@fitlab-ai/agent-infra 0.11.3 → 0.11.5

package/lib/platform/verification-sync.ts

@@ -5,6 +5,8 @@ import path from "node:path";
 import process from "node:process";
 import { execFileSync } from "node:child_process";
 
+import { resolveBranchWorktree } from "../git/branch-worktree.ts";
+
 import { resolvePlatformProviderContext } from "./context.ts";
 import { hasCheckedRequirement, resolveRequirementSection } from "./issue-metadata.ts";
 import { requirementSectionAnchors } from "./issues.ts";
@@ -1054,7 +1056,10 @@ function computeExpectedInLabels(taskDir: any, repositoryLabels: string[], mappi
     return { ok: false, type: "check_failed", message: "Task has no delivery_base_ref for in-label evidence" };
   }
   const branch = typeof task.metadata?.branch === "string" ? task.metadata.branch.trim() : "";
-  const gitCwd = branch ? worktreeForBranch(shared.repoRoot, branch) ?? taskDir : taskDir;
+  const gitCwd = branch ? resolveBranchWorktree(shared.repoRoot, branch) : taskDir;
+  if (!gitCwd) {
+    return { ok: false, type: "check_failed", message: `Task branch '${branch}' is not checked out in a usable worktree` };
+  }
   const changedFilesResult = gitText(["diff", `${baseRef}...HEAD`, "--name-only"], gitCwd);
   if (!changedFilesResult.ok) {
     return { ...changedFilesResult, type: "network_error" };
@@ -1082,25 +1087,6 @@ function computeExpectedInLabels(taskDir: any, repositoryLabels: string[], mappi
   return { ok: true, labels: planned.target, mode: "mapped" };
 }
 
-function worktreeForBranch(repositoryRoot: string, branch: string): string | null {
-  try {
-    const records = execFileSync("git", ["worktree", "list", "--porcelain"], {
-      cwd: repositoryRoot,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim().split(/\r?\n\r?\n/);
-    const expectedRef = `refs/heads/${branch}`;
-    for (const record of records) {
-      const worktree = /^worktree (.+)$/m.exec(record)?.[1];
-      const branchRef = /^branch (.+)$/m.exec(record)?.[1];
-      if (worktree && branchRef === expectedRef) return worktree;
-    }
-  } catch {
-    // Fall back to taskDir so ordinary in-repository task workspaces retain their behavior.
-  }
-  return null;
-}
-
 function loadInLabelMapping(shared: VerificationShared): any {
   const configPath = path.join(shared.repoRoot, ".agents", ".airc.json");
   if (!fs.existsSync(configPath)) {
@@ -1141,42 +1127,16 @@ function resolvePrHeadSha(context: any): any {
     return fallback();
   }
 
-  const worktreeList = gitText(["worktree", "list", "--porcelain"], context.taskDir);
-  if (!worktreeList.ok) {
-    return fallback();
-  }
-
-  const matchedWorktree = findWorktreeForBranch(worktreeList.value, branch);
+  const matchedWorktree = resolveBranchWorktree(context.taskDir, branch);
   if (!matchedWorktree) {
-    return fallback();
-  }
-
-  const headInWorktree = gitText(["rev-parse", "HEAD"], matchedWorktree);
-  if (!headInWorktree.ok) {
-    return fallback();
-  }
-
-  return headInWorktree;
-}
-
-function findWorktreeForBranch(porcelainOutput: any, branch: any): any {
-  let currentWorktree = "";
-  for (const rawLine of String(porcelainOutput || "").split("\n")) {
-    const line = rawLine.trimEnd();
-    if (line.startsWith("worktree ")) {
-      currentWorktree = line.slice("worktree ".length).trim();
-      continue;
-    }
-
-    if (line.startsWith("branch refs/heads/")) {
-      const usedBranch = line.slice("branch refs/heads/".length).trim();
-      if (usedBranch === branch && currentWorktree) {
-        return currentWorktree;
-      }
-    }
+    return {
+      ok: false,
+      type: "check_failed",
+      message: `Task branch '${branch}' is not checked out in a usable worktree`
+    };
   }
 
