@fitlab-ai/agent-infra 0.11.2 → 0.11.4

package/dist/lib/internal/manual-validation.js

@@ -5,7 +5,7 @@ import { resolveTaskRef } from '../task/resolve-ref.js';
 import { applyTaskEvent } from '../task/events.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
 import { normalizeAgentToken } from '../agent-clients/tokens.js';
-import { createManualValidationReceipt, manualValidationFinalSummaryDigest, manualValidationFinalSummaryProjectionMatches, readManualValidationReceipt, writeManualValidationReceiptAtomic } from '../task/manual-validation-receipt.js';
+import { MANUAL_VALIDATION_RECEIPT_PLACEHOLDER, createManualValidationReceipt, manualValidationFinalSummaryDigest, manualValidationFinalSummaryProjectionMatches, readManualValidationReceipt, writeManualValidationReceiptAtomic } from '../task/manual-validation-receipt.js';
 import { archiveManualValidationGeneration, createManualValidationTransaction, readManualValidationTransaction, retryManualValidationTransaction, summaryPreimageDigest, transitionManualValidationTransaction, validateManualValidationGenerationArchive, writeManualValidationTransactionAtomic } from '../task/manual-validation-transaction.js';
 import { sha256File } from '../task/artifact-receipts.js';
 import { summaryCommentState, syncPullRequestSummary } from '../platform/pr-summary.js';
@@ -22,28 +22,22 @@ function printFailure(format, error) {
         process.stderr.write(`${error.code}: ${error.message}\n`);
     process.exitCode = 1;
 }
-const MANUAL_VALIDATION_STATUS_SECTION = /^###\s+(?:⚠️\s+(?:需人工校验|Manual Validation Required)|✅\s+(?:人工验证已通过|无需人工校验|Manual Validation Passed|No Manual Validation Required)|⏳\s+(?:人工验证待收尾|Manual Validation Pending))\s*$[\s\S]*?(?=^#{1,3}\s|(?![\s\S]))/gmu;
-const TRAILING_CANONICAL_REPORT_PLACEHOLDER = /\n*<!--\s*canonical-pr-change-report\s*-->\s*$/u;
-function manualSummaryBody(body, phase, transactionId, receiptDigest = '', evidenceDigest = '', prHeadSha = '') {
+const MANUAL_VALIDATION_STATUS_HEADING = /^###\s+(?:⚠️\s+(?:需人工校验|Manual Validation Required)|✅\s+(?:人工验证已通过|无需人工校验|Manual Validation Passed|No Manual Validation Required)|⏳\s+(?:人工验证待收尾|Manual Validation Pending))\s*$/mu;
+function manualSummaryBody(body, phase) {
     const chinese = /###\s+(?:⚠️\s+需人工校验|✅\s+(?:人工验证已通过|无需人工校验)|⏳\s+人工验证待收尾)\s*$/mu.test(body);
-    const section = phase === 'pending'
-        ? chinese
-            ? `### ⏳ 人工验证待收尾\n\n人工验证证据已暂存；事务 ${transactionId} 正在等待最终完成。`
-            : `### ⏳ Manual Validation Pending\n\nManual validation evidence is staged; transaction ${transactionId} is awaiting final promotion.`
-        : chinese
-            ? `### ✅ 人工验证已通过\n\n人工验证已通过；transaction=${transactionId}; receipt=${receiptDigest}; evidence=${evidenceDigest}; head=${prHeadSha}.`
-            : `### ✅ Manual Validation Passed\n\nManual validation passed; transaction=${transactionId}; receipt=${receiptDigest}; evidence=${evidenceDigest}; head=${prHeadSha}.`;
-    let inserted = false;
-    const updated = body.replace(MANUAL_VALIDATION_STATUS_SECTION, (matched) => {
-        if (inserted)
-            return '';
-        inserted = true;
-        const trailingPlaceholder = TRAILING_CANONICAL_REPORT_PLACEHOLDER.exec(matched)?.[0];
-        return trailingPlaceholder
-            ? `${trailingPlaceholder.trim()}\n\n${section}\n\n`
-            : `${section}\n\n`;
-    });
-    return inserted ? `${updated.replace(/\s+$/u, '')}\n` : `${body.replace(/\s+$/u, '')}\n\n${section}\n`;
+    const heading = phase === 'pending'
+        ? chinese ? '### ⏳ 人工验证待收尾' : '### ⏳ Manual Validation Pending'
+        : chinese ? '### ✅ 人工验证已通过' : '### ✅ Manual Validation Passed';
+    const marker = phase === 'final'
+        ? `\n\n${MANUAL_VALIDATION_RECEIPT_PLACEHOLDER}`
+        : '';
+    if (MANUAL_VALIDATION_STATUS_HEADING.test(body)) {
