@fitlab-ai/agent-infra 0.11.15 → 0.12.1

package/dist/lib/task/review-finalization.js

@@ -8,7 +8,6 @@ import { finalizeReviewSummaryContent } from './review-artifacts.js';
 import { inspectDecisionDetailDuplicates } from './decision-details.js';
 import { resolveTaskRef } from './resolve-ref.js';
 import { validateLifecycleExecution } from './lifecycle-execution.js';
-import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.js';
 import { getArtifactSchema } from './artifact-schema.js';
 import { validateQualificationAudit } from './qualification-audit.js';
 import { canonicalSemanticDigest, inspectArtifactContract, sha256Content } from './artifact-operations.js';
@@ -47,7 +46,7 @@ function preflightFailed(request, code, message, taskId = null, extra = {}) {
     };
 }
 /** Validate the current review draft before any finding-ledger write. */
-function preflightReviewSummaryUnlocked(request, options = {}) {
+function preflightReviewSummary(request, options = {}) {
     const stage = request.stage;
     const spec = STAGES[stage];
     if (!spec)
@@ -106,21 +105,6 @@ function preflightReviewSummaryUnlocked(request, options = {}) {
         status: 'passed', changed: false, error: null
     };
 }
-function preflightReviewSummary(request, options = {}) {
-    if (request.dryRun || options.lockAlreadyHeld)
-        return preflightReviewSummaryUnlocked(request, options);
-    const resolved = resolveTaskRef(request.taskRef, { repoRoot: options.repoRoot });
-    if (!resolved.ok)
-        return preflightReviewSummaryUnlocked(request, options);
-    try {
-        return withTaskExecutionLock(resolved.repoRoot, resolved.taskId, 'task-review.preflight', () => preflightReviewSummaryUnlocked(request, { ...options, lockAlreadyHeld: true }));
-    }
-    catch (error) {
-        if (!(error instanceof TaskExecutionLockError))
-            throw error;
-        return preflightFailed(request, 'REVIEW_PROVENANCE_INVALID', `${error.code}: ${error.message}`, resolved.taskId);
-    }
-}
 /** Prepare domain validation, summary bytes and provenance before any publication. */
 function prepareReviewSummaryCandidate(request, artifactContent, options = {}) {
     let taskId = null;
@@ -208,7 +192,6 @@ function prepareReviewSummaryCandidate(request, artifactContent, options = {}) {
             operations: transformed.changed ? [{ kind: 'artifact', artifact: request.artifact, operation: 'update' }] : [],
             error: null
         },
-        lockAlreadyHeld: options.lockAlreadyHeld
     };
 }
 function commitReviewSummaryProvenance(prepared, repoRoot, options = {}) {
@@ -230,7 +213,7 @@ function replaceCurrentArtifactAtomically(file, content) {
         }
     }
 }
-function finalizeReviewSummaryUnlocked(request, options = {}) {
+function finalizeReviewSummary(request, options = {}) {
     const spec = STAGES[request.stage];
     if (!spec || !request.taskRef || !request.artifact)
         return prepareReviewSummaryCandidate(request, '', options).result;
@@ -267,21 +250,5 @@ function finalizeReviewSummaryUnlocked(request, options = {}) {
         return failed(request, 'REVIEW_RECOVERY_COMMIT_FAILED', `cannot update current review artifact: ${error instanceof Error ? error.message : String(error)}`, resolved.taskId);
     }
 }
-function finalizeReviewSummary(request, options = {}) {
-    const effectiveOptions = options;
-    if (request.dryRun || options.lockAlreadyHeld)
-        return finalizeReviewSummaryUnlocked(request, effectiveOptions);
-    const resolved = resolveTaskRef(request.taskRef, { repoRoot: options.repoRoot });
-    if (!resolved.ok)
-        return finalizeReviewSummaryUnlocked(request, effectiveOptions);
-    try {
-        return withTaskExecutionLock(resolved.repoRoot, resolved.taskId, 'task-review.finalize-summary', () => finalizeReviewSummaryUnlocked(request, { ...effectiveOptions, lockAlreadyHeld: true }));
-    }
-    catch (error) {
-        if (!(error instanceof TaskExecutionLockError))
-            throw error;
-        return failed(request, 'REVIEW_PROVENANCE_INVALID', `${error.code}: ${error.message}`, resolved.taskId);
-    }
-}
 export { finalizeReviewSummary, preflightReviewSummary, prepareReviewSummaryCandidate, commitReviewSummaryProvenance };
 //# sourceMappingURL=review-finalization.js.map

