@fitlab-ai/agent-infra 0.11.4 → 0.11.5

package/dist/lib/internal/task-warning.js

@@ -1,13 +1,11 @@
 import { applyWorkflowWarningIntent } from '../task/workflow-warning-intents.js';
-import { consumeHumanOverride, failureId, overrideDryRunConflict } from '../task/human-override.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal task-warning <task-ref> <add|set-status|list> [intent flags] [--dry-run]\n`;
 const FLAGS = {
     '--step': 'step', '--severity': 'severity', '--code': 'code', '--target': 'target',
-    '--message': 'message', '--action': 'action', '--id': 'id', '--status': 'status', '--resolution': 'resolution',
-    '--override-ticket': 'overrideTicket', '--override-target': 'overrideTarget', '--override-scope': 'overrideScope'
+    '--message': 'message', '--action': 'action', '--id': 'id', '--status': 'status', '--resolution': 'resolution'
 };
 function usageFailure(message) {
     process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'WARNING_PAYLOAD_INVALID', message } })}\n`);
@@ -66,9 +64,6 @@ async function taskWarning(args = []) {
     };
     const optional = kind === 'list' ? ['status'] : [];
     const allowed = new Set(['kind', 'taskRef', 'dryRun', ...required[kind], ...optional]);
-    allowed.add('overrideTicket');
-    allowed.add('overrideTarget');
-    allowed.add('overrideScope');
     const unexpected = Object.keys(values).find((key) => !allowed.has(key));
     const missing = required[kind].find((key) => values[key] === undefined);
     if (unexpected) {
@@ -79,43 +74,14 @@ async function taskWarning(args = []) {
         usageFailure(`${kind} requires '${missing}'`);
         return;
     }
-    const dryRunConflict = overrideDryRunConflict(values);
-    if (dryRunConflict) {
-        usageFailure(dryRunConflict.message);
-        return;
-    }
     const resolved = resolveTaskRef(taskRef);
     if (!resolved.ok) {
         usageFailure(resolved.message);
         return;
     }
     let result;
-    let humanOverride = null;
     try {
-        result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-warning.${kind}`, async () => {
-            let current = applyWorkflowWarningIntent(values);
-            if (current.status !== 'failed' || !values.overrideTicket)
-                return current;
-            if (!values.overrideTarget || !values.overrideScope) {
-                usageFailure('override ticket requires target and scope');
-                return current;
-            }
-            const consumed = await consumeHumanOverride({
-                taskRef, ticketId: String(values.overrideTicket),
-                failureId: failureId('workflow-warning', current.error?.code ?? 'TASK_STATE_MISMATCH'),
-                target: String(values.overrideTarget), scope: String(values.overrideScope)
-            }, {
-                effectExecutor: (capability) => {
-                    const retried = applyWorkflowWarningIntent(values, { manualOverride: capability });
-                    current = retried;
-                    return retried.status === 'failed' || retried.status === 'planned'
-                        ? { code: 'OVERRIDE_EFFECT_FAILED', message: retried.status === 'planned' ? 'producer returned planned; no workflow warning effect was committed' : `${retried.error?.code ?? 'WARNING_FAILED'}: ${retried.error?.message ?? 'manual warning effect failed'}` }
-                        : null;
-                }
-            });
-            humanOverride = consumed;
-            return current;
-        });
+        result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-warning.${kind}`, async () => applyWorkflowWarningIntent(values));
     }
     catch (error) {
         if (!(error instanceof TaskExecutionLockError))
@@ -124,10 +90,8 @@ async function taskWarning(args = []) {
         process.exitCode = 1;
         return;
     }
-    process.stdout.write(`${JSON.stringify(humanOverride ? { ...result, humanOverride } : result)}\n`);
-    const overrideFailed = Boolean(humanOverride && typeof humanOverride === 'object' &&
-        humanOverride.status === 'failed');
-    if (result.status === 'failed' || overrideFailed)
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+    if (result.status === 'failed')
         process.exitCode = 1;
 }
 export { taskWarning };

