@fitlab-ai/agent-infra 0.11.2 → 0.11.4

package/lib/sandbox/control/server.ts

@@ -1,5 +1,3 @@
-import { finalizationTerminalResponse } from './finalization-response.ts';
-import { isDeepStrictEqual } from 'node:util';
 import { completedReentryView } from './completed-reentry.ts';
 import fs from 'node:fs';
 import path from 'node:path';
@@ -12,7 +10,6 @@ import {
   SANDBOX_CONTROL_MAX_RESPONSE_BYTES,
   SANDBOX_CONTROL_MAX_TERMINAL_RECORD_BYTES,
   type SandboxControlManifest,
-  type SandboxControlRecoveryWarning,
   type SandboxControlRequest,
   type SandboxControlResponse,
   type SandboxControlTimingPolicy
@@ -62,10 +59,6 @@ import {
   operationRecoveryBinding,
   SANDBOX_CONTROL_REQUIRED_COMPLETION_PHASES
 } from '../../task/control-recovery.ts';
-import { readRun } from '../../task/orchestration.ts';
-import { readLifecycleRecoveryDomainEvidence } from '../../task/lifecycle-recovery.ts';
-import { captureRepositorySnapshot } from '../../task/workspace-snapshot.ts';
-import { parseTypedTaskFrontmatter } from '../../task/frontmatter.ts';
 import { readLifecycleJournalEvidence } from '../../task/lifecycle.ts';
 import { resolveTaskRef } from '../../task/resolve-ref.ts';
 import { loadShortIdByTaskId } from '../../task/short-id.ts';
@@ -83,75 +76,20 @@ import { readCodexControllerRegistration } from './controller-registration.ts';
 import { validateSandboxControlIdentity } from './identity-sentinel.ts';
 import {
   mergeSandboxTaskView,
-  taskViewAfterFinalization,
   taskViewForManifest,
   type SandboxTaskView
 } from './task-view.ts';
 import { taskCreateOutputUnavailableResult } from '../../task/create-service.ts';
-import {
-  consumeLifecycleRecoveryAttestation,
-  issueLifecycleRecoveryAttestation,
-  recoverLifecycleRecoveryOperation,
-  type LifecycleAuthorityResponseV1
-} from '../../task/control-authority.ts';
-import { createCodexCapabilityStore } from '../../agent-clients/adapters/codex-lifecycle/capability-store.ts';
-import { computeLifecycleBuildIdentity } from '../../agent-clients/adapters/codex-lifecycle/build-identity.ts';
 
 type ActiveExecution = {
   request: SandboxControlRequest;
   prepared: PreparedSandboxControlExecution;
-  lifecycleAuthority: LifecycleAuthorityResponseV1 | undefined;
   result: SandboxControlExecutionResult | null;
   resultEvidenceWritten: boolean;
   failure: unknown;
   settled: boolean;
 };
 
-function consumeLifecycleAuthorityForResult(
-  manifest: SandboxControlManifest,
-  execution: ActiveExecution
-): boolean {
-  const authority = execution.lifecycleAuthority?.attestation;
-  if (!authority || execution.result?.exitCode !== 0) return true;
-  try {
-    consumeLifecycleRecoveryAttestation(authority);
-    return true;
-  } catch (error) {
-    appendBrokerAudit(manifest, 'lifecycle-authority-consume-retry', {
-      ...requestAuditFields(manifest, execution.request),
-      errorCode: error instanceof Error ? error.name : 'LIFECYCLE_AUTHORITY_CONSUME_FAILED'
-    });
-    return false;
-  }
-}
-
-function lifecycleAuthorityForRequest(
-  manifest: SandboxControlManifest,
-  manifestPath: string,
-  request: SandboxControlRequest
-): LifecycleAuthorityResponseV1 | undefined {
-  const selector = request.family === 'task-workflow' || request.family === 'task-orchestration'
-    ? request.authority
-    : undefined;
-  if (!selector) return undefined;
-  let controllerBinding: { instanceDigest: string; controlGeneration: string } | null = null;
-  try {
-    const registration = readCodexControllerRegistration(manifestPath);
-    controllerBinding = {
-      instanceDigest: registration.controllerInstanceDigest,
-      controlGeneration: registration.controlGeneration
-    };
-  } catch {
-    // The issuer reports the stable unavailable result; the broker never trusts
-    // a controller binding supplied by the request.
-  }
-  return issueLifecycleRecoveryAttestation(selector, {
-    controllerBinding,
-    capabilityStore: createCodexCapabilityStore(),
-    buildIdentity: computeLifecycleBuildIdentity(manifest.repoRoot)
-  });
-}
-
 function appendBrokerAudit(
   manifest: SandboxControlManifest,
   event: string,
@@ -160,38 +98,21 @@ function appendBrokerAudit(
   appendDiagnosticAudit(manifest, event, { source: 'broker', ...fields });
 }
 
