@fitlab-ai/agent-infra 0.11.3 → 0.11.5

package/lib/internal/task-finalization.ts

@@ -3,8 +3,12 @@ import {
   dispatchTaskControlOperation,
   parseTaskControlOperation
 } from '../task/control-authority.ts';
-import { applyTaskFinalization } from '../task/finalization.ts';
+import { applyTaskFinalization, bindTaskFinalizationReceipt, prepareTaskFinalization } from '../task/finalization.ts';
+import { publishTaskFinalizationHandoff } from '../task/finalization-handoff.ts';
 import { detectRepoRoot, resolveTaskRef } from '../task/resolve-ref.ts';
+import { verifyTaskEvent } from '../task/verification.ts';
+import { resolveSandboxControlTransport } from './task-operation-registry.ts';
+import { requestSandboxTaskFinalization, SandboxControlClientError } from '../sandbox/control/client.ts';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.ts';
 
 const USAGE = 'Usage: agent-infra-internal task-finalization <N | TASK-id> complete --agent <agent>\n';
@@ -73,10 +77,52 @@ async function taskFinalization(args: string[] = []): Promise<void> {
     ...operation,
     request: { ...operation.request, taskRef: resolved.taskId }
   };
+  const transport = resolveSandboxControlTransport(process.env, { localWorkflow: true });
+  if (transport.kind === 'sandbox-local') {
+    const prepared = await prepareTaskFinalization(boundOperation.request, {
+      repoRoot,
+      preflight: (request, options) => verifyTaskEvent({ ...request, event: 'complete-task.hard-preflight' }, options)
+    });
+    if (prepared.status !== 'prepared') {
+      process.stdout.write(envelope(prepared.status, prepared.changed, true, prepared, prepared.error));
+      process.exitCode = exitCode(prepared.status);
+      return;
+    }
+    try {
+      const response = requestSandboxTaskFinalization({
+        agent: boundOperation.request.agent,
+        prepareHandoff: (binding) => {
+          const receipt = bindTaskFinalizationReceipt(repoRoot, boundOperation.request.taskRef, binding);
+          return publishTaskFinalizationHandoff('/share/branch', receipt, binding);
+        }
+      });
+      process.stdout.write(response.stdout);
+      process.stderr.write(response.stderr);
+      process.exitCode = response.exitCode ?? 1;
+      return;
+    } catch (error) {
+      const detail = error instanceof SandboxControlClientError
+        ? error.detail
+        : { code: 'SANDBOX_CONTROL_CLIENT_FAILED', message: error instanceof Error ? error.message : String(error), retryable: false };
+      process.stdout.write(envelope(detail.retryable ? 'blocked' : 'failed', false, false, null, detail));
+      process.exitCode = detail.retryable ? 2 : 1;
+      return;
+    }
+  }
   const result = await dispatchTaskControlOperation(
     createDirectHostExecutionContext({ repoRoot }),
     boundOperation
   );
+  if (result.status === 'prepared') {
+    const detail = {
+      code: 'TASK_FINALIZATION_DIRECT_COMMIT_REQUIRED',
+      message: 'direct finalization prepared external work without committing the lifecycle transition',
+      retryable: false
+    };
+    process.stdout.write(envelope('failed', result.changed, true, result, detail));
+    process.exitCode = 1;
+    return;
+  }
   process.stdout.write(envelope(result.status, result.changed, true, result, result.error));
   process.exitCode = exitCode(result.status);
 }

package/lib/internal/task-ledger.ts

@@ -2,23 +2,22 @@ import fs from 'node:fs';
 
 import { applyLedgerIntent } from '../task/ledger-intents.ts';
 import type { LedgerIntent } from '../task/ledger-intents.ts';
-import { consumeHumanOverride, failureId, overrideDryRunConflict } from '../task/human-override.ts';
 import { LEDGER_SECTION_MISSING_CODE, LEDGER_SECTION_MISSING_MESSAGE, isReviewStage, parseLedgerDocument, summarizeLedgerStage, validateLedgerRows } from '../task/ledger.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.ts';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.ts';
 
-const USAGE = `Usage: agent-infra-internal task-ledger <task-ref> <intent> [intent flags] [--dry-run]\n\nIntents: finding-upsert, finding-respond, finding-review, decision-next-id, decision-upsert, rework-intent-upsert, stage-status\n`;
+const USAGE = `Usage: agent-infra-internal task-ledger <task-ref> <intent> [intent flags] [--dry-run]\n\nIntents: finding-upsert, finding-respond, finding-review, decision-next-id, decision-upsert, rework-intent-upsert, rework-intent-rebuild, stage-status\n`;
 const FLAGS: Record<string, string> = {
   '--stage': 'stage', '--review-artifact': 'reviewArtifact', '--ordinal': 'ordinal',
   '--severity': 'severity', '--evidence': 'evidence', '--id': 'id', '--round': 'round',
   '--status': 'status', '--artifact': 'artifact', '--needs-implementation': 'needsImplementation',
   '--intent-id': 'intentId', '--finding-id': 'findingId', '--source-artifact': 'sourceArtifact',
-  '--source-sha256': 'sourceSha256', '--target': 'target',
-  '--override-ticket': 'overrideTicket', '--override-target': 'overrideTarget', '--override-scope': 'overrideScope'
+  '--source-sha256': 'sourceSha256', '--classification': 'classification'
 };
 const NUMERIC = new Set(['ordinal', 'round']);
 const BOOLEAN = new Set(['needsImplementation']);
+const REWORK_CLASSIFICATIONS = new Set(['scope-or-requirement', 'design', 'implementation', 'human-decision', 'insufficient-evidence']);
 
