@fitlab-ai/agent-infra 0.11.4 → 0.11.6

package/lib/task/lifecycle.ts

@@ -107,16 +107,11 @@ type TaskLifecycleOptions = {
   fileSystem?: Partial<LifecycleFileSystem>;
   taskFileSystem?: Partial<TaskFileSystem>;
   directoryRenameSync?: (source: string, target: string) => void;
-  manualOverride?: Readonly<{ failureId: string; operator: string; reason: string }>;
   /** Write the terminal task document and durable journal, but leave the move
    * and short-id mutation for a separately authorized commit. */
   prepareOnly?: boolean;
 };
 
-function allowsManualOverride(options: TaskLifecycleOptions, code: string): boolean {
-  return options.manualOverride?.failureId === `lifecycle.apply:${code}`;
-}
-
 const STEPS: readonly LifecycleStep[] = ['task-written', 'directory-moved', 'registry-committed'];
 const DEFAULT_IO: LifecycleFileSystem = {
   renameSync: (source, target) => fs.renameSync(source, target),
@@ -362,6 +357,44 @@ export function readLifecycleJournalEvidence(repoRoot: string, taskId: string):
   } catch { return { exists: true, completedSteps: [], failure: 'SANDBOX_CONTROL_LIFECYCLE_JOURNAL_INVALID' }; }
 }
 
+export function inspectTaskLifecycleProgress(
+  repoRoot: string, taskId: string, agent: string
+): 'not-started' | 'started-recoverable' | 'unknown' {
+  try {
+    const hot = locateHotTaskDirs(repoRoot, taskId);
+    if (hot.length !== 1 || (hot[0]!.state !== 'active' && hot[0]!.state !== 'completed')) return 'unknown';
+    const { state, taskDir } = hot[0]!;
+    const content = fs.readFileSync(path.join(taskDir, 'task.md'), 'utf8');
+    const frontmatter = parseTypedTaskFrontmatter(content);
+    if (frontmatter.id !== taskId) return 'unknown';
+    const journalPath = path.join(taskDir, '.task-lifecycle.json');
+    if (!fs.existsSync(journalPath)) {
+      if (state === 'active') return frontmatter.status === 'active' ? 'not-started' : 'unknown';
+      return matchingCompletion(content, { taskRef: taskId, intent: 'complete', agent })
+        ? 'started-recoverable' : 'unknown';
+    }
+    const journal = parseJournal(fs.readFileSync(journalPath, 'utf8'));
+    const request: TaskLifecycleRequest = { taskRef: taskId, intent: 'complete', agent };
+    if (journal.taskId !== taskId || journal.intent !== 'complete'
+      || journal.intentDigest !== intentIdentity(request, taskId)
+      || journal.sourceState !== 'active' || journal.targetState !== 'completed') return 'unknown';
+    if (journal.completedSteps.some((step, index) => STEPS[index] !== step)) return 'unknown';
+    const directoryMoved = journal.completedSteps.includes('directory-moved');
+    const registryCommitted = journal.completedSteps.includes('registry-committed');
+    const hasShortId = loadShortIdByTaskId(repoRoot).has(taskId);
+    if (state === 'active' && (directoryMoved || !hasShortId)) return 'unknown';
+    if (state === 'completed' && (!journal.completedSteps.includes('task-written')
+      || !matchingCompletion(content, request) || (registryCommitted && hasShortId))) return 'unknown';
+    if (frontmatter.status !== state
+      && !(state === 'active' && frontmatter.status === 'completed' && matchingCompletion(content, request))) {
+      return 'unknown';
+    }
+    return 'started-recoverable';
+  } catch {
+    return 'unknown';
+  }
+}
+
 type DirectoryEntry = Readonly<{ relativePath: string; kind: 'file' | 'directory'; size: number; digest: string }>;
 
