLink()
             ? Buffer.from(fs.readlinkSync(absolute))
@@ -60,7 +61,7 @@ function taskFileFingerprints(stateRoot, taskId) {
     for (const root of roots) {
         if (!fs.existsSync(root))
             continue;
-        const relative = path.posix.join('.agents/workspace/active', path.relative(activeRoot, root).split(path.sep).join('/'));
+        const relative = path.posix.join('task-workspace/active', path.relative(activeRoot, root).split(path.sep).join('/'));
         visit(root, relative.replace(/\/$/, ''));
     }
     return records.sort((left, right) => left.path.localeCompare(right.path));

package/dist/lifecycle-build-manifest.json

@@ -1,6 +1,6 @@
 {
   "protocolVersion": 3,
-  "packageVersion": "0.11.15",
-  "sourceInputHash": "2d62f5ec22e0e0024a0e11258cef192b9d4c80764386bc112e4c2a3a03d72a3f",
-  "internalExecutableBuildHash": "9b88774ed654efea7d31aea3790aa1194f30df1f4487f95664de03f48815123f"
+  "packageVersion": "0.12.0",
+  "sourceInputHash": "c0a3da802ab0d992591d4ddd191550627992e7f76fea444bab99f342bd59ec18",
+  "internalExecutableBuildHash": "536ccdede573b4204982cb184b9b0f5ad8c3f943f3d1e749b42ed05bbcca9ead"
 }

package/lib/agent-clients/adapters/codex-lifecycle/recovery.ts

@@ -11,7 +11,7 @@ import { captureTaskWriteMetadata, writeTask } from '../../../task/write.ts';
 import { parseTypedTaskFrontmatter } from '../../../task/frontmatter.ts';
 import { resolveTaskRef } from '../../../task/resolve-ref.ts';
 import {
-  recoverActivatedOrchestrationDelegationUnderLock,
+  recoverActivatedOrchestrationDelegation,
   readRun
 } from '../../../task/orchestration.ts';
 import type { OrchestrationOptions, OrchestrationRun } from '../../../task/orchestration.ts';
@@ -265,7 +265,7 @@ function appendRecoveryLog(
   });
 }
 
-function recoverStartedLifecycleUnderLock(
+function recoverStartedLifecycle(
   request: LifecycleRecoveryRequest,
   options: LifecycleRecoveryOptions = {}
 ): LifecycleRecoveryResult {
@@ -372,7 +372,7 @@ function consumeRecoveryEvidence(
   let consumed = stored;
   if (stored.consumer === null) {
     try {
-      consumed = store.consumeWithinTaskLock(pending.childId!, pending.id, stored.state.startEvidence?.hookDefinitionHash, {
+      consumed = store.consume(pending.childId!, pending.id, stored.state.startEvidence?.hookDefinitionHash, {
         taskId: pending.taskId, runId: pending.runId, receiptId: pending.id
       });
     } catch (error) {
@@ -393,7 +393,7 @@ function finishActiveRecovery(
   row: StepRow,
   options: LifecycleRecoveryOptions
 ): LifecycleRecoveryResult {
-  const recovered = recoverActivatedOrchestrationDelegationUnderLock(taskId, {
+  const recovered = recoverActivatedOrchestrationDelegation(taskId, {
     receiptId: pending.id,
     stage: pending.stage,
     round: pending.round,
@@ -411,8 +411,8 @@ function recoverStartedLifecycleFromAdapter(
   request: LifecycleRecoveryRequest,
   options: LifecycleRecoveryOptions = {}
 ): LifecycleRecoveryResult {
-  return recoverStartedLifecycleUnderLock(request, options);
+  return recoverStartedLifecycle(request, options);
 }
 
-export { recoverStartedLifecycleFromAdapter, recoverStartedLifecycleUnderLock };
+export { recoverStartedLifecycle, recoverStartedLifecycleFromAdapter };
 export type { LifecycleRecoveryOptions, LifecycleRecoveryRequest, LifecycleRecoveryResult };

package/lib/agent-clients/adapters/codex-lifecycle/store.ts

@@ -3,7 +3,6 @@ import path from 'node:path';
 