 function usageFailure(message: string): void {
   process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'LEDGER_PAYLOAD_INVALID', message } })}\n`);
@@ -38,6 +37,7 @@ async function taskLedger(args: string[] = []): Promise<void> {
     internalHandlerRoute('task-ledger', 'decision-next-id', kind),
     internalHandlerRoute('task-ledger', 'decision-upsert', kind),
     internalHandlerRoute('task-ledger', 'rework-intent-upsert', kind),
+    internalHandlerRoute('task-ledger', 'rework-intent-rebuild', kind),
     internalHandlerRoute('task-ledger', 'stage-status', kind)
   ].some(Boolean)) {
     usageFailure(`unknown ledger intent '${kind}'`); return;
@@ -67,23 +67,23 @@ async function taskLedger(args: string[] = []): Promise<void> {
     'finding-review': ['id', 'status', 'evidence'],
     'decision-next-id': [],
     'decision-upsert': ['id', 'stage', 'artifact'],
-    'rework-intent-upsert': ['intentId', 'findingId', 'sourceArtifact', 'sourceSha256', 'target'],
+    'rework-intent-upsert': ['intentId', 'findingId', 'sourceArtifact', 'sourceSha256', 'classification'],
+    'rework-intent-rebuild': [],
     'stage-status': ['stage']
   };
   const optional: Record<string, string[]> = {
     'finding-review': ['needsImplementation'],
-    'decision-upsert': ['needsImplementation']
+    'decision-upsert': ['needsImplementation'],
+    'rework-intent-rebuild': ['findingId', 'sourceArtifact', 'sourceSha256', 'classification']
   };
-  const overrideFields = kind === 'stage-status' || kind === 'decision-next-id' || kind === 'rework-intent-upsert'
-    ? []
-    : ['overrideTicket', 'overrideTarget', 'overrideScope'];
-  const allowed = new Set(['kind', 'taskRef', 'dryRun', ...required[kind]!, ...(optional[kind] ?? []), ...overrideFields]);
+  const allowed = new Set(['kind', 'taskRef', 'dryRun', ...required[kind]!, ...(optional[kind] ?? [])]);
   const unexpected = Object.keys(values).find((key) => !allowed.has(key));
   const missing = required[kind]!.find((key) => values[key] === undefined);
   if (unexpected) { usageFailure(`${kind} does not accept '${unexpected}'`); return; }
   if (missing) { usageFailure(`${kind} requires '${missing}'`); return; }
-  const dryRunConflict = overrideDryRunConflict(values);
-  if (dryRunConflict) { usageFailure(dryRunConflict.message); return; }
+  if (values.classification !== undefined && !REWORK_CLASSIFICATIONS.has(String(values.classification))) {
+    usageFailure(`invalid rework classification '${values.classification}'`); return;
+  }
   if (kind === 'stage-status') {
     if (!isReviewStage(String(values.stage))) { usageFailure(`stage-status requires a valid review stage`); return; }
     const resolved = resolveTaskRef(taskRef);
@@ -117,42 +117,16 @@ async function taskLedger(args: string[] = []): Promise<void> {
   const lockResolved = resolveTaskRef(taskRef);
   if (!lockResolved.ok) { usageFailure(lockResolved.message); return; }
   let result;
-  let humanOverride: unknown = null;
   try {
-    result = await withTaskExecutionLock(lockResolved.repoRoot, lockResolved.taskId, `task-ledger.${kind}`, async () => {
-      let current = applyLedgerIntent(values as LedgerIntent);
-      if (current.status !== 'failed' || !values.overrideTicket) return current;
-      if (!values.overrideTarget || !values.overrideScope) { usageFailure('override ticket requires target and scope'); return current; }
-      const consumed = await consumeHumanOverride({
-        taskRef,
-        ticketId: String(values.overrideTicket),
-        failureId: failureId('ledger-intent', current.error?.code ?? 'TASK_STATE_MISMATCH'),
-        target: String(values.overrideTarget),
-        scope: String(values.overrideScope)
-      }, {
-        effectExecutor: (capability) => {
-          const retried = applyLedgerIntent(values as LedgerIntent, { manualOverride: capability });
-          current = retried;
-          return retried.status === 'failed'
-            ? { code: 'OVERRIDE_EFFECT_FAILED', message: `${retried.error?.code ?? 'LEDGER_FAILED'}: ${retried.error?.message ?? 'manual ledger effect failed'}` }
-            : null;
-        }
-      });
-      humanOverride = consumed;
-      return current;
-    });
+    result = await withTaskExecutionLock(lockResolved.repoRoot, lockResolved.taskId, `task-ledger.${kind}`, async () => applyLedgerIntent(values as LedgerIntent));
   } catch (error) {
     if (!(error instanceof TaskExecutionLockError)) throw error;
     process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: error.code, message: error.message } })}\n`);
     process.exitCode = 1;
     return;
   }
-  process.stdout.write(`${JSON.stringify(humanOverride ? { ...result, humanOverride } : result)}\n`);
-  const overrideFailed = Boolean(
-    humanOverride && typeof humanOverride === 'object' &&
-    (humanOverride as { status?: unknown }).status === 'failed'
-  );
-  if (result.status === 'failed' || overrideFailed) process.exitCode = 1;
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+  if (result.status === 'failed') process.exitCode = 1;
 }
 