-  return null;
+  return gitText(["rev-parse", "HEAD"], matchedWorktree);
 }
 
 function interpolate(template: any, taskDir: any, artifactFile: any): any {

package/lib/sandbox/control/client.ts

@@ -393,6 +393,7 @@ export function requestSandboxControl(params: Readonly<{
 
 export function requestSandboxTaskFinalization(params: Readonly<{
   agent: string;
+  prepareHandoff?: (binding: Readonly<{ generation: string; requestId: string }>) => string;
   channelDir?: string;
   statusDir?: string;
   token?: string;
@@ -403,15 +404,18 @@ export function requestSandboxTaskFinalization(params: Readonly<{
   if (!agent) clientError('SANDBOX_CONTROL_REQUEST_INVALID', 'task-finalization agent is invalid', false);
   const auth = authority(params);
   const issuedAt = Date.now();
+  const id = randomUUID();
+  const handoffSha256 = (params.prepareHandoff ?? (() => '0'.repeat(64)))({ generation: auth.generation, requestId: id });
   const request: SandboxTaskFinalizationRequest = {
     version: 3,
-    id: randomUUID(),
+    id,
     ...auth,
     issuedAt,
     expiresAt: issuedAt + SANDBOX_CONTROL_ADMISSION_WINDOW_MS,
     family: 'task-finalization',
     operation: 'complete',
     agent,
+    handoffSha256,
     args: [],
     controllerProcess: null,
     controllerProof: null

package/lib/sandbox/control/executor.ts

@@ -2,6 +2,7 @@ import { spawn, type ChildProcess } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
+import { homedir } from 'node:os';
 import { getProcessStartTime } from '../../server/process-state.ts';
 import {
   createTask,
@@ -41,6 +42,11 @@ import {
   openCodexControllerRegistration,
   resolveCodexControllerBinding
 } from './controller-registration.ts';
+import { shareBranchDir } from '../constants.ts';
+
+function handoffDirectory(manifest: SandboxControlManifest): string {
+  return shareBranchDir({ shareBase: path.join(homedir(), '.agent-infra', 'share', manifest.project) }, manifest.branch);
+}
 
 export type SandboxControlExecutionResult = {
   exitCode: number;
@@ -373,10 +379,11 @@ async function executeRequestInner(
     }
   }
   if (request.family === 'task-finalization') {
-    const operation = parseTaskControlOperation(
+    const parsed = parseTaskControlOperation(
       'task-finalization', [manifest.taskId!, 'complete', '--agent', request.agent]
     );
-    if (operation.family !== 'task-finalization') throw new Error('SANDBOX_CONTROL_FINALIZATION_OPERATION_INVALID');
+    if (parsed.family !== 'task-finalization') throw new Error('SANDBOX_CONTROL_FINALIZATION_OPERATION_INVALID');
+    const operation = { ...parsed, request: { ...parsed.request, handoffSha256: request.handoffSha256 } };
     const result = dispatchTaskControlOperation(
       createSandboxExecutorExecutionContext({
         repoRoot: manifest.repoRoot,
@@ -385,7 +392,8 @@ async function executeRequestInner(
         taskId: manifest.taskId!,
         generation: manifest.generation,
         manifestPath,
-        requestId: request.id
+        requestId: request.id,
+        handoffDirectory: handoffDirectory(manifest)
       }),
       operation
     );
@@ -407,7 +415,8 @@ async function executeRequestInner(
     taskId: manifest.taskId!,
     generation: manifest.generation,
     manifestPath,
-    requestId: request.id
+    requestId: request.id,
+    handoffDirectory: handoffDirectory(manifest)
   });
   const format = (value: unknown): SandboxControlExecutionResult => {
     const result = value as { status?: string };