 import {
   mutateDelegationAdapterEvidence,
-  mutateDelegationAdapterEvidenceWithinTaskLock,
   readRun
 } from '../../../task/orchestration.ts';
 import type { DelegationReceipt } from '../../../task/delegation-receipts.ts';
@@ -195,12 +194,10 @@ function createCodexLifecycleStore(options: CodexLifecycleStoreOptions) {
   function update(
     binding: CodexLifecycleTaskBinding,
     key: string,
-    mutate: (current: StoredCodexLifecycle | null) => StoredCodexLifecycle,
-    taskLockHeld = false
+    mutate: (current: StoredCodexLifecycle | null) => StoredCodexLifecycle
   ): StoredCodexLifecycle {
     let result: StoredCodexLifecycle | null = null;
-    const updateState = taskLockHeld ? mutateDelegationAdapterEvidenceWithinTaskLock : mutateDelegationAdapterEvidence;
-    updateState(options.taskId, binding.receiptId, 'codex', (value) => {
+    mutateDelegationAdapterEvidence(options.taskId, binding.receiptId, 'codex', (value) => {
       const currentState = storedEvidence(value);
       const current = currentState.records[key] ?? null;
       result = mutate(current);
@@ -304,23 +301,18 @@ function createCodexLifecycleStore(options: CodexLifecycleStoreOptions) {
     return matches[0]!;
   }
 
-  function consumeWithLockMode(
+  function consume(
     childThreadId: string,
     consumer: string,
-    expectedHookDefinitionHash: string | undefined,
-    expectedTaskBinding: CodexLifecycleTaskBinding | undefined,
-    taskLockHeld: boolean
+    expectedHookDefinitionHash?: string,
+    expectedTaskBinding?: CodexLifecycleTaskBinding
   ): StoredCodexLifecycle {
     if (!consumer.trim()) throw new Error('Codex lifecycle consumer is required');
     const current = read(childThreadId);
     const binding = expectedTaskBinding ?? current.taskBinding;
     if (!binding) throw new Error('Codex lifecycle task receipt binding is missing');
     const spawn = current.state.spawn;
-    if (!spawn) {
-      throw new Error(taskLockHeld
-        ? 'Codex lifecycle task receipt binding is missing'
-        : 'Codex lifecycle spawn evidence is missing');
-    }
+    if (!spawn) throw new Error('Codex lifecycle spawn evidence is missing');
     const key = recordKey(spawn.sessionId, spawn.turnId, spawn.toolUseId);
     return update(binding, key, (latest) => {
       if (!latest || expectedTaskBinding && JSON.stringify(latest.taskBinding) !== JSON.stringify(expectedTaskBinding)) {
@@ -335,25 +327,7 @@ function createCodexLifecycleStore(options: CodexLifecycleStoreOptions) {
       }
       if (latest.consumer) return latest;
       return Object.freeze({ ...latest, revision: latest.revision + 1, consumer, consumedAt: now(), updatedAt: now() });
-    }, taskLockHeld);
-  }
-
-  function consume(
-    childThreadId: string,
-    consumer: string,
-    expectedHookDefinitionHash?: string,
-    expectedTaskBinding?: CodexLifecycleTaskBinding
-  ): StoredCodexLifecycle {
-    return consumeWithLockMode(childThreadId, consumer, expectedHookDefinitionHash, expectedTaskBinding, false);
-  }
-
-  function consumeWithinTaskLock(
-    childThreadId: string,
-    consumer: string,
-    expectedHookDefinitionHash?: string,
-    expectedTaskBinding?: CodexLifecycleTaskBinding
-  ): StoredCodexLifecycle {
-    return consumeWithLockMode(childThreadId, consumer, expectedHookDefinitionHash, expectedTaskBinding, true);
+    });
   }
 
   function expireBefore(cutoff: string): number {
@@ -373,7 +347,7 @@ function createCodexLifecycleStore(options: CodexLifecycleStoreOptions) {
     return changed;
   }
 
-  return Object.freeze({ taskId: options.taskId, root: path.join(taskDir, '.runtime'), apply, applyToSpawn, consume, consumeWithinTaskLock, expireBefore, findByParent, findByTaskBinding, read });
+  return Object.freeze({ taskId: options.taskId, root: path.join(taskDir, '.runtime'), apply, applyToSpawn, consume, expireBefore, findByParent, findByTaskBinding, read });
 }
 
 export { createCodexLifecycleStore, hasActiveCodexLifecycleEvidence, readCodexLifecycleActivationEvidence };