 export { taskLedger };

package/lib/internal/task-lifecycle.ts

@@ -10,7 +10,7 @@ import type { TaskLifecycleResult } from '../task/lifecycle.ts';
 import type { AgentClientLifecycleRecoveryResult as LifecycleRecoveryResult } from '../agent-clients/adapter.ts';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.ts';
 
-const USAGE = `Usage: agent-infra-internal task-lifecycle <N | TASK-id> <intent> --agent <agent> [intent flags] [--dry-run]\n\nIntents: ${lifecycleIntentCatalog.join(', ')}\nrecover-started: --auto\nOverride: --override-ticket <ticket> --override-target <target> --override-scope <scope>\n`;
+const USAGE = `Usage: agent-infra-internal task-lifecycle <N | TASK-id> <intent> --agent <agent> [intent flags] [--dry-run]\n\nIntents: ${lifecycleIntentCatalog.join(', ')}\nrecover-started: --auto\n`;
 
 function usageFailure(message: string): void {
   process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'LIFECYCLE_PAYLOAD_INVALID', message } })}\n`);
@@ -62,7 +62,7 @@ async function taskLifecycle(args: string[] = []): Promise<void> {
   const result = await dispatchTaskControlOperation(
     createDirectHostExecutionContext({ repoRoot }),
     operation
-  ) as (TaskLifecycleResult | LifecycleRecoveryResult) & { humanOverride?: unknown };
+  ) as TaskLifecycleResult | LifecycleRecoveryResult;
   process.stdout.write(`${JSON.stringify(result)}\n`);
   if (result.status === 'failed' || result.status === 'owner-unknown' || result.status === 'conflict') process.exitCode = 1;
 }

package/lib/internal/task-operation-registry.ts

@@ -125,6 +125,7 @@ function internalTaskRoutes(): TaskOperationDescriptor[] {
     descriptor('internal', 'task-ledger', 'finding-review', 'task-bound', 'progress'),
     descriptor('internal', 'task-ledger', 'decision-upsert', 'task-bound', 'progress'),
     descriptor('internal', 'task-ledger', 'rework-intent-upsert', 'task-bound', 'progress'),
+    descriptor('internal', 'task-ledger', 'rework-intent-rebuild', 'task-bound', 'progress'),
     descriptor('internal', 'task-warning', 'list', 'task-bound', 'diagnostic'),
     descriptor('internal', 'task-warning', 'add', 'task-bound', 'progress'),
     descriptor('internal', 'task-warning', 'set-status', 'task-bound', 'progress'),
@@ -142,9 +143,6 @@ function internalTaskRoutes(): TaskOperationDescriptor[] {
     descriptor('internal', 'task-review', 'finalize-summary', 'task-bound', 'progress'),
     descriptor('internal', 'task-event', 'event', 'task-bound', 'progress'),
     descriptor('internal', 'task-invalidation', 'reconcile', 'task-bound', 'progress'),
-    descriptor('internal', 'task-override', 'diagnose', 'task-bound', 'diagnostic'),
-    descriptor('internal', 'task-override', 'issue', 'task-bound', 'progress'),
-    descriptor('internal', 'task-override', 'consume', 'task-bound', 'progress'),
     descriptor('internal', 'task-lifecycle', 'intent', 'task-bound', 'progress'),
     descriptor('internal', 'task-finalization', 'complete', 'task-bound', 'progress'),
     descriptor('internal', 'task-short-id', 'list', 'conditional', 'diagnostic'),
@@ -223,7 +221,7 @@ export const INTERNAL_DISPATCHER_ROUTES = Object.freeze([
   'platform-comment', 'platform-issue', 'platform-pr', 'platform-pr-review', 'pr-review-grade',
   'platform-checks', 'task-context', 'task-ledger', 'task-warning', 'task-activity', 'task-artifact',
   'task-orchestration', 'task-review', 'task-event', 'task-invalidation', 'task-lifecycle',
-  'task-finalization', 'task-override', 'task-short-id', 'task-snapshot', 'task-verify', 'task-validate', 'manual-validation'
+  'task-finalization', 'task-short-id', 'task-snapshot', 'task-verify', 'task-validate', 'manual-validation'
 ]);
 export const PUBLIC_DISPATCHER_ROUTES = Object.freeze([
   'agent-client', 'cp', 'data', 'decide', 'help', 'init', 'merge', 'run', 'sandbox', 'server', 'task', 'sync', 'update', 'version'

