@fitlab-ai/agent-infra 0.11.3 → 0.11.5

package/dist/lib/internal/task-lifecycle.js

@@ -2,7 +2,7 @@ import { createDirectHostExecutionContext, dispatchTaskControlOperation, parseTa
 import { lifecycleIntentCatalog } from '../task/lifecycle.js';
 import { detectRepoRoot, resolveTaskRef } from '../task/resolve-ref.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
-const USAGE = `Usage: agent-infra-internal task-lifecycle <N | TASK-id> <intent> --agent <agent> [intent flags] [--dry-run]\n\nIntents: ${lifecycleIntentCatalog.join(', ')}\nrecover-started: --auto\nOverride: --override-ticket <ticket> --override-target <target> --override-scope <scope>\n`;
+const USAGE = `Usage: agent-infra-internal task-lifecycle <N | TASK-id> <intent> --agent <agent> [intent flags] [--dry-run]\n\nIntents: ${lifecycleIntentCatalog.join(', ')}\nrecover-started: --auto\n`;
 function usageFailure(message) {
     process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'LIFECYCLE_PAYLOAD_INVALID', message } })}\n`);
     process.stderr.write(USAGE);

package/dist/lib/internal/task-operation-registry.js

@@ -85,6 +85,7 @@ function internalTaskRoutes() {
         descriptor('internal', 'task-ledger', 'finding-review', 'task-bound', 'progress'),
         descriptor('internal', 'task-ledger', 'decision-upsert', 'task-bound', 'progress'),
         descriptor('internal', 'task-ledger', 'rework-intent-upsert', 'task-bound', 'progress'),
+        descriptor('internal', 'task-ledger', 'rework-intent-rebuild', 'task-bound', 'progress'),
         descriptor('internal', 'task-warning', 'list', 'task-bound', 'diagnostic'),
         descriptor('internal', 'task-warning', 'add', 'task-bound', 'progress'),
         descriptor('internal', 'task-warning', 'set-status', 'task-bound', 'progress'),
@@ -102,9 +103,6 @@ function internalTaskRoutes() {
         descriptor('internal', 'task-review', 'finalize-summary', 'task-bound', 'progress'),
         descriptor('internal', 'task-event', 'event', 'task-bound', 'progress'),
         descriptor('internal', 'task-invalidation', 'reconcile', 'task-bound', 'progress'),
-        descriptor('internal', 'task-override', 'diagnose', 'task-bound', 'diagnostic'),
-        descriptor('internal', 'task-override', 'issue', 'task-bound', 'progress'),
-        descriptor('internal', 'task-override', 'consume', 'task-bound', 'progress'),
         descriptor('internal', 'task-lifecycle', 'intent', 'task-bound', 'progress'),
         descriptor('internal', 'task-finalization', 'complete', 'task-bound', 'progress'),
         descriptor('internal', 'task-short-id', 'list', 'conditional', 'diagnostic'),
@@ -180,7 +178,7 @@ export const INTERNAL_DISPATCHER_ROUTES = Object.freeze([
     'platform-comment', 'platform-issue', 'platform-pr', 'platform-pr-review', 'pr-review-grade',
     'platform-checks', 'task-context', 'task-ledger', 'task-warning', 'task-activity', 'task-artifact',
     'task-orchestration', 'task-review', 'task-event', 'task-invalidation', 'task-lifecycle',
-    'task-finalization', 'task-override', 'task-short-id', 'task-snapshot', 'task-verify', 'task-validate', 'manual-validation'
+    'task-finalization', 'task-short-id', 'task-snapshot', 'task-verify', 'task-validate', 'manual-validation'
 ]);
 export const PUBLIC_DISPATCHER_ROUTES = Object.freeze([
     'agent-client', 'cp', 'data', 'decide', 'help', 'init', 'merge', 'run', 'sandbox', 'server', 'task', 'sync', 'update', 'version'

