@fitlab-ai/agent-infra 0.11.4 → 0.11.6

package/dist/lib/task/finalization-handoff.js

@@ -0,0 +1,92 @@
+import { createHash, randomUUID } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+const HANDOFF_VERSION = 1;
+const MAX_HANDOFF_BYTES = 1024 * 1024;
+function digest(value) {
+    return createHash('sha256').update(JSON.stringify(value)).digest('hex');
+}
+export function finalizationHandoffPath(directory, taskId) {
+    return path.join(directory, '.agent-infra', 'task-finalization', `${taskId}.json`);
+}
+export function publishTaskFinalizationHandoff(directory, receipt, binding) {
+    if (receipt.taskId === '' || receipt.controlBinding?.generation !== binding.generation
+        || receipt.controlBinding.requestId !== binding.requestId) {
+        throw new Error('TASK_FINALIZATION_HANDOFF_BINDING_INVALID');
+    }
+    const envelope = {
+        version: HANDOFF_VERSION, taskId: receipt.taskId, binding, receipt, receiptSha256: digest(receipt)
+    };
+    const target = finalizationHandoffPath(directory, receipt.taskId);
+    fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+    const temporary = `${target}.${process.pid}.${randomUUID()}.tmp`;
+    fs.writeFileSync(temporary, `${JSON.stringify(envelope)}\n`, { mode: 0o600, flag: 'wx' });
+    try {
+        fs.renameSync(temporary, target);
+    }
+    catch (error) {
+        try {
+            fs.unlinkSync(temporary);
+        }
+        catch { /* preserve the primary error */ }
+        throw error;
+    }
+    return digest(envelope);
+}
+export function readTaskFinalizationHandoff(directory, taskId, binding, handoffSha256) {
+    const file = finalizationHandoffPath(directory, taskId);
+    const initial = fs.lstatSync(file);
+    if (!initial.isFile() || initial.isSymbolicLink() || initial.size > MAX_HANDOFF_BYTES) {
+        throw new Error('TASK_FINALIZATION_HANDOFF_INVALID');
+    }
+    const descriptor = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+    let content;
+    try {
+        const opened = fs.fstatSync(descriptor);
+        if (!opened.isFile() || opened.dev !== initial.dev || opened.ino !== initial.ino
+            || opened.size > MAX_HANDOFF_BYTES)
+            throw new Error('TASK_FINALIZATION_HANDOFF_INVALID');
+        const bytes = Buffer.alloc(MAX_HANDOFF_BYTES + 1);
+        const length = fs.readSync(descriptor, bytes, 0, bytes.length, 0);
+        if (length !== opened.size || length > MAX_HANDOFF_BYTES)
+            throw new Error('TASK_FINALIZATION_HANDOFF_INVALID');
+        content = bytes.toString('utf8', 0, length);
+        const after = fs.fstatSync(descriptor);
+        if (after.dev !== opened.dev || after.ino !== opened.ino || after.size !== opened.size) {
+            throw new Error('TASK_FINALIZATION_HANDOFF_INVALID');
+        }
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+    const envelope = JSON.parse(content);
+    if (!envelope || typeof envelope !== 'object' || Array.isArray(envelope)
+        || Object.keys(envelope).sort().join('\0') !== ['binding', 'receipt', 'receiptSha256', 'taskId', 'version'].join('\0')
+        || envelope.version !== HANDOFF_VERSION || envelope.taskId !== taskId
+        || !envelope.binding || typeof envelope.binding !== 'object' || Array.isArray(envelope.binding)
+        || Object.keys(envelope.binding).sort().join('\0') !== ['generation', 'requestId'].join('\0')
+        || envelope.binding.generation !== binding.generation
+        || envelope.binding.requestId !== binding.requestId || !envelope.receipt
+        || envelope.receipt.controlBinding?.generation !== binding.generation
+        || envelope.receipt.controlBinding.requestId !== binding.requestId
+        || typeof envelope.receiptSha256 !== 'string' || envelope.receiptSha256 !== digest(envelope.receipt)
+        || digest(envelope) !== handoffSha256) {
+        throw new Error('TASK_FINALIZATION_HANDOFF_INVALID');
+    }
+    return {
+        receipt: envelope.receipt,
+        cleanup: () => {
+            try {
+                const current = fs.lstatSync(file);
+                if (current.isFile() && !current.isSymbolicLink()
+                    && current.dev === initial.dev && current.ino === initial.ino)
+                    fs.unlinkSync(file);
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+    };
+}
+//# sourceMappingURL=finalization-handoff.js.map

package/dist/lib/task/finalization.js

@@ -6,13 +6,16 @@ import { canonicalizeSummaryBody } from '../platform/comment-safety.js';
 import { backfillCompletionComments, inspectCompletionBackfillEligibility } from '../platform/completion-backfill.js';
 import { taskIssueIdentity } from '../platform/task-identities.js';
 import { parseTaskFrontmatter } from './frontmatter.js';