package/lib/sandbox/control/protocol.ts

@@ -65,7 +65,7 @@ export type SandboxTaskCommandRequest = RequestBase & Readonly<{
   family: 'task-lifecycle'; args: string[];
 }>;
 export type SandboxTaskFinalizationRequest = RequestBase & Readonly<{
-  family: 'task-finalization'; operation: 'complete'; agent: string; args: [];
+  family: 'task-finalization'; operation: 'complete'; agent: string; handoffSha256: string; args: [];
 }>;
 export type SandboxTaskCreateRequest = RequestBase & Readonly<{
   family: 'task-create'; candidate: TaskCreateCandidateV1;
@@ -279,11 +279,12 @@ export function validateSandboxControlRequest(
     return request as SandboxCodexControllerRequest;
   }
   if (request.family === 'task-finalization') {
-    const expected = ['agent', 'args', 'controllerProcess', 'controllerProof', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'operation', 'token', 'version'];
+    const expected = ['agent', 'args', 'controllerProcess', 'controllerProof', 'expiresAt', 'family', 'generation', 'handoffSha256', 'id', 'issuedAt', 'operation', 'token', 'version'];
     if (Object.keys(request).sort().join(',') !== expected.sort().join(',')
       || request.operation !== 'complete'
       || !Array.isArray(request.args) || request.args.length !== 0
       || typeof request.agent !== 'string' || normalizeAgentToken(request.agent) !== request.agent
+      || typeof request.handoffSha256 !== 'string' || !/^[a-f0-9]{64}$/u.test(request.handoffSha256)
       || request.controllerProcess !== null || request.controllerProof !== null) {
       fail('SANDBOX_CONTROL_REQUEST_INVALID', 'task-finalization request schema or authorization is invalid');
     }

package/lib/sandbox/control/server.ts

@@ -1,4 +1,3 @@
-import { finalizationTerminalResponse } from './finalization-response.ts';
 import { completedReentryView } from './completed-reentry.ts';
 import fs from 'node:fs';
 import path from 'node:path';
@@ -77,7 +76,6 @@ import { readCodexControllerRegistration } from './controller-registration.ts';
 import { validateSandboxControlIdentity } from './identity-sentinel.ts';
 import {
   mergeSandboxTaskView,
-  taskViewAfterFinalization,
   taskViewForManifest,
   type SandboxTaskView
 } from './task-view.ts';
@@ -207,61 +205,6 @@ export function writeSandboxControlResponse(manifest: SandboxControlManifest, re
   return true;
 }
 
-type FinalizationRecovery = Readonly<{
-  status: 'matched' | 'deferred' | 'not-applicable';
-  response?: SandboxControlResponse;
-}>;
-
-function finalizationRecoveryResponse(
-  manifest: SandboxControlManifest,
-  requestId: string,
-  exitCode: number
-): FinalizationRecovery {
-  if (!manifest.taskId || exitCode !== 0) return { status: 'not-applicable' };
-  let receipt;
-  try {
-    receipt = readTaskFinalizationReceipt(manifest.repoRoot, manifest.taskId);
-    if (!receipt || !receipt.controlBinding
-      || receipt.controlBinding.generation !== manifest.generation
-      || receipt.controlBinding.requestId !== requestId) return { status: 'deferred' };
-    const resolved = resolveTaskRef(manifest.taskId, { repoRoot: manifest.repoRoot });