+        return `${body.replace(MANUAL_VALIDATION_STATUS_HEADING, `${heading}${marker}`).replace(/\s+$/u, '')}\n`;
+    }
+    const fallback = phase === 'pending'
+        ? chinese ? '人工验证正在等待最终完成。' : 'Manual validation is awaiting final promotion.'
+        : chinese ? '人工验证已通过。' : 'Manual validation passed.';
+    return `${body.replace(/\s+$/u, '')}\n\n${heading}${marker}\n\n${fallback}\n`;
 }
 function openManualValidationStarted(taskMdPath) {
     let content;
@@ -102,7 +96,9 @@ async function executeManualValidationTransactionLocked(taskRef, values, cwd, re
     const pullRequest = currentState.pullRequest;
     const preimageBody = currentState.comment?.body ?? '';
     const preimage = { commentId: currentState.comment?.id ?? null, body: preimageBody, digest: summaryPreimageDigest(preimageBody) };
-    const evidenceDigest = sha256File(path.resolve(cwd, values.summaryFile));
+    const summaryPath = path.resolve(cwd, values.summaryFile);
+    const finalBodyWithoutReceipt = fs.readFileSync(summaryPath, 'utf8');
+    const evidenceDigest = sha256File(summaryPath);
     const archiveGeneration = options.archiveGeneration ?? archiveManualValidationGeneration;
     let transactionResult = readManualValidationTransaction(resolved.taskDir, { taskId: resolved.taskId, prNumber: pullRequest.number, prHeadSha: pullRequest.head.sha, evidenceDigest, artifact: values.artifact });
     let previousTransaction = null;
@@ -135,8 +131,7 @@ async function executeManualValidationTransactionLocked(taskRef, values, cwd, re
     const transactionId = transactionResult.ok
         ? transactionResult.value.transactionId
         : (openStarted.transactionId ?? values.transactionId ?? `mv-${Date.now()}`);
-    const finalBodyWithoutReceipt = fs.readFileSync(path.resolve(cwd, values.summaryFile), 'utf8');
-    const pendingBody = manualSummaryBody(finalBodyWithoutReceipt, 'pending', transactionId);
+    const pendingBody = manualSummaryBody(finalBodyWithoutReceipt, 'pending');
     const createTransaction = () => createManualValidationTransaction({
         transactionId,
         taskId: resolved.taskId,
@@ -145,7 +140,7 @@ async function executeManualValidationTransactionLocked(taskRef, values, cwd, re
         evidenceDigest,
         summaryPreimage: preimage,
         pendingSummaryDigest: summaryPreimageDigest(pendingBody),
-        finalSummaryDigest: manualValidationFinalSummaryDigest(manualSummaryBody(finalBodyWithoutReceipt, 'final', transactionId, '<receipt>', evidenceDigest, pullRequest.head.sha)),
+        finalSummaryDigest: manualValidationFinalSummaryDigest(manualSummaryBody(finalBodyWithoutReceipt, 'final')),
         artifact: values.artifact,
         attempt: 1,
         createdAt: new Date().toISOString(),
@@ -249,7 +244,7 @@ async function executeManualValidationTransactionLocked(taskRef, values, cwd, re
             transitionAndPersist('final-promotion-in-progress');
         }
         const promoted = await syncPullRequestSummary(taskRef, {
-            cwd, client: options.client, agent, body: manualSummaryBody(finalBodyWithoutReceipt, 'final', transaction.transactionId, receipt.receiptDigest, receipt.evidenceDigest, receipt.prHeadSha), changeReportFile: path.resolve(cwd, values.changeReportFile), primaryResult, strict: true,
+            cwd, client: options.client, agent, body: manualSummaryBody(finalBodyWithoutReceipt, 'final'), changeReportFile: path.resolve(cwd, values.changeReportFile), primaryResult, strict: true,
             manualValidation: { phase: 'final', transactionId: transaction.transactionId, receiptDigest: receipt.receiptDigest, prHeadSha: receipt.prHeadSha, authority: 'coordinator' }, lockAlreadyHeld: true
         });
         if (!['applied', 'no-op'].includes(promoted.status))