package/lib/internal/task-review.ts

@@ -1,11 +1,10 @@
 import { parseReviewCommand } from '../task/review-command.ts';
 import { finalizeReviewSummary, preflightReviewSummary } from '../task/review-finalization.ts';
-import { consumeHumanOverride, failureId, overrideDryRunConflict } from '../task/human-override.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.ts';
 import { ensureInternalHandlerRoute } from './cli-route-inventory.ts';
 
-const USAGE = 'Usage: agent-infra-internal task-review <task-ref> <preflight|finalize-summary> --stage <analysis|plan|code> --artifact <review-*.md> [--orchestrated] [--dry-run] [--override-ticket <ticket> --override-target <target> --override-scope <scope>]\n';
+const USAGE = 'Usage: agent-infra-internal task-review <task-ref> <preflight|finalize-summary> --stage <analysis|plan|code> --artifact <review-*.md> [--orchestrated] [--dry-run]\n';
 
 function failUsage(message: string): void {
   process.stdout.write(`${JSON.stringify({
@@ -27,37 +26,16 @@ async function taskReview(args: string[] = []): Promise<void> {
   let request;
   try { request = parseReviewCommand(args); }
   catch (error) { failUsage(error instanceof Error ? error.message : String(error)); return; }
-  const { stage, artifact, dryRun, orchestrated, overrideTicket, overrideTarget, overrideScope } = request;
+  const { stage, artifact, dryRun, orchestrated } = request;
   const operation = args[1]!;
-  const dryRunConflict = overrideDryRunConflict({ dryRun, overrideTicket, overrideTarget, overrideScope });
-  if (dryRunConflict) { failUsage(dryRunConflict.message); return; }
   const resolved = resolveTaskRef(args[0]!);
   if (!resolved.ok) { failUsage(resolved.message); return; }
   let result;
-  let humanOverride: unknown = null;
   try {
     result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-review.${operation}`, async () => {
-      let current = operation === 'preflight'
+      return operation === 'preflight'
         ? preflightReviewSummary({ taskRef: args[0]!, stage, artifact, orchestrated, dryRun }, { lockAlreadyHeld: true })
         : finalizeReviewSummary({ taskRef: args[0]!, stage, artifact, orchestrated, dryRun }, { lockAlreadyHeld: true });
-      if (operation === 'preflight') return current;
-      if (current.status !== 'failed' || !overrideTicket) return current;
-      if (!overrideTarget || !overrideScope) { failUsage('override ticket requires target and scope'); return current; }
-      const consumed = await consumeHumanOverride({
-        taskRef: args[0]!, ticketId: overrideTicket,
-        failureId: failureId('review-finalization', current.error?.code ?? 'TASK_STATE_MISMATCH'),
-        target: overrideTarget, scope: overrideScope
-      }, {
-        effectExecutor: (capability) => {
-          const retried = finalizeReviewSummary({ taskRef: args[0]!, stage, artifact, orchestrated, dryRun }, { lockAlreadyHeld: true, manualOverride: capability });
-          current = retried;
-          return retried.status === 'failed' || retried.status === 'planned'
-            ? { code: 'OVERRIDE_EFFECT_FAILED', message: retried.status === 'planned' ? 'producer returned planned; no review effect was committed' : `${retried.error?.code ?? 'REVIEW_FAILED'}: ${retried.error?.message ?? 'manual review effect failed'}` }
-            : null;
-        }
-      });
-      humanOverride = consumed;
-      return current;
     });
   } catch (error) {
     if (!(error instanceof TaskExecutionLockError)) throw error;
@@ -65,12 +43,8 @@ async function taskReview(args: string[] = []): Promise<void> {
     process.exitCode = 1;
     return;
   }
-  process.stdout.write(`${JSON.stringify(humanOverride ? { ...result, humanOverride } : result)}\n`);
-  const overrideFailed = Boolean(
-    humanOverride && typeof humanOverride === 'object' &&
-    (humanOverride as { status?: unknown }).status === 'failed'
-  );
-  if (result.status === 'failed' || overrideFailed) process.exitCode = 1;
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+  if (result.status === 'failed') process.exitCode = 1;
 }
 
 export { taskReview };

package/lib/internal/task-verify.ts

@@ -1,10 +1,9 @@
 import { renderTaskVerification, verifyTaskEvent } from '../task/verification.ts';
-import { consumeHumanOverride, failureId } from '../task/human-override.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.ts';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.ts';
 