package/dist/lib/task/review-identity.js

@@ -23,7 +23,9 @@ export function inspectReviewIdentity(taskDir, reportContent, repositoryRoot) {
     }
     try {
         const metadata = parseTypedTaskFrontmatter(fs.readFileSync(path.join(taskDir, 'task.md'), 'utf8'));
-        const taskRepositoryRoot = git(taskDir, ['rev-parse', '--show-toplevel']);
+        const taskRepositoryRoot = repositoryRoot
+            ? fs.realpathSync.native(repositoryRoot)
+            : git(taskDir, ['rev-parse', '--show-toplevel']);
         const branch = String(metadata.branch ?? '').trim();
         const gitRoot = branch ? resolveBranchWorktree(taskRepositoryRoot, branch) : taskRepositoryRoot;
         if (!gitRoot)

package/dist/lib/task/short-id.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { parseTypedTaskFrontmatter } from './frontmatter.js';
+import { resolveProjectTaskWorkspaceRoot } from './workspace-root.js';
 const REGISTRY_NAME = '.short-ids.json';
 const LOCK_NAME = '.short-ids.json.lock';
 function normalizeShortIdInput(input, opts) {
@@ -42,7 +43,7 @@ function resolveShortIdReadOnly(input, repoRoot, opts) {
         return shortIdFailure('SHORT_ID_NOT_FOUND', `short id '${input}' not found in active task registry`);
     }
     const key = normalized.value;
-    const registryPath = path.join(repoRoot, '.agents', 'workspace', 'active', REGISTRY_NAME);
+    const registryPath = path.join(resolveProjectTaskWorkspaceRoot(repoRoot), 'active', REGISTRY_NAME);
     if (!fs.existsSync(registryPath)) {
         return shortIdFailure('SHORT_ID_REGISTRY_NOT_FOUND', `short id '${key}' not found; active task registry is empty.`);
     }
@@ -95,8 +96,9 @@ function resolveShortIdReadOnly(input, repoRoot, opts) {
             : `short id '${key}' not found in task short-id registry.`;
         return shortIdFailure('SHORT_ID_NOT_FOUND', message);
     }
-    const activeTask = path.join(repoRoot, '.agents', 'workspace', 'active', taskId, 'task.md');
-    const completedTask = path.join(repoRoot, '.agents', 'workspace', 'completed', taskId, 'task.md');
+    const workspaceRoot = resolveProjectTaskWorkspaceRoot(repoRoot);
+    const activeTask = path.join(workspaceRoot, 'active', taskId, 'task.md');
+    const completedTask = path.join(workspaceRoot, 'completed', taskId, 'task.md');
     let isValidCompletedTask = false;
     try {
         const task = parseTypedTaskFrontmatter(fs.readFileSync(completedTask, 'utf8'));
@@ -210,7 +212,7 @@ function writeRegistry(registryPath, registry) {
     }
 }
 function mutateShortIdRegistry(repoRoot, taskId, requested) {
-    const activeDir = path.join(repoRoot, '.agents', 'workspace', 'active');
+    const activeDir = path.join(resolveProjectTaskWorkspaceRoot(repoRoot), 'active');
     return mutateShortIdRegistryAt(activeDir, configuredShortIdLength(repoRoot), taskId, requested);
 }
 function mutateShortIdRegistryAt(activeDir, width, taskId, requested, onlyReleaseWhenInactive = false, pruneOrphans = true) {
@@ -267,7 +269,7 @@ function mutateShortIdRegistryAt(activeDir, width, taskId, requested, onlyReleas
     });
 }
 function releaseStaleShortIdRegistry(repoRoot, taskId) {
-    const activeDir = path.join(repoRoot, '.agents', 'workspace', 'active');
+    const activeDir = path.join(resolveProjectTaskWorkspaceRoot(repoRoot), 'active');
     return mutateShortIdRegistryAt(activeDir, configuredShortIdLength(repoRoot), taskId, 'release', true, false);
 }
 function executeShortIdCommand(request) {
@@ -327,7 +329,7 @@ function executeShortIdCommand(request) {
     }
 }
 function readRegistry(repoRoot) {
-    const registryPath = path.join(repoRoot, '.agents', 'workspace', 'active', REGISTRY_NAME);
+    const registryPath = path.join(resolveProjectTaskWorkspaceRoot(repoRoot), 'active', REGISTRY_NAME);
     if (!fs.existsSync(registryPath))
         return null;
     try {
@@ -342,7 +344,7 @@ function readRegistry(repoRoot) {
     }
 }
 function readBranchFromTaskMd(repoRoot, taskId) {
-    const taskMdPath = path.join(repoRoot, '.agents', 'workspace', 'active', taskId, 'task.md');
+    const taskMdPath = path.join(resolveProjectTaskWorkspaceRoot(repoRoot), 'active', taskId, 'task.md');
     if (!fs.existsSync(taskMdPath))
         return null;
     const content = fs.readFileSync(taskMdPath, 'utf8');
@@ -362,7 +364,7 @@ function loadShortIdByTaskId(repoRoot) {
     return map;
 }
 function inspectShortIdRegistry(repoRoot, shortIdLength = configuredShortIdLength(repoRoot)) {
-    const registryPath = path.join(repoRoot, '.agents', 'workspace', 'active', REGISTRY_NAME);
+    const registryPath = path.join(resolveProjectTaskWorkspaceRoot(repoRoot), 'active', REGISTRY_NAME);
     if (!fs.existsSync(registryPath)) {
         return {
             status: 'missing',