-    if (!resolved.ok || resolved.state !== 'completed' || receipt.lifecycle !== 'done') return { status: 'deferred' };
-  } catch {
-    return { status: 'deferred' };
-  }
-  return { status: 'matched', response: finalizationTerminalResponse(manifest.taskId, requestId, receipt) };
-}
-
-function publishFinalizationTaskView(
-  manifest: SandboxControlManifest,
-  broker: BrokerOwner,
-  requestId: string,
-  state: 'starting' | 'healthy' | 'busy' | 'parked',
-  reasonCode: string | null,
-  activeRequestId: string | null
-): SandboxTaskView {
-  let view: SandboxTaskView;
-  try {
-    const resolved = resolveTaskRef(manifest.taskId ?? '', { repoRoot: manifest.repoRoot });
-    const receipt = readTaskFinalizationReceipt(manifest.repoRoot, manifest.taskId ?? '');
-    view = resolved.ok && resolved.state === 'completed'
-      ? taskViewAfterFinalization({
-          taskId: manifest.taskId ?? '', generation: manifest.generation, requestId, receipt
-        })
-      : {
-          state: 'unknown', taskId: manifest.taskId, observedSource: 'unknown', receipt: null,
-          reasonCode: 'SANDBOX_TASK_VIEW_SOURCE_UNCONFIRMED'
-        };
-  } catch {
-    view = {
-      state: 'unknown', taskId: manifest.taskId, observedSource: 'unknown', receipt: null,
-      reasonCode: 'SANDBOX_TASK_VIEW_RECEIPT_INVALID'
-    };
-  }
-  writeSandboxControlStatus(manifest, broker, state, reasonCode, activeRequestId, Date.now(), view);
-  return view;
-}
-
 function payloadReference(payload: ReturnType<typeof createSandboxControlPayload>) {
   return {
     version: payload.version,
@@ -458,11 +401,7 @@ export async function recoveryResponse(
     }, payload.stdout);
     if (JSON.stringify(payloadTerminal) !== JSON.stringify(terminalResult)) return unknown(request.id);
   }
-  const finalization = request.family === 'task-finalization' ? finalizationRecoveryResponse(manifest, request.id, 0) : null;
-  if (evidence.exitCode === 0 && finalization?.status === 'deferred') return null;
-  const recovery: RecoveryDomainEvidence = finalization
-    ? { domain: { consistent: finalization.status === 'matched' } }
-    : await readRecoveryDomain(manifest, manifestPath, request, operation, terminalResult, payload?.stdout ?? null);
+  const recovery = await readRecoveryDomain(manifest, manifestPath, request, operation, terminalResult, payload?.stdout ?? null);
   const binding = operationRecoveryBinding(request.id, manifest.generation, manifest.taskId, request.family, operationName!);
   const decision = classifySandboxControlRecovery({
     operation,
@@ -476,16 +415,11 @@ export async function recoveryResponse(
   if (decision.outcome === 'unknown' || decision.outcome === 'in-progress') return unknown(request.id);
   if (decision.outcome === 'not-executed') return notExecuted(request.id);
   if (decision.outcome !== 'success' && decision.outcome !== 'failure') return null;
-  if (request.family === 'task-finalization' && evidence.exitCode === 0) {
-    if (finalization?.status !== 'matched') return null;
-    return finalization.response ?? null;
-  }
   return genericRecoveryResponse(request, evidence.exitCode, payload);
 }
 
