@fitlab-ai/agent-infra 0.11.4 → 0.11.5

package/lib/internal/task-review.ts

@@ -1,11 +1,10 @@
 import { parseReviewCommand } from '../task/review-command.ts';
 import { finalizeReviewSummary, preflightReviewSummary } from '../task/review-finalization.ts';
-import { consumeHumanOverride, failureId, overrideDryRunConflict } from '../task/human-override.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.ts';
 import { ensureInternalHandlerRoute } from './cli-route-inventory.ts';
 
-const USAGE = 'Usage: agent-infra-internal task-review <task-ref> <preflight|finalize-summary> --stage <analysis|plan|code> --artifact <review-*.md> [--orchestrated] [--dry-run] [--override-ticket <ticket> --override-target <target> --override-scope <scope>]\n';
+const USAGE = 'Usage: agent-infra-internal task-review <task-ref> <preflight|finalize-summary> --stage <analysis|plan|code> --artifact <review-*.md> [--orchestrated] [--dry-run]\n';
 
 function failUsage(message: string): void {
   process.stdout.write(`${JSON.stringify({
@@ -27,37 +26,16 @@ async function taskReview(args: string[] = []): Promise<void> {
   let request;
   try { request = parseReviewCommand(args); }
   catch (error) { failUsage(error instanceof Error ? error.message : String(error)); return; }
-  const { stage, artifact, dryRun, orchestrated, overrideTicket, overrideTarget, overrideScope } = request;
+  const { stage, artifact, dryRun, orchestrated } = request;
   const operation = args[1]!;
-  const dryRunConflict = overrideDryRunConflict({ dryRun, overrideTicket, overrideTarget, overrideScope });
-  if (dryRunConflict) { failUsage(dryRunConflict.message); return; }
   const resolved = resolveTaskRef(args[0]!);
   if (!resolved.ok) { failUsage(resolved.message); return; }
   let result;
-  let humanOverride: unknown = null;
   try {
     result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-review.${operation}`, async () => {
-      let current = operation === 'preflight'
+      return operation === 'preflight'
         ? preflightReviewSummary({ taskRef: args[0]!, stage, artifact, orchestrated, dryRun }, { lockAlreadyHeld: true })
         : finalizeReviewSummary({ taskRef: args[0]!, stage, artifact, orchestrated, dryRun }, { lockAlreadyHeld: true });
-      if (operation === 'preflight') return current;
-      if (current.status !== 'failed' || !overrideTicket) return current;
-      if (!overrideTarget || !overrideScope) { failUsage('override ticket requires target and scope'); return current; }
-      const consumed = await consumeHumanOverride({
-        taskRef: args[0]!, ticketId: overrideTicket,
-        failureId: failureId('review-finalization', current.error?.code ?? 'TASK_STATE_MISMATCH'),
-        target: overrideTarget, scope: overrideScope
-      }, {
-        effectExecutor: (capability) => {
-          const retried = finalizeReviewSummary({ taskRef: args[0]!, stage, artifact, orchestrated, dryRun }, { lockAlreadyHeld: true, manualOverride: capability });
-          current = retried;
-          return retried.status === 'failed' || retried.status === 'planned'
-            ? { code: 'OVERRIDE_EFFECT_FAILED', message: retried.status === 'planned' ? 'producer returned planned; no review effect was committed' : `${retried.error?.code ?? 'REVIEW_FAILED'}: ${retried.error?.message ?? 'manual review effect failed'}` }
-            : null;
-        }
-      });
-      humanOverride = consumed;
-      return current;
     });
   } catch (error) {
     if (!(error instanceof TaskExecutionLockError)) throw error;
@@ -65,12 +43,8 @@ async function taskReview(args: string[] = []): Promise<void> {
     process.exitCode = 1;
     return;
   }
-  process.stdout.write(`${JSON.stringify(humanOverride ? { ...result, humanOverride } : result)}\n`);
-  const overrideFailed = Boolean(
-    humanOverride && typeof humanOverride === 'object' &&
-    (humanOverride as { status?: unknown }).status === 'failed'
-  );
-  if (result.status === 'failed' || overrideFailed) process.exitCode = 1;
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+  if (result.status === 'failed') process.exitCode = 1;
 }
 
 export { taskReview };

package/lib/internal/task-verify.ts

@@ -1,10 +1,9 @@
 import { renderTaskVerification, verifyTaskEvent } from '../task/verification.ts';
-import { consumeHumanOverride, failureId } from '../task/human-override.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.ts';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.ts';
 