package/dist/lib/task/verification-engine.js

@@ -54,9 +54,7 @@ const DEFAULT_REQUIRED_FIELDS = [
     "assigned_to"
 ];
 const DATE_TIME_PATTERN = /^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(?:[+-]\d{2}:\d{2})?$/;
-// Start markers (action suffixed with ` [started]`) are excluded from the
-// "latest action" / freshness computation so a step's in-flight marker never
-// satisfies a skill's expected_action_pattern; the matching done entry does.
+// Started rows do not represent completed lifecycle actions.
 const ACTIVITY_LOG_STARTED_RE = /\s*\[started\]\s*$/;
 const BRANCH_SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 // Review disagreement ledger (see .agents/rules/review-handshake.md).
@@ -322,15 +320,9 @@ function checkTaskMeta({ taskDir, config, repositoryRoot, skillName, artifactFil
     if (expectedStep && metadata.current_step !== expectedStep) {
         let validLifecycleArtifact = false;
         if (currentTask) {
-            const activityConfig = loadVerificationConfig(repositoryRoot, skillName).checks?.["activity-log"];
             const { section, invalidEntries } = inspectActivityLog(task.content);
-            if (activityConfig && section && invalidEntries.length === 0) {
-                let latestAction = "";
-                for (const entry of section.entries) {
-                    if (!ACTIVITY_LOG_STARTED_RE.test(entry.step))
-                        latestAction = entry.step;
-                }
-                validLifecycleArtifact = checkArtifactLifecycleActivityLog(taskDir, artifactFile, skillName, activityConfig, task, section.entries, latestAction)?.status === "pass";
+            if (section && invalidEntries.length === 0) {
+                validLifecycleArtifact = checkArtifactLifecycleActivityLog(taskDir, artifactFile, skillName, task, section.entries)?.status === "pass";
             }
         }
         if (!validLifecycleArtifact) {
@@ -634,14 +626,14 @@ function checkImplementationInput({ taskDir, artifactFile }) {
     return passResult("implementation-input", `${actionDecision} matches Activity Log, report, and task table`);
 }
 const ARTIFACT_ACTIVITY_STAGES = {
-    "analyze-task": { family: "analysis", event: "analyze.completed" },
-    "plan-task": { family: "plan", event: "plan.completed" },
-    "review-analysis": { family: "review-analysis", event: "review-analysis.completed" },
-    "review-plan": { family: "review-plan", event: "review-plan.completed" },
-    "code-task": { family: "code", event: "code.completed" },
-    "review-code": { family: "review-code", event: "review-code.completed" }
+    "analyze-task": { family: "analysis", event: "analyze.completed", action: "Analyze Task" },
+    "plan-task": { family: "plan", event: "plan.completed", action: "Plan Task" },
+    "review-analysis": { family: "review-analysis", event: "review-analysis.completed", action: "Review Analysis" },
+    "review-plan": { family: "review-plan", event: "review-plan.completed", action: "Review Plan" },
+    "code-task": { family: "code", event: "code.completed", action: "Code Task" },
+    "review-code": { family: "review-code", event: "review-code.completed", action: "Review Code" }
 };
-function checkArtifactLifecycleActivityLog(taskDir, artifactFile, skillName, config, task, entries, latestAction) {
+function checkArtifactLifecycleActivityLog(taskDir, artifactFile, skillName, task, entries) {
     const stage = ARTIFACT_ACTIVITY_STAGES[skillName];
     if (!stage)
         return null;
@@ -680,26 +672,18 @@ function checkArtifactLifecycleActivityLog(taskDir, artifactFile, skillName, con
             return failResult("activity-log", `Input '${input.name}' changed or is no longer current; rerun ${skillName} to refresh '${output}'`);
         }
     }
-    const expectedAction = new RegExp(config.expected_action_pattern);
+    const roundActionPattern = new RegExp(`^${stage.action} \\(Round ${identity.round}(?:, [^)]+)?\\)$`);
     const roundAction = entries.find((entry) => {
-        if (ACTIVITY_LOG_STARTED_RE.test(entry.step))
-            return false;
-        if (!expectedAction.test(entry.step))