-function operationKey(request: SandboxControlRequest, output?: string): string | null {
+function operationKey(request: SandboxControlRequest): string | null {
   if (request.family === 'task-finalization') return request.operation;
   if (request.family === 'task-create') return 'create';
   if (request.family === 'codex-controller') return request.command;
-  if (request.family === 'task-workflow') return request.workflow.operation;
-  if (request.family !== 'task-lifecycle' && request.family !== 'task-orchestration') return null;
-  if (request.family === 'task-orchestration' && request.args[1] === 'route') {
-    if (!output) return 'route';
-    const result = parseControlOutput(output);
-    return result?.changed === true && result.status === 'completed' ? 'route.clean-completion' : 'route.read';
-  }
+  if (request.family !== 'task-lifecycle') return null;
   try {
     const operation = parseTaskControlOperation(request.family, request.args);
-    return operation.family === 'task-orchestration' ? operation.intent : operation.request.intent;
+    return operation.family === 'task-lifecycle' ? operation.request.intent : null;
   } catch {
     return null;
   }
 }
 
-function recoveryOperationKey(
-  request: SandboxControlRequest,
-  terminalResult: ReturnType<typeof readSandboxControlTerminalResult> | null,
-  output: string | undefined
-): string | null {
-  const operation = operationKey(request, output);
-  if (operation !== 'route') return operation;
-  const digest = terminalResult?.intentDigest;
-  for (const candidate of ['route.read', 'route.clean-completion'] as const) {
-    const expected = operationRecoveryBinding(request.id, request.generation, null, request.family, candidate).intentDigest;
-    if (digest === expected) return candidate;
-  }
-  return null;
+function recoveryOperationKey(request: SandboxControlRequest): string | null {
+  return operationKey(request);
 }
 
 function terminalResultMatchesRequest(
@@ -199,9 +120,7 @@ function terminalResultMatchesRequest(
   terminalResult: ReturnType<typeof readSandboxControlTerminalResult>
 ): boolean {
   const operation = operationKey(request);
-  const candidates = operation === 'route'
-    ? ['route.read', 'route.clean-completion']
-    : operation ? [operation] : [];
+  const candidates = operation ? [operation] : [];
   return candidates.some((candidate) => createHash('sha256').update(`${request.family}\0${candidate}`, 'utf8').digest('hex') === terminalResult.intentDigest);
 }
 
@@ -286,61 +205,6 @@ export function writeSandboxControlResponse(manifest: SandboxControlManifest, re
   return true;
 }
 