-const USAGE = 'Usage: agent-infra-internal task-verify <N | TASK-id> <verification-event> [--artifact <canonical.md>] [--format json|text] [--override-ticket <ticket> --override-target <target> --override-scope <scope>]\n';
+const USAGE = 'Usage: agent-infra-internal task-verify <N | TASK-id> <verification-event> [--artifact <canonical.md>] [--format json|text]\n';
 
 function fail(message: string): void {
   process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'VERIFY_PAYLOAD_INVALID', message } })}\n`);
@@ -21,63 +20,28 @@ async function taskVerify(args: string[] = []): Promise<void> {
   const event = args[1];
   let artifact: string | undefined;
   let format: 'json' | 'text' = 'json';
-  let overrideTicket: string | undefined;
-  let overrideTarget: string | undefined;
-  let overrideScope: string | undefined;
   const seen = new Set<string>();
   for (let index = 2; index < args.length; index += 1) {
     const flag = args[index]!;
-    if (!['--artifact', '--format', '--override-ticket', '--override-target', '--override-scope'].includes(flag)) { fail(`unknown option '${flag}'`); return; }
+    if (!['--artifact', '--format'].includes(flag)) { fail(`unknown option '${flag}'`); return; }
     if (seen.has(flag)) { fail(`duplicate option '${flag}'`); return; }
     const value = args[++index];
     if (!value || value.startsWith('--')) { fail(`option '${flag}' requires a value`); return; }
     seen.add(flag);
     if (flag === '--artifact') artifact = value;
-    else if (flag === '--override-ticket') overrideTicket = value;
-    else if (flag === '--override-target') overrideTarget = value;
-    else if (flag === '--override-scope') overrideScope = value;
     else if (value === 'json' || value === 'text') format = value;
     else { fail("option '--format' requires 'json' or 'text'"); return; }
   }
   const resolved = resolveTaskRef(taskRef);
   if (!resolved.ok) { fail(resolved.message); return; }
   let result;
-  let humanOverride: unknown = null;
   try {
-    result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-verify.${event}`, async () => {
-      let current = await verifyTaskEvent({ taskRef, event, ...(artifact ? { artifact } : {}) });
-      if (current.status === 'pass' || !overrideTicket) return current;
-      if (!overrideTarget || !overrideScope) { fail('override ticket requires target and scope'); return current; }
-      const failureProducer = current.status === 'blocked' || current.status === 'fail'
-        ? 'verification-engine'
-        : 'task-verify';
-      const failureCode = current.status === 'blocked'
-        ? 'CHECK_BLOCKED'
-        : current.status === 'fail'
-          ? 'CHECK_FAILED'
-          : current.error?.code ?? 'VERIFY_TASK_STATE_MISMATCH';
-      const consumed = await consumeHumanOverride({
-        taskRef, ticketId: overrideTicket,
-        failureId: failureId(failureProducer, failureCode),
-        target: overrideTarget, scope: overrideScope
-      }, {
-        effectExecutor: async (capability) => {
-          const retried = await verifyTaskEvent({ taskRef, event, ...(artifact ? { artifact } : {}) }, { manualOverride: capability });
-          current = retried;
-          return retried.status !== 'pass'
-            ? { code: 'OVERRIDE_EFFECT_FAILED', message: `${retried.error?.code ?? 'VERIFY_FAILED'}: ${retried.error?.message ?? 'manual verification effect failed'}` }
-            : null;
-        }
-      });
-      humanOverride = consumed;
-      return current;
-    });
+    result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-verify.${event}`, async () => verifyTaskEvent({ taskRef, event, ...(artifact ? { artifact } : {}) }));
   } catch (error) {
     if (!(error instanceof TaskExecutionLockError)) throw error;
     fail(`${error.code}: ${error.message}`);
     return;
   }
-  if (humanOverride) result = { ...result, humanOverride } as typeof result;
   process.stdout.write(format === 'text' ? renderTaskVerification(result) : `${JSON.stringify(result)}\n`);
   process.exitCode = result.status === 'pass' ? 0 : result.status === 'blocked' ? 2 : 1;
 }