package/dist/lib/internal/sandbox-control.js

@@ -1,10 +1,9 @@
-import { recoverSandboxControl, requestSandboxControl, requestSandboxTaskFinalization, requestSandboxTaskWorkflow, resolveVisibleActiveShortId, SandboxControlClientError } from '../sandbox/control/client.js';
+import { recoverSandboxControl, requestSandboxControl, requestSandboxTaskFinalization, SandboxControlClientError } from '../sandbox/control/client.js';
 import { normalizeAgentToken, AGENT_USAGE_HINT } from '../agent-clients/tokens.js';
 import { serveSandboxControl } from '../sandbox/control/server.js';
 import { runSandboxControlExecutor } from '../sandbox/control/executor.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 import { parseTaskCreateResult, taskCreateExitCode } from '../task/create-service.js';
-import { createTaskWorkflowRequest } from '../sandbox/control/task-workflow.js';
 function writeFinalizationEnvelope(status, accepted, error, changed = false, result = null) {
     process.stdout.write(`${JSON.stringify({ version: 1, status, changed, accepted, result, error })}\n`);
 }
@@ -132,47 +131,6 @@ async function sandboxControl(args) {
             sandboxFinalizationClient(commandArgs);
             return;
         }
-        if (family === 'task-workflow') {
-            const command = commandArgs[0];
-            const taskId = process.env.AGENT_INFRA_TASK_ID;
-            const generation = process.env.AGENT_INFRA_CONTROL_GENERATION;
-            if (!command || !taskId || !generation) {
-                process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'SANDBOX_CONTROL_REQUEST_INVALID', message: 'task-workflow requires a bound task and generation' } })}\n`);
-                process.exitCode = 1;
-                return;
-            }
-            let workflow;
-            try {
-                const args = commandArgs.slice(1);
-                if (/^\d+$/.test(args[0] ?? '')) {
-                    const resolved = resolveVisibleActiveShortId(args[0]);
-                    if (resolved !== taskId)
-                        throw new Error('SANDBOX_TASK_REF_MISMATCH');
-                    args[0] = resolved;
-                }
-                workflow = createTaskWorkflowRequest(command, args, taskId, generation);
-            }
-            catch (error) {
-                process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'SANDBOX_CONTROL_REQUEST_INVALID', message: error instanceof Error ? error.message : String(error) } })}\n`);
-                process.exitCode = 1;
-                return;
-            }
-            let response;
-            try {
-                response = requestSandboxTaskWorkflow({ workflow });
-            }
-            catch (error) {
-                if (!(error instanceof SandboxControlClientError))
-                    throw error;
-                writeClientError(error);
-                process.exitCode = error.detail.retryable ? 75 : 1;
-                return;
-            }
-            process.stdout.write(response.stdout);
-            process.stderr.write(response.stderr);
-            process.exitCode = response.phase === 'rejected' ? response.error?.retryable ? 75 : 1 : response.exitCode ?? 1;
-            return;
-        }
         let response;
         try {
             response = requestSandboxControl({ family, args: commandArgs });

package/dist/lib/internal/task-artifact.js

@@ -1,6 +1,6 @@
 import { parseArtifactCommand, executeArtifactCommand } from '../task/artifact-command.js';
 import { ensureInternalHandlerRoute } from './cli-route-inventory.js';
-const USAGE = `Usage: agent-infra-internal task-artifact <N | TASK-id> inspect --family <family>\n       agent-infra-internal task-artifact <N | TASK-id> init --family <family> --artifact <artifact> [--locale <zh-CN|en>]\n       agent-infra-internal task-artifact <N | TASK-id> preflight|finalize-local --family <analysis|plan|code> --artifact <artifact>\n\nInspect, initialize, preflight, or finalize a workflow artifact without changing task state.\n`;
+const USAGE = `Usage: agent-infra-internal task-artifact <N | TASK-id> inspect --family <family> [--source-finding <id> --source-artifact <name> --source-sha256 <digest>]\n       agent-infra-internal task-artifact <N | TASK-id> init --family <family> --artifact <artifact> [--locale <zh-CN|en>]\n       agent-infra-internal task-artifact <N | TASK-id> preflight|finalize-local --family <analysis|plan|code> --artifact <artifact>\n\nInspect, initialize, preflight, or finalize workflow artifact facts.\n`;
 function taskArtifact(args = []) {
     if (!ensureInternalHandlerRoute('task-artifact', args))
         return;