-type FinalizationRecovery = Readonly<{
-  status: 'matched' | 'deferred' | 'not-applicable';
-  response?: SandboxControlResponse;
-}>;
-
-function finalizationRecoveryResponse(
-  manifest: SandboxControlManifest,
-  requestId: string,
-  exitCode: number
-): FinalizationRecovery {
-  if (!manifest.taskId || exitCode !== 0) return { status: 'not-applicable' };
-  let receipt;
-  try {
-    receipt = readTaskFinalizationReceipt(manifest.repoRoot, manifest.taskId);
-    if (!receipt || !receipt.controlBinding
-      || receipt.controlBinding.generation !== manifest.generation
-      || receipt.controlBinding.requestId !== requestId) return { status: 'deferred' };
-    const resolved = resolveTaskRef(manifest.taskId, { repoRoot: manifest.repoRoot });
-    if (!resolved.ok || resolved.state !== 'completed' || receipt.lifecycle !== 'done') return { status: 'deferred' };
-  } catch {
-    return { status: 'deferred' };
-  }
-  return { status: 'matched', response: finalizationTerminalResponse(manifest.taskId, requestId, receipt) };
-}
-
-function publishFinalizationTaskView(
-  manifest: SandboxControlManifest,
-  broker: BrokerOwner,
-  requestId: string,
-  state: 'starting' | 'healthy' | 'busy' | 'parked',
-  reasonCode: string | null,
-  activeRequestId: string | null
-): SandboxTaskView {
-  let view: SandboxTaskView;
-  try {
-    const resolved = resolveTaskRef(manifest.taskId ?? '', { repoRoot: manifest.repoRoot });
-    const receipt = readTaskFinalizationReceipt(manifest.repoRoot, manifest.taskId ?? '');
-    view = resolved.ok && resolved.state === 'completed'
-      ? taskViewAfterFinalization({
-          taskId: manifest.taskId ?? '', generation: manifest.generation, requestId, receipt
-        })
-      : {
-          state: 'unknown', taskId: manifest.taskId, observedSource: 'unknown', receipt: null,
-          reasonCode: 'SANDBOX_TASK_VIEW_SOURCE_UNCONFIRMED'
-        };
-  } catch {
-    view = {
-      state: 'unknown', taskId: manifest.taskId, observedSource: 'unknown', receipt: null,
-      reasonCode: 'SANDBOX_TASK_VIEW_RECEIPT_INVALID'
-    };
-  }
-  writeSandboxControlStatus(manifest, broker, state, reasonCode, activeRequestId, Date.now(), view);
-  return view;
-}
-
 function payloadReference(payload: ReturnType<typeof createSandboxControlPayload>) {
   return {
     version: payload.version,
@@ -374,8 +238,7 @@ export function genericRecoveryResponse(
   request: SandboxControlRequest,
   exitCode: number,
   payload: ReturnType<typeof readSandboxControlPayload> | null,
-  cause: 'publish' | 'recovery' = 'recovery',
-  warning: SandboxControlRecoveryWarning | null = null
+  cause: 'publish' | 'recovery' = 'recovery'
 ): SandboxControlResponse {
   const outputUnavailable = request.family === 'task-create' && !payload;
   return {
@@ -384,9 +247,7 @@ export function genericRecoveryResponse(
     phase: 'completed',
     exitCode,
     stdout: outputUnavailable ? `${JSON.stringify(taskCreateOutputUnavailableResult(request.id))}\n` : '',
-    stderr: payload ? '' : warning
-      ? `${warning.code}: ${warning.message}\nAction: ${warning.action}\n`
-      : cause === 'publish'
+    stderr: payload ? '' : cause === 'publish'
         ? 'SANDBOX_CONTROL_OUTPUT_UNAVAILABLE: output payload was not retained\n'
         : 'SANDBOX_CONTROL_OUTPUT_UNAVAILABLE: broker restarted after executor completion\n',
     error: null,
@@ -465,42 +326,16 @@ function controllerDomainEvidence(
   }
 }
 
-function orchestrationDomainEvidence(
-  operation: ReturnType<typeof findSandboxControlRecoveryOperation>,
-  terminalResult: ReturnType<typeof readSandboxControlTerminalResult>,
-  output: Record<string, unknown> | null,
-  run: ReturnType<typeof readRun> | null
-): Readonly<Record<string, unknown>> {
-  if (!operation || !output) return { consistent: false };
-  const outputRun = output.run && typeof output.run === 'object' && !Array.isArray(output.run)
-    ? output.run as Record<string, unknown> : null;
-  const runMatches = outputRun === null ? run === null : run !== null && JSON.stringify(run) === JSON.stringify(outputRun);
-  if (operation.class === 'read-only') {
-    return {
-      consistent: output.status === terminalResult.status && output.changed === terminalResult.changed && runMatches,
-      snapshotValid: true,
-      status: run?.status ?? terminalResult.status,
-      pendingDelegation: run?.pendingDelegation ?? null
-    };
-  }
-  if (!run || !outputRun) return { consistent: false };
-  return {
-    consistent: output.status === terminalResult.status && output.changed === terminalResult.changed && runMatches,
-    status: run.status,
-    pendingDelegation: run.pendingDelegation
-  };
-}
-
-function readRecoveryDomain(
+async function readRecoveryDomain(
   manifest: SandboxControlManifest,
   manifestPath: string,
   request: SandboxControlRequest,
   operation: ReturnType<typeof findSandboxControlRecoveryOperation>,
   terminalResult: ReturnType<typeof readSandboxControlTerminalResult>,
   payloadOutput: string | null
-): RecoveryDomainEvidence {
+): Promise<RecoveryDomainEvidence> {
   if (!operation) return { domain: null };
-  const taskRef = request.family === 'task-finalization' || request.family === 'task-workflow'
+  const taskRef = request.family === 'task-finalization'
     ? manifest.taskId
     : 'args' in request ? request.args[0] ?? null : manifest.taskId;
   const output = parseControlOutput(payloadOutput);
@@ -510,19 +345,7 @@ function readRecoveryDomain(
 