package/lib/internal/task-warning.ts

@@ -1,6 +1,5 @@
 import { applyWorkflowWarningIntent } from '../task/workflow-warning-intents.ts';
 import type { WorkflowWarningIntent } from '../task/workflow-warning-intents.ts';
-import { consumeHumanOverride, failureId, overrideDryRunConflict } from '../task/human-override.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.ts';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.ts';
@@ -9,7 +8,6 @@ const USAGE = `Usage: agent-infra-internal task-warning <task-ref> <add|set-stat
 const FLAGS: Record<string, string> = {
   '--step': 'step', '--severity': 'severity', '--code': 'code', '--target': 'target',
   '--message': 'message', '--action': 'action', '--id': 'id', '--status': 'status', '--resolution': 'resolution'
-  , '--override-ticket': 'overrideTicket', '--override-target': 'overrideTarget', '--override-scope': 'overrideScope'
 };
 
 function usageFailure(message: string): void {
@@ -48,50 +46,23 @@ async function taskWarning(args: string[] = []): Promise<void> {
   };
   const optional = kind === 'list' ? ['status'] : [];
   const allowed = new Set(['kind', 'taskRef', 'dryRun', ...required[kind]!, ...optional]);
-  allowed.add('overrideTicket'); allowed.add('overrideTarget'); allowed.add('overrideScope');
   const unexpected = Object.keys(values).find((key) => !allowed.has(key));
   const missing = required[kind]!.find((key) => values[key] === undefined);
   if (unexpected) { usageFailure(`${kind} does not accept '${unexpected}'`); return; }
   if (missing) { usageFailure(`${kind} requires '${missing}'`); return; }
-  const dryRunConflict = overrideDryRunConflict(values);
-  if (dryRunConflict) { usageFailure(dryRunConflict.message); return; }
   const resolved = resolveTaskRef(taskRef);
   if (!resolved.ok) { usageFailure(resolved.message); return; }
   let result;
-  let humanOverride: unknown = null;
   try {
-    result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-warning.${kind}`, async () => {
-      let current = applyWorkflowWarningIntent(values as WorkflowWarningIntent);
-      if (current.status !== 'failed' || !values.overrideTicket) return current;
-      if (!values.overrideTarget || !values.overrideScope) { usageFailure('override ticket requires target and scope'); return current; }
-      const consumed = await consumeHumanOverride({
-        taskRef, ticketId: String(values.overrideTicket),
-        failureId: failureId('workflow-warning', current.error?.code ?? 'TASK_STATE_MISMATCH'),
-        target: String(values.overrideTarget), scope: String(values.overrideScope)
-      }, {
-        effectExecutor: (capability) => {
-          const retried = applyWorkflowWarningIntent(values as WorkflowWarningIntent, { manualOverride: capability });
-          current = retried;
-          return retried.status === 'failed' || retried.status === 'planned'
-            ? { code: 'OVERRIDE_EFFECT_FAILED', message: retried.status === 'planned' ? 'producer returned planned; no workflow warning effect was committed' : `${retried.error?.code ?? 'WARNING_FAILED'}: ${retried.error?.message ?? 'manual warning effect failed'}` }
-            : null;
-        }
-      });
-      humanOverride = consumed;
-      return current;
-    });
+    result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-warning.${kind}`, async () => applyWorkflowWarningIntent(values as WorkflowWarningIntent));
   } catch (error) {
     if (!(error instanceof TaskExecutionLockError)) throw error;
     process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: error.code, message: error.message } })}\n`);
     process.exitCode = 1;
     return;
   }
-  process.stdout.write(`${JSON.stringify(humanOverride ? { ...result, humanOverride } : result)}\n`);
-  const overrideFailed = Boolean(
-    humanOverride && typeof humanOverride === 'object' &&
-    (humanOverride as { status?: unknown }).status === 'failed'
-  );
-  if (result.status === 'failed' || overrideFailed) process.exitCode = 1;
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+  if (result.status === 'failed') process.exitCode = 1;
 }
 
 export { taskWarning };

package/lib/platform/pr-summary.ts

@@ -3,7 +3,6 @@ import path from 'node:path';
 