 function directoryManifest(root: string): DirectoryEntry[] {
@@ -468,7 +501,7 @@ function applyTaskLifecycle(requestInput: TaskLifecycleRequest, options: TaskLif
     }
     return failed(request, { code: 'LIFECYCLE_INTENT_CONFLICT', message: `task ${taskId} is already ${spec.target} with a different lifecycle intent` }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
   }
-  if (!spec.sources.includes(sourceState) && !existingJournal && !allowsManualOverride(options, 'LIFECYCLE_SOURCE_INVALID')) {
+  if (!spec.sources.includes(sourceState) && !existingJournal) {
     return failed(request, { code: 'LIFECYCLE_SOURCE_INVALID', message: `${request.intent} is not allowed from ${sourceState}` }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
   }
   if (sourcePath !== targetPath && fs.existsSync(targetPath) && !existingJournal) {
@@ -479,7 +512,7 @@ function applyTaskLifecycle(requestInput: TaskLifecycleRequest, options: TaskLif
   try { frontmatter = parseTypedTaskFrontmatter(content); }
   catch (error) { return failed(request, { code: 'LIFECYCLE_DOCUMENT_INVALID', message: error instanceof Error ? error.message : String(error) }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath }); }
   if (frontmatter.id !== taskId) return failed(request, { code: 'LIFECYCLE_IDENTITY_INVALID', message: 'task.md id does not match its lifecycle task id' }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
-  if (!locateActivityLog(content) && !allowsManualOverride(options, 'LIFECYCLE_LOG_MISSING')) return failed(request, { code: 'LIFECYCLE_LOG_MISSING', message: 'task has no unique Activity Log section' }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
+  if (!locateActivityLog(content)) return failed(request, { code: 'LIFECYCLE_LOG_MISSING', message: 'task has no unique Activity Log section' }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
   if (spec.target === 'active') {
     const contract = validateCurrentTaskContract(content);
     if (!contract.ok) return failed(request, { code: 'LIFECYCLE_DOCUMENT_INVALID', message: contract.message }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
@@ -493,10 +526,10 @@ function applyTaskLifecycle(requestInput: TaskLifecycleRequest, options: TaskLif
   }
   const registry = JSON.parse(registryRequest.output || '{"version":1,"ids":{}}') as { ids: Record<string, string> };
   const registeredKey = Object.entries(registry.ids).find(([, candidate]) => candidate === taskId)?.[0];
-  if (spec.registry === 'release' && sourceState === 'active' && !registeredKey && !allowsManualOverride(options, 'LIFECYCLE_SHORT_ID_PRECONDITION')) {
+  if (spec.registry === 'release' && sourceState === 'active' && !registeredKey) {
     return failed(request, { code: 'LIFECYCLE_SHORT_ID_PRECONDITION', message: 'active source has no short-id registry entry' }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
   }
-  if (spec.registry === 'alloc' && !registeredKey && Object.keys(registry.ids).length >= 10 ** configuredShortIdLength(repoRoot) - 1 && !allowsManualOverride(options, 'SHORT_ID_CAPACITY_EXCEEDED')) {
+  if (spec.registry === 'alloc' && !registeredKey && Object.keys(registry.ids).length >= 10 ** configuredShortIdLength(repoRoot) - 1) {
     return failed(request, { code: 'SHORT_ID_CAPACITY_EXCEEDED', message: 'short-id registry has no free slot' }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
   }
   const digest = intentIdentity(request, taskId);
@@ -514,8 +547,7 @@ function applyTaskLifecycle(requestInput: TaskLifecycleRequest, options: TaskLif
       if (!journal.failure) return failed(request, { code: 'LIFECYCLE_JOURNAL_INVALID', message: 'existing lifecycle journal has no durable failure evidence for a read-only probe' }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath, journalPath: initialJournalPath });
       return failed(request, journal.failure, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath, journalPath: initialJournalPath, completedSteps: journal.completedSteps, pendingSteps: STEPS.filter((step) => !journal.completedSteps.includes(step)) });
     }
-    const overrideResumesRecordedFailure = journal.failure && allowsManualOverride(options, journal.failure.code);
-    if (journal.intentDigest !== digest && !overrideResumesRecordedFailure) return failed(request, { code: 'LIFECYCLE_INTENT_CONFLICT', message: 'an in-progress lifecycle journal belongs to a different request' }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath, journalPath: initialJournalPath });
+    if (journal.intentDigest !== digest) return failed(request, { code: 'LIFECYCLE_INTENT_CONFLICT', message: 'an in-progress lifecycle journal belongs to a different request' }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath, journalPath: initialJournalPath });
   } else {
     let metadata: TaskWriteMetadata;
     try { metadata = (options.metadataProvider ?? captureTaskWriteMetadata)(); }
@@ -525,7 +557,7 @@ function applyTaskLifecycle(requestInput: TaskLifecycleRequest, options: TaskLif
     }
     journal = { version: 1, taskId, intent: request.intent, intentDigest: digest, sourceState, targetState: spec.target, metadata, completedSteps: [] };
     if (request.dryRun) {
-      const plannedMutations = mutationsFor(request, content, metadata, restoredFiles, allowsManualOverride(options, 'LIFECYCLE_LOG_MISSING'));
+      const plannedMutations = mutationsFor(request, content, metadata, restoredFiles, false);
       if ('code' in plannedMutations) return failed(request, plannedMutations, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
       const taskPlan = writeTask(
         { taskRef: taskId, expectedState: sourceState === 'blocked' ? 'blocked' : 'active', mutations: plannedMutations, dryRun: true },
@@ -561,7 +593,7 @@ function applyTaskLifecycle(requestInput: TaskLifecycleRequest, options: TaskLif
   if (matchingCompletion(io.readFileSync(path.join(sourcePath, 'task.md')), request, restoredFiles)) completed.add('task-written');
   if (!completed.has('task-written')) {
     const current = io.readFileSync(path.join(sourcePath, 'task.md'));
-    const mutations = mutationsFor(request, current, journal.metadata, restoredFiles, allowsManualOverride(options, 'LIFECYCLE_LOG_MISSING'));
+    const mutations = mutationsFor(request, current, journal.metadata, restoredFiles, false);
     if ('code' in mutations) return failed(request, mutations, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath, journalPath, completedSteps: [...completed], changed: completed.size > 0 });
     const writeResult = writeTask(
       { taskRef: taskId, expectedState: sourceState === 'blocked' ? 'blocked' : 'active', mutations },

package/lib/task/local-artifact-finalization.ts

@@ -2,10 +2,10 @@ import fs from 'node:fs';
 import path from 'node:path';
 