-const USAGE = 'Usage: agent-infra-internal task-verify <N | TASK-id> <verification-event> [--artifact <canonical.md>] [--format json|text] [--override-ticket <ticket> --override-target <target> --override-scope <scope>]\n';
+const USAGE = 'Usage: agent-infra-internal task-verify <N | TASK-id> <verification-event> [--artifact <canonical.md>] [--format json|text]\n';
 
 function fail(message: string): void {
   process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'VERIFY_PAYLOAD_INVALID', message } })}\n`);
@@ -21,63 +20,28 @@ async function taskVerify(args: string[] = []): Promise<void> {
   const event = args[1];
   let artifact: string | undefined;
   let format: 'json' | 'text' = 'json';
-  let overrideTicket: string | undefined;
-  let overrideTarget: string | undefined;
-  let overrideScope: string | undefined;
   const seen = new Set<string>();
   for (let index = 2; index < args.length; index += 1) {
     const flag = args[index]!;
-    if (!['--artifact', '--format', '--override-ticket', '--override-target', '--override-scope'].includes(flag)) { fail(`unknown option '${flag}'`); return; }
+    if (!['--artifact', '--format'].includes(flag)) { fail(`unknown option '${flag}'`); return; }
     if (seen.has(flag)) { fail(`duplicate option '${flag}'`); return; }
     const value = args[++index];
     if (!value || value.startsWith('--')) { fail(`option '${flag}' requires a value`); return; }
     seen.add(flag);
     if (flag === '--artifact') artifact = value;
-    else if (flag === '--override-ticket') overrideTicket = value;
-    else if (flag === '--override-target') overrideTarget = value;
-    else if (flag === '--override-scope') overrideScope = value;
     else if (value === 'json' || value === 'text') format = value;
     else { fail("option '--format' requires 'json' or 'text'"); return; }
   }
   const resolved = resolveTaskRef(taskRef);
   if (!resolved.ok) { fail(resolved.message); return; }
   let result;
-  let humanOverride: unknown = null;
   try {
-    result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-verify.${event}`, async () => {
-      let current = await verifyTaskEvent({ taskRef, event, ...(artifact ? { artifact } : {}) });
-      if (current.status === 'pass' || !overrideTicket) return current;
-      if (!overrideTarget || !overrideScope) { fail('override ticket requires target and scope'); return current; }
-      const failureProducer = current.status === 'blocked' || current.status === 'fail'
-        ? 'verification-engine'
-        : 'task-verify';
-      const failureCode = current.status === 'blocked'
-        ? 'CHECK_BLOCKED'
-        : current.status === 'fail'
-          ? 'CHECK_FAILED'
-          : current.error?.code ?? 'VERIFY_TASK_STATE_MISMATCH';
-      const consumed = await consumeHumanOverride({
-        taskRef, ticketId: overrideTicket,
-        failureId: failureId(failureProducer, failureCode),
-        target: overrideTarget, scope: overrideScope
-      }, {
-        effectExecutor: async (capability) => {
-          const retried = await verifyTaskEvent({ taskRef, event, ...(artifact ? { artifact } : {}) }, { manualOverride: capability });
-          current = retried;
-          return retried.status !== 'pass'
-            ? { code: 'OVERRIDE_EFFECT_FAILED', message: `${retried.error?.code ?? 'VERIFY_FAILED'}: ${retried.error?.message ?? 'manual verification effect failed'}` }
-            : null;
-        }
-      });
-      humanOverride = consumed;
-      return current;
-    });
+    result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-verify.${event}`, async () => verifyTaskEvent({ taskRef, event, ...(artifact ? { artifact } : {}) }));
   } catch (error) {
     if (!(error instanceof TaskExecutionLockError)) throw error;
     fail(`${error.code}: ${error.message}`);
     return;
   }
-  if (humanOverride) result = { ...result, humanOverride } as typeof result;
   process.stdout.write(format === 'text' ? renderTaskVerification(result) : `${JSON.stringify(result)}\n`);
   process.exitCode = result.status === 'pass' ? 0 : result.status === 'blocked' ? 2 : 1;
 }

package/lib/internal/task-warning.ts

@@ -1,6 +1,5 @@
 import { applyWorkflowWarningIntent } from '../task/workflow-warning-intents.ts';
 import type { WorkflowWarningIntent } from '../task/workflow-warning-intents.ts';
-import { consumeHumanOverride, failureId, overrideDryRunConflict } from '../task/human-override.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.ts';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.ts';
@@ -9,7 +8,6 @@ const USAGE = `Usage: agent-infra-internal task-warning <task-ref> <add|set-stat
 const FLAGS: Record<string, string> = {
   '--step': 'step', '--severity': 'severity', '--code': 'code', '--target': 'target',
   '--message': 'message', '--action': 'action', '--id': 'id', '--status': 'status', '--resolution': 'resolution'
-  , '--override-ticket': 'overrideTicket', '--override-target': 'overrideTarget', '--override-scope': 'overrideScope'
 };
 