 import { enumerateArtifacts } from '../task/artifacts.ts';
 import { parseTypedTaskFrontmatter } from '../task/frontmatter.ts';
-import { renderHumanOverrideAudit } from '../task/human-override.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.ts';
 import { readPrDeliveryFact } from '../task/pr-delivery-fact.ts';
@@ -11,7 +10,7 @@ import type { PrDeliveryFact } from '../task/pr-delivery-fact.ts';
 import { resolvePlatformProviderContext } from './context.ts';
 import type { LoadedContext, PlatformClient } from './context.ts';
 import { normalizeCommentContent } from './issue-comments.ts';
-import { CONTROL_MARKER_PATTERN, escapeHtmlText, sanitizeMarkdownDocument, splitDocumentPlaceholder } from './comment-safety.ts';
+import { CONTROL_MARKER_PATTERN, sanitizeMarkdownDocument, splitDocumentPlaceholder } from './comment-safety.ts';
 import { platformResult } from './types.ts';
 import type { PlatformResult } from './types.ts';
 import type { OperationWarning } from '../task/operation-outcome.ts';
@@ -74,25 +73,6 @@ function summaryMarker(taskId: string): string {
   return `<!-- sync-pr:${taskId}:summary -->`;
 }
 
-function escapeSummaryAuditText(value: string): string {
-  return escapeHtmlText(value).replace(/\r\n?/g, '\n');
-}
-
-function renderSummaryAuditLine(value: string): string {
-  const safe = escapeSummaryAuditText(value);
-  const longestRun = Math.max(0, ...(safe.match(/`+/g) || []).map((run) => run.length));
-  const delimiter = '`'.repeat(longestRun + 1);
-  return `${delimiter} ${safe} ${delimiter}`;
-}
-
-function renderSafeHumanOverrideAudit(value: string): string {
-  const normalized = value.trim().replace(/\r\n?/g, '\n');
-  if (!normalized) return '';
-  const [heading, ...rows] = normalized.split('\n');
-  const safeHeading = heading === '## Human Override Audit' ? heading : renderSummaryAuditLine(heading || '');
-  return [safeHeading, ...rows.map((row) => row ? renderSummaryAuditLine(row) : '')].join('\n');
-}
-
 function isSafeSummaryEnvelope(value: string, taskId: string): boolean {
   return value.includes(summaryMarker(taskId))
     && (value.match(/<!--\s*sync-pr:/gi) || []).length === 1
@@ -136,9 +116,8 @@ function platformError(error: { code: string; message: string; retryable?: boole
   return { code: error.code, message: error.message, retryable: error.retryable ?? false };
 }
 
-function buildPullRequestSummary(taskId: string, body: string, headSha: string, humanOverrideAudit = ''): string {
-  const sections = [body.replace(/\s+$/, ''), renderSafeHumanOverrideAudit(humanOverrideAudit)].filter(Boolean).join('\n\n');
-  return normalizeCommentContent(`${summaryMarker(taskId)}\n<!-- last-commit: ${headSha} -->\n\n${sections}\n`);
+function buildPullRequestSummary(taskId: string, body: string, headSha: string): string {
+  return normalizeCommentContent(`${summaryMarker(taskId)}\n<!-- last-commit: ${headSha} -->\n\n${body.replace(/\s+$/, '')}\n`);
 }
 
 function reconcileSummaryComment(comments: SummaryComment[], taskId: string, desired: string):
@@ -643,7 +622,7 @@ async function syncPullRequestSummary(
           `<!-- manual-validation-receipt: transaction=${manual.transactionId}; receipt=${manual.receiptDigest}; evidence=${manualEvidenceDigest}; head=${manual.prHeadSha} -->`
         )
         : replaced.value;
-      const desired = buildPullRequestSummary(resolved.taskId, renderedBody, initial.value.head.sha, renderHumanOverrideAudit(taskContent));
+      const desired = buildPullRequestSummary(resolved.taskId, renderedBody, initial.value.head.sha);
       if (!isSafeSummaryEnvelope(desired, resolved.taskId)) return fail('failed', context, {
         code: 'PR_SUMMARY_RENDER_INVALID',
         message: 'Summary contains an invalid or duplicated reserved control marker',

package/lib/platform/verification-sync.ts

@@ -5,6 +5,8 @@ import path from "node:path";
 import process from "node:process";
 import { execFileSync } from "node:child_process";
 