package/dist/lib/platform/pr-summary.js

@@ -2,13 +2,12 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { enumerateArtifacts } from '../task/artifacts.js';
 import { parseTypedTaskFrontmatter } from '../task/frontmatter.js';
-import { renderHumanOverrideAudit } from '../task/human-override.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
 import { readPrDeliveryFact } from '../task/pr-delivery-fact.js';
 import { resolvePlatformProviderContext } from './context.js';
 import { normalizeCommentContent } from './issue-comments.js';
-import { CONTROL_MARKER_PATTERN, escapeHtmlText, sanitizeMarkdownDocument, splitDocumentPlaceholder } from './comment-safety.js';
+import { CONTROL_MARKER_PATTERN, sanitizeMarkdownDocument, splitDocumentPlaceholder } from './comment-safety.js';
 import { platformResult } from './types.js';
 import { providerError, providerOperationContext, providerStatus, providerResourceToken, resourceIdentityNumber, unsupportedProviderOperation } from './provider-bridge.js';
 import { resourceIdentityEquals } from './resource-identity.js';
@@ -18,23 +17,6 @@ import { readManualValidationCompletion } from '../task/manual-validation-comple
 function summaryMarker(taskId) {
     return `<!-- sync-pr:${taskId}:summary -->`;
 }
-function escapeSummaryAuditText(value) {
-    return escapeHtmlText(value).replace(/\r\n?/g, '\n');
-}
-function renderSummaryAuditLine(value) {
-    const safe = escapeSummaryAuditText(value);
-    const longestRun = Math.max(0, ...(safe.match(/`+/g) || []).map((run) => run.length));
-    const delimiter = '`'.repeat(longestRun + 1);
-    return `${delimiter} ${safe} ${delimiter}`;
-}
-function renderSafeHumanOverrideAudit(value) {
-    const normalized = value.trim().replace(/\r\n?/g, '\n');
-    if (!normalized)
-        return '';
-    const [heading, ...rows] = normalized.split('\n');
-    const safeHeading = heading === '## Human Override Audit' ? heading : renderSummaryAuditLine(heading || '');
-    return [safeHeading, ...rows.map((row) => row ? renderSummaryAuditLine(row) : '')].join('\n');
-}
 function isSafeSummaryEnvelope(value, taskId) {
     return value.includes(summaryMarker(taskId))
         && (value.match(/<!--\s*sync-pr:/gi) || []).length === 1
@@ -71,9 +53,8 @@ function warningResultForPrimary(primaryResult) {
 function platformError(error) {
     return { code: error.code, message: error.message, retryable: error.retryable ?? false };
 }
-function buildPullRequestSummary(taskId, body, headSha, humanOverrideAudit = '') {
-    const sections = [body.replace(/\s+$/, ''), renderSafeHumanOverrideAudit(humanOverrideAudit)].filter(Boolean).join('\n\n');
-    return normalizeCommentContent(`${summaryMarker(taskId)}\n<!-- last-commit: ${headSha} -->\n\n${sections}\n`);
+function buildPullRequestSummary(taskId, body, headSha) {
+    return normalizeCommentContent(`${summaryMarker(taskId)}\n<!-- last-commit: ${headSha} -->\n\n${body.replace(/\s+$/, '')}\n`);
 }
 function reconcileSummaryComment(comments, taskId, desired) {
     const marker = summaryMarker(taskId);
@@ -586,7 +567,7 @@ async function syncPullRequestSummary(taskRef, options) {
             const renderedBody = manual?.phase === 'final'
                 ? replaced.value.replace(MANUAL_VALIDATION_RECEIPT_PLACEHOLDER, `<!-- manual-validation-receipt: transaction=${manual.transactionId}; receipt=${manual.receiptDigest}; evidence=${manualEvidenceDigest}; head=${manual.prHeadSha} -->`)
                 : replaced.value;
-            const desired = buildPullRequestSummary(resolved.taskId, renderedBody, initial.value.head.sha, renderHumanOverrideAudit(taskContent));
+            const desired = buildPullRequestSummary(resolved.taskId, renderedBody, initial.value.head.sha);
             if (!isSafeSummaryEnvelope(desired, resolved.taskId))
                 return fail('failed', context, {
                     code: 'PR_SUMMARY_RENDER_INVALID',