 function usageFailure(message: string): void {
@@ -48,50 +46,23 @@ async function taskWarning(args: string[] = []): Promise<void> {
   };
   const optional = kind === 'list' ? ['status'] : [];
   const allowed = new Set(['kind', 'taskRef', 'dryRun', ...required[kind]!, ...optional]);
-  allowed.add('overrideTicket'); allowed.add('overrideTarget'); allowed.add('overrideScope');
   const unexpected = Object.keys(values).find((key) => !allowed.has(key));
   const missing = required[kind]!.find((key) => values[key] === undefined);
   if (unexpected) { usageFailure(`${kind} does not accept '${unexpected}'`); return; }
   if (missing) { usageFailure(`${kind} requires '${missing}'`); return; }
-  const dryRunConflict = overrideDryRunConflict(values);
-  if (dryRunConflict) { usageFailure(dryRunConflict.message); return; }
   const resolved = resolveTaskRef(taskRef);
   if (!resolved.ok) { usageFailure(resolved.message); return; }
   let result;
-  let humanOverride: unknown = null;
   try {
-    result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-warning.${kind}`, async () => {
-      let current = applyWorkflowWarningIntent(values as WorkflowWarningIntent);
-      if (current.status !== 'failed' || !values.overrideTicket) return current;
-      if (!values.overrideTarget || !values.overrideScope) { usageFailure('override ticket requires target and scope'); return current; }
-      const consumed = await consumeHumanOverride({
-        taskRef, ticketId: String(values.overrideTicket),
-        failureId: failureId('workflow-warning', current.error?.code ?? 'TASK_STATE_MISMATCH'),
-        target: String(values.overrideTarget), scope: String(values.overrideScope)
-      }, {
-        effectExecutor: (capability) => {
-          const retried = applyWorkflowWarningIntent(values as WorkflowWarningIntent, { manualOverride: capability });
-          current = retried;
-          return retried.status === 'failed' || retried.status === 'planned'
-            ? { code: 'OVERRIDE_EFFECT_FAILED', message: retried.status === 'planned' ? 'producer returned planned; no workflow warning effect was committed' : `${retried.error?.code ?? 'WARNING_FAILED'}: ${retried.error?.message ?? 'manual warning effect failed'}` }
-            : null;
-        }
-      });
-      humanOverride = consumed;
-      return current;
-    });
+    result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-warning.${kind}`, async () => applyWorkflowWarningIntent(values as WorkflowWarningIntent));
   } catch (error) {
     if (!(error instanceof TaskExecutionLockError)) throw error;
     process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: error.code, message: error.message } })}\n`);
     process.exitCode = 1;
     return;
   }
-  process.stdout.write(`${JSON.stringify(humanOverride ? { ...result, humanOverride } : result)}\n`);
-  const overrideFailed = Boolean(
-    humanOverride && typeof humanOverride === 'object' &&
-    (humanOverride as { status?: unknown }).status === 'failed'
-  );
-  if (result.status === 'failed' || overrideFailed) process.exitCode = 1;
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+  if (result.status === 'failed') process.exitCode = 1;
 }
 
 export { taskWarning };

package/lib/platform/completion-backfill.ts

@@ -19,6 +19,24 @@ type CompletionBackfillResult = PlatformResult & {
   artifacts: Array<{ artifact: string; status: PlatformResult['status'] }>;
   warnings: Array<{ id: string; status: string }>;
 };
+type CompletionBackfillEligibility = Readonly<{
+  status: 'ready' | 'failed';
+  eligible: boolean;
+  error: { code: string; message: string; retryable: boolean } | null;
+}>;
+type BackfillArtifactReference = Readonly<
+  | { status: 'ignored'; artifact: null; error: null }
+  | { status: 'ready'; artifact: string; error: null }
+  | { status: 'failed'; artifact: null; error: { code: string; message: string; retryable: false } }
+>;
+type BackfillWarningMatch = Readonly<{
+  warning: ReturnType<typeof getOpenWorkflowWarnings>[number];
+  artifact: string;
+}>;
+type BackfillWarningMatches = Readonly<
+  | { status: 'ready'; matches: BackfillWarningMatch[]; error: null }
+  | { status: 'failed'; matches: []; error: { code: string; message: string; retryable: false } }
+>;
 
 function result(
   base: PlatformResult,
@@ -28,18 +46,65 @@ function result(
   return { ...base, artifacts, warnings };
 }
 