-            return false;
-        expectedAction.lastIndex = 0;
-        const actionRound = /\(Round (\d+)/.exec(entry.step)?.[1];
-        return actionRound === String(identity.round) && entry.note.includes(`→ ${output}`);
+        return !ACTIVITY_LOG_STARTED_RE.test(entry.step)
+            && roundActionPattern.test(entry.step)
+            && entry.note.includes(`→ ${output}`);
     });
     if (!roundAction) {
         return failResult("activity-log", `No completed Activity Log row records '${output}' for ${skillName} Round ${identity.round}`);
     }
-    if (skillName === "plan-task" && /^(?:Human Decision|Decision)\b/.test(latestAction)
-        && expectedAction.test(latestAction)) {
-        return passResult("activity-log", `Plan completion '${output}' is current; latest action '${latestAction}' is a human decision`);
-    }
     return passResult("activity-log", `Current ${stage.family} completion '${output}' is valid for Round ${identity.round}`);
 }
-function checkActivityLog({ taskDir, config, skillName, artifactFile }) {
+function checkActivityLog({ taskDir, skillName, artifactFile }) {
     const task = loadTask(taskDir);
     if (!task.ok) {
         return failResult("activity-log", task.message);
@@ -712,37 +696,14 @@ function checkActivityLog({ taskDir, config, skillName, artifactFile }) {
     const entries = section.entries;
     if (entries.length === 0)
         return failResult("activity-log", "Activity Log has no entries");
-    let latestAction = "";
-    let latestTimestamp = "";
-    const doneActions = [];
     for (const entry of entries) {
         if (!entry.note.trim())
             return failResult("activity-log", "Activity Log entry note is required");
-        const { time: timestamp, step: action } = entry;
-        // A `[started]` marker is not a terminal action: keep latestAction/latestTimestamp
-        // on the most recent done entry so expected_action_pattern sees it.
-        if (!ACTIVITY_LOG_STARTED_RE.test(action)) {
-            latestTimestamp = timestamp;
-            latestAction = action;
-            doneActions.push(action);
-        }
     }
-    const artifactLifecycleResult = checkArtifactLifecycleActivityLog(taskDir, artifactFile, skillName, config, task, entries, latestAction);
+    const artifactLifecycleResult = checkArtifactLifecycleActivityLog(taskDir, artifactFile, skillName, task, entries);
     if (artifactLifecycleResult)
         return artifactLifecycleResult;
-    if (config.expected_action_pattern && !new RegExp(config.expected_action_pattern).test(latestAction)) {
-        const expected = new RegExp(config.expected_action_pattern);
-        let index = doneActions.length - 1;
-        while (index >= 0 && doneActions[index] === 'Commit' && !expected.test(doneActions[index]))
-            index -= 1;
-        if (index >= 0 && expected.test(doneActions[index])) {
-            latestAction = doneActions[index];
-        }
-    }
-    if (config.expected_action_pattern && !new RegExp(config.expected_action_pattern).test(latestAction)) {
-        return failResult("activity-log", `Latest action '${latestAction}' does not match '${config.expected_action_pattern}'`);
-    }
-    return passResult("activity-log", `Latest entry '${latestAction}' at ${latestTimestamp}`);
+    return passResult("activity-log", "Activity Log is valid");
 }
 function checkCompletionChecklist({ taskDir, config }) {
     const task = loadTask(taskDir);
@@ -932,10 +893,10 @@ async function checkPostReviewCommit({ taskDir, config, repositoryRoot }) {
     }
     let gitRoot;
     try {
-        gitRoot = execFileSync("git", ["-C", taskDir, "rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
+        gitRoot = execFileSync("git", ["-C", repositoryRoot, "rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
     }
     catch {
-        return blockedResult("post-review-commit", "git unavailable or task directory is not inside a git repository");
+        return blockedResult("post-review-commit", "git unavailable or repository root is not inside a git repository");
     }
     const task = loadTask(taskDir);
     if (!task.ok)