package/dist/lib/internal/task-finalization.js

@@ -1,6 +1,9 @@
 import { createDirectHostExecutionContext, dispatchTaskControlOperation, parseTaskControlOperation } from '../task/control-authority.js';
-import { applyTaskFinalization } from '../task/finalization.js';
+import { applyTaskFinalization, prepareTaskFinalization } from '../task/finalization.js';
 import { detectRepoRoot, resolveTaskRef } from '../task/resolve-ref.js';
+import { verifyTaskEvent } from '../task/verification.js';
+import { resolveSandboxControlTransport } from './task-operation-registry.js';
+import { requestSandboxTaskFinalization, SandboxControlClientError } from '../sandbox/control/client.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = 'Usage: agent-infra-internal task-finalization <N | TASK-id> complete --agent <agent>\n';
 function envelope(status, changed, accepted, result, error) {
@@ -59,7 +62,44 @@ async function taskFinalization(args = []) {
         ...operation,
         request: { ...operation.request, taskRef: resolved.taskId }
     };
+    const transport = resolveSandboxControlTransport(process.env, { localWorkflow: true });
+    if (transport.kind === 'sandbox-local') {
+        const prepared = await prepareTaskFinalization(boundOperation.request, {
+            repoRoot,
+            preflight: (request, options) => verifyTaskEvent({ ...request, event: 'complete-task.hard-preflight' }, options)
+        });
+        if (prepared.status !== 'prepared') {
+            process.stdout.write(envelope(prepared.status, prepared.changed, true, prepared, prepared.error));
+            process.exitCode = exitCode(prepared.status);
+            return;
+        }
+        try {
+            const response = requestSandboxTaskFinalization({ agent: boundOperation.request.agent });
+            process.stdout.write(response.stdout);
+            process.stderr.write(response.stderr);
+            process.exitCode = response.exitCode ?? 1;
+            return;
+        }
+        catch (error) {
+            const detail = error instanceof SandboxControlClientError
+                ? error.detail
+                : { code: 'SANDBOX_CONTROL_CLIENT_FAILED', message: error instanceof Error ? error.message : String(error), retryable: false };
+            process.stdout.write(envelope(detail.retryable ? 'blocked' : 'failed', false, false, null, detail));
+            process.exitCode = detail.retryable ? 2 : 1;
+            return;
+        }
+    }
     const result = await dispatchTaskControlOperation(createDirectHostExecutionContext({ repoRoot }), boundOperation);
+    if (result.status === 'prepared') {
+        const detail = {
+            code: 'TASK_FINALIZATION_DIRECT_COMMIT_REQUIRED',
+            message: 'direct finalization prepared external work without committing the lifecycle transition',
+            retryable: false
+        };
+        process.stdout.write(envelope('failed', result.changed, true, result, detail));
+        process.exitCode = 1;
+        return;
+    }
     process.stdout.write(envelope(result.status, result.changed, true, result, result.error));
     process.exitCode = exitCode(result.status);
 }

package/dist/lib/internal/task-ledger.js

@@ -5,17 +5,18 @@ import { LEDGER_SECTION_MISSING_CODE, LEDGER_SECTION_MISSING_MESSAGE, isReviewSt
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
-const USAGE = `Usage: agent-infra-internal task-ledger <task-ref> <intent> [intent flags] [--dry-run]\n\nIntents: finding-upsert, finding-respond, finding-review, decision-next-id, decision-upsert, rework-intent-upsert, stage-status\n`;
+const USAGE = `Usage: agent-infra-internal task-ledger <task-ref> <intent> [intent flags] [--dry-run]\n\nIntents: finding-upsert, finding-respond, finding-review, decision-next-id, decision-upsert, rework-intent-upsert, rework-intent-rebuild, stage-status\n`;
 const FLAGS = {
     '--stage': 'stage', '--review-artifact': 'reviewArtifact', '--ordinal': 'ordinal',
     '--severity': 'severity', '--evidence': 'evidence', '--id': 'id', '--round': 'round',
     '--status': 'status', '--artifact': 'artifact', '--needs-implementation': 'needsImplementation',
     '--intent-id': 'intentId', '--finding-id': 'findingId', '--source-artifact': 'sourceArtifact',
-    '--source-sha256': 'sourceSha256', '--target': 'target',
+    '--source-sha256': 'sourceSha256', '--classification': 'classification',
     '--override-ticket': 'overrideTicket', '--override-target': 'overrideTarget', '--override-scope': 'overrideScope'
 };
 const NUMERIC = new Set(['ordinal', 'round']);
 const BOOLEAN = new Set(['needsImplementation']);
+const REWORK_CLASSIFICATIONS = new Set(['scope-or-requirement', 'design', 'implementation', 'human-decision', 'insufficient-evidence']);
 function usageFailure(message) {
     process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'LEDGER_PAYLOAD_INVALID', message } })}\n`);
     process.stderr.write(USAGE);
@@ -40,6 +41,7 @@ async function taskLedger(args = []) {
         internalHandlerRoute('task-ledger', 'decision-next-id', kind),
         internalHandlerRoute('task-ledger', 'decision-upsert', kind),
         internalHandlerRoute('task-ledger', 'rework-intent-upsert', kind),
+        internalHandlerRoute('task-ledger', 'rework-intent-rebuild', kind),
         internalHandlerRoute('task-ledger', 'stage-status', kind)
     ].some(Boolean)) {
         usageFailure(`unknown ledger intent '${kind}'`);
@@ -85,14 +87,16 @@ async function taskLedger(args = []) {
         'finding-review': ['id', 'status', 'evidence'],
         'decision-next-id': [],
         'decision-upsert': ['id', 'stage', 'artifact'],
-        'rework-intent-upsert': ['intentId', 'findingId', 'sourceArtifact', 'sourceSha256', 'target'],
+        'rework-intent-upsert': ['intentId', 'findingId', 'sourceArtifact', 'sourceSha256', 'classification'],
+        'rework-intent-rebuild': [],
         'stage-status': ['stage']
     };
     const optional = {
         'finding-review': ['needsImplementation'],
-        'decision-upsert': ['needsImplementation']
+        'decision-upsert': ['needsImplementation'],
+        'rework-intent-rebuild': ['findingId', 'sourceArtifact', 'sourceSha256', 'classification']
     };
-    const overrideFields = kind === 'stage-status' || kind === 'decision-next-id' || kind === 'rework-intent-upsert'
+    const overrideFields = kind === 'stage-status' || kind === 'decision-next-id' || kind === 'rework-intent-upsert' || kind === 'rework-intent-rebuild'
         ? []
         : ['overrideTicket', 'overrideTarget', 'overrideScope'];
     const allowed = new Set(['kind', 'taskRef', 'dryRun', ...required[kind], ...(optional[kind] ?? []), ...overrideFields]);
@@ -111,6 +115,10 @@ async function taskLedger(args = []) {
         usageFailure(dryRunConflict.message);
         return;
     }
+    if (values.classification !== undefined && !REWORK_CLASSIFICATIONS.has(String(values.classification))) {
+        usageFailure(`invalid rework classification '${values.classification}'`);
+        return;
+    }
     if (kind === 'stage-status') {
         if (!isReviewStage(String(values.stage))) {
             usageFailure(`stage-status requires a valid review stage`);