   if (operation.family === 'task-lifecycle') {
     if (operation.intent === 'recover-started') {
-      try {
-        if (!('args' in request)) return { domain: null };
-        const parsed = parseTaskControlOperation('task-lifecycle', request.args);
-        if (parsed.family !== 'task-lifecycle' || parsed.request.intent !== 'recover-started') {
-          return { domain: null };
-        }
-        return {
-          domain: readLifecycleRecoveryDomainEvidence(manifest.repoRoot, parsed.request, terminalResult),
-          journal: readLifecycleJournalEvidence(manifest.repoRoot, taskRef!)
-        };
-      } catch {
-        return { domain: null };
-      }
+      return { domain: null };
     }
     if (!taskRef || !terminalResult.targetState) return { domain: null };
     const journal = readLifecycleJournalEvidence(manifest.repoRoot, taskRef);
@@ -541,48 +364,12 @@ function readRecoveryDomain(
     }
   }
 
-  if (operation.family === 'task-orchestration') {
-    if (!taskRef) return { domain: null };
-    try {
-      const resolved = resolveTaskRef(taskRef, { repoRoot: manifest.repoRoot });
-      if (!resolved.ok) return { domain: { consistent: false } };
-      const run = readRun(resolved.taskDir);
-      if (!run && operation.class !== 'read-only') return { domain: { consistent: false } };
-      if (operation.class === 'route.clean-completion') {
-        const snapshot = captureRepositorySnapshot(manifest.repoRoot);
-        const metadata = parseTypedTaskFrontmatter(fs.readFileSync(resolved.taskMdPath, 'utf8'));
-        const completion = run?.completionEvidence ?? null;
-        const consistent = run !== null && completion !== null
-          && terminalResult.completionEvidence !== null
-          && isDeepStrictEqual(completion, terminalResult.completionEvidence);
-        return {
-          domain: {
-            consistent,
-            status: run?.status ?? null,
-            pendingDelegation: run?.pendingDelegation ?? null,
-            completionEvidence: completion,
-            snapshot,
-            lastReviewedCommit: metadata.last_reviewed_commit
-          }
-        };
-      }
-      return { domain: orchestrationDomainEvidence(operation, terminalResult, output, run) };
-    } catch {
-      return { domain: { consistent: false } };
-    }
-  }
-
   if (operation.family === 'task-create') {
     return { domain: taskCreateDomainEvidence(manifest, output) };
   }
   if (operation.family === 'codex-controller') {
     return { domain: controllerDomainEvidence(manifest, manifestPath, request, output) };
   }
-  if (operation.family === 'task-workflow') {
-    return {
-      domain: { consistent: output?.status === terminalResult.status && output.changed === terminalResult.changed, snapshotValid: true }
-    };
-  }
   return { domain: null };
 }
 
@@ -597,15 +384,15 @@ function readCommittedCriticalPhases(manifest: SandboxControlManifest, requestId
   });
 }
 