package/dist/lib/internal/task-review.js

@@ -1,10 +1,9 @@
 import { parseReviewCommand } from '../task/review-command.js';
 import { finalizeReviewSummary, preflightReviewSummary } from '../task/review-finalization.js';
-import { consumeHumanOverride, failureId, overrideDryRunConflict } from '../task/human-override.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
 import { ensureInternalHandlerRoute } from './cli-route-inventory.js';
-const USAGE = 'Usage: agent-infra-internal task-review <task-ref> <preflight|finalize-summary> --stage <analysis|plan|code> --artifact <review-*.md> [--orchestrated] [--dry-run] [--override-ticket <ticket> --override-target <target> --override-scope <scope>]\n';
+const USAGE = 'Usage: agent-infra-internal task-review <task-ref> <preflight|finalize-summary> --stage <analysis|plan|code> --artifact <review-*.md> [--orchestrated] [--dry-run]\n';
 function failUsage(message) {
     process.stdout.write(`${JSON.stringify({
         status: 'failed',
@@ -30,48 +29,19 @@ async function taskReview(args = []) {
         failUsage(error instanceof Error ? error.message : String(error));
         return;
     }
-    const { stage, artifact, dryRun, orchestrated, overrideTicket, overrideTarget, overrideScope } = request;
+    const { stage, artifact, dryRun, orchestrated } = request;
     const operation = args[1];
-    const dryRunConflict = overrideDryRunConflict({ dryRun, overrideTicket, overrideTarget, overrideScope });
-    if (dryRunConflict) {
-        failUsage(dryRunConflict.message);
-        return;
-    }
     const resolved = resolveTaskRef(args[0]);
     if (!resolved.ok) {
         failUsage(resolved.message);
         return;
     }
     let result;
-    let humanOverride = null;
     try {
         result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-review.${operation}`, async () => {
-            let current = operation === 'preflight'
+            return operation === 'preflight'
                 ? preflightReviewSummary({ taskRef: args[0], stage, artifact, orchestrated, dryRun }, { lockAlreadyHeld: true })
                 : finalizeReviewSummary({ taskRef: args[0], stage, artifact, orchestrated, dryRun }, { lockAlreadyHeld: true });
-            if (operation === 'preflight')
-                return current;
-            if (current.status !== 'failed' || !overrideTicket)
-                return current;
-            if (!overrideTarget || !overrideScope) {
-                failUsage('override ticket requires target and scope');
-                return current;
-            }
-            const consumed = await consumeHumanOverride({
-                taskRef: args[0], ticketId: overrideTicket,
-                failureId: failureId('review-finalization', current.error?.code ?? 'TASK_STATE_MISMATCH'),
-                target: overrideTarget, scope: overrideScope
-            }, {
-                effectExecutor: (capability) => {
-                    const retried = finalizeReviewSummary({ taskRef: args[0], stage, artifact, orchestrated, dryRun }, { lockAlreadyHeld: true, manualOverride: capability });
-                    current = retried;
-                    return retried.status === 'failed' || retried.status === 'planned'
-                        ? { code: 'OVERRIDE_EFFECT_FAILED', message: retried.status === 'planned' ? 'producer returned planned; no review effect was committed' : `${retried.error?.code ?? 'REVIEW_FAILED'}: ${retried.error?.message ?? 'manual review effect failed'}` }
-                        : null;
-                }
-            });
-            humanOverride = consumed;
-            return current;
         });
     }
     catch (error) {
@@ -81,10 +51,8 @@ async function taskReview(args = []) {
         process.exitCode = 1;
         return;
     }
-    process.stdout.write(`${JSON.stringify(humanOverride ? { ...result, humanOverride } : result)}\n`);
-    const overrideFailed = Boolean(humanOverride && typeof humanOverride === 'object' &&
-        humanOverride.status === 'failed');
-    if (result.status === 'failed' || overrideFailed)
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+    if (result.status === 'failed')
         process.exitCode = 1;
 }
 export { taskReview };