package/dist/lib/task/workspace-root.js

@@ -0,0 +1,59 @@
+import path from 'node:path';
+import fs from 'node:fs';
+import os from 'node:os';
+import { isSandbox } from '../sandbox/environment.js';
+/**
+ * Resolve the physical task-workspace boundary from the verified process
+ * execution context. Sandbox mode (task-bound / branch-only) does not affect
+ * the task workspace mount location.
+ */
+export function resolveTaskWorkspaceExecutionBoundary(env = process.env) {
+    if (env.AGENT_INFRA_SANDBOX !== '1')
+        return 'host';
+    const statusMountPath = env.AGENT_INFRA_CONTROL_STATUS_DIR;
+    if (!statusMountPath || !isSandbox(env, { statusMountPath })) {
+        throw new Error('task workspace boundary requires a verified sandbox execution context');
+    }
+    return 'container';
+}
+export function resolveTaskWorkspaceLayout(input) {
+    const { project, boundary } = input;
+    if (!project || project === '.' || project === '..' || /[\\/\u0000-\u001f\u007f]/u.test(project)) {
+        throw new TypeError('project must be a safe single path segment');
+    }
+    let root;
+    if (boundary === 'container') {
+        root = '/task-workspace';
+    }
+    else if (boundary === 'host') {
+        if (!input.home)
+            throw new TypeError('home is required for host task workspace resolution');
+        if (!path.isAbsolute(input.home))
+            throw new TypeError('home must be an absolute path for host task workspace resolution');
+        root = path.join(input.home, '.agent-infra', 'task-workspaces', project);
+    }
+    else {
+        throw new TypeError(`unsupported task workspace boundary: ${String(boundary)}`);
+    }
+    return {
+        projectKey: project,
+        boundary,
+        root,
+        active: path.join(root, 'active'),
+        blocked: path.join(root, 'blocked'),
+        completed: path.join(root, 'completed'),
+        archive: path.join(root, 'archive'),
+        shortIds: path.join(root, 'active', '.short-ids.json')
+    };
+}
+export function resolveProjectTaskWorkspaceLayout(repoRoot, boundary = resolveTaskWorkspaceExecutionBoundary()) {
+    const configPath = path.join(repoRoot, '.agents', '.airc.json');
+    const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+    if (typeof config.project !== 'string')
+        throw new TypeError(`project is missing from ${configPath}`);
+    return resolveTaskWorkspaceLayout({ project: config.project, boundary, home: process.env.HOME || os.homedir() });
+}
+export function resolveProjectTaskWorkspaceRoot(repoRoot) {
+    return resolveProjectTaskWorkspaceLayout(repoRoot).root;
+}
+//# sourceMappingURL=workspace-root.js.map