-export function recoveryResponse(
+export async function recoveryResponse(
   manifest: SandboxControlManifest,
   manifestPath: string,
   request: SandboxControlRequest,
   evidence: ReturnType<typeof readSandboxControlResultEvidence>,
   payload: ReturnType<typeof readSandboxControlPayload> | null,
   terminalResult: ReturnType<typeof readSandboxControlTerminalResult>
-): SandboxControlResponse | null {
-  const operationName = recoveryOperationKey(request, terminalResult, payload?.stdout);
+): Promise<SandboxControlResponse | null> {
+  const operationName = recoveryOperationKey(request);
   const operation = operationName ? findSandboxControlRecoveryOperation(request.family, operationName) : null;
   if (!operation) return null;
   if (payload) {
@@ -614,32 +401,7 @@ export function recoveryResponse(
     }, payload.stdout);
     if (JSON.stringify(payloadTerminal) !== JSON.stringify(terminalResult)) return unknown(request.id);
   }
-  const finalization = request.family === 'task-finalization' ? finalizationRecoveryResponse(manifest, request.id, 0) : null;
-  if (evidence.exitCode === 0 && finalization?.status === 'deferred') return null;
-  if (evidence.exitCode === 0 && request.family === 'task-workflow' && request.authority?.phase === 'task-event.completed') {
-    try {
-      const registration = readCodexControllerRegistration(manifestPath);
-      const recovered = recoverLifecycleRecoveryOperation(request.authority, {
-        repoRoot: manifest.repoRoot,
-        capabilityStore: createCodexCapabilityStore(),
-        buildIdentity: computeLifecycleBuildIdentity(manifest.repoRoot),
-        controllerBinding: {
-          instanceDigest: registration.controllerInstanceDigest,
-          controlGeneration: registration.controlGeneration
-        }
-      });
-      if (recovered.status !== 'committed') return null;
-    } catch (error) {
-      appendBrokerAudit(manifest, 'lifecycle-authority-recovery-failed', {
-        ...requestAuditFields(manifest, request),
-        errorCode: error instanceof Error ? error.name : 'LIFECYCLE_AUTHORITY_RECOVERY_FAILED'
-      });
-      return null;
-    }
-  }
-  const recovery: RecoveryDomainEvidence = finalization
-    ? { domain: { consistent: finalization.status === 'matched' } }
-    : readRecoveryDomain(manifest, manifestPath, request, operation, terminalResult, payload?.stdout ?? null);
+  const recovery = await readRecoveryDomain(manifest, manifestPath, request, operation, terminalResult, payload?.stdout ?? null);
   const binding = operationRecoveryBinding(request.id, manifest.generation, manifest.taskId, request.family, operationName!);
   const decision = classifySandboxControlRecovery({
     operation,
@@ -653,31 +415,18 @@ export function recoveryResponse(
   if (decision.outcome === 'unknown' || decision.outcome === 'in-progress') return unknown(request.id);
   if (decision.outcome === 'not-executed') return notExecuted(request.id);
   if (decision.outcome !== 'success' && decision.outcome !== 'failure') return null;
-  if (request.family === 'task-finalization' && evidence.exitCode === 0) {
-    if (finalization?.status !== 'matched') return null;
-    return finalization.response ?? null;
-  }
-  return genericRecoveryResponse(request, evidence.exitCode, payload, 'recovery', terminalResult.warning ?? null);
+  return genericRecoveryResponse(request, evidence.exitCode, payload);
 }
 