package/lib/agent-clients/adapters/codex-orchestration.ts

@@ -481,7 +481,7 @@ async function sealCodexOrchestrationDelegation(
       coreOptions(options),
       () => {
         try {
-          const consumed = store.consumeWithinTaskLock(
+          const consumed = store.consume(
             childThreadId,
             current.receipt.id,
             existing.state.spawn?.hookDefinitionHash,

package/lib/decide.ts

@@ -3,7 +3,6 @@ import { parseTaskScope } from './task/command-options.ts';
 import { applyHumanDecision } from './task/decision-intents.ts';
 import { canonicalTimestamp } from './task/write.ts';
 import { resolveTaskContext } from './task/resolve-ref.ts';
-import { TaskExecutionLockError, withTaskExecutionLock } from './task/task-execution-lock.ts';
 
 type DecideOptions = {
   repoRoot?: string;
@@ -70,15 +69,11 @@ export async function decide(args: string[], options: DecideOptions = {}): Promi
       repoRoot: resolved.repoRoot,
       metadataProvider: () => ({ timestamp: now, agentInfraVersion: options.version ?? VERSION })
     };
-    let result;
-    const execute = async () => applyHumanDecision(request, writeOptions);
-    result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, 'task-decision', execute);
+    const result = await applyHumanDecision(request, writeOptions);
     if (result.error) throw new Error(result.error.message);
     return 0;
   } catch (error) {
-    const message = error instanceof TaskExecutionLockError
-      ? `${error.code}: ${error.message}`
-      : error instanceof Error ? error.message : String(error);
+    const message = error instanceof Error ? error.message : String(error);
     process.stderr.write(`Error: ${message}\n`);
     return 1;
   }

package/lib/internal/cli-route-inventory.ts

@@ -52,6 +52,7 @@ export const INTERNAL_HANDLER_ROUTE_SELECTORS = Object.freeze({
   'pr-review-grade': ['decide', 'resolve-host', 'verify-artifact'],
   'platform-checks': ['inspect', 'watch', 'resolve-run', 'logs'],
   'task-context': ['resolve'],
+  'task-workspace': ['resolve'],
   'task-ledger': ['decision-next-id', 'stage-status', 'finding-upsert', 'finding-respond', 'finding-review', 'decision-upsert', 'rework-intent-upsert', 'rework-intent-rebuild'],
   'task-warning': ['list', 'add', 'set-status'],
   'task-activity': ['pr-review-inspect', 'pr-review-start', 'pr-review-complete', 'pr-review-terminate'],
@@ -104,6 +105,7 @@ export function internalRouteSelector(command: string, args: readonly string[]):
   if (['task-ledger', 'task-warning', 'task-activity'].includes(command)) return args[1] ?? '';
   if (command === 'task-delivery') return args[1] ?? '';
   if (command === 'task-context') return first(args);
+  if (command === 'task-workspace') return first(args);
   return first(args);
 }
 

package/lib/internal/manual-validation.ts

@@ -4,7 +4,6 @@ import path from 'node:path';
 import { locateActivityLog, pairEntries } from '../task/activity-log.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
 import { applyTaskEvent } from '../task/events.ts';
-import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.ts';
 import { normalizeAgentToken } from '../agent-clients/tokens.ts';
 import { MANUAL_VALIDATION_RECEIPT_PLACEHOLDER, createManualValidationReceipt, manualValidationFinalSummaryDigest, manualValidationFinalSummaryProjectionMatches, readManualValidationReceipt, writeManualValidationReceiptAtomic } from '../task/manual-validation-receipt.ts';
 import { archiveManualValidationGeneration, createManualValidationTransaction, readManualValidationTransaction, retryManualValidationTransaction, summaryPreimageDigest, transitionManualValidationTransaction, validateManualValidationGenerationArchive, writeManualValidationTransactionAtomic } from '../task/manual-validation-transaction.ts';
@@ -91,20 +90,10 @@ async function executeManualValidationTransaction(taskRef: string, values: Recor
   if (!['pr_created', 'pr_reused', 'no_op'].includes(primaryResult)) return result('failed', { code: 'MANUAL_VALIDATION_TRANSACTION_ARGS_INVALID', message: '--result must be pr_created, pr_reused, or no_op' });
   const resolved = resolveTaskRef(taskRef, { repoRoot: cwd });
   if (!resolved.ok) return result('failed', { code: resolved.code, message: resolved.message });
-  try {
-    return await withTaskExecutionLock(
-      resolved.repoRoot,
-      resolved.taskId,
-      `manual-validation:${taskRef}`,
-      () => executeManualValidationTransactionLocked(taskRef, values, cwd, resolved, agent, primaryResult as 'pr_created' | 'pr_reused' | 'no_op', prepareOnly, options)
-    );
-  } catch (error) {
-    if (error instanceof TaskExecutionLockError) return result('failed', { code: error.code, message: error.message });
-    throw error;
-  }
+  return executeManualValidationTransactionAtResolvedTask(taskRef, values, cwd, resolved, agent, primaryResult as 'pr_created' | 'pr_reused' | 'no_op', prepareOnly, options);
 }
 