 import { inspectDecisionDetailDuplicates } from './decision-details.ts';
-import { scanVisibleMarkdown } from './markdown.ts';
 import { parseArtifactName } from './artifact-name.ts';
+import { parseLifecyclePathDecision } from './lifecycle-path.ts';
 import { resolveTaskRef } from './resolve-ref.ts';
-import { canonicalSemanticDigest, inspectArtifactPatterns, inspectArtifactStructure, sha256Content } from './artifact-operations.ts';
+import { canonicalSemanticDigest, inspectArtifactContract, sha256Content } from './artifact-operations.ts';
 import { getArtifactSchema } from './artifact-schema.ts';
 
 type LocalArtifactFamily = 'analysis' | 'plan' | 'code';
@@ -24,7 +24,8 @@ type LocalArtifactDiagnosticCode =
   | 'LOCAL_DECISION_DETAIL_DUPLICATE'
   | 'LOCAL_REQUIRED_PATTERN_MISSING'
   | 'LOCAL_STRUCTURAL_INVALID'
-  | 'LOCAL_SECTION_HEADING_TRAILING_PUNCTUATION';
+  | 'LOCAL_SECTION_HEADING_TRAILING_PUNCTUATION'
+  | 'LOCAL_FLOW_DECISION_INVALID';
 
 type LocalArtifactDiagnostic = {
   code: LocalArtifactDiagnosticCode;
@@ -71,7 +72,9 @@ function localDiagnosticCode(code: string): LocalArtifactDiagnosticCode {
     ARTIFACT_EMPTY: 'LOCAL_ARTIFACT_EMPTY',
     ARTIFACT_MISSING_SECTION: 'LOCAL_ARTIFACT_MISSING_SECTION',
     ARTIFACT_DUPLICATE_SECTION: 'LOCAL_ARTIFACT_DUPLICATE_SECTION',
-    ARTIFACT_HEADING_TRAILING_PUNCTUATION: 'LOCAL_SECTION_HEADING_TRAILING_PUNCTUATION'
+    ARTIFACT_HEADING_TRAILING_PUNCTUATION: 'LOCAL_SECTION_HEADING_TRAILING_PUNCTUATION',
+    ARTIFACT_STATE_CHECK_PATTERN_MISSING: 'LOCAL_STATUS_COMMAND_MISSING',
+    ARTIFACT_REQUIRED_PATTERN_MISSING: 'LOCAL_REQUIRED_PATTERN_MISSING'
   };
   return map[code] ?? 'LOCAL_STRUCTURAL_INVALID';
 }
@@ -80,47 +83,25 @@ function localDiagnostic(item: { code: string; message: string; line: number | n
   return { code: localDiagnosticCode(item.code), message: item.message, line: item.line };
 }
 
-function isStatusPattern(pattern: string): boolean {
-  return pattern === '^\\$ ';
-}
-
 function validateLocalArtifact(
   content: string,
   options: LocalArtifactValidationOptions
 ): LocalArtifactValidationResult {
   const schema = getArtifactSchema(options.family)!;
   const diagnostics: LocalArtifactDiagnostic[] = [];
-  const scanned = scanVisibleMarkdown(content);
-  const structure = inspectArtifactStructure(content, schema);
-  for (const item of structure.diagnostics) diagnostics.push(localDiagnostic(item));
-
-  const statusSection = schema.sections.find((section) => section.id === 'state-check');
-  if (statusSection) {
-    const statusHeading = scanned.headings.find((heading) => (
-      heading.level === 2 && [statusSection.headings.zh, statusSection.headings.en].some((name) => (
-        heading.text === name || heading.text === `${name}:` || heading.text === `${name}：`
-      ))
-    ));
-    if (statusHeading) {
-      const next = scanned.headings.find((candidate) => candidate.start > statusHeading.start && candidate.level <= 2);
-      const body = content.slice(statusHeading.end, next?.start ?? content.length);
-      for (const pattern of schema.requiredPatterns.filter(isStatusPattern)) {
-        if (!new RegExp(pattern, 'm').test(body)) {
-          diagnostics.push({ code: 'LOCAL_STATUS_COMMAND_MISSING', message: `status section '${statusHeading.text}' is missing required command output`, line: content.slice(0, statusHeading.start).split('\n').length });
-        }
-      }
-    }
-  }
-
-  const patternInspection = inspectArtifactPatterns(content, {
-    ...schema,
-    requiredPatterns: schema.requiredPatterns.filter((item) => !isStatusPattern(item))
-  });
-  for (const item of patternInspection.diagnostics) diagnostics.push({ code: 'LOCAL_REQUIRED_PATTERN_MISSING', message: item.message, line: null });
+  const inspection = inspectArtifactContract(content, schema, { scopeStateCheckSection: true });
+  for (const item of inspection.diagnostics) diagnostics.push(localDiagnostic(item));
 
   const decisionDetails = inspectDecisionDetailDuplicates(content);
   if (!decisionDetails.ok) diagnostics.push({ code: 'LOCAL_DECISION_DETAIL_DUPLICATE', message: decisionDetails.message, line: null });
 