-function terminalMatchesEvidence(
+async function terminalMatchesEvidence(
   manifest: SandboxControlManifest,
-  manifestPath: string,
   request: SandboxControlRequest,
   response: SandboxControlResponse,
   evidence: ReturnType<typeof readSandboxControlResultEvidence>,
   payload: ReturnType<typeof readSandboxControlPayload> | null,
   payloadInvalid: boolean,
   terminalResult: ReturnType<typeof readSandboxControlTerminalResult> | null
-): { valid: boolean; payloadReferenced: boolean } {
-  if (request.family === 'task-finalization' && evidence.exitCode === 0) {
-    if (!terminalResult) return { valid: false, payloadReferenced: false };
-    const expected = recoveryResponse(manifest, manifestPath, request, evidence, payload, terminalResult);
-    return {
-      valid: expected !== null && JSON.stringify(response) === JSON.stringify(expected),
-      payloadReferenced: false
-    };
-  }
+): Promise<{ valid: boolean; payloadReferenced: boolean }> {
   if (response.version !== 2 || response.id !== request.id || response.phase !== 'completed'
     || response.exitCode !== evidence.exitCode || response.error !== null) {
     return { valid: false, payloadReferenced: false };
@@ -701,7 +450,7 @@ function terminalMatchesEvidence(
   if (response.outputState === 'unavailable') {
     const causes = ['recovery', 'publish'] as const;
     const valid = causes.some((cause) => JSON.stringify(response)
-      === JSON.stringify(genericRecoveryResponse(request, evidence.exitCode, null, cause, terminalResult?.warning ?? null)));
+      === JSON.stringify(genericRecoveryResponse(request, evidence.exitCode, null, cause)));
     return { valid, payloadReferenced: false };
   }
   return {
@@ -716,55 +465,39 @@ function publishExecutionResult(
   manifest: SandboxControlManifest,
   request: SandboxControlRequest,
   result: SandboxControlExecutionResult,
-  broker: BrokerOwner,
   brokerOwns: () => boolean
 ): boolean {
   const normalized = sanitizeSandboxControlResult(manifest, result);
   const terminalResult = writeSandboxControlTerminalResult(manifest, {
     id: request.id,
     family: request.family,
-    operation: operationKey(request, normalized.stdout)
+    operation: operationKey(request)
   }, normalized.stdout);
   if (fs.existsSync(path.join(manifest.processingDir, request.id, 'transitions'))) {
     criticalRequestPhase(manifest, request, 'completed', normalized.exitCode === 0 ? 'success' : 'failure');
     criticalRequestPhase(manifest, request, 'evidence-written', normalized.exitCode === 0 ? 'success' : 'failure');
     criticalRequestPhase(manifest, request, 'publish-authorized', normalized.exitCode === 0 ? 'success' : 'failure');
   }
-  let terminal: SandboxControlResponse | null = null;
-  if (request.family === 'task-finalization') {
-    const finalization = finalizationRecoveryResponse(manifest, request.id, normalized.exitCode);
-    if (finalization.status === 'deferred') return false;
-    terminal = finalization.response ?? null;
-  }
-  if (!terminal) {
-    const inline: SandboxControlResponse = {
-      version: 2, id: request.id, phase: 'completed', exitCode: normalized.exitCode,
-      stdout: normalized.stdout, stderr: normalized.stderr, error: null
-    };
-    if (sandboxControlEncodedJsonBytes(inline) <= SANDBOX_CONTROL_MAX_TERMINAL_RECORD_BYTES) {
-      terminal = inline;
-    }
+  let terminal: SandboxControlResponse = {
+    version: 2, id: request.id, phase: 'completed', exitCode: normalized.exitCode,
+    stdout: normalized.stdout, stderr: normalized.stderr, error: null
+  };
+  if (sandboxControlEncodedJsonBytes(terminal) > SANDBOX_CONTROL_MAX_TERMINAL_RECORD_BYTES) {
     let payload: ReturnType<typeof createSandboxControlPayload> | null = null;
-    if (!terminal) {
-      try {
-        payload = createSandboxControlPayload(manifest, request.id, normalized);
-        const usage = sandboxControlGenerationUsage(manifest);
-        if (usage.bytes + sandboxControlEncodedJsonBytes(payload) <= SANDBOX_CONTROL_MAX_RESPONSE_BYTES) {
-          writeSandboxControlPayload(manifest, request.id, normalized);
-        } else {
-          payload = null;
-        }
-      } catch {
+    try {
+      payload = createSandboxControlPayload(manifest, request.id, normalized);
+      const usage = sandboxControlGenerationUsage(manifest);
+      if (usage.bytes + sandboxControlEncodedJsonBytes(payload) <= SANDBOX_CONTROL_MAX_RESPONSE_BYTES) {
+        writeSandboxControlPayload(manifest, request.id, normalized);
+      } else {
         payload = null;
       }
-      terminal = genericRecoveryResponse(request, normalized.exitCode, payload, 'publish', terminalResult.warning ?? null);
+    } catch {
+      payload = null;
     }
+    terminal = genericRecoveryResponse(request, normalized.exitCode, payload, 'publish');
   }
   if (!brokerOwns()) return false;
-  if (request.family === 'task-finalization' && normalized.exitCode === 0) {
-    const view = publishFinalizationTaskView(manifest, broker, request.id, 'healthy', null, null);
-    if (view.state === 'unknown') return false;
-  }
   const committed = writeSandboxControlResponse(manifest, terminal);
   if (committed && fs.existsSync(path.join(manifest.processingDir, request.id, 'transitions'))) {
     criticalRequestPhase(manifest, request, 'published-committed', normalized.exitCode === 0 ? 'success' : 'failure');
@@ -848,7 +581,7 @@ function assertCurrentSandboxControlIdentity(manifest: SandboxControlManifest, m
   }
 }
 