-async function executeManualValidationTransactionLocked(
+async function executeManualValidationTransactionAtResolvedTask(
   taskRef: string,
   values: Record<string, string>,
   cwd: string,
@@ -168,7 +157,7 @@ async function executeManualValidationTransactionLocked(
   let startedEventApplied = false;
   if (!transactionResult.ok) {
     transaction = createTransaction();
-    const started = applyTaskEvent({ taskRef, event: 'manual-validation.started', agent, initiator: 'model', requestId: transactionId, reasonCode: 'user-request', transactionId }, { lockAlreadyHeld: true, repoRoot: cwd });
+    const started = applyTaskEvent({ taskRef, event: 'manual-validation.started', agent, initiator: 'model', requestId: transactionId, reasonCode: 'user-request', transactionId }, { repoRoot: cwd });
     if (started.status === 'failed') return result('failed', started.error ?? { code: 'MANUAL_VALIDATION_TRANSACTION_FAILED', message: 'manual-validation started event failed' });
     startedEventApplied = true;
     if (previousTransaction) {
@@ -186,7 +175,7 @@ async function executeManualValidationTransactionLocked(
     }
   }
   if (transaction.phase === 'prepared' && !startedEventApplied) {
-    const started = applyTaskEvent({ taskRef, event: 'manual-validation.started', agent, initiator: 'model', requestId: transaction.transactionId, reasonCode: 'user-request', transactionId: transaction.transactionId }, { lockAlreadyHeld: true, repoRoot: cwd });
+    const started = applyTaskEvent({ taskRef, event: 'manual-validation.started', agent, initiator: 'model', requestId: transaction.transactionId, reasonCode: 'user-request', transactionId: transaction.transactionId }, { repoRoot: cwd });
     if (started.status === 'failed') return result('failed', started.error ?? { code: 'MANUAL_VALIDATION_TRANSACTION_FAILED', message: 'manual-validation started event failed' });
   }
   if (prepareOnly) return result('applied', null, { transaction, prepared: true, idempotent });
@@ -206,7 +195,7 @@ async function executeManualValidationTransactionLocked(
     if (transaction.phase === 'prepared') {
       const staged = await syncPullRequestSummary(taskRef, {
         cwd, client: options.client, agent, body: pendingBody, changeReportFile: path.resolve(cwd, values.changeReportFile!), primaryResult: primaryResult as 'pr_created' | 'pr_reused' | 'no_op', strict: true,
-        manualValidation: { phase: 'pending', transactionId: transaction.transactionId }, lockAlreadyHeld: true
+        manualValidation: { phase: 'pending', transactionId: transaction.transactionId }
       });
       if (!['applied', 'no-op'].includes(staged.status)) transactionFailure(staged.error ?? { code: 'MANUAL_VALIDATION_TRANSACTION_FAILED', message: 'pending summary staging failed' });
       transitionAndPersist('summary-staged');
@@ -242,7 +231,7 @@ async function executeManualValidationTransactionLocked(
       transitionAndPersist('receipt-committed', { committedReceipt: receipt.receiptDigest });
     }
     if (transaction.phase === 'receipt-committed' && !transaction.eventAppended) {
-      const completed = applyTaskEvent({ taskRef, event: 'manual-validation.completed', agent, initiator: 'model', requestId: transaction.transactionId, reasonCode: 'user-request', artifact: values.artifact, summaryResult: 'human-confirmed validation and committed receipt', transactionId: transaction.transactionId, receiptDigest: receipt.receiptDigest, prHeadSha: receipt.prHeadSha }, { lockAlreadyHeld: true, repoRoot: cwd });
+      const completed = applyTaskEvent({ taskRef, event: 'manual-validation.completed', agent, initiator: 'model', requestId: transaction.transactionId, reasonCode: 'user-request', artifact: values.artifact, summaryResult: 'human-confirmed validation and committed receipt', transactionId: transaction.transactionId, receiptDigest: receipt.receiptDigest, prHeadSha: receipt.prHeadSha }, { repoRoot: cwd });
       if (completed.status === 'failed') transactionFailure(completed.error ?? { code: 'MANUAL_VALIDATION_TRANSACTION_FAILED', message: 'manual-validation completion event failed' });
       transitionAndPersist('receipt-committed', { eventAppended: true });
     }
@@ -251,7 +240,7 @@ async function executeManualValidationTransactionLocked(
     }
     const promoted = await syncPullRequestSummary(taskRef, {
       cwd, client: options.client, agent, body: manualSummaryBody(finalBodyWithoutReceipt, 'final'), changeReportFile: path.resolve(cwd, values.changeReportFile!), primaryResult, strict: true,
-      manualValidation: { phase: 'final', transactionId: transaction.transactionId, receiptDigest: receipt.receiptDigest, prHeadSha: receipt.prHeadSha, authority: 'coordinator' }, lockAlreadyHeld: true
+      manualValidation: { phase: 'final', transactionId: transaction.transactionId, receiptDigest: receipt.receiptDigest, prHeadSha: receipt.prHeadSha, authority: 'coordinator' }
     });
     if (!['applied', 'no-op'].includes(promoted.status)) transactionFailure(promoted.error ?? { code: 'MANUAL_VALIDATION_TRANSACTION_RECOVERY_REQUIRED', message: 'final summary promotion failed' });
     const postWrite = await summaryCommentState(taskRef, { cwd, client: options.client });
@@ -264,7 +253,7 @@ async function executeManualValidationTransactionLocked(
       try {
         await syncPullRequestSummary(taskRef, {
           cwd, client: options.client, agent, body: pendingBody, changeReportFile: path.resolve(cwd, values.changeReportFile!), primaryResult: primaryResult as 'pr_created' | 'pr_reused' | 'no_op', strict: true,
-          manualValidation: { phase: 'pending', transactionId: transaction.transactionId }, lockAlreadyHeld: true
+          manualValidation: { phase: 'pending', transactionId: transaction.transactionId }
         });
       } catch {
         // Preserve recovery-required when pending compensation cannot be confirmed.