 async function terminalMatchesEvidence(
   manifest: SandboxControlManifest,
-  manifestPath: string,
   request: SandboxControlRequest,
   response: SandboxControlResponse,
   evidence: ReturnType<typeof readSandboxControlResultEvidence>,
@@ -493,14 +427,6 @@ async function terminalMatchesEvidence(
   payloadInvalid: boolean,
   terminalResult: ReturnType<typeof readSandboxControlTerminalResult> | null
 ): Promise<{ valid: boolean; payloadReferenced: boolean }> {
-  if (request.family === 'task-finalization' && evidence.exitCode === 0) {
-    if (!terminalResult) return { valid: false, payloadReferenced: false };
-    const expected = await recoveryResponse(manifest, manifestPath, request, evidence, payload, terminalResult);
-    return {
-      valid: expected !== null && JSON.stringify(response) === JSON.stringify(expected),
-      payloadReferenced: false
-    };
-  }
   if (response.version !== 2 || response.id !== request.id || response.phase !== 'completed'
     || response.exitCode !== evidence.exitCode || response.error !== null) {
     return { valid: false, payloadReferenced: false };
@@ -539,7 +465,6 @@ function publishExecutionResult(
   manifest: SandboxControlManifest,
   request: SandboxControlRequest,
   result: SandboxControlExecutionResult,
-  broker: BrokerOwner,
   brokerOwns: () => boolean
 ): boolean {
   const normalized = sanitizeSandboxControlResult(manifest, result);
@@ -553,41 +478,26 @@ function publishExecutionResult(
     criticalRequestPhase(manifest, request, 'evidence-written', normalized.exitCode === 0 ? 'success' : 'failure');
     criticalRequestPhase(manifest, request, 'publish-authorized', normalized.exitCode === 0 ? 'success' : 'failure');
   }
-  let terminal: SandboxControlResponse | null = null;
-  if (request.family === 'task-finalization') {
-    const finalization = finalizationRecoveryResponse(manifest, request.id, normalized.exitCode);
-    if (finalization.status === 'deferred') return false;
-    terminal = finalization.response ?? null;
-  }
-  if (!terminal) {
-    const inline: SandboxControlResponse = {
-      version: 2, id: request.id, phase: 'completed', exitCode: normalized.exitCode,
-      stdout: normalized.stdout, stderr: normalized.stderr, error: null
-    };
-    if (sandboxControlEncodedJsonBytes(inline) <= SANDBOX_CONTROL_MAX_TERMINAL_RECORD_BYTES) {
-      terminal = inline;
-    }
+  let terminal: SandboxControlResponse = {
+    version: 2, id: request.id, phase: 'completed', exitCode: normalized.exitCode,
+    stdout: normalized.stdout, stderr: normalized.stderr, error: null
+  };
+  if (sandboxControlEncodedJsonBytes(terminal) > SANDBOX_CONTROL_MAX_TERMINAL_RECORD_BYTES) {
     let payload: ReturnType<typeof createSandboxControlPayload> | null = null;
-    if (!terminal) {
-      try {
-        payload = createSandboxControlPayload(manifest, request.id, normalized);
-        const usage = sandboxControlGenerationUsage(manifest);
-        if (usage.bytes + sandboxControlEncodedJsonBytes(payload) <= SANDBOX_CONTROL_MAX_RESPONSE_BYTES) {
-          writeSandboxControlPayload(manifest, request.id, normalized);
-        } else {
-          payload = null;
-        }
-      } catch {
+    try {
+      payload = createSandboxControlPayload(manifest, request.id, normalized);
+      const usage = sandboxControlGenerationUsage(manifest);
+      if (usage.bytes + sandboxControlEncodedJsonBytes(payload) <= SANDBOX_CONTROL_MAX_RESPONSE_BYTES) {
+        writeSandboxControlPayload(manifest, request.id, normalized);
+      } else {
         payload = null;
       }
-      terminal = genericRecoveryResponse(request, normalized.exitCode, payload, 'publish');
+    } catch {
+      payload = null;
     }
+    terminal = genericRecoveryResponse(request, normalized.exitCode, payload, 'publish');
   }
   if (!brokerOwns()) return false;
-  if (request.family === 'task-finalization' && normalized.exitCode === 0) {
-    const view = publishFinalizationTaskView(manifest, broker, request.id, 'healthy', null, null);
-    if (view.state === 'unknown') return false;
-  }
   const committed = writeSandboxControlResponse(manifest, terminal);
   if (committed && fs.existsSync(path.join(manifest.processingDir, request.id, 'transitions'))) {
     criticalRequestPhase(manifest, request, 'published-committed', normalized.exitCode === 0 ? 'success' : 'failure');
@@ -780,7 +690,6 @@ async function recoverProcessing(manifest: SandboxControlManifest, manifestPath:
         if (!terminalResult && request.family !== 'task-create') continue;
         const reconciliation = await terminalMatchesEvidence(
           manifest,
-          manifestPath,
           request,
           existingTerminalResponse!,
           resultEvidence,
@@ -791,10 +700,6 @@ async function recoverProcessing(manifest: SandboxControlManifest, manifestPath:
         if (!reconciliation.valid) continue;
         terminalReconciled = true;
         payloadReferenced = reconciliation.payloadReferenced;
-        if (request.family === 'task-finalization' && resultEvidence.exitCode === 0) {
-          const view = publishFinalizationTaskView(manifest, broker, request.id, 'starting', null, null);