package/dist/lib/task/workspace-snapshot.js

@@ -3,6 +3,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { resolveProjectTaskWorkspaceRoot } from './workspace-root.js';
 function git(repoRoot, indexFile, args) {
     const env = indexFile ? { ...process.env, GIT_INDEX_FILE: indexFile } : process.env;
     const result = spawnSync('git', args, { cwd: repoRoot, env, encoding: 'utf8' });
@@ -32,7 +33,7 @@ function captureWorktreeTree(repoRoot, forcedPath) {
     }
 }
 function taskFileFingerprints(stateRoot, taskId) {
-    const activeRoot = path.join(stateRoot, '.agents', 'workspace', 'active');
+    const activeRoot = path.join(resolveProjectTaskWorkspaceRoot(stateRoot), 'active');
     const roots = taskId ? [path.join(activeRoot, taskId)] : [activeRoot];
     const records = [];
     const visit = (absolute, relative) => {
@@ -45,7 +46,7 @@ function taskFileFingerprints(stateRoot, taskId) {
         }
         if (!stat.isFile() && !stat.isSymbolicLink())
             return;
-        if (/^\.agents\/workspace\/(?:active|blocked|completed)\/TASK-[0-9]{8}-[0-9]{6}\/\.runtime\/orchestration\.json$/u.test(relative))
+        if (/^task-workspace\/(?:active|blocked|completed)\/TASK-[0-9]{8}-[0-9]{6}\/\.runtime\/orchestration\.json$/u.test(relative))
             return;
         const content = stat.isSymbolicLink()
             ? Buffer.from(fs.readlinkSync(absolute))
@@ -60,7 +61,7 @@ function taskFileFingerprints(stateRoot, taskId) {
     for (const root of roots) {
         if (!fs.existsSync(root))
             continue;
-        const relative = path.posix.join('.agents/workspace/active', path.relative(activeRoot, root).split(path.sep).join('/'));
+        const relative = path.posix.join('task-workspace/active', path.relative(activeRoot, root).split(path.sep).join('/'));
         visit(root, relative.replace(/\/$/, ''));
     }
     return records.sort((left, right) => left.path.localeCompare(right.path));

package/dist/lifecycle-build-manifest.json

@@ -1,6 +1,6 @@
 {
   "protocolVersion": 3,
-  "packageVersion": "0.11.15",
-  "sourceInputHash": "2d62f5ec22e0e0024a0e11258cef192b9d4c80764386bc112e4c2a3a03d72a3f",
-  "internalExecutableBuildHash": "9b88774ed654efea7d31aea3790aa1194f30df1f4487f95664de03f48815123f"
+  "packageVersion": "0.12.1",
+  "sourceInputHash": "b998fe9d348d3f7f55e1258d2d09793f09240d1d70173d6bce49a9ce6c89429e",
+  "internalExecutableBuildHash": "d75b6e06c5ed88b0cd03663d98e2001c3f5c661d9637b8e6b8993580f69a3f16"
 }

package/lib/agent-clients/adapters/codex-lifecycle/recovery.ts

@@ -11,7 +11,7 @@ import { captureTaskWriteMetadata, writeTask } from '../../../task/write.ts';
 import { parseTypedTaskFrontmatter } from '../../../task/frontmatter.ts';
 import { resolveTaskRef } from '../../../task/resolve-ref.ts';
 import {
-  recoverActivatedOrchestrationDelegationUnderLock,
+  recoverActivatedOrchestrationDelegation,
   readRun
 } from '../../../task/orchestration.ts';
 import type { OrchestrationOptions, OrchestrationRun } from '../../../task/orchestration.ts';
@@ -265,7 +265,7 @@ function appendRecoveryLog(
   });
 }
 
-function recoverStartedLifecycleUnderLock(
+function recoverStartedLifecycle(
   request: LifecycleRecoveryRequest,
   options: LifecycleRecoveryOptions = {}
 ): LifecycleRecoveryResult {
@@ -372,7 +372,7 @@ function consumeRecoveryEvidence(
   let consumed = stored;
   if (stored.consumer === null) {
     try {
-      consumed = store.consumeWithinTaskLock(pending.childId!, pending.id, stored.state.startEvidence?.hookDefinitionHash, {
+      consumed = store.consume(pending.childId!, pending.id, stored.state.startEvidence?.hookDefinitionHash, {
         taskId: pending.taskId, runId: pending.runId, receiptId: pending.id
       });
     } catch (error) {
@@ -393,7 +393,7 @@ function finishActiveRecovery(
   row: StepRow,
   options: LifecycleRecoveryOptions
 ): LifecycleRecoveryResult {
-  const recovered = recoverActivatedOrchestrationDelegationUnderLock(taskId, {
+  const recovered = recoverActivatedOrchestrationDelegation(taskId, {
     receiptId: pending.id,
     stage: pending.stage,
     round: pending.round,
@@ -411,8 +411,8 @@ function recoverStartedLifecycleFromAdapter(
   request: LifecycleRecoveryRequest,
   options: LifecycleRecoveryOptions = {}
 ): LifecycleRecoveryResult {
-  return recoverStartedLifecycleUnderLock(request, options);
+  return recoverStartedLifecycle(request, options);
 }
 