package/dist/lib/internal/task-verify.js

@@ -1,9 +1,8 @@
 import { renderTaskVerification, verifyTaskEvent } from '../task/verification.js';
-import { consumeHumanOverride, failureId } from '../task/human-override.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
-const USAGE = 'Usage: agent-infra-internal task-verify <N | TASK-id> <verification-event> [--artifact <canonical.md>] [--format json|text] [--override-ticket <ticket> --override-target <target> --override-scope <scope>]\n';
+const USAGE = 'Usage: agent-infra-internal task-verify <N | TASK-id> <verification-event> [--artifact <canonical.md>] [--format json|text]\n';
 function fail(message) {
     process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'VERIFY_PAYLOAD_INVALID', message } })}\n`);
     process.stderr.write(USAGE);
@@ -25,13 +24,10 @@ async function taskVerify(args = []) {
     const event = args[1];
     let artifact;
     let format = 'json';
-    let overrideTicket;
-    let overrideTarget;
-    let overrideScope;
     const seen = new Set();
     for (let index = 2; index < args.length; index += 1) {
         const flag = args[index];
-        if (!['--artifact', '--format', '--override-ticket', '--override-target', '--override-scope'].includes(flag)) {
+        if (!['--artifact', '--format'].includes(flag)) {
             fail(`unknown option '${flag}'`);
             return;
         }
@@ -47,12 +43,6 @@ async function taskVerify(args = []) {
         seen.add(flag);
         if (flag === '--artifact')
             artifact = value;
-        else if (flag === '--override-ticket')
-            overrideTicket = value;
-        else if (flag === '--override-target')
-            overrideTarget = value;
-        else if (flag === '--override-scope')
-            overrideScope = value;
         else if (value === 'json' || value === 'text')
             format = value;
         else {
@@ -66,40 +56,8 @@ async function taskVerify(args = []) {
         return;
     }
     let result;
-    let humanOverride = null;
     try {
-        result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-verify.${event}`, async () => {
-            let current = await verifyTaskEvent({ taskRef, event, ...(artifact ? { artifact } : {}) });
-            if (current.status === 'pass' || !overrideTicket)
-                return current;
-            if (!overrideTarget || !overrideScope) {
-                fail('override ticket requires target and scope');
-                return current;
-            }
-            const failureProducer = current.status === 'blocked' || current.status === 'fail'
-                ? 'verification-engine'
-                : 'task-verify';
-            const failureCode = current.status === 'blocked'
-                ? 'CHECK_BLOCKED'
-                : current.status === 'fail'
-                    ? 'CHECK_FAILED'
-                    : current.error?.code ?? 'VERIFY_TASK_STATE_MISMATCH';
-            const consumed = await consumeHumanOverride({
-                taskRef, ticketId: overrideTicket,
-                failureId: failureId(failureProducer, failureCode),
-                target: overrideTarget, scope: overrideScope
-            }, {
-                effectExecutor: async (capability) => {
-                    const retried = await verifyTaskEvent({ taskRef, event, ...(artifact ? { artifact } : {}) }, { manualOverride: capability });
-                    current = retried;
-                    return retried.status !== 'pass'
-                        ? { code: 'OVERRIDE_EFFECT_FAILED', message: `${retried.error?.code ?? 'VERIFY_FAILED'}: ${retried.error?.message ?? 'manual verification effect failed'}` }
-                        : null;
-                }
-            });
-            humanOverride = consumed;
-            return current;
-        });
+        result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-verify.${event}`, async () => verifyTaskEvent({ taskRef, event, ...(artifact ? { artifact } : {}) }));
     }
     catch (error) {
         if (!(error instanceof TaskExecutionLockError))
@@ -107,8 +65,6 @@ async function taskVerify(args = []) {
         fail(`${error.code}: ${error.message}`);
         return;
     }
-    if (humanOverride)
-        result = { ...result, humanOverride };
     process.stdout.write(format === 'text' ? renderTaskVerification(result) : `${JSON.stringify(result)}\n`);
     process.exitCode = result.status === 'pass' ? 0 : result.status === 'blocked' ? 2 : 1;
 }