-          if (view.state === 'unknown') continue;
-        }
       }
       if (!terminalResult && !terminalReconciled) {
         if (terminal) continue;
@@ -814,17 +719,13 @@ async function recoverProcessing(manifest: SandboxControlManifest, manifestPath:
         if (!resultEvidence || !request || payloadInvalid) continue;
         const recovered = await recoveryResponse(manifest, manifestPath, request, resultEvidence, payload, terminalResult!);
         if (!recovered) continue;
-        if (request.family === 'task-finalization' && resultEvidence.exitCode === 0) {
-          const view = publishFinalizationTaskView(manifest, broker, request.id, 'starting', null, null);
-          if (view.state === 'unknown') continue;
-        }
         writeSandboxControlResponse(manifest, recovered);
         const preserveRecoveryEvidence = recovered.error?.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN';
         if (transitionProtocolActive && !preserveRecoveryEvidence) {
           writeSandboxControlTransition(manifest, { requestId: entry.name, phase: 'recovered' });
         }
         if (preserveRecoveryEvidence) continue;
-        payloadReferenced = Boolean(payload) && request.family !== 'task-finalization';
+        payloadReferenced = Boolean(payload);
       }
     } else {
       if (!brokerOwns()) return false;
@@ -922,14 +823,10 @@ export async function serveSandboxControl(
     try {
       startupReceipt = readTaskFinalizationReceipt(manifest.repoRoot, manifest.taskId);
     } catch {
-      // Preserve malformed receipt evidence as unknown rather than treating it as no receipt.
       startupReceipt = {};
     }
   }
-  let taskView = taskViewForManifest({
-    ...manifest,
-    receipt: startupReceipt
-  });
+  let taskView = taskViewForManifest({ ...manifest, receipt: startupReceipt });
   try {
     const previous = readSandboxControlStatus(manifest.publicStatusDir);
     if (previous.generation === manifest.generation) taskView = mergeSandboxTaskView(taskView, previous.taskView);
@@ -1086,15 +983,7 @@ export async function serveSandboxControl(
         if (!brokerOwns()) break;
         let terminalCommitted = false;
         if (settledExecution.result && settledExecution.resultEvidenceWritten) {
-          terminalCommitted = publishExecutionResult(manifest, settledExecution.request, settledExecution.result, broker, brokerOwns);
-          if (terminalCommitted && settledExecution.request.family === 'task-finalization') {
-            try {
-              const published = readSandboxControlStatus(manifest.publicStatusDir);
-              if (published.generation === manifest.generation) taskView = published.taskView;
-            } catch {
-              taskView = { state: 'unknown', taskId: manifest.taskId, observedSource: 'unknown', receipt: null, reasonCode: 'SANDBOX_TASK_VIEW_STATUS_INVALID' };
-            }
-          }
+          terminalCommitted = publishExecutionResult(manifest, settledExecution.request, settledExecution.result, brokerOwns);
         } else {
           terminalCommitted = writeSandboxControlResponse(manifest, unknown(settledExecution.request.id));
         }
@@ -1341,7 +1230,7 @@ export async function serveSandboxControl(
         }
       }
       if (owned && active.result && active.resultEvidenceWritten) {
-        if (publishExecutionResult(manifest, active.request, active.result, broker, brokerOwns)) {
+        if (publishExecutionResult(manifest, active.request, active.result, brokerOwns)) {
           if (brokerOwns()) {
             removeAcceptedResponse(manifest, active.request.id);
             fs.rmSync(path.join(manifest.processingDir, active.request.id), { recursive: true, force: true });
@@ -1350,22 +1239,8 @@ export async function serveSandboxControl(
         }
       }
       if (active) {
-        const terminationConfirmed = active.prepared.terminate(owned);
-        if (owned && brokerOwns() && active.request.family === 'task-finalization') {
-          const recovered = finalizationRecoveryResponse(manifest, active.request.id, 0);
-          const view = recovered.status === 'matched'
-            ? publishFinalizationTaskView(manifest, broker, active.request.id, 'healthy', null, null)
-            : null;
-          if (view?.state !== 'unknown' && recovered.status === 'matched' && recovered.response
-            && writeSandboxControlResponse(manifest, recovered.response)) {
-            if (terminationConfirmed && brokerOwns()) {
-              removeAcceptedResponse(manifest, active.request.id);
-              fs.rmSync(path.join(manifest.processingDir, active.request.id), { recursive: true, force: true });
-              active = null;
-            }
-          }
-        }
-        if (owned && brokerOwns() && active && active.request.family !== 'task-finalization' && !active.resultEvidenceWritten) {
+        active.prepared.terminate(owned);
+        if (owned && brokerOwns() && active && !active.resultEvidenceWritten) {
           writeSandboxControlResponse(manifest, unknown(active.request.id));
         }
       }