+  if (options.family === 'analysis') {
+    const flowDecision = parseLifecyclePathDecision(content);
+    if (flowDecision.status !== 'valid') {
+      diagnostics.push({ code: 'LOCAL_FLOW_DECISION_INVALID', message: flowDecision.message, line: null });
+    }
+  }
+
   return {
     ok: diagnostics.length === 0,
     family: options.family,

package/lib/task/resolve-ref.ts

@@ -81,7 +81,7 @@ function listSortedNumeric(dir: string, width: number): string[] {
 }
 
 function findInArchive(repoRoot: string, taskId: string): string | null {
-  // archive-tasks SKILL writes to .agents/workspace/archive/YYYY/MM/DD/{taskId}/task.md
+  // archive-tasks stores local material at .agents/workspace/archive/YYYY/MM/DD/{taskId}/local/task.md
   // where YYYY/MM/DD comes from completed_at (or updated_at fallback) — NOT from
   // the task id's creation date. So we cannot derive the path from taskId alone;
   // walk the bounded YYYY/MM/DD tree instead. Newest-first to favor recent archives.
@@ -91,7 +91,7 @@ function findInArchive(repoRoot: string, taskId: string): string | null {
     for (const month of listSortedNumeric(yearDir, 2)) {
       const monthDir = path.join(yearDir, month);
       for (const day of listSortedNumeric(monthDir, 2)) {
-        const candidate = path.join(monthDir, day, taskId, 'task.md');
+        const candidate = path.join(monthDir, day, taskId, 'local', 'task.md');
         if (fs.existsSync(candidate)) return candidate;
       }
     }
@@ -162,7 +162,7 @@ function enumerateAllTaskDirs(repoRoot: string): { taskId: string; taskDir: stri
       const monthDir = path.join(yearDir, month);
       for (const day of listSortedNumeric(monthDir, 2).reverse()) {
         const dayDir = path.join(monthDir, day);
-        for (const taskId of fs.readdirSync(dayDir).sort()) add(taskId, path.join(dayDir, taskId), 'archive');
+        for (const taskId of fs.readdirSync(dayDir).sort()) add(taskId, path.join(dayDir, taskId, 'local'), 'archive');
       }
     }
   }

package/lib/task/review-command.ts

@@ -1,13 +1,10 @@
 import type { ReviewFinalizationRequest } from './review-finalization.ts';
 
-export function parseReviewCommand(args: readonly string[]): ReviewFinalizationRequest & {
-  overrideTicket?: string; overrideTarget?: string; overrideScope?: string;
-} {
+export function parseReviewCommand(args: readonly string[]): ReviewFinalizationRequest {
   if (!args[0] || !['preflight', 'finalize-summary'].includes(args[1] ?? '')) throw new Error('task ref and a supported review operation are required');
   const values: Record<string, string | boolean> = {};
   const flags = {
-    '--stage': 'stage', '--artifact': 'artifact', '--orchestrated': 'orchestrated', '--dry-run': 'dryRun',
-    '--override-ticket': 'overrideTicket', '--override-target': 'overrideTarget', '--override-scope': 'overrideScope'
+    '--stage': 'stage', '--artifact': 'artifact', '--orchestrated': 'orchestrated', '--dry-run': 'dryRun'
   } as const;
   for (let index = 2; index < args.length; index += 1) {
     const flag = args[index]!;

package/lib/task/review-finalization.ts

@@ -12,8 +12,6 @@ import { resolveTaskRef } from './resolve-ref.ts';
 import { validateLifecycleExecution } from './lifecycle-execution.ts';
 import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.ts';
 import type { ResolveTaskRefErrorCode } from './resolve-ref.ts';
-import { allowsManualOverride } from './guard-override.ts';
-import type { ManualOverrideCapability } from './guard-override.ts';
 import { getArtifactSchema } from './artifact-schema.ts';
 import { canonicalSemanticDigest, inspectArtifactContract, sha256Content } from './artifact-operations.ts';
 
@@ -70,7 +68,6 @@ type ReviewFileSystem = {
 type ReviewFinalizationOptions = {
   repoRoot?: string;
   fileSystem?: Partial<ReviewFileSystem>;
-  manualOverride?: ManualOverrideCapability;
   lockAlreadyHeld?: boolean;
 };
 
@@ -224,7 +221,7 @@ function prepareReviewSummaryCandidate(
   const resolved = resolveTaskRef(request.taskRef, { repoRoot: options.repoRoot });
   taskId = resolved.taskId ?? null;
   if (!resolved.ok) return reject(resolved.code, resolved.message);
-  if (resolved.state !== 'active' && !allowsManualOverride(options.manualOverride, 'review-finalization', 'TASK_STATE_MISMATCH')) {
+  if (resolved.state !== 'active') {
     return reject('TASK_STATE_MISMATCH', `task ${taskId} is ${resolved.state}, expected active`);
   }
   const parsed = parseArtifactName(request.artifact);