package/dist/lib/platform/verification-sync.js

@@ -3,6 +3,7 @@ import fs from "node:fs";
 import path from "node:path";
 import process from "node:process";
 import { execFileSync } from "node:child_process";
+import { resolveBranchWorktree } from "../git/branch-worktree.js";
 import { resolvePlatformProviderContext } from "./context.js";
 import { hasCheckedRequirement, resolveRequirementSection } from "./issue-metadata.js";
 import { requirementSectionAnchors } from "./issues.js";
@@ -807,7 +808,10 @@ function computeExpectedInLabels(taskDir, repositoryLabels, mappingOverride, sha
         return { ok: false, type: "check_failed", message: "Task has no delivery_base_ref for in-label evidence" };
     }
     const branch = typeof task.metadata?.branch === "string" ? task.metadata.branch.trim() : "";
-    const gitCwd = branch ? worktreeForBranch(shared.repoRoot, branch) ?? taskDir : taskDir;
+    const gitCwd = branch ? resolveBranchWorktree(shared.repoRoot, branch) : taskDir;
+    if (!gitCwd) {
+        return { ok: false, type: "check_failed", message: `Task branch '${branch}' is not checked out in a usable worktree` };
+    }
     const changedFilesResult = gitText(["diff", `${baseRef}...HEAD`, "--name-only"], gitCwd);
     if (!changedFilesResult.ok) {
         return { ...changedFilesResult, type: "network_error" };
@@ -831,26 +835,6 @@ function computeExpectedInLabels(taskDir, repositoryLabels, mappingOverride, sha
     }
     return { ok: true, labels: planned.target, mode: "mapped" };
 }
-function worktreeForBranch(repositoryRoot, branch) {
-    try {
-        const records = execFileSync("git", ["worktree", "list", "--porcelain"], {
-            cwd: repositoryRoot,
-            encoding: "utf8",
-            stdio: ["pipe", "pipe", "pipe"]
-        }).trim().split(/\r?\n\r?\n/);
-        const expectedRef = `refs/heads/${branch}`;
-        for (const record of records) {
-            const worktree = /^worktree (.+)$/m.exec(record)?.[1];
-            const branchRef = /^branch (.+)$/m.exec(record)?.[1];
-            if (worktree && branchRef === expectedRef)
-                return worktree;
-        }
-    }
-    catch {
-        // Fall back to taskDir so ordinary in-repository task workspaces retain their behavior.
-    }
-    return null;
-}
 function loadInLabelMapping(shared) {
     const configPath = path.join(shared.repoRoot, ".agents", ".airc.json");
     if (!fs.existsSync(configPath)) {
@@ -888,36 +872,15 @@ function resolvePrHeadSha(context) {
     if (!branch) {
         return fallback();
     }
-    const worktreeList = gitText(["worktree", "list", "--porcelain"], context.taskDir);
-    if (!worktreeList.ok) {
-        return fallback();
-    }
-    const matchedWorktree = findWorktreeForBranch(worktreeList.value, branch);
+    const matchedWorktree = resolveBranchWorktree(context.taskDir, branch);
     if (!matchedWorktree) {
-        return fallback();
-    }
-    const headInWorktree = gitText(["rev-parse", "HEAD"], matchedWorktree);
-    if (!headInWorktree.ok) {
-        return fallback();
-    }
-    return headInWorktree;
-}
-function findWorktreeForBranch(porcelainOutput, branch) {
-    let currentWorktree = "";
-    for (const rawLine of String(porcelainOutput || "").split("\n")) {
-        const line = rawLine.trimEnd();
-        if (line.startsWith("worktree ")) {
-            currentWorktree = line.slice("worktree ".length).trim();
-            continue;
-        }
-        if (line.startsWith("branch refs/heads/")) {
-            const usedBranch = line.slice("branch refs/heads/".length).trim();
-            if (usedBranch === branch && currentWorktree) {
-                return currentWorktree;
-            }
-        }
+        return {
+            ok: false,
+            type: "check_failed",
+            message: `Task branch '${branch}' is not checked out in a usable worktree`
+        };
     }
-    return null;
+    return gitText(["rev-parse", "HEAD"], matchedWorktree);
 }
 function interpolate(template, taskDir, artifactFile) {
     const artifactStem = artifactFile ? path.basename(artifactFile, path.extname(artifactFile)) : "";