package/dist/lib/internal/task-warning.js

@@ -1,13 +1,11 @@
 import { applyWorkflowWarningIntent } from '../task/workflow-warning-intents.js';
-import { consumeHumanOverride, failureId, overrideDryRunConflict } from '../task/human-override.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal task-warning <task-ref> <add|set-status|list> [intent flags] [--dry-run]\n`;
 const FLAGS = {
     '--step': 'step', '--severity': 'severity', '--code': 'code', '--target': 'target',
-    '--message': 'message', '--action': 'action', '--id': 'id', '--status': 'status', '--resolution': 'resolution',
-    '--override-ticket': 'overrideTicket', '--override-target': 'overrideTarget', '--override-scope': 'overrideScope'
+    '--message': 'message', '--action': 'action', '--id': 'id', '--status': 'status', '--resolution': 'resolution'
 };
 function usageFailure(message) {
     process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'WARNING_PAYLOAD_INVALID', message } })}\n`);
@@ -66,9 +64,6 @@ async function taskWarning(args = []) {
     };
     const optional = kind === 'list' ? ['status'] : [];
     const allowed = new Set(['kind', 'taskRef', 'dryRun', ...required[kind], ...optional]);
-    allowed.add('overrideTicket');
-    allowed.add('overrideTarget');
-    allowed.add('overrideScope');
     const unexpected = Object.keys(values).find((key) => !allowed.has(key));
     const missing = required[kind].find((key) => values[key] === undefined);
     if (unexpected) {
@@ -79,43 +74,14 @@ async function taskWarning(args = []) {
         usageFailure(`${kind} requires '${missing}'`);
         return;
     }
-    const dryRunConflict = overrideDryRunConflict(values);
-    if (dryRunConflict) {
-        usageFailure(dryRunConflict.message);
-        return;
-    }
     const resolved = resolveTaskRef(taskRef);
     if (!resolved.ok) {
         usageFailure(resolved.message);
         return;
     }
     let result;
-    let humanOverride = null;
     try {
-        result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-warning.${kind}`, async () => {
-            let current = applyWorkflowWarningIntent(values);
-            if (current.status !== 'failed' || !values.overrideTicket)
-                return current;
-            if (!values.overrideTarget || !values.overrideScope) {
-                usageFailure('override ticket requires target and scope');
-                return current;
-            }
-            const consumed = await consumeHumanOverride({
-                taskRef, ticketId: String(values.overrideTicket),
-                failureId: failureId('workflow-warning', current.error?.code ?? 'TASK_STATE_MISMATCH'),
-                target: String(values.overrideTarget), scope: String(values.overrideScope)
-            }, {
-                effectExecutor: (capability) => {
-                    const retried = applyWorkflowWarningIntent(values, { manualOverride: capability });
-                    current = retried;
-                    return retried.status === 'failed' || retried.status === 'planned'
-                        ? { code: 'OVERRIDE_EFFECT_FAILED', message: retried.status === 'planned' ? 'producer returned planned; no workflow warning effect was committed' : `${retried.error?.code ?? 'WARNING_FAILED'}: ${retried.error?.message ?? 'manual warning effect failed'}` }
-                        : null;
-                }
-            });
-            humanOverride = consumed;
-            return current;
-        });
+        result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-warning.${kind}`, async () => applyWorkflowWarningIntent(values));
     }
     catch (error) {
         if (!(error instanceof TaskExecutionLockError))
@@ -124,10 +90,8 @@ async function taskWarning(args = []) {
         process.exitCode = 1;
         return;
     }
-    process.stdout.write(`${JSON.stringify(humanOverride ? { ...result, humanOverride } : result)}\n`);
-    const overrideFailed = Boolean(humanOverride && typeof humanOverride === 'object' &&
-        humanOverride.status === 'failed');
-    if (result.status === 'failed' || overrideFailed)
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+    if (result.status === 'failed')
         process.exitCode = 1;
 }
 export { taskWarning };