+import { resolveBranchWorktree } from "../git/branch-worktree.ts";
+
 import { resolvePlatformProviderContext } from "./context.ts";
 import { hasCheckedRequirement, resolveRequirementSection } from "./issue-metadata.ts";
 import { requirementSectionAnchors } from "./issues.ts";
@@ -1054,7 +1056,10 @@ function computeExpectedInLabels(taskDir: any, repositoryLabels: string[], mappi
     return { ok: false, type: "check_failed", message: "Task has no delivery_base_ref for in-label evidence" };
   }
   const branch = typeof task.metadata?.branch === "string" ? task.metadata.branch.trim() : "";
-  const gitCwd = branch ? worktreeForBranch(shared.repoRoot, branch) ?? taskDir : taskDir;
+  const gitCwd = branch ? resolveBranchWorktree(shared.repoRoot, branch) : taskDir;
+  if (!gitCwd) {
+    return { ok: false, type: "check_failed", message: `Task branch '${branch}' is not checked out in a usable worktree` };
+  }
   const changedFilesResult = gitText(["diff", `${baseRef}...HEAD`, "--name-only"], gitCwd);
   if (!changedFilesResult.ok) {
     return { ...changedFilesResult, type: "network_error" };
@@ -1082,25 +1087,6 @@ function computeExpectedInLabels(taskDir: any, repositoryLabels: string[], mappi
   return { ok: true, labels: planned.target, mode: "mapped" };
 }
 
-function worktreeForBranch(repositoryRoot: string, branch: string): string | null {
-  try {
-    const records = execFileSync("git", ["worktree", "list", "--porcelain"], {
-      cwd: repositoryRoot,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim().split(/\r?\n\r?\n/);
-    const expectedRef = `refs/heads/${branch}`;
-    for (const record of records) {
-      const worktree = /^worktree (.+)$/m.exec(record)?.[1];
-      const branchRef = /^branch (.+)$/m.exec(record)?.[1];
-      if (worktree && branchRef === expectedRef) return worktree;
-    }
-  } catch {
-    // Fall back to taskDir so ordinary in-repository task workspaces retain their behavior.
-  }
-  return null;
-}
-
 function loadInLabelMapping(shared: VerificationShared): any {
   const configPath = path.join(shared.repoRoot, ".agents", ".airc.json");
   if (!fs.existsSync(configPath)) {
@@ -1141,42 +1127,16 @@ function resolvePrHeadSha(context: any): any {
     return fallback();
   }
 
-  const worktreeList = gitText(["worktree", "list", "--porcelain"], context.taskDir);
-  if (!worktreeList.ok) {
-    return fallback();
-  }
-
-  const matchedWorktree = findWorktreeForBranch(worktreeList.value, branch);
+  const matchedWorktree = resolveBranchWorktree(context.taskDir, branch);
   if (!matchedWorktree) {
-    return fallback();
-  }
-
-  const headInWorktree = gitText(["rev-parse", "HEAD"], matchedWorktree);
-  if (!headInWorktree.ok) {
-    return fallback();
-  }
-
-  return headInWorktree;
-}
-
-function findWorktreeForBranch(porcelainOutput: any, branch: any): any {
-  let currentWorktree = "";
-  for (const rawLine of String(porcelainOutput || "").split("\n")) {
-    const line = rawLine.trimEnd();
-    if (line.startsWith("worktree ")) {
-      currentWorktree = line.slice("worktree ".length).trim();
-      continue;
-    }
-
-    if (line.startsWith("branch refs/heads/")) {
-      const usedBranch = line.slice("branch refs/heads/".length).trim();
-      if (usedBranch === branch && currentWorktree) {
-        return currentWorktree;
-      }
-    }
+    return {
+      ok: false,
+      type: "check_failed",
+      message: `Task branch '${branch}' is not checked out in a usable worktree`
+    };
   }
 
-  return null;
+  return gitText(["rev-parse", "HEAD"], matchedWorktree);
 }
 
 function interpolate(template: any, taskDir: any, artifactFile: any): any {

package/lib/sandbox/control/client.ts

@@ -393,6 +393,7 @@ export function requestSandboxControl(params: Readonly<{
 
 export function requestSandboxTaskFinalization(params: Readonly<{
   agent: string;
+  prepareHandoff?: (binding: Readonly<{ generation: string; requestId: string }>) => string;
   channelDir?: string;
   statusDir?: string;
   token?: string;
@@ -403,15 +404,18 @@ export function requestSandboxTaskFinalization(params: Readonly<{
   if (!agent) clientError('SANDBOX_CONTROL_REQUEST_INVALID', 'task-finalization agent is invalid', false);
   const auth = authority(params);
   const issuedAt = Date.now();
+  const id = randomUUID();
+  const handoffSha256 = (params.prepareHandoff ?? (() => '0'.repeat(64)))({ generation: auth.generation, requestId: id });
   const request: SandboxTaskFinalizationRequest = {
     version: 3,
-    id: randomUUID(),
+    id,
     ...auth,
     issuedAt,
     expiresAt: issuedAt + SANDBOX_CONTROL_ADMISSION_WINDOW_MS,
     family: 'task-finalization',
     operation: 'complete',
     agent,
+    handoffSha256,
     args: [],
     controllerProcess: null,
     controllerProof: null