package/dist/lib/sandbox/control/client.js

@@ -340,15 +340,18 @@ export function requestSandboxTaskFinalization(params) {
         clientError('SANDBOX_CONTROL_REQUEST_INVALID', 'task-finalization agent is invalid', false);
     const auth = authority(params);
     const issuedAt = Date.now();
+    const id = randomUUID();
+    const handoffSha256 = (params.prepareHandoff ?? (() => '0'.repeat(64)))({ generation: auth.generation, requestId: id });
     const request = {
         version: 3,
-        id: randomUUID(),
+        id,
         ...auth,
         issuedAt,
         expiresAt: issuedAt + SANDBOX_CONTROL_ADMISSION_WINDOW_MS,
         family: 'task-finalization',
         operation: 'complete',
         agent,
+        handoffSha256,
         args: [],
         controllerProcess: null,
         controllerProof: null

package/dist/lib/sandbox/control/executor.js

@@ -2,6 +2,7 @@ import { spawn } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
+import { homedir } from 'node:os';
 import { getProcessStartTime } from '../../server/process-state.js';
 import { createTask, projectTaskCreateResult, taskCreateExitCode, taskCreateFailure } from '../../task/create-service.js';
 import { applyTaskFinalization } from '../../task/finalization.js';
@@ -13,6 +14,10 @@ import { createSandboxExecutorExecutionContext, dispatchTaskControlOperation, pa
 import { assertSandboxControlBrokerOwner, readSandboxControlManifest } from './lifecycle.js';
 import { computeLifecycleBuildIdentity } from '../../agent-clients/adapters/codex-lifecycle/build-identity.js';
 import { closeCodexControllerRegistration, CodexControllerRegistrationError, openCodexControllerRegistration, resolveCodexControllerBinding } from './controller-registration.js';
+import { shareBranchDir } from '../constants.js';
+function handoffDirectory(manifest) {
+    return shareBranchDir({ shareBase: path.join(homedir(), '.agent-infra', 'share', manifest.project) }, manifest.branch);
+}
 function sameBrokerOwner(left, right) {
     return left.version === right.version
         && left.pid === right.pid
@@ -295,9 +300,10 @@ async function executeRequestInner(manifest, manifestPath, request, options = {}
         }
     }
     if (request.family === 'task-finalization') {
-        const operation = parseTaskControlOperation('task-finalization', [manifest.taskId, 'complete', '--agent', request.agent]);
-        if (operation.family !== 'task-finalization')
+        const parsed = parseTaskControlOperation('task-finalization', [manifest.taskId, 'complete', '--agent', request.agent]);
+        if (parsed.family !== 'task-finalization')
             throw new Error('SANDBOX_CONTROL_FINALIZATION_OPERATION_INVALID');
+        const operation = { ...parsed, request: { ...parsed.request, handoffSha256: request.handoffSha256 } };
         const result = dispatchTaskControlOperation(createSandboxExecutorExecutionContext({
             repoRoot: manifest.repoRoot,
             worktreeRoot: manifest.worktreeRoot,
@@ -305,7 +311,8 @@ async function executeRequestInner(manifest, manifestPath, request, options = {}
             taskId: manifest.taskId,
             generation: manifest.generation,
             manifestPath,
-            requestId: request.id
+            requestId: request.id,
+            handoffDirectory: handoffDirectory(manifest)
         }), operation);
         return finalizationResult(await result);
     }
@@ -326,7 +333,8 @@ async function executeRequestInner(manifest, manifestPath, request, options = {}
         taskId: manifest.taskId,
         generation: manifest.generation,
         manifestPath,
-        requestId: request.id
+        requestId: request.id,
+        handoffDirectory: handoffDirectory(manifest)
     });
     const format = (value) => {
         const result = value;

package/dist/lib/sandbox/control/protocol.js

@@ -158,11 +158,12 @@ export function validateSandboxControlRequest(value, manifest, options = {}) {
         return request;
     }
     if (request.family === 'task-finalization') {
-        const expected = ['agent', 'args', 'controllerProcess', 'controllerProof', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'operation', 'token', 'version'];
+        const expected = ['agent', 'args', 'controllerProcess', 'controllerProof', 'expiresAt', 'family', 'generation', 'handoffSha256', 'id', 'issuedAt', 'operation', 'token', 'version'];
         if (Object.keys(request).sort().join(',') !== expected.sort().join(',')
             || request.operation !== 'complete'
             || !Array.isArray(request.args) || request.args.length !== 0
             || typeof request.agent !== 'string' || normalizeAgentToken(request.agent) !== request.agent
+            || typeof request.handoffSha256 !== 'string' || !/^[a-f0-9]{64}$/u.test(request.handoffSha256)
             || request.controllerProcess !== null || request.controllerProof !== null) {
             fail('SANDBOX_CONTROL_REQUEST_INVALID', 'task-finalization request schema or authorization is invalid');
         }