package/lib/internal/platform-comment.ts

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { resolveProjectTaskWorkspaceRoot } from '../task/workspace-root.ts';
 import { createHash, randomUUID } from 'node:crypto';
 
 import { normalizeAgentToken, AGENT_USAGE_HINT } from '../agent-clients/tokens.ts';
@@ -98,14 +99,14 @@ async function platformComment(args: string[] = []): Promise<void> {
     const unexpected = Object.keys(parsed.values).find((key) => !['issue', 'taskId', 'output', 'cwd'].includes(key));
     if (unexpected) { fail(`recover does not accept '--${unexpected}'`); return; }
     const outputPath = path.resolve(cwd, output);
-    const workspaceDir = path.resolve(cwd, '.agents', 'workspace');
+    const workspaceDir = resolveProjectTaskWorkspaceRoot(cwd);
     const stagingDir = path.dirname(outputPath);
     const stagingParent = fs.existsSync(stagingDir) ? path.dirname(fs.realpathSync(stagingDir)) : '';
     const realWorkspace = fs.existsSync(workspaceDir) ? fs.realpathSync(workspaceDir) : '';
     if (path.basename(outputPath) !== 'task.md' || stagingParent !== realWorkspace
       || !path.basename(stagingDir).startsWith('.restore-staging-') || !fs.existsSync(stagingDir)
       || !fs.lstatSync(stagingDir).isDirectory() || fs.existsSync(outputPath)) {
-      fail('recover output must be a new task.md inside an existing .agents/workspace/.restore-staging-* directory');
+      fail('recover output must be a new task.md inside an existing task-workspace/.restore-staging-* directory');
       return;
     }
     const listed = await listPlatformComments(issue, cwd);

package/lib/internal/task-activity.ts

@@ -7,7 +7,6 @@ import type {
   PrReviewInspectIntent
 } from '../task/activity-intent.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
-import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.ts';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.ts';
 