package/lib/task/snapshot.ts

@@ -97,22 +97,22 @@ function collectTaskSnapshot(taskRef: string, options: SnapshotOptions = {}): Ta
   const observations: SnapshotObservation[] = [];
   try {
     const output = stripOneTrailingNewline((options.gitStatus ?? defaultGitStatus)(resolved.repoRoot));
-    observations.push({ name: 'git', status: 'ready', command: '$ git status -s', output, error: null });
+    observations.push({ name: 'git', status: 'ready', command: 'git status --short --untracked-files=all', output, error: null });
   } catch (error) {
-    return failedSnapshot(resolved, taskRef, observations, 'git', '$ git status -s', 'SNAPSHOT_GIT_FAILED', error);
+    return failedSnapshot(resolved, taskRef, observations, 'git', 'git status --short --untracked-files=all', 'SNAPSHOT_GIT_FAILED', error);
   }
   try {
     const entries = (options.readDirectory ?? ((dir) => fs.readdirSync(dir, { withFileTypes: true })))(resolved.taskDir);
     const output = renderDirectory(entries, resolved.taskDir, options.lstat ?? fs.lstatSync);
-    observations.push({ name: 'task-directory', status: 'ready', command: `$ ls -la ${taskDirPath}/`, output, error: null });
+    observations.push({ name: 'task-directory', status: 'ready', command: `fs.readdirSync ${taskDirPath}/`, output, error: null });
   } catch (error) {
-    return failedSnapshot(resolved, taskRef, observations, 'task-directory', `$ ls -la ${taskDirPath}/`, 'SNAPSHOT_DIRECTORY_READ_FAILED', error);
+    return failedSnapshot(resolved, taskRef, observations, 'task-directory', `fs.readdirSync ${taskDirPath}/`, 'SNAPSHOT_DIRECTORY_READ_FAILED', error);
   }
   try {
     const content = (options.readTask ?? ((file) => fs.readFileSync(file, 'utf8')))(resolved.taskMdPath);
-    observations.push({ name: 'task-tail', status: 'ready', command: `$ tail ${taskPath}`, output: renderTail(content), error: null });
+    observations.push({ name: 'task-tail', status: 'ready', command: `fs.readFileSync ${taskPath} (last 10 lines)`, output: renderTail(content), error: null });
   } catch (error) {
-    return failedSnapshot(resolved, taskRef, observations, 'task-tail', `$ tail ${taskPath}`, 'SNAPSHOT_TASK_READ_FAILED', error);
+    return failedSnapshot(resolved, taskRef, observations, 'task-tail', `fs.readFileSync ${taskPath} (last 10 lines)`, 'SNAPSHOT_TASK_READ_FAILED', error);
   }
   return {
     status: 'ready', changed: false, requestRef: taskRef, taskId: resolved.taskId,

package/lib/task/verification-engine.ts

@@ -23,6 +23,7 @@ import { inspectPlatformPullRequest } from "../platform/pull-requests.ts";
 import { resolveMaterializedReviewedHeadRelation } from "../platform/change-request-git-evidence.ts";
 import { resolveReviewedHeadRelation } from "../platform/merged-pr-equivalence.ts";
 import { resolveLocalReviewedCommitRelation } from "../git/reviewed-commit-equivalence.ts";
+import { resolveBranchWorktree } from "../git/branch-worktree.ts";
 import { parseTypedTaskFrontmatter } from "./frontmatter.ts";
 import { LEDGER_TERMINAL, LEDGER_SECTION_MISSING_CODE, LEDGER_SECTION_MISSING_MESSAGE, parseLedgerDocument, summarizeLedgerStage, validateLedgerRows } from "./ledger.ts";
 import type { LedgerRow } from "./ledger.ts";
@@ -570,6 +571,23 @@ function checkArtifact({ taskDir, config, artifactFile, skillName }: any): any {
     }
   }
 
+  const stateCheckPatterns = config.state_check_patterns || [];
+  if (stateCheckPatterns.length > 0) {
+    const scanned = scanVisibleMarkdown(content);
+    const stateCheckHeading = scanned.headings.find((heading) => (
+      heading.level === 2 && (heading.text === "状态核对" || heading.text === "State Check")
+    ));
+    const nextHeading = stateCheckHeading && scanned.headings.find((heading) => (
+      heading.start > stateCheckHeading.start && heading.level <= 2
+    ));
+    const stateCheckBody = stateCheckHeading ? content.slice(stateCheckHeading.end, nextHeading?.start ?? content.length) : "";
+    for (const pattern of stateCheckPatterns) {
+      if (!new RegExp(pattern, "m").test(stateCheckBody)) {
+        return failResult("artifact", `${path.basename(artifactPath)} state-check section is missing required command: ${pattern}`);
+      }
+    }
+  }
+
   return passResult(
     "artifact",
     `${path.basename(artifactPath)} passed (${requiredSections.length} sections)`
@@ -1251,16 +1269,8 @@ function checkReviewFact({ taskDir, artifactFile, repositoryRoot }: any): any {
 
 function reviewWorktreeForTask(repositoryRoot: string, branch: string): string | null {
   if (!branch) return null;
-  const expectedRef = `refs/heads/${branch}`;
-  const records = execFileSync("git", ["-C", repositoryRoot, "worktree", "list", "--porcelain"], {
-    encoding: "utf8",
-    stdio: ["pipe", "pipe", "pipe"]
-  }).trim().split(/\r?\n\r?\n/);
-  for (const record of records) {
-    const worktree = /^worktree (.+)$/m.exec(record)?.[1];
-    const branchRef = /^branch (.+)$/m.exec(record)?.[1];
-    if (worktree && branchRef === expectedRef) return worktree;
-  }
+  const worktree = resolveBranchWorktree(repositoryRoot, branch);
+  if (worktree) return worktree;
   throw new Error(`Task branch '${branch}' is not checked out in a registered worktree`);
 }
 