package/dist/lib/sandbox/removal.js

@@ -17,6 +17,7 @@ import { acquireSandboxResourceLock } from './control/native-file-lock.js';
 import { toolConfigDirCandidates, toolProjectDirCandidates } from './tools.js';
 import { getProcessStartTime } from '../server/process-state.js';
 import { releaseStaleShortIdRegistry } from '../task/short-id.js';
+import { withRepositoryMutationLock } from '../task/task-execution-lock.js';
 import { fetchSandboxRows } from './commands/list-running.js';
 import { formatIntermediateCleanupReport, cleanupIntermediateUnderRemovalCoordinator, protectIntermediateCleanupReport, mergeIntermediateCleanupReports, scanIntermediateCleanup } from '../task/intermediate-cleanup.js';
 import { createSandboxControlBindingEvidence } from './task-cleanup.js';
@@ -670,7 +671,7 @@ async function runRmOneUnderRepositoryLock(config, tools, branch, options = {})
     return rmOneCore(config, tools, branch, { ...options, target });
 }
 async function rmOne(config, tools, branch, options = {}) {
-    await runRmOneUnderRepositoryLock(config, tools, branch, options);
+    await withRepositoryMutationLock(config.repoRoot, () => runRmOneUnderRepositoryLock(config, tools, branch, options));
 }
 async function removeUncheckedSandbox(config, target, options) {
     const confirm = options.prompt?.confirm ?? p.confirm;
@@ -703,8 +704,12 @@ async function removeUncheckedSandbox(config, target, options) {
             p.outro('Cancelled');
         return null;
     }
+    const worktreePermits = options.permits ?? await authorizeWorktrees(existingWorktrees, { allowDirtyDiscard: true, assumeYes: Boolean(options.assumeYes) }, { ...options.prompt, interactive: options.interactive });
     for (const container of matchedContainers)
         runSafeEngine(engine, 'docker', ['rm', '-f', container]);
+    if (!sandboxContainersRemoved(engine, matchedContainers)) {
+        throw new Error(`SANDBOX_REMOVAL_CONTAINER_STILL_PRESENT: ${matchedContainers.join(', ')}`);
+    }
     for (const root of controlRoots) {
         fs.rmSync(root, { recursive: true, force: true });
         removeEmptyManagedParent(path.join(config.controlBase, config.project), root);
@@ -720,14 +725,16 @@ async function removeUncheckedSandbox(config, target, options) {
     if (shouldRemoveShare)
         fs.rmSync(sharePath, { recursive: true, force: true });
     if (shouldRemoveWorktree) {
-        for (const worktree of existingWorktrees)
-            fs.rmSync(worktree, { recursive: true, force: true });
-        runSafe('git', ['-C', config.repoRoot, 'worktree', 'prune']);
+        for (const worktree of existingWorktrees) {
+            const permit = worktreePermits.get(path.resolve(worktree));
+            if (!permit)
+                throw new Error(`SANDBOX_WORKTREE_REMOVAL_PERMIT_MISSING: ${worktree}`);
+            removeWorktreeDir(config.repoRoot, config.worktreeBase, worktree, permit);
+        }
     }
-    if (shouldDeleteBranch)
+    if (shouldDeleteBranch) {
+        assertBranchRemovalIdentity(config, effectiveBranch, worktreePermits);
         runSafe('git', ['-C', config.repoRoot, 'branch', '-D', effectiveBranch]);
-    if (!sandboxContainersRemoved(engine, matchedContainers)) {
-        throw new Error(`SANDBOX_REMOVAL_CONTAINER_STILL_PRESENT: ${matchedContainers.join(', ')}`);
     }
     if (target.workspace.mode === 'task-bound') {
         releaseStaleShortIdRegistry(config.repoRoot, target.workspace.taskId);
@@ -741,7 +748,7 @@ async function rmOneCore(config, tools, branch, options = {}) {
     return removeUncheckedSandbox(config, target, options);
 }
 async function rmPurge(config, tools, prompt = {}) {
-    return rmPurgeCore(config, tools, prompt);
+    return withRepositoryMutationLock(config.repoRoot, () => rmPurgeCore(config, tools, prompt));
 }
 async function rmPurgeCore(config, tools, prompt = {}) {
     const engine = detectEngine(config);