package/dist/lib/platform/completion-backfill.js

@@ -13,21 +13,70 @@ import { taskIssueIdentity } from './task-identities.js';
 function result(base, artifacts, warnings) {
     return { ...base, artifacts, warnings };
 }
-function excludedPrReview(taskDir, message) {
-    const names = [...message.matchAll(/(?:^|[^A-Za-z0-9_-])(pr-review(?:-r[1-9]\d*)?\.md)(?=$|[^A-Za-z0-9_.-])/g)]
+function referencedBackfillArtifact(taskDir, message) {
+    const names = [...message.matchAll(/(?:^|[^A-Za-z0-9_-])([a-z][a-z-]*(?:-r[1-9]\d*)?\.md)(?=$|[^A-Za-z0-9_.-])/g)]
         .map((match) => match[1]);
     if (names.length !== 1)
-        return null;
+        return { status: 'ignored', artifact: null, error: null };
     const parsed = parseArtifactName(names[0]);
-    if (!parsed || parsed.family !== 'pr-review')
-        return null;
+    if (!parsed || (parsed.family !== 'pr-review' && !COMPLETION_BACKFILL_FAMILIES.includes(parsed.family))) {
+        return { status: 'ignored', artifact: null, error: null };
+    }
     const artifactPath = path.join(taskDir, parsed.name);
     try {
         const stat = fs.lstatSync(artifactPath);
-        return stat.isFile() && !stat.isSymbolicLink() ? parsed.name : null;
+        if (stat.isSymbolicLink())
+            return {
+                status: 'failed', artifact: null,
+                error: { code: 'ARTIFACT_TOPOLOGY_CONFLICT', message: `SYMBOLIC_LINK: symbolic links are not workflow artifacts: ${parsed.name}`, retryable: false }
+            };
+        if (!stat.isFile())
+            return {
+                status: 'failed', artifact: null,
+                error: { code: 'ARTIFACT_TOPOLOGY_CONFLICT', message: `NON_REGULAR_FILE: artifact is not a regular file: ${parsed.name}`, retryable: false }
+            };
+        fs.accessSync(artifactPath, fs.constants.R_OK);
+        return { status: 'ready', artifact: parsed.name, error: null };
+    }
+    catch (error) {
+        return {
+            status: 'failed', artifact: null,
+            error: { code: 'ARTIFACT_READ_FAILED', message: `Unable to inspect referenced artifact '${parsed.name}': ${error instanceof Error ? error.message : String(error)}`, retryable: false }
+        };
+    }
+}
+function matchingBackfillWarnings(taskDir, content) {
+    const matches = [];
+    for (const warning of getOpenWorkflowWarnings(content)) {
+        if (warning.step !== 'complete-task' || warning.code !== 'COMMENT_SYNC_FAILED' || warning.target !== 'artifact')
+            continue;
+        const reference = referencedBackfillArtifact(taskDir, warning.message);
+        if (reference.status === 'failed')
+            return { status: 'failed', matches: [], error: reference.error };
+        if (reference.status === 'ready')
+            matches.push({ warning, artifact: reference.artifact });
+    }
+    return { status: 'ready', matches, error: null };
+}
+function inspectCompletionBackfillEligibility(taskRef, options = {}) {
+    const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
+    if (!resolved.ok)
+        return {
+            status: 'failed', eligible: false,
+            error: { code: resolved.code, message: resolved.message, retryable: false }
+        };
+    try {
+        const content = fs.readFileSync(resolved.taskMdPath, 'utf8');
+        const matching = matchingBackfillWarnings(resolved.taskDir, content);
+        if (matching.status === 'failed')
+            return { status: 'failed', eligible: false, error: matching.error };
+        return { status: 'ready', eligible: matching.matches.length > 0, error: null };
     }
-    catch {
-        return null;
+    catch (error) {
+        return {
+            status: 'failed', eligible: false,
+            error: { code: 'TASK_READ_FAILED', message: error instanceof Error ? error.message : String(error), retryable: false }
+        };
     }
 }
 async function backfillCompletionComments(taskRef, options) {
@@ -46,6 +95,9 @@ async function backfillCompletionComments(taskRef, options) {
             }
         }), [], []);
     const initialContent = fs.readFileSync(resolved.taskMdPath, 'utf8');
+    const matching = matchingBackfillWarnings(resolved.taskDir, initialContent);
+    if (matching.status === 'failed')
+        return result(platformResult('failed', { error: matching.error }), [], []);
     const issueIdentity = taskIssueIdentity(parseTaskFrontmatter(initialContent));
     if (!issueIdentity)
         return result(platformResult('no-op', {
@@ -79,18 +131,12 @@ async function backfillCompletionComments(taskRef, options) {
                 error: latest.error
             }), artifacts, []);
     }
-    const matching = getOpenWorkflowWarnings(initialContent).flatMap((warning) => {
-        if (warning.step !== 'complete-task' || warning.code !== 'COMMENT_SYNC_FAILED' || warning.target !== 'artifact')
-            return [];
-        const excluded = excludedPrReview(resolved.taskDir, warning.message);
-        return excluded ? [{ warning, excluded }] : [];
-    });
     const warnings = [];
     let metadata = null;
-    for (const { warning, excluded } of matching) {
+    for (const { warning, artifact } of matching.matches) {
         metadata ??= captureTaskWriteMetadata();
         const resolution = [
-            `excluded=${excluded}`,
+            `artifact=${artifact}`,
             `completionFamilies=${COMPLETION_BACKFILL_FAMILIES.join(',')}`,
             `synchronized=${inventory.artifacts.map((artifact) => artifact.name).join(',') || 'none'}`,
             `completedAt=${metadata.timestamp}`
@@ -119,5 +165,5 @@ async function backfillCompletionComments(taskRef, options) {
         error: null
     }), artifacts, warnings);
 }
-export { backfillCompletionComments };
+export { backfillCompletionComments, inspectCompletionBackfillEligibility };
 //# sourceMappingURL=completion-backfill.js.map