-import { applyTaskLifecycle } from './lifecycle.js';
+import { applyTaskLifecycle, inspectTaskLifecycleProgress } from './lifecycle.js';
 import { resolveTaskRef } from './resolve-ref.js';
 import { inspectShortIdRegistry } from './short-id.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.js';
 import { verifyTaskEvent } from './verification.js';
 import { projectFinalizationWarning } from './workflow-warning-intents.js';
 import { mergeOperationWarnings } from './operation-outcome.js';
+import { readTaskFinalizationHandoff } from './finalization-handoff.js';
+import { readSandboxControlManifest } from '../sandbox/control/lifecycle.js';
+import { validateSandboxControlIdentity } from '../sandbox/control/identity-sentinel.js';
 const RECEIPT_VERSION = 4;
 const FINALIZATION_STEPS = ['lifecycle', 'task-comment', 'verification', 'summary'];
 function finalizationRoot(repoRoot) {
@@ -89,19 +92,32 @@ function validateReceipt(value, taskId) {
     const receipt = value;
     const controlBinding = receipt.controlBinding;
     const states = ['pending', 'done', 'skipped'];
-    if (receipt.version !== RECEIPT_VERSION || receipt.taskId !== taskId || receipt.intent !== 'complete'
+    const requiredKeys = [
+        'version', 'taskId', 'intent', 'receiptId', 'revision', 'lifecycle', 'taskComment',
+        'verification', 'summary', 'warningProjection', 'warnings', 'updatedAt', 'lastError'
+    ];
+    if (receipt.controlBinding !== undefined)
+        requiredKeys.push('controlBinding');
+    if (Object.keys(receipt).sort().join('\0') !== requiredKeys.sort().join('\0')
+        ||
+            receipt.version !== RECEIPT_VERSION || receipt.taskId !== taskId || receipt.intent !== 'complete'
         || typeof receipt.receiptId !== 'string' || receipt.receiptId.length === 0
         || !Number.isSafeInteger(receipt.revision) || Number(receipt.revision) < 0
-        || !states.includes(String(receipt.lifecycle))
-        || !states.includes(String(receipt.taskComment))
-        || !states.includes(String(receipt.verification))
-        || !states.includes(String(receipt.summary))
-        || !['pending', 'done'].includes(String(receipt.warningProjection))
+        || !states.includes(receipt.lifecycle)
+        || !states.includes(receipt.taskComment)
+        || !states.includes(receipt.verification)
+        || !states.includes(receipt.summary)
+        || !['pending', 'done'].includes(receipt.warningProjection)
         || !Array.isArray(receipt.warnings) || receipt.warnings.some((warning) => !validWarning(warning))
-        || typeof receipt.updatedAt !== 'string'
-        || (receipt.lastError !== null && (typeof receipt.lastError !== 'object' || Array.isArray(receipt.lastError)))
+        || typeof receipt.updatedAt !== 'string' || receipt.updatedAt.length === 0
+        || (receipt.lastError !== null && (typeof receipt.lastError !== 'object' || Array.isArray(receipt.lastError)
+            || Object.keys(receipt.lastError).sort().join('\0') !== ['code', 'message', 'retryable'].join('\0')
+            || typeof receipt.lastError.code !== 'string'
+            || typeof receipt.lastError.message !== 'string'
+            || typeof receipt.lastError.retryable !== 'boolean'))
         || (receipt.controlBinding !== undefined && (!controlBinding || typeof controlBinding !== 'object'
             || Array.isArray(controlBinding)
+            || Object.keys(controlBinding).sort().join('\0') !== ['generation', 'requestId'].join('\0')
             || typeof controlBinding.generation !== 'string' || controlBinding.generation.length === 0
             || typeof controlBinding.requestId !== 'string' || !/^[a-f0-9-]{16,64}$/u.test(controlBinding.requestId))))
         throw new Error('receipt schema is invalid');
@@ -134,6 +150,12 @@ function writeReceipt(repoRoot, receipt) {
         throw error;
     }
 }
+export function bindTaskFinalizationReceipt(repoRoot, taskId, controlBinding) {
+    const receipt = readReceipt(path.resolve(repoRoot), taskId);
+    if (!receipt)
+        throw new Error('TASK_FINALIZATION_PREPARATION_REQUIRED');
+    return updateReceipt(path.resolve(repoRoot), receipt, { controlBinding, lastError: null });
+}
 function updateReceipt(repoRoot, receipt, patch) {
     const current = readReceipt(repoRoot, receipt.taskId);
     if (!current || current.receiptId !== receipt.receiptId)
@@ -629,8 +651,15 @@ async function prepareUnderLock(request, taskId, options) {
         return failed(taskId, errorOf(error, 'TASK_FINALIZATION_RECEIPT_INVALID'));
     }
     if (options.controlBinding && (receipt.controlBinding?.generation !== options.controlBinding.generation
-        || receipt.controlBinding.requestId !== options.controlBinding.requestId))