package/dist/lib/task/activity-intent.js

@@ -6,7 +6,6 @@ import { assertWritableInventory, buildArtifactLinkSection, inspectTaskArtifacts
 import { parseArtifactName } from './artifact-name.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.js';
 import { captureTaskWriteMetadata, writeTask } from './write.js';
-import { allowsManualOverride } from './guard-override.js';
 const HEAD_RE = /^[0-9a-f]{40}$/;
 const REVIEW_ACTION_RE = /^Review PR \(Round ([1-9]\d*)\)( \[started\])?$/;
 const VERDICTS = new Set(['approved', 'changes-requested', 'commented']);
@@ -294,7 +293,7 @@ export function applyPrReviewActivityIntent(intent, options = {}) {
     const resolved = resolveTaskRef(intent.taskRef, { repoRoot: options.repoRoot });
     if (!resolved.ok)
         return failed(intent, resolved.code, resolved.message, resolved.taskId);
-    if (resolved.state !== 'active' && !allowsManualOverride(options.manualOverride, 'activity-intent', 'TASK_STATE_MISMATCH')) {
+    if (resolved.state !== 'active') {
         return failed(intent, 'TASK_STATE_MISMATCH', `task ${resolved.taskId} is ${resolved.state}, expected active`, resolved.taskId);
     }
     if (options.lockAlreadyHeld)

package/dist/lib/task/artifact-operations.js

@@ -166,10 +166,44 @@ function inspectArtifactPatterns(content, schema) {
         diagnostics
     };
 }
-function inspectArtifactContract(content, schema) {
+function inspectArtifactStateCheck(content, schema, scopeToStateCheckSection) {
+    const stateCheck = schema.sections.find((section) => section.id === 'state-check');
+    if (!stateCheck || schema.stateCheckPatterns.length === 0) {
+        return { ok: true, family: schema.family, semanticDigest: canonicalSemanticDigest(content), diagnostics: [] };
+    }
+    if (!scopeToStateCheckSection) {
+        const diagnostics = schema.stateCheckPatterns
+            .filter((pattern) => !new RegExp(pattern, 'm').test(content))
+            .map((pattern) => diagnostic('ARTIFACT_STATE_CHECK_PATTERN_MISSING', `artifact is missing required state-check command '${pattern}'`, stateCheck.id, null));
+        return {
+            ok: diagnostics.length === 0,
+            family: schema.family,
+            semanticDigest: canonicalSemanticDigest(content),
+            diagnostics
+        };
+    }
+    const scanned = scanVisibleMarkdown(content);
+    const headings = scanned.headings.filter((heading) => (heading.level === 2 && sectionHeadings(schema, stateCheck).includes(heading.text)));
+    if (headings.length !== 1) {
+        return { ok: true, family: schema.family, semanticDigest: canonicalSemanticDigest(content), diagnostics: [] };
+    }
+    const bodyBounds = sectionBodyBounds(content, headings[0], scanned);
+    const body = content.slice(bodyBounds.start, bodyBounds.end);
+    const diagnostics = schema.stateCheckPatterns
+        .filter((pattern) => !new RegExp(pattern, 'm').test(body))
+        .map((pattern) => diagnostic('ARTIFACT_STATE_CHECK_PATTERN_MISSING', `state-check section is missing required command '${pattern}'`, stateCheck.id, lineNumber(content, headings[0].start)));
+    return {
+        ok: diagnostics.length === 0,
+        family: schema.family,
+        semanticDigest: canonicalSemanticDigest(content),
+        diagnostics
+    };
+}
+function inspectArtifactContract(content, schema, options = {}) {
     const structure = inspectArtifactStructure(content, schema);
+    const stateCheck = inspectArtifactStateCheck(content, schema, options.scopeStateCheckSection === true);
     const patterns = inspectArtifactPatterns(content, schema);
-    const diagnostics = [...structure.diagnostics, ...patterns.diagnostics];
+    const diagnostics = [...structure.diagnostics, ...stateCheck.diagnostics, ...patterns.diagnostics];
     return {
         ok: diagnostics.length === 0,
         family: schema.family,