-export { recoverStartedLifecycleFromAdapter, recoverStartedLifecycleUnderLock };
+export { recoverStartedLifecycle, recoverStartedLifecycleFromAdapter };
 export type { LifecycleRecoveryOptions, LifecycleRecoveryRequest, LifecycleRecoveryResult };

package/lib/agent-clients/adapters/codex-lifecycle/store.ts

@@ -3,7 +3,6 @@ import path from 'node:path';
 
 import {
   mutateDelegationAdapterEvidence,
-  mutateDelegationAdapterEvidenceWithinTaskLock,
   readRun
 } from '../../../task/orchestration.ts';
 import type { DelegationReceipt } from '../../../task/delegation-receipts.ts';
@@ -195,12 +194,10 @@ function createCodexLifecycleStore(options: CodexLifecycleStoreOptions) {
   function update(
     binding: CodexLifecycleTaskBinding,
     key: string,
-    mutate: (current: StoredCodexLifecycle | null) => StoredCodexLifecycle,
-    taskLockHeld = false
+    mutate: (current: StoredCodexLifecycle | null) => StoredCodexLifecycle
   ): StoredCodexLifecycle {
     let result: StoredCodexLifecycle | null = null;
-    const updateState = taskLockHeld ? mutateDelegationAdapterEvidenceWithinTaskLock : mutateDelegationAdapterEvidence;
-    updateState(options.taskId, binding.receiptId, 'codex', (value) => {
+    mutateDelegationAdapterEvidence(options.taskId, binding.receiptId, 'codex', (value) => {
       const currentState = storedEvidence(value);
       const current = currentState.records[key] ?? null;
       result = mutate(current);
@@ -304,23 +301,18 @@ function createCodexLifecycleStore(options: CodexLifecycleStoreOptions) {
     return matches[0]!;
   }
 
-  function consumeWithLockMode(
+  function consume(
     childThreadId: string,
     consumer: string,
-    expectedHookDefinitionHash: string | undefined,
-    expectedTaskBinding: CodexLifecycleTaskBinding | undefined,
-    taskLockHeld: boolean
+    expectedHookDefinitionHash?: string,
+    expectedTaskBinding?: CodexLifecycleTaskBinding
   ): StoredCodexLifecycle {
     if (!consumer.trim()) throw new Error('Codex lifecycle consumer is required');
     const current = read(childThreadId);
     const binding = expectedTaskBinding ?? current.taskBinding;
     if (!binding) throw new Error('Codex lifecycle task receipt binding is missing');
     const spawn = current.state.spawn;
-    if (!spawn) {
-      throw new Error(taskLockHeld
-        ? 'Codex lifecycle task receipt binding is missing'
-        : 'Codex lifecycle spawn evidence is missing');
-    }
+    if (!spawn) throw new Error('Codex lifecycle spawn evidence is missing');
     const key = recordKey(spawn.sessionId, spawn.turnId, spawn.toolUseId);
     return update(binding, key, (latest) => {
       if (!latest || expectedTaskBinding && JSON.stringify(latest.taskBinding) !== JSON.stringify(expectedTaskBinding)) {
@@ -335,25 +327,7 @@ function createCodexLifecycleStore(options: CodexLifecycleStoreOptions) {
       }
       if (latest.consumer) return latest;
       return Object.freeze({ ...latest, revision: latest.revision + 1, consumer, consumedAt: now(), updatedAt: now() });
-    }, taskLockHeld);
-  }
-
-  function consume(
-    childThreadId: string,
-    consumer: string,
-    expectedHookDefinitionHash?: string,
-    expectedTaskBinding?: CodexLifecycleTaskBinding
-  ): StoredCodexLifecycle {
-    return consumeWithLockMode(childThreadId, consumer, expectedHookDefinitionHash, expectedTaskBinding, false);
-  }
-
-  function consumeWithinTaskLock(
-    childThreadId: string,
-    consumer: string,
-    expectedHookDefinitionHash?: string,
-    expectedTaskBinding?: CodexLifecycleTaskBinding
-  ): StoredCodexLifecycle {
-    return consumeWithLockMode(childThreadId, consumer, expectedHookDefinitionHash, expectedTaskBinding, true);
+    });
   }
 