package/dist/lib/platform/pr-summary.js

@@ -2,13 +2,12 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { enumerateArtifacts } from '../task/artifacts.js';
 import { parseTypedTaskFrontmatter } from '../task/frontmatter.js';
-import { renderHumanOverrideAudit } from '../task/human-override.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
 import { readPrDeliveryFact } from '../task/pr-delivery-fact.js';
 import { resolvePlatformProviderContext } from './context.js';
 import { normalizeCommentContent } from './issue-comments.js';
-import { CONTROL_MARKER_PATTERN, escapeHtmlText, sanitizeMarkdownDocument, splitDocumentPlaceholder } from './comment-safety.js';
+import { CONTROL_MARKER_PATTERN, sanitizeMarkdownDocument, splitDocumentPlaceholder } from './comment-safety.js';
 import { platformResult } from './types.js';
 import { providerError, providerOperationContext, providerStatus, providerResourceToken, resourceIdentityNumber, unsupportedProviderOperation } from './provider-bridge.js';
 import { resourceIdentityEquals } from './resource-identity.js';
@@ -18,23 +17,6 @@ import { readManualValidationCompletion } from '../task/manual-validation-comple
 function summaryMarker(taskId) {
     return `<!-- sync-pr:${taskId}:summary -->`;
 }
-function escapeSummaryAuditText(value) {
-    return escapeHtmlText(value).replace(/\r\n?/g, '\n');
-}
-function renderSummaryAuditLine(value) {
-    const safe = escapeSummaryAuditText(value);
-    const longestRun = Math.max(0, ...(safe.match(/`+/g) || []).map((run) => run.length));
-    const delimiter = '`'.repeat(longestRun + 1);
-    return `${delimiter} ${safe} ${delimiter}`;
-}
-function renderSafeHumanOverrideAudit(value) {
-    const normalized = value.trim().replace(/\r\n?/g, '\n');
-    if (!normalized)
-        return '';
-    const [heading, ...rows] = normalized.split('\n');
-    const safeHeading = heading === '## Human Override Audit' ? heading : renderSummaryAuditLine(heading || '');
-    return [safeHeading, ...rows.map((row) => row ? renderSummaryAuditLine(row) : '')].join('\n');
-}
 function isSafeSummaryEnvelope(value, taskId) {
     return value.includes(summaryMarker(taskId))
         && (value.match(/<!--\s*sync-pr:/gi) || []).length === 1
@@ -71,9 +53,8 @@ function warningResultForPrimary(primaryResult) {
 function platformError(error) {
     return { code: error.code, message: error.message, retryable: error.retryable ?? false };
 }
-function buildPullRequestSummary(taskId, body, headSha, humanOverrideAudit = '') {
-    const sections = [body.replace(/\s+$/, ''), renderSafeHumanOverrideAudit(humanOverrideAudit)].filter(Boolean).join('\n\n');
-    return normalizeCommentContent(`${summaryMarker(taskId)}\n<!-- last-commit: ${headSha} -->\n\n${sections}\n`);
+function buildPullRequestSummary(taskId, body, headSha) {
+    return normalizeCommentContent(`${summaryMarker(taskId)}\n<!-- last-commit: ${headSha} -->\n\n${body.replace(/\s+$/, '')}\n`);
 }
 function reconcileSummaryComment(comments, taskId, desired) {
     const marker = summaryMarker(taskId);
@@ -586,7 +567,7 @@ async function syncPullRequestSummary(taskRef, options) {
             const renderedBody = manual?.phase === 'final'
                 ? replaced.value.replace(MANUAL_VALIDATION_RECEIPT_PLACEHOLDER, `<!-- manual-validation-receipt: transaction=${manual.transactionId}; receipt=${manual.receiptDigest}; evidence=${manualEvidenceDigest}; head=${manual.prHeadSha} -->`)
                 : replaced.value;
-            const desired = buildPullRequestSummary(resolved.taskId, renderedBody, initial.value.head.sha, renderHumanOverrideAudit(taskContent));
+            const desired = buildPullRequestSummary(resolved.taskId, renderedBody, initial.value.head.sha);
             if (!isSafeSummaryEnvelope(desired, resolved.taskId))
                 return fail('failed', context, {
                     code: 'PR_SUMMARY_RENDER_INVALID',