package/dist/lib/task/artifact-schema.js

@@ -81,21 +81,21 @@ function buildSections(family) {
         marker: `artifact-section:${family}:${id}`
     }));
 }
+const TASK_SNAPSHOT_PATTERN = 'agent-infra-internal[ \\t]+task-snapshot\\b';
 const ARTIFACT_SCHEMAS = [
-    { family: 'analysis', title: { zh: '需求分析报告', en: 'Requirements Analysis' }, sections: buildSections('analysis'), requiredPatterns: ['^\\$ '] },
-    { family: 'review-analysis', title: { zh: '需求分析审查报告', en: 'Analysis Review Report' }, sections: buildSections('review-analysis'), requiredPatterns: ['^### (?:审查决定|Approval Decision)$', '^\\$ '] },
-    { family: 'plan', title: { zh: '技术方案', en: 'Technical Plan' }, sections: buildSections('plan'), requiredPatterns: ['^\\$ '] },
-    { family: 'review-plan', title: { zh: '技术方案审查报告', en: 'Plan Review Report' }, sections: buildSections('review-plan'), requiredPatterns: ['^### (?:审查决定|Approval Decision)$', '^\\$ '] },
-    { family: 'code', title: { zh: '实现报告', en: 'Implementation Report' }, sections: buildSections('code'), requiredPatterns: ['^\\$ '] },
+    { family: 'analysis', title: { zh: '需求分析报告', en: 'Requirements Analysis' }, sections: buildSections('analysis'), stateCheckPatterns: [TASK_SNAPSHOT_PATTERN], requiredPatterns: [] },
+    { family: 'review-analysis', title: { zh: '需求分析审查报告', en: 'Analysis Review Report' }, sections: buildSections('review-analysis'), stateCheckPatterns: [TASK_SNAPSHOT_PATTERN], requiredPatterns: ['^### (?:审查决定|Approval Decision)$'] },
+    { family: 'plan', title: { zh: '技术方案', en: 'Technical Plan' }, sections: buildSections('plan'), stateCheckPatterns: [TASK_SNAPSHOT_PATTERN], requiredPatterns: [] },
+    { family: 'review-plan', title: { zh: '技术方案审查报告', en: 'Plan Review Report' }, sections: buildSections('review-plan'), stateCheckPatterns: [TASK_SNAPSHOT_PATTERN], requiredPatterns: ['^### (?:审查决定|Approval Decision)$'] },
+    { family: 'code', title: { zh: '实现报告', en: 'Implementation Report' }, sections: buildSections('code'), stateCheckPatterns: [TASK_SNAPSHOT_PATTERN], requiredPatterns: [] },
     { family: 'review-code', title: { zh: '代码审查报告', en: 'Code Review Report' }, sections: buildSections('review-code'), requiredPatterns: [
             '^### (?:审查决定|Approval Decision)$',
-            '^\\$ ',
             '^- \\*\\*(?:总体结论|Overall Verdict)\\*\\*[:：]\\s*(?:通过|需要修改|拒绝|Approved|Changes Requested|Rejected)\\s*$',
             '^- \\*\\*(?:审查基线提交|Review Baseline Commit)\\*\\*[:：]\\s*\\S',
             '^- \\*\\*(?:审查差异基线|Reviewed Diff Base)\\*\\*[:：]\\s*[0-9a-f]{40,64}\\s*$',
             '^- \\*\\*(?:审查差异指纹|Reviewed Diff Fingerprint)\\*\\*[:：]\\s*sha256:[0-9a-f]{64}\\s*$',
             '^- \\*\\*(?:审查快照树|Reviewed Snapshot Tree)\\*\\*[:：]\\s*[0-9a-f]{40,64}\\s*$'
-        ] }
+        ], stateCheckPatterns: [TASK_SNAPSHOT_PATTERN] }
 ];
 function getArtifactSchema(family) {
     return ARTIFACT_SCHEMAS.find((schema) => schema.family === family) ?? null;