package/dist/lib/internal/task-lifecycle.js

@@ -2,7 +2,7 @@ import { createDirectHostExecutionContext, dispatchTaskControlOperation, parseTa
 import { lifecycleIntentCatalog } from '../task/lifecycle.js';
 import { detectRepoRoot, resolveTaskRef } from '../task/resolve-ref.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
-const USAGE = `Usage: agent-infra-internal task-lifecycle <N | TASK-id> <intent> --agent <agent> [intent flags] [--dry-run]\n\nIntents: ${lifecycleIntentCatalog.join(', ')}\nrecover-started: --stage <stage> --round <round> --artifact <artifact> --reason <reason>\nOverride: --override-ticket <ticket> --override-target <target> --override-scope <scope>\n`;
+const USAGE = `Usage: agent-infra-internal task-lifecycle <N | TASK-id> <intent> --agent <agent> [intent flags] [--dry-run]\n\nIntents: ${lifecycleIntentCatalog.join(', ')}\nrecover-started: --auto\nOverride: --override-ticket <ticket> --override-target <target> --override-scope <scope>\n`;
 function usageFailure(message) {
     process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'LIFECYCLE_PAYLOAD_INVALID', message } })}\n`);
     process.stderr.write(USAGE);

package/dist/lib/internal/task-operation-registry.js

@@ -85,6 +85,7 @@ function internalTaskRoutes() {
         descriptor('internal', 'task-ledger', 'finding-review', 'task-bound', 'progress'),
         descriptor('internal', 'task-ledger', 'decision-upsert', 'task-bound', 'progress'),
         descriptor('internal', 'task-ledger', 'rework-intent-upsert', 'task-bound', 'progress'),
+        descriptor('internal', 'task-ledger', 'rework-intent-rebuild', 'task-bound', 'progress'),
         descriptor('internal', 'task-warning', 'list', 'task-bound', 'diagnostic'),
         descriptor('internal', 'task-warning', 'add', 'task-bound', 'progress'),
         descriptor('internal', 'task-warning', 'set-status', 'task-bound', 'progress'),
@@ -229,6 +230,8 @@ export function resolveDelegatedTaskOperation(args) {
     const [operation, ...rest] = args;
     if (operation !== 'client' || !rest[0])
         return null;
+    if (rest[0] === 'task-orchestration')
+        return null;
     return resolveTaskOperation('internal', rest[0], rest.slice(1));
 }
 const TASK_MARKER_KEYS = [
@@ -352,14 +355,16 @@ export function resolveSandboxControlTransport(env = process.env, options = {})
         if (!hasCompleteConfig) {
             return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_CONFIGURATION_INCOMPLETE' };
         }
-        return { kind: 'broker-client', reasonCode: null };
+        return { kind: options.localWorkflow ? 'sandbox-local' : 'broker-client', reasonCode: null };
     }
     if (!hasAnyMarker)
         return { kind: 'direct-host', reasonCode: null };
     if (!hasCompleteConfig || (taskBound && !runtime) || (!taskBound && runtime)) {
         return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_CONFIGURATION_INCOMPLETE' };
     }
-    return { kind: 'broker-client', reasonCode: null };
+    return options.localWorkflow
+        ? { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_MISSING' }
+        : { kind: 'broker-client', reasonCode: null };
 }
 export function hasTaskBoundMarker(env = process.env) {
     return taskMarkerState(env) === 'task-bound';