package/dist/lib/platform/verification-sync.js

@@ -3,6 +3,7 @@ import fs from "node:fs";
 import path from "node:path";
 import process from "node:process";
 import { execFileSync } from "node:child_process";
+import { resolveBranchWorktree } from "../git/branch-worktree.js";
 import { resolvePlatformProviderContext } from "./context.js";
 import { hasCheckedRequirement, resolveRequirementSection } from "./issue-metadata.js";
 import { requirementSectionAnchors } from "./issues.js";
@@ -807,7 +808,10 @@ function computeExpectedInLabels(taskDir, repositoryLabels, mappingOverride, sha
         return { ok: false, type: "check_failed", message: "Task has no delivery_base_ref for in-label evidence" };
     }
     const branch = typeof task.metadata?.branch === "string" ? task.metadata.branch.trim() : "";
-    const gitCwd = branch ? worktreeForBranch(shared.repoRoot, branch) ?? taskDir : taskDir;
+    const gitCwd = branch ? resolveBranchWorktree(shared.repoRoot, branch) : taskDir;
+    if (!gitCwd) {
+        return { ok: false, type: "check_failed", message: `Task branch '${branch}' is not checked out in a usable worktree` };
+    }
     const changedFilesResult = gitText(["diff", `${baseRef}...HEAD`, "--name-only"], gitCwd);
     if (!changedFilesResult.ok) {
         return { ...changedFilesResult, type: "network_error" };
@@ -831,26 +835,6 @@ function computeExpectedInLabels(taskDir, repositoryLabels, mappingOverride, sha
     }
     return { ok: true, labels: planned.target, mode: "mapped" };
 }
-function worktreeForBranch(repositoryRoot, branch) {
-    try {
-        const records = execFileSync("git", ["worktree", "list", "--porcelain"], {
-            cwd: repositoryRoot,
-            encoding: "utf8",
-            stdio: ["pipe", "pipe", "pipe"]
-        }).trim().split(/\r?\n\r?\n/);
-        const expectedRef = `refs/heads/${branch}`;
-        for (const record of records) {
-            const worktree = /^worktree (.+)$/m.exec(record)?.[1];
-            const branchRef = /^branch (.+)$/m.exec(record)?.[1];
-            if (worktree && branchRef === expectedRef)
-                return worktree;
-        }
-    }
-    catch {
-        // Fall back to taskDir so ordinary in-repository task workspaces retain their behavior.
-    }
-    return null;
-}
 function loadInLabelMapping(shared) {
     const configPath = path.join(shared.repoRoot, ".agents", ".airc.json");
     if (!fs.existsSync(configPath)) {
@@ -888,36 +872,15 @@ function resolvePrHeadSha(context) {
     if (!branch) {
         return fallback();
     }
-    const worktreeList = gitText(["worktree", "list", "--porcelain"], context.taskDir);
-    if (!worktreeList.ok) {
-        return fallback();
-    }
-    const matchedWorktree = findWorktreeForBranch(worktreeList.value, branch);
+    const matchedWorktree = resolveBranchWorktree(context.taskDir, branch);
     if (!matchedWorktree) {
-        return fallback();
-    }
-    const headInWorktree = gitText(["rev-parse", "HEAD"], matchedWorktree);
-    if (!headInWorktree.ok) {
-        return fallback();
-    }
-    return headInWorktree;
-}
-function findWorktreeForBranch(porcelainOutput, branch) {
-    let currentWorktree = "";
-    for (const rawLine of String(porcelainOutput || "").split("\n")) {
-        const line = rawLine.trimEnd();
-        if (line.startsWith("worktree ")) {
-            currentWorktree = line.slice("worktree ".length).trim();
-            continue;
-        }
-        if (line.startsWith("branch refs/heads/")) {
-            const usedBranch = line.slice("branch refs/heads/".length).trim();
-            if (usedBranch === branch && currentWorktree) {
-                return currentWorktree;
-            }
-        }
+        return {
+            ok: false,
+            type: "check_failed",
+            message: `Task branch '${branch}' is not checked out in a usable worktree`
+        };
     }
-    return null;
+    return gitText(["rev-parse", "HEAD"], matchedWorktree);
 }
 function interpolate(template, taskDir, artifactFile) {
     const artifactStem = artifactFile ? path.basename(artifactFile, path.extname(artifactFile)) : "";

package/dist/lib/sandbox/control/client.js

@@ -340,15 +340,18 @@ export function requestSandboxTaskFinalization(params) {
         clientError('SANDBOX_CONTROL_REQUEST_INVALID', 'task-finalization agent is invalid', false);
     const auth = authority(params);
     const issuedAt = Date.now();
+    const id = randomUUID();
+    const handoffSha256 = (params.prepareHandoff ?? (() => '0'.repeat(64)))({ generation: auth.generation, requestId: id });
     const request = {
         version: 3,
-        id: randomUUID(),
+        id,
         ...auth,
         issuedAt,
         expiresAt: issuedAt + SANDBOX_CONTROL_ADMISSION_WINDOW_MS,
         family: 'task-finalization',
         operation: 'complete',
         agent,
+        handoffSha256,
         args: [],
         controllerProcess: null,
         controllerProof: null