package/lib/task/verification.ts

@@ -7,8 +7,6 @@ import { parseArtifactName } from './artifact-name.ts';
 import type { ArtifactFamily } from './artifact-lifecycle.ts';
 import { resolveTaskRef } from './resolve-ref.ts';
 import type { TaskWorkspaceState } from './resolve-ref.ts';
-import { allowsManualOverride } from './guard-override.ts';
-import type { ManualOverrideCapability } from './guard-override.ts';
 
 type VerificationEvent =
   | 'analyze.awaiting-input' | 'analyze.completed'
@@ -50,7 +48,6 @@ type TaskVerificationResult = {
 type VerificationOptions = {
   repoRoot?: string;
   engine?: (input: Parameters<typeof verifyInProcess>[0]) => Record<string, unknown> | Promise<Record<string, unknown>>;
-  manualOverride?: ManualOverrideCapability;
 };
 
 const gate = (skill: string, expectedState: VerificationSpec['expectedState'], artifactFamily?: ArtifactFamily): VerificationSpec => ({
@@ -98,7 +95,7 @@ async function verifyTaskEvent(request: { taskRef: string; event: string; artifa
   const resolved = resolveTaskRef(request.taskRef, { repoRoot: options.repoRoot });
   if (!resolved.ok) return failure(request, resolved.code, resolved.message, { taskId: resolved.taskId, skill: spec.skill, mode: spec.mode });
   const identity = { taskId: resolved.taskId, taskDir: resolved.taskDir, taskState: resolved.state, skill: spec.skill, mode: spec.mode } as const;
-  if (resolved.state !== spec.expectedState && !allowsManualOverride(options.manualOverride, 'task-verify', 'VERIFY_TASK_STATE_MISMATCH')) {
+  if (resolved.state !== spec.expectedState) {
     return failure(request, 'VERIFY_TASK_STATE_MISMATCH', `event '${request.event}' requires workspace '${spec.expectedState}', received '${resolved.state}'`, identity);
   }
   if (spec.artifactFamily) {
@@ -116,22 +113,11 @@ async function verifyTaskEvent(request: { taskRef: string; event: string; artifa
   if (spec.mode === 'gate') {
     const payload = await engine({ mode: 'gate', skillName: spec.skill, taskDir: resolved.taskDir, artifactFile: request.artifact, checks: [], repositoryRoot: resolved.repoRoot });
     const status = payload.gate as 'pass' | 'fail' | 'blocked';
-    if (status !== 'pass' && allowsManualOverride(options.manualOverride, 'verification-engine', status === 'blocked' ? 'CHECK_BLOCKED' : 'CHECK_FAILED')) {
-      invocations.push({ status: 'pass', exitCode: 0, payload: { ...payload, gate: 'pass', humanOverride: 'human-approved', originalGate: status } });
-      return {
-        status: 'pass', changed: false, event: request.event, requestRef: request.taskRef,
-        ...identity, artifact: request.artifact ?? null, invocations, error: null
-      };
-    }
     invocations.push({ status, exitCode: ({ pass: 0, fail: 1, blocked: 2 } as const)[status], payload });
   } else {
     for (const check of spec.checks ?? []) {
       const payload = await engine({ mode: 'checks', skillName: spec.skill, taskDir: resolved.taskDir, artifactFile: request.artifact, checks: [check], repositoryRoot: resolved.repoRoot });
       const status = (payload.effectiveStatus ?? payload.status) as 'pass' | 'fail' | 'blocked';
-      if (status !== 'pass' && allowsManualOverride(options.manualOverride, 'verification-engine', status === 'blocked' ? 'CHECK_BLOCKED' : 'CHECK_FAILED')) {
-        invocations.push({ status: 'pass', exitCode: 0, payload: { ...payload, status: 'pass', humanOverride: 'human-approved', originalStatus: status } });
-        break;
-      }
       invocations.push({ status, exitCode: ({ pass: 0, fail: 1, blocked: 2 } as const)[status], payload });
       if (status !== 'pass') break;
     }

package/lib/task/workflow-warning-intents.ts

@@ -12,7 +12,6 @@ import {
 import type { WorkflowWarning } from './workflow-warnings.ts';
 import { captureTaskWriteMetadata, writeTask } from './write.ts';
 import type { TaskMutation, TaskOperationSummary, TaskWriteOptions } from './write.ts';
-import { allowsManualOverride } from './guard-override.ts';
 import { retryHintForWarning, type OperationWarning } from './operation-outcome.ts';
 
 type WarningSeverity = 'IMPORTANT' | 'ACTION_REQUIRED';
@@ -77,8 +76,7 @@ function rowMutation(row: WorkflowWarning): TaskMutation {
 function applyWorkflowWarningIntent(intent: WorkflowWarningIntent, options: TaskWriteOptions = {}): WorkflowWarningIntentResult {
   const resolved = resolveTaskRef(intent.taskRef, { repoRoot: options.repoRoot });
   if (!resolved.ok) return failed(intent, resolved.code, resolved.message, resolved.taskId);
-  const stateOverride = allowsManualOverride(options.manualOverride, 'workflow-warning', 'TASK_STATE_MISMATCH');
-  if (resolved.state !== 'active' && !stateOverride) return failed(intent, 'TASK_STATE_MISMATCH', `task ${resolved.taskId} is ${resolved.state}, expected active`, resolved.taskId);
+  if (resolved.state !== 'active') return failed(intent, 'TASK_STATE_MISMATCH', `task ${resolved.taskId} is ${resolved.state}, expected active`, resolved.taskId);
   let content: string;
   let rows: WorkflowWarning[];
   try {
@@ -122,7 +120,7 @@ function applyWorkflowWarningIntent(intent: WorkflowWarningIntent, options: Task
   }
 