package/lib/sandbox/removal.ts

@@ -47,6 +47,7 @@ import { toolConfigDirCandidates, toolProjectDirCandidates } from './tools.ts';
 import type { SandboxTool } from './tools.ts';
 import { getProcessStartTime } from '../server/process-state.ts';
 import { releaseStaleShortIdRegistry } from '../task/short-id.ts';
+import { withRepositoryMutationLock } from '../task/task-execution-lock.ts';
 import { fetchSandboxRows, type SandboxRow } from './commands/list-running.ts';
 import {
   formatIntermediateCleanupReport,
@@ -959,7 +960,10 @@ async function rmOne(
   branch: string,
   options: RmOneOptions = {}
 ): Promise<void> {
-  await runRmOneUnderRepositoryLock(config, tools, branch, options);
+  await withRepositoryMutationLock(
+    config.repoRoot,
+    () => runRmOneUnderRepositoryLock(config, tools, branch, options)
+  );
 }
 
 async function removeUncheckedSandbox(
@@ -998,7 +1002,16 @@ async function removeUncheckedSandbox(
     return null;
   }
 
+  const worktreePermits = options.permits ?? await authorizeWorktrees(
+    existingWorktrees,
+    { allowDirtyDiscard: true, assumeYes: Boolean(options.assumeYes) },
+    { ...options.prompt, interactive: options.interactive }
+  );
+
   for (const container of matchedContainers) runSafeEngine(engine, 'docker', ['rm', '-f', container]);
+  if (!sandboxContainersRemoved(engine, matchedContainers)) {
+    throw new Error(`SANDBOX_REMOVAL_CONTAINER_STILL_PRESENT: ${matchedContainers.join(', ')}`);
+  }
   for (const root of controlRoots) {
     fs.rmSync(root, { recursive: true, force: true });
     removeEmptyManagedParent(path.join(config.controlBase, config.project), root);
@@ -1011,12 +1024,15 @@ async function removeUncheckedSandbox(
   for (const shell of shellConfigDirCandidates(config, effectiveBranch)) fs.rmSync(shell, { recursive: true, force: true });
   if (shouldRemoveShare) fs.rmSync(sharePath, { recursive: true, force: true });
   if (shouldRemoveWorktree) {
-    for (const worktree of existingWorktrees) fs.rmSync(worktree, { recursive: true, force: true });
-    runSafe('git', ['-C', config.repoRoot, 'worktree', 'prune']);
+    for (const worktree of existingWorktrees) {
+      const permit = worktreePermits.get(path.resolve(worktree));
+      if (!permit) throw new Error(`SANDBOX_WORKTREE_REMOVAL_PERMIT_MISSING: ${worktree}`);
+      removeWorktreeDir(config.repoRoot, config.worktreeBase, worktree, permit);
+    }
   }
-  if (shouldDeleteBranch) runSafe('git', ['-C', config.repoRoot, 'branch', '-D', effectiveBranch]);
-  if (!sandboxContainersRemoved(engine, matchedContainers)) {
-    throw new Error(`SANDBOX_REMOVAL_CONTAINER_STILL_PRESENT: ${matchedContainers.join(', ')}`);
+  if (shouldDeleteBranch) {
+    assertBranchRemovalIdentity(config, effectiveBranch, worktreePermits);
+    runSafe('git', ['-C', config.repoRoot, 'branch', '-D', effectiveBranch]);
   }
   if (target.workspace.mode === 'task-bound') {
     releaseStaleShortIdRegistry(config.repoRoot, target.workspace.taskId);
@@ -1045,7 +1061,7 @@ async function rmPurge(
   tools: SandboxTool[],
   prompt: PromptDependencies = {}
 ): Promise<void> {
-  return rmPurgeCore(config, tools, prompt);
+  return withRepositoryMutationLock(config.repoRoot, () => rmPurgeCore(config, tools, prompt));
 }
 
 async function rmPurgeCore(

package/lib/sandbox/task-cleanup.ts

@@ -8,7 +8,6 @@ import { enumerateAllTaskDirs } from '../task/resolve-ref.ts';
 import { resolveSandboxCleanupTarget } from './workspace-identity.ts';
 import { readSandboxControlManifest } from './control/lifecycle.ts';
 import { readJsonFile, readSandboxControlStatus } from './control/state.ts';
-import { finalizationTerminalResponse } from './control/finalization-response.ts';
 
 const TASK_ID_RE = /^TASK-\d{8}-\d{6}$/;
 