package/dist/lib/sandbox/control/executor.js

@@ -2,6 +2,7 @@ import { spawn } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
+import { homedir } from 'node:os';
 import { getProcessStartTime } from '../../server/process-state.js';
 import { createTask, projectTaskCreateResult, taskCreateExitCode, taskCreateFailure } from '../../task/create-service.js';
 import { applyTaskFinalization } from '../../task/finalization.js';
@@ -13,6 +14,10 @@ import { createSandboxExecutorExecutionContext, dispatchTaskControlOperation, pa
 import { assertSandboxControlBrokerOwner, readSandboxControlManifest } from './lifecycle.js';
 import { computeLifecycleBuildIdentity } from '../../agent-clients/adapters/codex-lifecycle/build-identity.js';
 import { closeCodexControllerRegistration, CodexControllerRegistrationError, openCodexControllerRegistration, resolveCodexControllerBinding } from './controller-registration.js';
+import { shareBranchDir } from '../constants.js';
+function handoffDirectory(manifest) {
+    return shareBranchDir({ shareBase: path.join(homedir(), '.agent-infra', 'share', manifest.project) }, manifest.branch);
+}
 function sameBrokerOwner(left, right) {
     return left.version === right.version
         && left.pid === right.pid
@@ -295,9 +300,10 @@ async function executeRequestInner(manifest, manifestPath, request, options = {}
         }
     }
     if (request.family === 'task-finalization') {
-        const operation = parseTaskControlOperation('task-finalization', [manifest.taskId, 'complete', '--agent', request.agent]);
-        if (operation.family !== 'task-finalization')
+        const parsed = parseTaskControlOperation('task-finalization', [manifest.taskId, 'complete', '--agent', request.agent]);
+        if (parsed.family !== 'task-finalization')
             throw new Error('SANDBOX_CONTROL_FINALIZATION_OPERATION_INVALID');
+        const operation = { ...parsed, request: { ...parsed.request, handoffSha256: request.handoffSha256 } };
         const result = dispatchTaskControlOperation(createSandboxExecutorExecutionContext({
             repoRoot: manifest.repoRoot,
             worktreeRoot: manifest.worktreeRoot,
@@ -305,7 +311,8 @@ async function executeRequestInner(manifest, manifestPath, request, options = {}
             taskId: manifest.taskId,
             generation: manifest.generation,
             manifestPath,
-            requestId: request.id
+            requestId: request.id,
+            handoffDirectory: handoffDirectory(manifest)
         }), operation);
         return finalizationResult(await result);
     }
@@ -326,7 +333,8 @@ async function executeRequestInner(manifest, manifestPath, request, options = {}
         taskId: manifest.taskId,
         generation: manifest.generation,
         manifestPath,
-        requestId: request.id
+        requestId: request.id,
+        handoffDirectory: handoffDirectory(manifest)
     });
     const format = (value) => {
         const result = value;

package/dist/lib/sandbox/control/protocol.js

@@ -158,11 +158,12 @@ export function validateSandboxControlRequest(value, manifest, options = {}) {
         return request;
     }
     if (request.family === 'task-finalization') {
-        const expected = ['agent', 'args', 'controllerProcess', 'controllerProof', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'operation', 'token', 'version'];
+        const expected = ['agent', 'args', 'controllerProcess', 'controllerProof', 'expiresAt', 'family', 'generation', 'handoffSha256', 'id', 'issuedAt', 'operation', 'token', 'version'];
         if (Object.keys(request).sort().join(',') !== expected.sort().join(',')
             || request.operation !== 'complete'
             || !Array.isArray(request.args) || request.args.length !== 0
             || typeof request.agent !== 'string' || normalizeAgentToken(request.agent) !== request.agent
+            || typeof request.handoffSha256 !== 'string' || !/^[a-f0-9]{64}$/u.test(request.handoffSha256)
             || request.controllerProcess !== null || request.controllerProof !== null) {
             fail('SANDBOX_CONTROL_REQUEST_INVALID', 'task-finalization request schema or authorization is invalid');
         }