   function expireBefore(cutoff: string): number {
@@ -373,7 +347,7 @@ function createCodexLifecycleStore(options: CodexLifecycleStoreOptions) {
     return changed;
   }
 
-  return Object.freeze({ taskId: options.taskId, root: path.join(taskDir, '.runtime'), apply, applyToSpawn, consume, consumeWithinTaskLock, expireBefore, findByParent, findByTaskBinding, read });
+  return Object.freeze({ taskId: options.taskId, root: path.join(taskDir, '.runtime'), apply, applyToSpawn, consume, expireBefore, findByParent, findByTaskBinding, read });
 }
 
 export { createCodexLifecycleStore, hasActiveCodexLifecycleEvidence, readCodexLifecycleActivationEvidence };

package/lib/agent-clients/adapters/codex-orchestration.ts

@@ -481,7 +481,7 @@ async function sealCodexOrchestrationDelegation(
       coreOptions(options),
       () => {
         try {
-          const consumed = store.consumeWithinTaskLock(
+          const consumed = store.consume(
             childThreadId,
             current.receipt.id,
             existing.state.spawn?.hookDefinitionHash,

package/lib/decide.ts

@@ -3,7 +3,6 @@ import { parseTaskScope } from './task/command-options.ts';
 import { applyHumanDecision } from './task/decision-intents.ts';
 import { canonicalTimestamp } from './task/write.ts';
 import { resolveTaskContext } from './task/resolve-ref.ts';
-import { TaskExecutionLockError, withTaskExecutionLock } from './task/task-execution-lock.ts';
 
 type DecideOptions = {
   repoRoot?: string;
@@ -70,15 +69,11 @@ export async function decide(args: string[], options: DecideOptions = {}): Promi
       repoRoot: resolved.repoRoot,
       metadataProvider: () => ({ timestamp: now, agentInfraVersion: options.version ?? VERSION })
     };
-    let result;
-    const execute = async () => applyHumanDecision(request, writeOptions);
-    result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, 'task-decision', execute);
+    const result = await applyHumanDecision(request, writeOptions);
     if (result.error) throw new Error(result.error.message);
     return 0;
   } catch (error) {
-    const message = error instanceof TaskExecutionLockError
-      ? `${error.code}: ${error.message}`
-      : error instanceof Error ? error.message : String(error);
+    const message = error instanceof Error ? error.message : String(error);
     process.stderr.write(`Error: ${message}\n`);
     return 1;
   }

package/lib/internal/cli-route-inventory.ts

@@ -52,6 +52,7 @@ export const INTERNAL_HANDLER_ROUTE_SELECTORS = Object.freeze({
   'pr-review-grade': ['decide', 'resolve-host', 'verify-artifact'],
   'platform-checks': ['inspect', 'watch', 'resolve-run', 'logs'],
   'task-context': ['resolve'],
+  'task-workspace': ['resolve'],
   'task-ledger': ['decision-next-id', 'stage-status', 'finding-upsert', 'finding-respond', 'finding-review', 'decision-upsert', 'rework-intent-upsert', 'rework-intent-rebuild'],
   'task-warning': ['list', 'add', 'set-status'],
   'task-activity': ['pr-review-inspect', 'pr-review-start', 'pr-review-complete', 'pr-review-terminate'],
@@ -104,6 +105,7 @@ export function internalRouteSelector(command: string, args: readonly string[]):
   if (['task-ledger', 'task-warning', 'task-activity'].includes(command)) return args[1] ?? '';
   if (command === 'task-delivery') return args[1] ?? '';
   if (command === 'task-context') return first(args);
+  if (command === 'task-workspace') return first(args);
   return first(args);
 }