   const writeResult = writeTask({
-    taskRef: intent.taskRef, expectedState: stateOverride ? resolved.state : 'active', mutations: [...sectionMutation(content), rowMutation(after)], dryRun: intent.dryRun
+    taskRef: intent.taskRef, expectedState: 'active', mutations: [...sectionMutation(content), rowMutation(after)], dryRun: intent.dryRun
   }, {
     ...options,
     taskLocation: { repoRoot: resolved.repoRoot, taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, state: resolved.state },

package/lib/task/write.ts

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import crypto from 'node:crypto';
 
 import { isValidAgentInfraVersion, VERSION } from '../version.ts';
 import {
@@ -12,8 +13,6 @@ import type {
   ResolveTaskRefErrorCode,
   TaskWorkspaceState
 } from './resolve-ref.ts';
-import { allowsManualOverride } from './guard-override.ts';
-import type { ManualOverrideCapability } from './guard-override.ts';
 import { mutateTableRow, upsertSection } from './sections.ts';
 import { validateCurrentTaskContract } from './current-contract.ts';
 import { invalidationBlocks, parseInvalidationDocument } from './invalidation.ts';
@@ -163,7 +162,6 @@ type TaskWriteOptions = {
   metadataProvider?: () => TaskWriteMetadata;
   randomSuffix?: () => string;
   fileSystem?: Partial<TaskFileSystem>;
-  manualOverride?: ManualOverrideCapability;
   invalidationContext?: 'standard' | 'source-completion' | 'reconcile';
 };
 
@@ -226,7 +224,7 @@ function errorDetails(error: unknown, fallback: TaskWriteErrorCode): TaskWriteEr
   };
 }
 
-function writeTask(request: TaskWriteRequest, options: TaskWriteOptions = {}): TaskWriteResult {
+function writeTaskCore(request: TaskWriteRequest, options: TaskWriteOptions = {}): TaskWriteResult {
   const resolved = options.taskLocation
     ? {
         ok: true as const,
@@ -250,7 +248,7 @@ function writeTask(request: TaskWriteRequest, options: TaskWriteOptions = {}): T
     taskMdPath: resolved.taskMdPath,
     actualState: resolved.state
   };
-  if (resolved.state !== request.expectedState && !allowsManualOverride(options.manualOverride, 'task.write', 'TASK_STATE_MISMATCH')) {
+  if (resolved.state !== request.expectedState) {
     return failure(
       request,
       identity,
@@ -482,6 +480,119 @@ function writeTask(request: TaskWriteRequest, options: TaskWriteOptions = {}): T
   return { ...successBase, status: 'applied', changed: true };
 }
 