@@ -83,13 +82,10 @@ function canonicalPath(input: string): string {
 
 function taskFinalizationReceiptComplete(
   receipt: TaskFinalizationReceipt,
-  taskId: string,
-  binding: SandboxControlBinding
+  taskId: string
 ): boolean {
   return receipt.taskId === taskId
-    && taskFinalizationReceiptState(receipt) === 'complete'
-    && receipt.controlBinding?.generation === binding.generation
-    && receipt.controlBinding.requestId === binding.requestId;
+    && taskFinalizationReceiptState(receipt) === 'complete';
 }
 
 function terminalControlBindingEvidence(
@@ -114,24 +110,20 @@ function terminalControlBindingEvidence(
       if (errorCode(error) !== 'ENOENT') return false;
     }
     const receipt = readTaskFinalizationReceipt(repoRoot, taskId);
-    if (!receipt || !taskFinalizationReceiptComplete(receipt, taskId, binding)) {
+    if (!receipt || !taskFinalizationReceiptComplete(receipt, taskId)) {
       return false;
     }
-    const status = readSandboxControlStatus(manifest.publicStatusDir);
-    const viewReceipt = status.taskView.receipt;
-    const terminalTaskView = (status.taskView.state === 'current' && status.taskView.observedSource === 'completed')
-      || (status.taskView.state === 'finalized-stale' && status.taskView.observedSource === 'active');
-    if (status.generation !== binding.generation || status.state !== 'healthy'
-      || status.activeRequestId !== null || !terminalTaskView || status.taskView.taskId !== taskId
-      || !viewReceipt || viewReceipt.generation !== binding.generation
-      || viewReceipt.requestId !== binding.requestId
-      || viewReceipt.receiptId !== receipt.receiptId
-      || viewReceipt.revision !== receipt.revision) return false;
     const responsePath = path.join(manifest.channelDir, 'responses', `${binding.requestId}.json`);
     if (!inspectOwnedPath(path.join(controlRoot, 'channel'), responsePath, 'file')) return false;
     const actual = readJsonFile(responsePath);
-    const expected = finalizationTerminalResponse(taskId, binding.requestId, receipt);
-    return JSON.stringify(actual) === JSON.stringify(expected);
+    const response = actual as Record<string, unknown>;
+    if (response.version !== 2 || response.id !== binding.requestId || response.phase !== 'completed'
+      || response.exitCode !== 0 || typeof response.stdout !== 'string') return false;
+    const envelope = JSON.parse(response.stdout) as Record<string, unknown>;
+    const result = envelope.result as Record<string, unknown> | null;
+    return envelope.status === 'completed' && envelope.accepted === true
+      && result !== null && typeof result === 'object'
+      && result.status === 'completed' && result.taskId === taskId;
   } catch {
     return false;
   }
@@ -157,7 +149,7 @@ function removedControlBindingEvidence(
   if (frontmatter.id !== taskId || frontmatter.branch !== journal.target.branch) return false;
   try {
     const receipt = readTaskFinalizationReceipt(repoRoot, taskId);
-    return receipt !== null && taskFinalizationReceiptComplete(receipt, taskId, binding);
+    return receipt !== null && taskFinalizationReceiptComplete(receipt, taskId);
   } catch {
     return false;
   }

package/lib/task/activity-intent.ts

@@ -14,7 +14,6 @@ import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-
 import type { TaskExecutionLockOptions } from './task-execution-lock.ts';
 import { captureTaskWriteMetadata, writeTask } from './write.ts';
 import type { TaskMutation, TaskOperationSummary, TaskWriteOptions } from './write.ts';
-import { allowsManualOverride } from './guard-override.ts';
 
 type PrReviewVerdict = 'approved' | 'changes-requested' | 'commented';
 type PrReviewOutcome = 'aborted' | 'superseded';
@@ -398,7 +397,7 @@ export function applyPrReviewActivityIntent(intent: PrReviewActivityIntent, opti
   if ('code' in validated) return failed(intent, validated.code, validated.message);
   const resolved = resolveTaskRef(intent.taskRef, { repoRoot: options.repoRoot });
   if (!resolved.ok) return failed(intent, resolved.code, resolved.message, resolved.taskId);
-  if (resolved.state !== 'active' && !allowsManualOverride(options.manualOverride, 'activity-intent', 'TASK_STATE_MISMATCH')) {
+  if (resolved.state !== 'active') {
     return failed(intent, 'TASK_STATE_MISMATCH', `task ${resolved.taskId} is ${resolved.state}, expected active`, resolved.taskId);
   }
   if (options.lockAlreadyHeld) return applyLocked(intent, validated.agent, { ...options, repoRoot: resolved.repoRoot });