-function recoverProcessing(manifest: SandboxControlManifest, manifestPath: string, broker: BrokerOwner, brokerOwns: () => boolean): boolean {
+async function recoverProcessing(manifest: SandboxControlManifest, manifestPath: string, broker: BrokerOwner, brokerOwns: () => boolean): Promise<boolean> {
   for (const entry of fs.readdirSync(manifest.processingDir, { withFileTypes: true })) {
     if (!entry.isDirectory() || !/^[a-f0-9-]{16,64}$/.test(entry.name)) continue;
     if (!brokerOwns()) return false;
@@ -955,9 +688,8 @@ function recoverProcessing(manifest: SandboxControlManifest, manifestPath: strin
       if (terminal && (!request || !resultEvidence)) continue;
       if (terminal && request && resultEvidence) {
         if (!terminalResult && request.family !== 'task-create') continue;
-        const reconciliation = terminalMatchesEvidence(
+        const reconciliation = await terminalMatchesEvidence(
           manifest,
-          manifestPath,
           request,
           existingTerminalResponse!,
           resultEvidence,
@@ -968,10 +700,6 @@ function recoverProcessing(manifest: SandboxControlManifest, manifestPath: strin
         if (!reconciliation.valid) continue;
         terminalReconciled = true;
         payloadReferenced = reconciliation.payloadReferenced;
-        if (request.family === 'task-finalization' && resultEvidence.exitCode === 0) {
-          const view = publishFinalizationTaskView(manifest, broker, request.id, 'starting', null, null);
-          if (view.state === 'unknown') continue;
-        }
       }
       if (!terminalResult && !terminalReconciled) {
         if (terminal) continue;
@@ -989,19 +717,15 @@ function recoverProcessing(manifest: SandboxControlManifest, manifestPath: strin
       if (!terminal) {
         if (!brokerOwns()) return false;
         if (!resultEvidence || !request || payloadInvalid) continue;
-        const recovered = recoveryResponse(manifest, manifestPath, request, resultEvidence, payload, terminalResult!);
+        const recovered = await recoveryResponse(manifest, manifestPath, request, resultEvidence, payload, terminalResult!);
         if (!recovered) continue;
-        if (request.family === 'task-finalization' && resultEvidence.exitCode === 0) {
-          const view = publishFinalizationTaskView(manifest, broker, request.id, 'starting', null, null);
-          if (view.state === 'unknown') continue;
-        }
         writeSandboxControlResponse(manifest, recovered);
         const preserveRecoveryEvidence = recovered.error?.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN';
         if (transitionProtocolActive && !preserveRecoveryEvidence) {
           writeSandboxControlTransition(manifest, { requestId: entry.name, phase: 'recovered' });
         }
         if (preserveRecoveryEvidence) continue;
-        payloadReferenced = Boolean(payload) && request.family !== 'task-finalization';
+        payloadReferenced = Boolean(payload);
       }
     } else {
       if (!brokerOwns()) return false;
@@ -1099,14 +823,10 @@ export async function serveSandboxControl(
     try {
       startupReceipt = readTaskFinalizationReceipt(manifest.repoRoot, manifest.taskId);
     } catch {
-      // Preserve malformed receipt evidence as unknown rather than treating it as no receipt.
       startupReceipt = {};
     }
   }
-  let taskView = taskViewForManifest({
-    ...manifest,
-    receipt: startupReceipt
-  });
+  let taskView = taskViewForManifest({ ...manifest, receipt: startupReceipt });
   try {
     const previous = readSandboxControlStatus(manifest.publicStatusDir);
     if (previous.generation === manifest.generation) taskView = mergeSandboxTaskView(taskView, previous.taskView);
@@ -1140,7 +860,7 @@ export async function serveSandboxControl(
       pid: broker.pid,
       brokerId: broker.brokerId
     });
-    if (!recoverProcessing(manifest, manifestPath, broker, brokerOwns)) return;
+    if (!await recoverProcessing(manifest, manifestPath, broker, brokerOwns)) return;
     try {
       const published = readSandboxControlStatus(manifest.publicStatusDir);
       if (published.generation === manifest.generation) taskView = published.taskView;
@@ -1263,19 +983,7 @@ export async function serveSandboxControl(
         if (!brokerOwns()) break;
         let terminalCommitted = false;
         if (settledExecution.result && settledExecution.resultEvidenceWritten) {
-          if (!consumeLifecycleAuthorityForResult(manifest, settledExecution)) {
-            active = settledExecution;