 const USAGE = `Usage: agent-infra-internal task-activity <task-ref> pr-review-inspect
@@ -95,15 +94,7 @@ async function taskActivity(args: string[] = []): Promise<void> {
   }
   const resolved = resolveTaskRef(taskRef);
   if (!resolved.ok) { usageFailure(resolved.message); return; }
-  let result;
-  try {
-    result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-activity.${kind}`, async () => applyPrReviewActivityIntent(values as PrReviewActivityIntent, { lockAlreadyHeld: true }));
-  } catch (error) {
-    if (!(error instanceof TaskExecutionLockError)) throw error;
-    process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: error.code, message: error.message } })}\n`);
-    process.exitCode = 1;
-    return;
-  }
+  const result = await applyPrReviewActivityIntent(values as PrReviewActivityIntent);
   process.stdout.write(`${JSON.stringify(result)}\n`);
   if (result.status === 'failed') process.exitCode = 1;
 }

package/lib/internal/task-event.ts

@@ -2,7 +2,6 @@ import { normalizeAgentToken, AGENT_USAGE_HINT } from '../agent-clients/tokens.t
 import { applyTaskEvent, eventCatalog } from '../task/events.ts';
 import type { TaskEventRequest, Verdict } from '../task/events.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
-import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.ts';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.ts';
 
 const USAGE = `Usage: agent-infra-internal task-event <N | TASK-id> <event> --agent <agent> [event options] [--orchestrated] [--dry-run]
@@ -73,15 +72,7 @@ async function taskEvent(args: string[] = []): Promise<void> {
     process.exitCode = 1;
     return;
   }
-  let result;
-  try {
-    result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-event.${request.event}`, async () => applyTaskEvent(request, { lockAlreadyHeld: true }));
-  } catch (error) {
-    if (!(error instanceof TaskExecutionLockError)) throw error;
-    process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: error.code, message: error.message } })}\n`);
-    process.exitCode = 1;
-    return;
-  }
+  const result = await applyTaskEvent(request);
   process.stdout.write(`${JSON.stringify(result)}\n`);
   if (result.status === 'failed') process.exitCode = 1;
 }

package/lib/internal/task-ledger.ts

@@ -4,7 +4,6 @@ import { applyLedgerIntent } from '../task/ledger-intents.ts';
 import type { LedgerIntent } from '../task/ledger-intents.ts';
 import { LEDGER_SECTION_MISSING_CODE, LEDGER_SECTION_MISSING_MESSAGE, isReviewStage, parseLedgerDocument, summarizeLedgerStage, validateLedgerRows } from '../task/ledger.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
-import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.ts';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.ts';
 
 const USAGE = `Usage: agent-infra-internal task-ledger <task-ref> <intent> [intent flags] [--dry-run]\n\nIntents: finding-upsert, finding-respond, finding-review, decision-next-id, decision-upsert, rework-intent-upsert, rework-intent-rebuild, stage-status\n`;
@@ -116,15 +115,7 @@ async function taskLedger(args: string[] = []): Promise<void> {
   }
   const lockResolved = resolveTaskRef(taskRef);
   if (!lockResolved.ok) { usageFailure(lockResolved.message); return; }
-  let result;
-  try {
-    result = await withTaskExecutionLock(lockResolved.repoRoot, lockResolved.taskId, `task-ledger.${kind}`, async () => applyLedgerIntent(values as LedgerIntent));
-  } catch (error) {
-    if (!(error instanceof TaskExecutionLockError)) throw error;
-    process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: error.code, message: error.message } })}\n`);
-    process.exitCode = 1;
-    return;
-  }
+  const result = await applyLedgerIntent(values as LedgerIntent);
   process.stdout.write(`${JSON.stringify(result)}\n`);
   if (result.status === 'failed') process.exitCode = 1;
 }