-function excludedPrReview(taskDir: string, message: string): string | null {
-  const names = [...message.matchAll(/(?:^|[^A-Za-z0-9_-])(pr-review(?:-r[1-9]\d*)?\.md)(?=$|[^A-Za-z0-9_.-])/g)]
+function referencedBackfillArtifact(taskDir: string, message: string): BackfillArtifactReference {
+  const names = [...message.matchAll(/(?:^|[^A-Za-z0-9_-])([a-z][a-z-]*(?:-r[1-9]\d*)?\.md)(?=$|[^A-Za-z0-9_.-])/g)]
     .map((match) => match[1]!);
-  if (names.length !== 1) return null;
+  if (names.length !== 1) return { status: 'ignored', artifact: null, error: null };
   const parsed = parseArtifactName(names[0]!);
-  if (!parsed || parsed.family !== 'pr-review') return null;
+  if (!parsed || (parsed.family !== 'pr-review' && !COMPLETION_BACKFILL_FAMILIES.includes(parsed.family as typeof COMPLETION_BACKFILL_FAMILIES[number]))) {
+    return { status: 'ignored', artifact: null, error: null };
+  }
   const artifactPath = path.join(taskDir, parsed.name);
   try {
     const stat = fs.lstatSync(artifactPath);
-    return stat.isFile() && !stat.isSymbolicLink() ? parsed.name : null;
-  } catch {
-    return null;
+    if (stat.isSymbolicLink()) return {
+      status: 'failed', artifact: null,
+      error: { code: 'ARTIFACT_TOPOLOGY_CONFLICT', message: `SYMBOLIC_LINK: symbolic links are not workflow artifacts: ${parsed.name}`, retryable: false }
+    };
+    if (!stat.isFile()) return {
+      status: 'failed', artifact: null,
+      error: { code: 'ARTIFACT_TOPOLOGY_CONFLICT', message: `NON_REGULAR_FILE: artifact is not a regular file: ${parsed.name}`, retryable: false }
+    };
+    fs.accessSync(artifactPath, fs.constants.R_OK);
+    return { status: 'ready', artifact: parsed.name, error: null };
+  } catch (error) {
+    return {
+      status: 'failed', artifact: null,
+      error: { code: 'ARTIFACT_READ_FAILED', message: `Unable to inspect referenced artifact '${parsed.name}': ${error instanceof Error ? error.message : String(error)}`, retryable: false }
+    };
+  }
+}
+
+function matchingBackfillWarnings(taskDir: string, content: string): BackfillWarningMatches {
+  const matches: BackfillWarningMatch[] = [];
+  for (const warning of getOpenWorkflowWarnings(content)) {
+    if (warning.step !== 'complete-task' || warning.code !== 'COMMENT_SYNC_FAILED' || warning.target !== 'artifact') continue;
+    const reference = referencedBackfillArtifact(taskDir, warning.message);
+    if (reference.status === 'failed') return { status: 'failed', matches: [], error: reference.error };
+    if (reference.status === 'ready') matches.push({ warning, artifact: reference.artifact });
+  }
+  return { status: 'ready', matches, error: null };
+}
+
+function inspectCompletionBackfillEligibility(
+  taskRef: string,
+  options: Pick<CompletionBackfillOptions, 'cwd'> = {}
+): CompletionBackfillEligibility {
+  const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
+  if (!resolved.ok) return {
+    status: 'failed', eligible: false,
+    error: { code: resolved.code, message: resolved.message, retryable: false }
+  };
+  try {
+    const content = fs.readFileSync(resolved.taskMdPath, 'utf8');
+    const matching = matchingBackfillWarnings(resolved.taskDir, content);
+    if (matching.status === 'failed') return { status: 'failed', eligible: false, error: matching.error };
+    return { status: 'ready', eligible: matching.matches.length > 0, error: null };
+  } catch (error) {
+    return {
+      status: 'failed', eligible: false,
+      error: { code: 'TASK_READ_FAILED', message: error instanceof Error ? error.message : String(error), retryable: false }
+    };
   }
 }
 
@@ -60,6 +125,8 @@ async function backfillCompletionComments(
     }
   }), [], []);
   const initialContent = fs.readFileSync(resolved.taskMdPath, 'utf8');
+  const matching = matchingBackfillWarnings(resolved.taskDir, initialContent);
+  if (matching.status === 'failed') return result(platformResult('failed', { error: matching.error }), [], []);
   const issueIdentity = taskIssueIdentity(parseTaskFrontmatter(initialContent));
   if (!issueIdentity) return result(platformResult('no-op', {
     error: { code: 'ISSUE_NOT_LINKED', message: 'Task has no valid platform issue identity', retryable: false }
@@ -92,17 +159,12 @@ async function backfillCompletionComments(
     }), artifacts, []);
   }
 
-  const matching = getOpenWorkflowWarnings(initialContent).flatMap((warning) => {
-    if (warning.step !== 'complete-task' || warning.code !== 'COMMENT_SYNC_FAILED' || warning.target !== 'artifact') return [];
-    const excluded = excludedPrReview(resolved.taskDir, warning.message);
-    return excluded ? [{ warning, excluded }] : [];
-  });
   const warnings: CompletionBackfillResult['warnings'] = [];
   let metadata: ReturnType<typeof captureTaskWriteMetadata> | null = null;
-  for (const { warning, excluded } of matching) {
+  for (const { warning, artifact } of matching.matches) {
     metadata ??= captureTaskWriteMetadata();
     const resolution = [
-      `excluded=${excluded}`,
+      `artifact=${artifact}`,
       `completionFamilies=${COMPLETION_BACKFILL_FAMILIES.join(',')}`,
       `synchronized=${inventory.artifacts.map((artifact) => artifact.name).join(',') || 'none'}`,
       `completedAt=${metadata.timestamp}`
@@ -131,5 +193,5 @@ async function backfillCompletionComments(
   }), artifacts, warnings);
 }
 