-            continue;
-          }
-          terminalCommitted = publishExecutionResult(manifest, settledExecution.request, settledExecution.result, broker, brokerOwns);
-          if (terminalCommitted && settledExecution.request.family === 'task-finalization') {
-            try {
-              const published = readSandboxControlStatus(manifest.publicStatusDir);
-              if (published.generation === manifest.generation) taskView = published.taskView;
-            } catch {
-              taskView = { state: 'unknown', taskId: manifest.taskId, observedSource: 'unknown', receipt: null, reasonCode: 'SANDBOX_TASK_VIEW_STATUS_INVALID' };
-            }
-          }
+          terminalCommitted = publishExecutionResult(manifest, settledExecution.request, settledExecution.result, brokerOwns);
         } else {
           terminalCommitted = writeSandboxControlResponse(manifest, unknown(settledExecution.request.id));
         }
@@ -1351,17 +1059,9 @@ export async function serveSandboxControl(
             executorCwd: manifest.repoRoot,
             executorEntry: options.internalCliPath ?? process.argv[1] ?? null
           });
-          const lifecycleAuthority = lifecycleAuthorityForRequest(manifest, manifestPath, request);
-          if (lifecycleAuthority?.status === 'rejected') {
-            throw Object.assign(
-              new Error(lifecycleAuthority.error?.message ?? 'lifecycle authority was rejected'),
-              { code: lifecycleAuthority.error?.code ?? 'LIFECYCLE_AUTHORITY_REJECTED' }
-            );
-          }
           prepared = await prepareExecution({
             manifest, manifestPath, request, requestPath: claimed,
-            internalCliPath: options.internalCliPath ?? process.argv[1]!,
-            ...(lifecycleAuthority ? { lifecycleAuthority } : {})
+            internalCliPath: options.internalCliPath ?? process.argv[1]!
           });
           const preparedExecution = prepared;
           if (!preparedExecution) throw new Error('SANDBOX_CONTROL_EXECUTION_PREPARE_INVALID');
@@ -1376,7 +1076,7 @@ export async function serveSandboxControl(
             executionPath: executionPath(manifest, request.id)
           });
           const execution: ActiveExecution = {
-            request, prepared: preparedExecution, lifecycleAuthority, result: null,
+            request, prepared: preparedExecution, result: null,
             resultEvidenceWritten: false, failure: null, settled: false
           };
           active = execution;
@@ -1530,8 +1230,7 @@ export async function serveSandboxControl(
         }
       }
       if (owned && active.result && active.resultEvidenceWritten) {
-        if (consumeLifecycleAuthorityForResult(manifest, active)
-          && publishExecutionResult(manifest, active.request, active.result, broker, brokerOwns)) {
+        if (publishExecutionResult(manifest, active.request, active.result, brokerOwns)) {
           if (brokerOwns()) {
             removeAcceptedResponse(manifest, active.request.id);
             fs.rmSync(path.join(manifest.processingDir, active.request.id), { recursive: true, force: true });
@@ -1540,22 +1239,8 @@ export async function serveSandboxControl(
         }
       }
       if (active) {
-        const terminationConfirmed = active.prepared.terminate(owned);
-        if (owned && brokerOwns() && active.request.family === 'task-finalization') {
-          const recovered = finalizationRecoveryResponse(manifest, active.request.id, 0);
-          const view = recovered.status === 'matched'
-            ? publishFinalizationTaskView(manifest, broker, active.request.id, 'healthy', null, null)
-            : null;
-          if (view?.state !== 'unknown' && recovered.status === 'matched' && recovered.response
-            && writeSandboxControlResponse(manifest, recovered.response)) {
-            if (terminationConfirmed && brokerOwns()) {
-              removeAcceptedResponse(manifest, active.request.id);
-              fs.rmSync(path.join(manifest.processingDir, active.request.id), { recursive: true, force: true });
-              active = null;
-            }
-          }
-        }
-        if (owned && brokerOwns() && active && active.request.family !== 'task-finalization' && !active.resultEvidenceWritten) {
+        active.prepared.terminate(owned);
+        if (owned && brokerOwns() && active && !active.resultEvidenceWritten) {
           writeSandboxControlResponse(manifest, unknown(active.request.id));
         }
       }