package/lib/internal/task-operation-registry.ts

@@ -112,6 +112,7 @@ function internalTaskRoutes(): TaskOperationDescriptor[] {
     descriptor('internal', 'platform-checks', 'resolve-run', 'conditional', 'diagnostic'),
     descriptor('internal', 'platform-checks', 'logs', 'conditional', 'diagnostic'),
     descriptor('internal', 'task-context', 'resolve', 'task-bound', 'diagnostic'),
+    descriptor('internal', 'task-workspace', 'resolve', 'non-task', 'diagnostic', 'none'),
     descriptor('internal', 'task-ledger', 'decision-next-id', 'task-bound', 'diagnostic'),
     descriptor('internal', 'task-ledger', 'stage-status', 'task-bound', 'diagnostic'),
     descriptor('internal', 'task-ledger', 'finding-upsert', 'task-bound', 'progress'),
@@ -214,7 +215,7 @@ export const INTERNAL_DISPATCHER_ROUTES = Object.freeze([
   'task-create', 'task-qualification', 'sandbox-control', 'agent-client', 'codex-lifecycle',
   'git-workflow', 'task-delivery', 'release-workflow', 'platform-release-notes', 'platform-security', 'platform-metadata', 'platform-context',
   'platform-comment', 'platform-issue', 'platform-pr', 'platform-pr-review', 'pr-review-grade',
-  'platform-checks', 'task-context', 'task-ledger', 'task-warning', 'task-activity', 'task-artifact',
+  'platform-checks', 'task-context', 'task-workspace', 'task-ledger', 'task-warning', 'task-activity', 'task-artifact',
   'task-orchestration', 'task-review', 'task-event', 'task-lifecycle',
   'task-finalization', 'task-platform-recovery', 'task-short-id', 'task-snapshot', 'task-verify', 'task-validate', 'manual-validation'
 ]);

package/lib/internal/task-qualification.ts

@@ -5,7 +5,6 @@ import type { QualificationConfirmationRequest } from '../task/qualification-con
 import { applyQualificationProposal } from '../task/qualification-intents.ts';
 import type { QualificationProposalRequest } from '../task/qualification-intents.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
-import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.ts';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.ts';
 
 const USAGE = `Usage: agent-infra-internal task-qualification <task-ref> <proposal|confirm|supersede|revoke> --input <json-file> [--dry-run]\n`;
@@ -46,16 +45,11 @@ async function taskQualification(args: string[] = []): Promise<void> {
   if (!payload || typeof payload !== 'object' || Array.isArray(payload)) { fail('qualification input must be an object'); return; }
   const resolved = resolveTaskRef(taskRef);
   if (!resolved.ok) { fail(resolved.message, resolved.code); return; }
-  try {
-    const result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-qualification.${operation}`, () => operation === 'proposal'
-      ? applyQualificationProposal({ ...(payload as Record<string, unknown>), taskRef: resolved.taskId, dryRun } as QualificationProposalRequest, { repoRoot: resolved.repoRoot })
-      : applyQualificationConfirmation({ ...(payload as Record<string, unknown>), taskRef: resolved.taskId, operation, dryRun } as QualificationConfirmationRequest, { repoRoot: resolved.repoRoot }));
-    process.stdout.write(`${JSON.stringify(result)}\n`);
-    if (result.status === 'failed') process.exitCode = 1;
-  } catch (error) {
-    if (error instanceof TaskExecutionLockError) fail(`${error.code}: ${error.message}`, error.code);
-    else throw error;
-  }
+  const result = await (operation === 'proposal'
+    ? applyQualificationProposal({ ...(payload as Record<string, unknown>), taskRef: resolved.taskId, dryRun } as QualificationProposalRequest, { repoRoot: resolved.repoRoot })
+    : applyQualificationConfirmation({ ...(payload as Record<string, unknown>), taskRef: resolved.taskId, operation, dryRun } as QualificationConfirmationRequest, { repoRoot: resolved.repoRoot }));
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+  if (result.status === 'failed') process.exitCode = 1;
 }
 
 export { taskQualification };

package/lib/internal/task-review.ts

@@ -1,7 +1,6 @@
 import { parseReviewCommand } from '../task/review-command.ts';
 import { finalizeReviewSummary, preflightReviewSummary } from '../task/review-finalization.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
-import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.ts';
 import { ensureInternalHandlerRoute } from './cli-route-inventory.ts';
 
 const USAGE = 'Usage: agent-infra-internal task-review <task-ref> <preflight|finalize-summary> --stage <analysis|plan|code> --artifact <review-*.md> [--orchestrated] [--dry-run]\n';
@@ -30,19 +29,9 @@ async function taskReview(args: string[] = []): Promise<void> {
   const operation = args[1]!;
   const resolved = resolveTaskRef(args[0]!);
   if (!resolved.ok) { failUsage(resolved.message); return; }
-  let result;
-  try {
-    result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-review.${operation}`, async () => {
-      return operation === 'preflight'
-        ? preflightReviewSummary({ taskRef: args[0]!, stage, artifact, orchestrated, dryRun }, { lockAlreadyHeld: true })
-        : finalizeReviewSummary({ taskRef: args[0]!, stage, artifact, orchestrated, dryRun }, { lockAlreadyHeld: true });
-    });
-  } catch (error) {
-    if (!(error instanceof TaskExecutionLockError)) throw error;
-    process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: error.code, message: error.message } })}\n`);
-    process.exitCode = 1;
-    return;
-  }
+  const result = operation === 'preflight'
+    ? preflightReviewSummary({ taskRef: args[0]!, stage, artifact, orchestrated, dryRun })
+    : finalizeReviewSummary({ taskRef: args[0]!, stage, artifact, orchestrated, dryRun });
   process.stdout.write(`${JSON.stringify(result)}\n`);
   if (result.status === 'failed') process.exitCode = 1;
 }