package/dist/lib/platform/completion-backfill.js

@@ -13,21 +13,70 @@ import { taskIssueIdentity } from './task-identities.js';
 function result(base, artifacts, warnings) {
     return { ...base, artifacts, warnings };
 }
-function excludedPrReview(taskDir, message) {
-    const names = [...message.matchAll(/(?:^|[^A-Za-z0-9_-])(pr-review(?:-r[1-9]\d*)?\.md)(?=$|[^A-Za-z0-9_.-])/g)]
+function referencedBackfillArtifact(taskDir, message) {
+    const names = [...message.matchAll(/(?:^|[^A-Za-z0-9_-])([a-z][a-z-]*(?:-r[1-9]\d*)?\.md)(?=$|[^A-Za-z0-9_.-])/g)]
         .map((match) => match[1]);
     if (names.length !== 1)
-        return null;
+        return { status: 'ignored', artifact: null, error: null };
     const parsed = parseArtifactName(names[0]);
-    if (!parsed || parsed.family !== 'pr-review')
-        return null;
+    if (!parsed || (parsed.family !== 'pr-review' && !COMPLETION_BACKFILL_FAMILIES.includes(parsed.family))) {
+        return { status: 'ignored', artifact: null, error: null };
+    }
     const artifactPath = path.join(taskDir, parsed.name);
     try {
         const stat = fs.lstatSync(artifactPath);
-        return stat.isFile() && !stat.isSymbolicLink() ? parsed.name : null;
+        if (stat.isSymbolicLink())
+            return {
+                status: 'failed', artifact: null,
+                error: { code: 'ARTIFACT_TOPOLOGY_CONFLICT', message: `SYMBOLIC_LINK: symbolic links are not workflow artifacts: ${parsed.name}`, retryable: false }
+            };
+        if (!stat.isFile())
+            return {
+                status: 'failed', artifact: null,
+                error: { code: 'ARTIFACT_TOPOLOGY_CONFLICT', message: `NON_REGULAR_FILE: artifact is not a regular file: ${parsed.name}`, retryable: false }
+            };
+        fs.accessSync(artifactPath, fs.constants.R_OK);
+        return { status: 'ready', artifact: parsed.name, error: null };
+    }
+    catch (error) {
+        return {
+            status: 'failed', artifact: null,
+            error: { code: 'ARTIFACT_READ_FAILED', message: `Unable to inspect referenced artifact '${parsed.name}': ${error instanceof Error ? error.message : String(error)}`, retryable: false }
+        };
+    }
+}
+function matchingBackfillWarnings(taskDir, content) {
+    const matches = [];
+    for (const warning of getOpenWorkflowWarnings(content)) {
+        if (warning.step !== 'complete-task' || warning.code !== 'COMMENT_SYNC_FAILED' || warning.target !== 'artifact')
+            continue;
+        const reference = referencedBackfillArtifact(taskDir, warning.message);
+        if (reference.status === 'failed')
+            return { status: 'failed', matches: [], error: reference.error };
+        if (reference.status === 'ready')
+            matches.push({ warning, artifact: reference.artifact });
+    }
+    return { status: 'ready', matches, error: null };
+}
+function inspectCompletionBackfillEligibility(taskRef, options = {}) {
+    const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
+    if (!resolved.ok)
+        return {
+            status: 'failed', eligible: false,
+            error: { code: resolved.code, message: resolved.message, retryable: false }
+        };
+    try {
+        const content = fs.readFileSync(resolved.taskMdPath, 'utf8');
+        const matching = matchingBackfillWarnings(resolved.taskDir, content);
+        if (matching.status === 'failed')
+            return { status: 'failed', eligible: false, error: matching.error };
+        return { status: 'ready', eligible: matching.matches.length > 0, error: null };
     }
-    catch {
-        return null;
+    catch (error) {
+        return {
+            status: 'failed', eligible: false,
+            error: { code: 'TASK_READ_FAILED', message: error instanceof Error ? error.message : String(error), retryable: false }
+        };
     }
 }
 async function backfillCompletionComments(taskRef, options) {
@@ -46,6 +95,9 @@ async function backfillCompletionComments(taskRef, options) {
             }
         }), [], []);
     const initialContent = fs.readFileSync(resolved.taskMdPath, 'utf8');
+    const matching = matchingBackfillWarnings(resolved.taskDir, initialContent);
+    if (matching.status === 'failed')
+        return result(platformResult('failed', { error: matching.error }), [], []);
     const issueIdentity = taskIssueIdentity(parseTaskFrontmatter(initialContent));
     if (!issueIdentity)
         return result(platformResult('no-op', {
@@ -79,18 +131,12 @@ async function backfillCompletionComments(taskRef, options) {
                 error: latest.error
             }), artifacts, []);
     }
-    const matching = getOpenWorkflowWarnings(initialContent).flatMap((warning) => {
-        if (warning.step !== 'complete-task' || warning.code !== 'COMMENT_SYNC_FAILED' || warning.target !== 'artifact')
-            return [];
-        const excluded = excludedPrReview(resolved.taskDir, warning.message);
-        return excluded ? [{ warning, excluded }] : [];
-    });
     const warnings = [];
     let metadata = null;
-    for (const { warning, excluded } of matching) {
+    for (const { warning, artifact } of matching.matches) {
         metadata ??= captureTaskWriteMetadata();
         const resolution = [
-            `excluded=${excluded}`,
+            `artifact=${artifact}`,
             `completionFamilies=${COMPLETION_BACKFILL_FAMILIES.join(',')}`,
             `synchronized=${inventory.artifacts.map((artifact) => artifact.name).join(',') || 'none'}`,
             `completedAt=${metadata.timestamp}`
@@ -119,5 +165,5 @@ async function backfillCompletionComments(taskRef, options) {
         error: null
     }), artifacts, warnings);
 }
-export { backfillCompletionComments };
+export { backfillCompletionComments, inspectCompletionBackfillEligibility };
 //# sourceMappingURL=completion-backfill.js.map