-export { backfillCompletionComments };
-export type { CompletionBackfillOptions, CompletionBackfillResult };
+export { backfillCompletionComments, inspectCompletionBackfillEligibility };
+export type { CompletionBackfillEligibility, CompletionBackfillOptions, CompletionBackfillResult };

package/lib/platform/pr-summary.ts

@@ -3,7 +3,6 @@ import path from 'node:path';
 
 import { enumerateArtifacts } from '../task/artifacts.ts';
 import { parseTypedTaskFrontmatter } from '../task/frontmatter.ts';
-import { renderHumanOverrideAudit } from '../task/human-override.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.ts';
 import { readPrDeliveryFact } from '../task/pr-delivery-fact.ts';
@@ -11,7 +10,7 @@ import type { PrDeliveryFact } from '../task/pr-delivery-fact.ts';
 import { resolvePlatformProviderContext } from './context.ts';
 import type { LoadedContext, PlatformClient } from './context.ts';
 import { normalizeCommentContent } from './issue-comments.ts';
-import { CONTROL_MARKER_PATTERN, escapeHtmlText, sanitizeMarkdownDocument, splitDocumentPlaceholder } from './comment-safety.ts';
+import { CONTROL_MARKER_PATTERN, sanitizeMarkdownDocument, splitDocumentPlaceholder } from './comment-safety.ts';
 import { platformResult } from './types.ts';
 import type { PlatformResult } from './types.ts';
 import type { OperationWarning } from '../task/operation-outcome.ts';
@@ -74,25 +73,6 @@ function summaryMarker(taskId: string): string {
   return `<!-- sync-pr:${taskId}:summary -->`;
 }
 
-function escapeSummaryAuditText(value: string): string {
-  return escapeHtmlText(value).replace(/\r\n?/g, '\n');
-}
-
-function renderSummaryAuditLine(value: string): string {
-  const safe = escapeSummaryAuditText(value);
-  const longestRun = Math.max(0, ...(safe.match(/`+/g) || []).map((run) => run.length));
-  const delimiter = '`'.repeat(longestRun + 1);
-  return `${delimiter} ${safe} ${delimiter}`;
-}
-
-function renderSafeHumanOverrideAudit(value: string): string {
-  const normalized = value.trim().replace(/\r\n?/g, '\n');
-  if (!normalized) return '';
-  const [heading, ...rows] = normalized.split('\n');
-  const safeHeading = heading === '## Human Override Audit' ? heading : renderSummaryAuditLine(heading || '');
-  return [safeHeading, ...rows.map((row) => row ? renderSummaryAuditLine(row) : '')].join('\n');
-}
-
 function isSafeSummaryEnvelope(value: string, taskId: string): boolean {
   return value.includes(summaryMarker(taskId))
     && (value.match(/<!--\s*sync-pr:/gi) || []).length === 1
@@ -136,9 +116,8 @@ function platformError(error: { code: string; message: string; retryable?: boole
   return { code: error.code, message: error.message, retryable: error.retryable ?? false };
 }
 
-function buildPullRequestSummary(taskId: string, body: string, headSha: string, humanOverrideAudit = ''): string {
-  const sections = [body.replace(/\s+$/, ''), renderSafeHumanOverrideAudit(humanOverrideAudit)].filter(Boolean).join('\n\n');
-  return normalizeCommentContent(`${summaryMarker(taskId)}\n<!-- last-commit: ${headSha} -->\n\n${sections}\n`);
+function buildPullRequestSummary(taskId: string, body: string, headSha: string): string {
+  return normalizeCommentContent(`${summaryMarker(taskId)}\n<!-- last-commit: ${headSha} -->\n\n${body.replace(/\s+$/, '')}\n`);
 }
 
 function reconcileSummaryComment(comments: SummaryComment[], taskId: string, desired: string):
@@ -643,7 +622,7 @@ async function syncPullRequestSummary(
           `<!-- manual-validation-receipt: transaction=${manual.transactionId}; receipt=${manual.receiptDigest}; evidence=${manualEvidenceDigest}; head=${manual.prHeadSha} -->`
         )
         : replaced.value;
-      const desired = buildPullRequestSummary(resolved.taskId, renderedBody, initial.value.head.sha, renderHumanOverrideAudit(taskContent));
+      const desired = buildPullRequestSummary(resolved.taskId, renderedBody, initial.value.head.sha);
       if (!isSafeSummaryEnvelope(desired, resolved.taskId)) return fail('failed', context, {
         code: 'PR_SUMMARY_RENDER_INVALID',
         message: 'Summary contains an invalid or duplicated reserved control marker',