package/lib/internal/task-short-id.ts

@@ -1,6 +1,7 @@
 import path from 'node:path';
 
 import { detectRepoRoot } from '../task/resolve-ref.ts';
+import { resolveProjectTaskWorkspaceRoot } from '../task/workspace-root.ts';
 import { configuredShortIdLength, executeShortIdCommand } from '../task/short-id.ts';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.ts';
 
@@ -50,7 +51,7 @@ function taskShortId(args: string[] = []): void {
   if (positional.length > (operation === 'list' ? 0 : 1)) { failure('too many positional arguments'); return; }
   let repoRoot: string | null = null;
   try { repoRoot = detectRepoRoot(); } catch { /* custom active-dir mode */ }
-  const resolvedActiveDir = activeDir ?? (repoRoot ? path.join(repoRoot, '.agents', 'workspace', 'active') : null);
+  const resolvedActiveDir = activeDir ?? (repoRoot ? path.join(resolveProjectTaskWorkspaceRoot(repoRoot), 'active') : null);
   if (!resolvedActiveDir) { failure('cannot determine active task directory'); return; }
   const width = shortIdLength ?? (repoRoot ? configuredShortIdLength(repoRoot) : 2);
   const result = executeShortIdCommand({

package/lib/internal/task-verify.ts

@@ -1,6 +1,5 @@
 import { renderTaskVerification, verifyTaskEvent } from '../task/verification.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
-import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.ts';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.ts';
 
 const USAGE = 'Usage: agent-infra-internal task-verify <N | TASK-id> <verification-event> [--artifact <canonical.md>] [--format json|text]\n';
@@ -34,14 +33,7 @@ async function taskVerify(args: string[] = []): Promise<void> {
   }
   const resolved = resolveTaskRef(taskRef);
   if (!resolved.ok) { fail(resolved.message); return; }
-  let result;
-  try {
-    result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-verify.${event}`, async () => verifyTaskEvent({ taskRef, event, ...(artifact ? { artifact } : {}) }));
-  } catch (error) {
-    if (!(error instanceof TaskExecutionLockError)) throw error;
-    fail(`${error.code}: ${error.message}`);
-    return;
-  }
+  const result = await verifyTaskEvent({ taskRef, event, ...(artifact ? { artifact } : {}) });
   process.stdout.write(format === 'text' ? renderTaskVerification(result) : `${JSON.stringify(result)}\n`);
   process.exitCode = result.status === 'pass' ? 0 : result.status === 'blocked' ? 2 : 1;
 }

package/lib/internal/task-warning.ts

@@ -1,7 +1,6 @@
 import { applyWorkflowWarningIntent } from '../task/workflow-warning-intents.ts';
 import type { WorkflowWarningIntent } from '../task/workflow-warning-intents.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
-import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.ts';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.ts';
 
 const USAGE = `Usage: agent-infra-internal task-warning <task-ref> <add|set-status|list> [intent flags] [--dry-run]\n`;
@@ -52,15 +51,7 @@ async function taskWarning(args: string[] = []): Promise<void> {
   if (missing) { usageFailure(`${kind} requires '${missing}'`); return; }
   const resolved = resolveTaskRef(taskRef);
   if (!resolved.ok) { usageFailure(resolved.message); return; }
-  let result;
-  try {
-    result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-warning.${kind}`, async () => applyWorkflowWarningIntent(values as WorkflowWarningIntent));
-  } catch (error) {
-    if (!(error instanceof TaskExecutionLockError)) throw error;
-    process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: error.code, message: error.message } })}\n`);
-    process.exitCode = 1;
-    return;
-  }
+  const result = await applyWorkflowWarningIntent(values as WorkflowWarningIntent);
   process.stdout.write(`${JSON.stringify(result)}\n`);
   if (result.status === 'failed') process.exitCode = 1;
 }