package/dist/lib/platform/issue-comments.js

@@ -10,7 +10,7 @@ import { resourceIdentityNumber } from './resource-identity.js';
 import { taskIssueIdentity, taskIssueIdentityError } from './task-identities.js';
 import { recordForArtifact, recordForCancel, recordForSummary, recordForTask, renderActivityRecoveryMetadata } from './activity-recovery.js';
 import { projectTaskComment } from './task-comment-projection.js';
-import { canonicalizeCommentBody, canonicalizeSummaryBody, escapeHtmlText, fenceRanges, renderSafeCodeFence } from './comment-safety.js';
+import { canonicalizeCommentBody, escapeHtmlText, fenceRanges, renderSafeCodeFence } from './comment-safety.js';
 function providerCommentId(id, provider) {
     return provider.identity?.comment === 'number' && /^\d+$/.test(id) ? Number(id) : id;
 }
@@ -29,8 +29,6 @@ const ARTIFACT_TITLES = {
     'review-plan': '技术方案审查',
     code: '实现报告',
     'review-code': '代码审查',
-    'manual-validation': '人工验证报告',
-    'validation-run': '验证运行证据',
     'pr-review': 'PR 审查报告'
 };
 function normalizeCommentContent(content) {
@@ -100,7 +98,7 @@ function taskCommentLanguage(repoRoot) {
 }
 function artifactIdentity(artifact) {
     const stem = path.basename(artifact, '.md');
-    const match = stem.match(/^(analysis|review-analysis|plan|review-plan|code|review-code|manual-validation|validation-run|pr-review)(?:-r(\d+))?$/);
+    const match = stem.match(/^(analysis|review-analysis|plan|review-plan|code|review-code|pr-review)(?:-r(\d+))?$/);
     if (!match)
         throw new Error(`unsupported artifact '${artifact}'`);
     const base = ARTIFACT_TITLES[match[1]];
@@ -390,14 +388,6 @@ function summaryPosition(comments, taskId) {
     const sequence = summary[0].createdSequence;
     return { ok: managed.every((comment) => sequence >= comment.createdSequence), known: true, summary: summary[0] };
 }
-function summaryDigest(comment) {
-    const body = normalizeCommentContent(comment.body)
-        .replace(/^<!-- sync-issue:[^\n]+:summary -->\n## [^\n]+\n\n> [^\n]+\n\n/u, '')
-        .replace(/^<details><summary>恢复元数据<\/summary>[\s\S]*?<\/details>\n\n/u, '')
-        .replace(/\n---\n\*[^\n]*\*$/u, '');
-    const canonical = canonicalizeSummaryBody(body);
-    return canonical.ok ? createHash('sha256').update(canonical.value).digest('hex') : '';
-}
 async function listedComments(provider, loaded, parent) {
     return provider.comments?.list
         ? provider.comments.list({ context: providerOperationContext(loaded), parent }).then((response) => response.ok
@@ -510,25 +500,6 @@ async function syncPlatformComment(taskRef, options) {
             });
         }
     }
-    if (options.verifyOnly) {
-        if (options.kind !== 'summary' || !options.summaryAuthorization) {
-            return platformResult('failed', {
-                ...contextFields(context), resource: { kind: 'issue', number: issue },
-                error: { code: 'SUMMARY_VERIFICATION_INVALID', message: 'summary verification requires durable authorization', retryable: false }
-            });
-        }
-        const position = summaryPosition(listed.value, resolved.taskId);
-        if (!position.ok || !position.summary || summaryDigest(position.summary) !== options.summaryAuthorization.sha256) {
-            return platformResult('failed', {
-                ...contextFields(context), resource: { kind: 'issue', number: issue },
-                error: { code: 'SUMMARY_VERIFICATION_FAILED', message: 'summary marker, body digest, or managed comment order is invalid', retryable: true }
-            });
-        }
-        return platformResult('no-op', {
-            ...contextFields(context), changed: false, resource: { kind: 'issue', number: issue },
-            comment: { kind: options.kind, marker: desired[0].marker, ids: [position.summary.id], parts: 1 }, error: null
-        });
-    }
     // Backfill only supplies missing artifact comments; valid existing marker sets stay untouched.
     if (options.kind === 'artifact' && options.backfill && existing.length > 0) {
         const operations = existing.map((comment) => ({