package/lib/sandbox/control/executor.ts

@@ -2,6 +2,7 @@ import { spawn, type ChildProcess } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
+import { homedir } from 'node:os';
 import { getProcessStartTime } from '../../server/process-state.ts';
 import {
   createTask,
@@ -41,6 +42,11 @@ import {
   openCodexControllerRegistration,
   resolveCodexControllerBinding
 } from './controller-registration.ts';
+import { shareBranchDir } from '../constants.ts';
+
+function handoffDirectory(manifest: SandboxControlManifest): string {
+  return shareBranchDir({ shareBase: path.join(homedir(), '.agent-infra', 'share', manifest.project) }, manifest.branch);
+}
 
 export type SandboxControlExecutionResult = {
   exitCode: number;
@@ -373,10 +379,11 @@ async function executeRequestInner(
     }
   }
   if (request.family === 'task-finalization') {
-    const operation = parseTaskControlOperation(
+    const parsed = parseTaskControlOperation(
       'task-finalization', [manifest.taskId!, 'complete', '--agent', request.agent]
     );
-    if (operation.family !== 'task-finalization') throw new Error('SANDBOX_CONTROL_FINALIZATION_OPERATION_INVALID');
+    if (parsed.family !== 'task-finalization') throw new Error('SANDBOX_CONTROL_FINALIZATION_OPERATION_INVALID');
+    const operation = { ...parsed, request: { ...parsed.request, handoffSha256: request.handoffSha256 } };
     const result = dispatchTaskControlOperation(
       createSandboxExecutorExecutionContext({
         repoRoot: manifest.repoRoot,
@@ -385,7 +392,8 @@ async function executeRequestInner(
         taskId: manifest.taskId!,
         generation: manifest.generation,
         manifestPath,
-        requestId: request.id
+        requestId: request.id,
+        handoffDirectory: handoffDirectory(manifest)
       }),
       operation
     );
@@ -407,7 +415,8 @@ async function executeRequestInner(
     taskId: manifest.taskId!,
     generation: manifest.generation,
     manifestPath,
-    requestId: request.id
+    requestId: request.id,
+    handoffDirectory: handoffDirectory(manifest)
   });
   const format = (value: unknown): SandboxControlExecutionResult => {
     const result = value as { status?: string };

package/lib/sandbox/control/protocol.ts

@@ -65,7 +65,7 @@ export type SandboxTaskCommandRequest = RequestBase & Readonly<{
   family: 'task-lifecycle'; args: string[];
 }>;
 export type SandboxTaskFinalizationRequest = RequestBase & Readonly<{
-  family: 'task-finalization'; operation: 'complete'; agent: string; args: [];
+  family: 'task-finalization'; operation: 'complete'; agent: string; handoffSha256: string; args: [];
 }>;
 export type SandboxTaskCreateRequest = RequestBase & Readonly<{
   family: 'task-create'; candidate: TaskCreateCandidateV1;
@@ -279,11 +279,12 @@ export function validateSandboxControlRequest(
     return request as SandboxCodexControllerRequest;
   }
   if (request.family === 'task-finalization') {
-    const expected = ['agent', 'args', 'controllerProcess', 'controllerProof', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'operation', 'token', 'version'];
+    const expected = ['agent', 'args', 'controllerProcess', 'controllerProof', 'expiresAt', 'family', 'generation', 'handoffSha256', 'id', 'issuedAt', 'operation', 'token', 'version'];
     if (Object.keys(request).sort().join(',') !== expected.sort().join(',')
       || request.operation !== 'complete'
       || !Array.isArray(request.args) || request.args.length !== 0
       || typeof request.agent !== 'string' || normalizeAgentToken(request.agent) !== request.agent
+      || typeof request.handoffSha256 !== 'string' || !/^[a-f0-9]{64}$/u.test(request.handoffSha256)
       || request.controllerProcess !== null || request.controllerProof !== null) {
       fail('SANDBOX_CONTROL_REQUEST_INVALID', 'task-finalization request schema or authorization is invalid');
     }