+function archiveContentsHash(localDir: string): string {
+  const files: string[] = [];
+  const walk = (dir: string) => {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      if (entry.name.includes('\n') || entry.name.includes('\r') || entry.name === 'manifest.md') {
+        throw new Error(`Archive source path is not valid: ${path.join(dir, entry.name)}`);
+      }
+      const target = path.join(dir, entry.name);
+      const stat = fs.lstatSync(target);
+      if (stat.isSymbolicLink()) throw new Error(`Archive source cannot contain symbolic links: ${target}`);
+      if (stat.isDirectory()) walk(target);
+      else if (stat.isFile()) {
+        if (entry.name !== 'contents.sha256') files.push(target);
+      }
+      else throw new Error(`Archive source cannot contain special files: ${target}`);
+    }
+  };
+  walk(localDir);
+  const rows = files
+    .map((file) => ({ file, relative: path.relative(localDir, file).split(path.sep).join('/') }))
+    .sort((left, right) => Buffer.compare(Buffer.from(left.relative), Buffer.from(right.relative)))
+    .map(({ file, relative }) => `${crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex')}  ${relative}`);
+  return `${rows.join('\n')}${rows.length ? '\n' : ''}`;
+}
+
+function writeArchiveContentsHash(localDir: string): void {
+  const contents = archiveContentsHash(localDir);
+  const hashPath = path.join(localDir, 'contents.sha256');
+  const tempPath = path.join(localDir, `.contents.sha256.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`);
+  try {
+    fs.writeFileSync(tempPath, contents, { flag: 'wx' });
+    fs.renameSync(tempPath, hashPath);
+  } catch (error) {
+    try {
+      fs.unlinkSync(tempPath);
+    } catch (cleanupError) {
+      if ((cleanupError as NodeJS.ErrnoException).code !== 'ENOENT') {
+        throw new Error(`${error instanceof Error ? error.message : String(error)}; failed to remove ${tempPath}: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
+      }
+    }
+    throw error;
+  }
+}
+
+function restoreArchivedTask(taskMdPath: string, contents: Buffer, mode: number): void {
+  const tempPath = `${taskMdPath}.${process.pid}.${Math.random().toString(36).slice(2)}.rollback`;
+  fs.writeFileSync(tempPath, contents, { flag: 'wx', mode });
+  try {
+    fs.renameSync(tempPath, taskMdPath);
+  } catch (error) {
+    try {
+      fs.unlinkSync(tempPath);
+    } catch (cleanupError) {
+      if ((cleanupError as NodeJS.ErrnoException).code !== 'ENOENT') {
+        throw new Error(`${error instanceof Error ? error.message : String(error)}; failed to remove ${tempPath}: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
+      }
+    }
+    throw error;
+  }
+}
+
+function writeTask(request: TaskWriteRequest, options: TaskWriteOptions = {}): TaskWriteResult {
+  const resolved = options.taskLocation
+    ? {
+        ok: true as const,
+        repoRoot: options.taskLocation.repoRoot,
+        taskId: options.taskLocation.taskId,
+        taskDir: path.dirname(options.taskLocation.taskMdPath),
+        taskMdPath: options.taskLocation.taskMdPath,
+        state: options.taskLocation.state
+      }
+    : resolveTaskRef(request.taskRef, { repoRoot: options.repoRoot });
+  if (!resolved.ok) {
+    return failure(request, { taskId: resolved.taskId, taskMdPath: null, actualState: null }, resolved.code, resolved.message);
+  }
+  if (resolved.state !== 'archive' || request.expectedState !== 'archive' || request.dryRun) {
+    return writeTaskCore(request, { ...options, taskLocation: {
+      repoRoot: resolved.repoRoot,
+      taskId: resolved.taskId,
+      taskMdPath: resolved.taskMdPath,
+      state: resolved.state
+    } });
+  }
+
+  const identity = { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, actualState: resolved.state };
+  try {
+    const originalTask = fs.readFileSync(resolved.taskMdPath);
+    const originalMode = fs.statSync(resolved.taskMdPath).mode;
+    archiveContentsHash(resolved.taskDir);
+    const result = writeTaskCore(request, { ...options, taskLocation: {
+      repoRoot: resolved.repoRoot,
+      taskId: resolved.taskId,
+      taskMdPath: resolved.taskMdPath,
+      state: resolved.state
+    } });
+    if (result.status === 'applied') {
+      try {
+        writeArchiveContentsHash(resolved.taskDir);
+      } catch (error) {
+        try {
+          restoreArchivedTask(resolved.taskMdPath, originalTask, originalMode);
+        } catch (rollbackError) {
+          throw new Error(`Archive checksum update failed: ${error instanceof Error ? error.message : String(error)}; task rollback failed: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
+        }
+        throw error;
+      }
+    }
+    return result;
+  } catch (error) {
+    return failure(request, identity, 'TASK_READ_FAILED', error instanceof Error ? error.message : String(error));
+  }
+}
+
 export { writeTask, captureTaskWriteMetadata, canonicalTimestamp };
 export type {
   FrontmatterMutation,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fitlab-ai/agent-infra",
-  "version": "0.11.4",
+  "version": "0.11.6",
   "description": "Bootstrap tool for AI multi-tool collaboration infrastructure — works with Claude Code, Codex, Antigravity CLI, and OpenCode",
   "license": "MIT",
   "type": "module",

package/templates/.agents/rules/evidence-reporting.en.md

@@ -21,8 +21,7 @@ Record a reproducible command or entry point, the exact file/line/object/version
 - Preserve artifact SHA-256, semantic digest, review head, receipt, request-id, snapshot tree, and platform marker exactly.
 - The Issue continues to mirror the complete report; the report must not depend on logs accessible only on the local machine.
 - Manual validation keeps its stricter basename-only and sanitized-result rules; this shared rule does not expand public fields.
-- A `$ ` command line satisfies the structural gate but does not require complete successful output.
 
 ## Evidence Pairing
 
-Pair every verification claim with a `$ ` command and a proportionate result summary. Include a decisive raw excerpt only for failure, blocking, or dispute conclusions. When a command contains sensitive arguments, use its allowed public name or a redacted command.
+Pair every verification claim with an executable command and a proportionate result summary. Include a decisive raw excerpt only for failure, blocking, or dispute conclusions. When a command contains sensitive arguments, use its allowed public name or a redacted command.

package/templates/.agents/rules/evidence-reporting.zh-CN.md

@@ -21,8 +21,7 @@
 - artifact SHA-256、semantic digest、review head、receipt、request-id、快照树和平台 marker 必须精确保留。
 - Issue 继续镜像报告全文；报告不得依赖只有本机可访问的日志。
 - 人工验证继续使用 basename-only、sanitized result 等更严格规则；共享规则不扩大可公开字段。
-- `$ ` 命令行标记满足结构门禁，但不要求附带完整成功输出。
 
 ## 证据配对
 
-报告中的每个验证断言都应配一个 `$ ` 命令和相称结果摘要；只有失败、阻塞或争议结论才附决定性原文摘录。命令含敏感参数时使用允许公开的命令名或脱敏命令。
+报告中的每个验证断言都应配一个可执行命令和相称结果摘要；只有失败、阻塞或争议结论才附决定性原文摘录。命令含敏感参数时使用允许公开的命令名或脱敏命令。