package/dist/lib/platform/pr-summary.js

@@ -13,7 +13,7 @@ import { platformResult } from './types.js';
 import { providerError, providerOperationContext, providerStatus, providerResourceToken, resourceIdentityNumber, unsupportedProviderOperation } from './provider-bridge.js';
 import { resourceIdentityEquals } from './resource-identity.js';
 import { buildPrChangeReport, CANONICAL_REPORT_PLACEHOLDER, readPrChangeReport, replaceCanonicalReportPlaceholder, runMechanicalChangeReport, taskIntentDigest, validateMechanicalReport, validatePrecheckCandidate, writePrChangeReportAtomic } from './pr-change-report.js';
-import { manualValidationFinalSummaryProjectionMatches } from '../task/manual-validation-receipt.js';
+import { MANUAL_VALIDATION_RECEIPT_PLACEHOLDER, manualValidationFinalSummaryProjectionMatches } from '../task/manual-validation-receipt.js';
 import { readManualValidationCompletion } from '../task/manual-validation-completion.js';
 function summaryMarker(taskId) {
     return `<!-- sync-pr:${taskId}:summary -->`;
@@ -515,6 +515,7 @@ async function syncPullRequestSummary(taskRef, options) {
             if (!initial.ok)
                 return fail(initial.status, context, initial.error);
             const manual = options.manualValidation;
+            let manualEvidenceDigest = null;
             const hasFinalManualValidation = /###\s+✅\s+(?:Manual Validation Passed|人工验证已通过)/u.test(options.body);
             if (hasFinalManualValidation && (!manual || manual.phase !== 'final'))
                 return fail('failed', context, { code: 'MANUAL_VALIDATION_TRANSACTION_REQUIRED', message: 'final manual-validation summary requires the transaction coordinator', retryable: false }, prNumber);
@@ -538,6 +539,7 @@ async function syncPullRequestSummary(taskRef, options) {
                     if (!completion.ok)
                         return fail('failed', context, platformError(completion.error), prNumber);
                     const { receipt, transaction } = completion.value;
+                    manualEvidenceDigest = receipt.evidenceDigest;
                     if (transaction.phase !== 'final-promotion-in-progress' || !transaction.eventAppended)
                         return fail('failed', context, { code: 'MANUAL_VALIDATION_TRANSACTION_PHASE_INVALID', message: 'final summary requires a receipt-backed promotion intent', retryable: false }, prNumber);
                     if (!manualValidationFinalSummaryProjectionMatches(options.body, receipt))
@@ -581,7 +583,10 @@ async function syncPullRequestSummary(taskRef, options) {
             const replaced = replaceCanonicalReportPlaceholder(`${prefix.value}${placeholder}${suffix.value}`, report.value);
             if (!replaced.ok)
                 return fail('failed', context, platformError(replaced.error));
-            const desired = buildPullRequestSummary(resolved.taskId, replaced.value, initial.value.head.sha, renderHumanOverrideAudit(taskContent));
+            const renderedBody = manual?.phase === 'final'
+                ? replaced.value.replace(MANUAL_VALIDATION_RECEIPT_PLACEHOLDER, `<!-- manual-validation-receipt: transaction=${manual.transactionId}; receipt=${manual.receiptDigest}; evidence=${manualEvidenceDigest}; head=${manual.prHeadSha} -->`)
+                : replaced.value;
+            const desired = buildPullRequestSummary(resolved.taskId, renderedBody, initial.value.head.sha, renderHumanOverrideAudit(taskContent));
             if (!isSafeSummaryEnvelope(desired, resolved.taskId))
                 return fail('failed', context, {
                     code: 'PR_SUMMARY_RENDER_INVALID',