package/lib/sandbox/removal.ts

@@ -47,6 +47,7 @@ import { toolConfigDirCandidates, toolProjectDirCandidates } from './tools.ts';
 import type { SandboxTool } from './tools.ts';
 import { getProcessStartTime } from '../server/process-state.ts';
 import { releaseStaleShortIdRegistry } from '../task/short-id.ts';
+import { withRepositoryMutationLock } from '../task/task-execution-lock.ts';
 import { fetchSandboxRows, type SandboxRow } from './commands/list-running.ts';
 import {
   formatIntermediateCleanupReport,
@@ -959,7 +960,10 @@ async function rmOne(
   branch: string,
   options: RmOneOptions = {}
 ): Promise<void> {
-  await runRmOneUnderRepositoryLock(config, tools, branch, options);
+  await withRepositoryMutationLock(
+    config.repoRoot,
+    () => runRmOneUnderRepositoryLock(config, tools, branch, options)
+  );
 }
 
 async function removeUncheckedSandbox(
@@ -998,7 +1002,16 @@ async function removeUncheckedSandbox(
     return null;
   }
 
+  const worktreePermits = options.permits ?? await authorizeWorktrees(
+    existingWorktrees,
+    { allowDirtyDiscard: true, assumeYes: Boolean(options.assumeYes) },
+    { ...options.prompt, interactive: options.interactive }
+  );
+
   for (const container of matchedContainers) runSafeEngine(engine, 'docker', ['rm', '-f', container]);
+  if (!sandboxContainersRemoved(engine, matchedContainers)) {
+    throw new Error(`SANDBOX_REMOVAL_CONTAINER_STILL_PRESENT: ${matchedContainers.join(', ')}`);
+  }
   for (const root of controlRoots) {
     fs.rmSync(root, { recursive: true, force: true });
     removeEmptyManagedParent(path.join(config.controlBase, config.project), root);
@@ -1011,12 +1024,15 @@ async function removeUncheckedSandbox(
   for (const shell of shellConfigDirCandidates(config, effectiveBranch)) fs.rmSync(shell, { recursive: true, force: true });
   if (shouldRemoveShare) fs.rmSync(sharePath, { recursive: true, force: true });
   if (shouldRemoveWorktree) {
-    for (const worktree of existingWorktrees) fs.rmSync(worktree, { recursive: true, force: true });
-    runSafe('git', ['-C', config.repoRoot, 'worktree', 'prune']);
+    for (const worktree of existingWorktrees) {
+      const permit = worktreePermits.get(path.resolve(worktree));
+      if (!permit) throw new Error(`SANDBOX_WORKTREE_REMOVAL_PERMIT_MISSING: ${worktree}`);
+      removeWorktreeDir(config.repoRoot, config.worktreeBase, worktree, permit);
+    }
   }
-  if (shouldDeleteBranch) runSafe('git', ['-C', config.repoRoot, 'branch', '-D', effectiveBranch]);
-  if (!sandboxContainersRemoved(engine, matchedContainers)) {
-    throw new Error(`SANDBOX_REMOVAL_CONTAINER_STILL_PRESENT: ${matchedContainers.join(', ')}`);
+  if (shouldDeleteBranch) {
+    assertBranchRemovalIdentity(config, effectiveBranch, worktreePermits);
+    runSafe('git', ['-C', config.repoRoot, 'branch', '-D', effectiveBranch]);
   }
   if (target.workspace.mode === 'task-bound') {
     releaseStaleShortIdRegistry(config.repoRoot, target.workspace.taskId);
@@ -1045,7 +1061,7 @@ async function rmPurge(
   tools: SandboxTool[],
   prompt: PromptDependencies = {}
 ): Promise<void> {
-  return rmPurgeCore(config, tools, prompt);
+  return withRepositoryMutationLock(config.repoRoot, () => rmPurgeCore(config, tools, prompt));
 }
 
 async function rmPurgeCore(

package/lib/task/activity-intent.ts

@@ -14,7 +14,6 @@ import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-
 import type { TaskExecutionLockOptions } from './task-execution-lock.ts';
 import { captureTaskWriteMetadata, writeTask } from './write.ts';
 import type { TaskMutation, TaskOperationSummary, TaskWriteOptions } from './write.ts';
-import { allowsManualOverride } from './guard-override.ts';
 
 type PrReviewVerdict = 'approved' | 'changes-requested' | 'commented';
 type PrReviewOutcome = 'aborted' | 'superseded';
@@ -398,7 +397,7 @@ export function applyPrReviewActivityIntent(intent: PrReviewActivityIntent, opti
   if ('code' in validated) return failed(intent, validated.code, validated.message);
   const resolved = resolveTaskRef(intent.taskRef, { repoRoot: options.repoRoot });
   if (!resolved.ok) return failed(intent, resolved.code, resolved.message, resolved.taskId);
-  if (resolved.state !== 'active' && !allowsManualOverride(options.manualOverride, 'activity-intent', 'TASK_STATE_MISMATCH')) {
+  if (resolved.state !== 'active') {
     return failed(intent, 'TASK_STATE_MISMATCH', `task ${resolved.taskId} is ${resolved.state}, expected active`, resolved.taskId);
   }
   if (options.lockAlreadyHeld) return applyLocked(intent, validated.agent, { ...options, repoRoot: resolved.repoRoot });

package/lib/task/artifact-operations.ts

@@ -27,6 +27,7 @@ type ArtifactStructuralDiagnosticCode =
   | 'ARTIFACT_EMPTY_SECTION'
   | 'ARTIFACT_SECTION_ORDER_INVALID'
   | 'ARTIFACT_HEADING_TRAILING_PUNCTUATION'
+  | 'ARTIFACT_STATE_CHECK_PATTERN_MISSING'
   | 'ARTIFACT_REQUIRED_PATTERN_MISSING';
 
 type ArtifactStructuralDiagnostic = Readonly<{
@@ -254,13 +255,68 @@ function inspectArtifactPatterns(
   };
 }
 
+function inspectArtifactStateCheck(
+  content: string,
+  schema: ArtifactSchema,
+  scopeToStateCheckSection: boolean
+): ArtifactStructureResult {
+  const stateCheck = schema.sections.find((section) => section.id === 'state-check');
+  if (!stateCheck || schema.stateCheckPatterns.length === 0) {
+    return { ok: true, family: schema.family, semanticDigest: canonicalSemanticDigest(content), diagnostics: [] };
+  }
+
+  if (!scopeToStateCheckSection) {
+    const diagnostics = schema.stateCheckPatterns
+      .filter((pattern) => !new RegExp(pattern, 'm').test(content))
+      .map((pattern) => diagnostic(
+        'ARTIFACT_STATE_CHECK_PATTERN_MISSING',
+        `artifact is missing required state-check command '${pattern}'`,
+        stateCheck.id,
+        null
+      ));
+    return {
+      ok: diagnostics.length === 0,
+      family: schema.family,
+      semanticDigest: canonicalSemanticDigest(content),
+      diagnostics
+    };
+  }
+
+  const scanned = scanVisibleMarkdown(content);
+  const headings = scanned.headings.filter((heading) => (
+    heading.level === 2 && sectionHeadings(schema, stateCheck).includes(heading.text)
+  ));
+  if (headings.length !== 1) {
+    return { ok: true, family: schema.family, semanticDigest: canonicalSemanticDigest(content), diagnostics: [] };
+  }
+
+  const bodyBounds = sectionBodyBounds(content, headings[0]!, scanned);
+  const body = content.slice(bodyBounds.start, bodyBounds.end);
+  const diagnostics = schema.stateCheckPatterns
+    .filter((pattern) => !new RegExp(pattern, 'm').test(body))
+    .map((pattern) => diagnostic(
+      'ARTIFACT_STATE_CHECK_PATTERN_MISSING',
+      `state-check section is missing required command '${pattern}'`,
+      stateCheck.id,
+      lineNumber(content, headings[0]!.start)
+    ));
+  return {
+    ok: diagnostics.length === 0,
+    family: schema.family,
+    semanticDigest: canonicalSemanticDigest(content),
+    diagnostics
+  };
+}
+
 function inspectArtifactContract(
   content: string,
-  schema: ArtifactSchema
+  schema: ArtifactSchema,
+  options: { scopeStateCheckSection?: boolean } = {}
 ): ArtifactStructureResult {
   const structure = inspectArtifactStructure(content, schema);
+  const stateCheck = inspectArtifactStateCheck(content, schema, options.scopeStateCheckSection === true);
   const patterns = inspectArtifactPatterns(content, schema);
-  const diagnostics = [...structure.diagnostics, ...patterns.diagnostics];
+  const diagnostics = [...structure.diagnostics, ...stateCheck.diagnostics, ...patterns.diagnostics];
   return {
     ok: diagnostics.length === 0,
     family: schema.family,