-        receipt = updateReceipt(repoRoot, receipt, { controlBinding: options.controlBinding });
+        || receipt.controlBinding.requestId !== options.controlBinding.requestId)) {
+        const state = resolveTaskRef(taskId, { repoRoot });
+        if (!(receipt.lifecycle === 'done' && state.ok && state.state === 'completed')) {
+            return failed(taskId, {
+                code: 'TASK_FINALIZATION_RECOVERY_PROOF_UNAVAILABLE',
+                message: 'canonical receipt is not bound to the current sandbox request', retryable: false
+            });
+        }
+    }
     const preflightState = resolveTaskRef(taskId, { repoRoot });
     if (options.preflight && preflightState.ok && preflightState.state === 'active') {
         try {
@@ -878,7 +907,53 @@ async function commitPreparedTaskFinalization(request, options) {
         return failed(resolved.taskId, { code: resolved.code, message: resolved.message, retryable: false });
     try {
         return await withTaskExecutionLock(repoRoot, resolved.taskId, 'task-finalization.commit', () => {
-            const receipt = readReceipt(repoRoot, resolved.taskId);
+            if (options.controlBinding && options.manifestPath) {
+                try {
+                    const manifest = readSandboxControlManifest(options.manifestPath);
+                    const identity = validateSandboxControlIdentity({
+                        publicStatusDir: manifest.publicStatusDir,
+                        root: path.dirname(path.resolve(options.manifestPath)),
+                        mode: manifest.mode,
+                        taskId: manifest.taskId,
+                        generation: manifest.generation,
+                        controlRootId: manifest.controlRootId
+                    });
+                    if (identity.state !== 'valid' || manifest.taskId !== resolved.taskId
+                        || manifest.generation !== options.controlBinding.generation
+                        || fs.realpathSync.native(manifest.repoRoot) !== fs.realpathSync.native(repoRoot)) {
+                        throw new Error('current sandbox manifest does not match finalization request');
+                    }
+                }
+                catch (error) {
+                    return failed(resolved.taskId, {
+                        code: 'TASK_FINALIZATION_RECOVERY_PROOF_UNAVAILABLE',
+                        message: error instanceof Error ? error.message : String(error), retryable: false
+                    });
+                }
+            }
+            let receipt = readReceipt(repoRoot, resolved.taskId);
+            if (!receipt && options.controlBinding && options.handoffDirectory && request.handoffSha256) {
+                try {
+                    const handoff = readTaskFinalizationHandoff(options.handoffDirectory, resolved.taskId, options.controlBinding, request.handoffSha256);
+                    receipt = validateReceipt(handoff.receipt, resolved.taskId);
+                    if (receipt.lifecycle !== 'pending')
+                        throw new Error('handoff lifecycle must be pending');
+                    if (inspectTaskLifecycleProgress(repoRoot, resolved.taskId, request.agent) === 'unknown') {
+                        throw new Error('TASK_FINALIZATION_RECOVERY_PROOF_UNAVAILABLE');
+                    }
+                    writeReceipt(repoRoot, receipt);
+                    try {
+                        handoff.cleanup();
+                    }
+                    catch { /* keep the persisted canonical receipt usable */ }
+                }
+                catch (error) {
+                    return failed(resolved.taskId, {
+                        code: 'TASK_FINALIZATION_HANDOFF_INVALID',
+                        message: error instanceof Error ? error.message : String(error), retryable: false
+                    });
+                }
+            }
             if (!receipt)
                 return failed(resolved.taskId, {
                     code: 'TASK_FINALIZATION_PREPARATION_REQUIRED', message: 'sandbox preparation receipt is unavailable', retryable: true
@@ -886,6 +961,42 @@ async function commitPreparedTaskFinalization(request, options) {
             if (receipt.lifecycle === 'done' && resolved.state === 'completed') {
                 return terminalResult(resolved.taskId, receipt, { lifecycle: { status: 'no-op', changed: false, error: null } }, false);
             }
+            if (options.controlBinding) {
+                const proof = inspectTaskLifecycleProgress(repoRoot, resolved.taskId, request.agent);
+                const oldBinding = receipt.controlBinding;
+                if (!oldBinding || oldBinding.generation !== options.controlBinding.generation || proof === 'unknown') {
+                    return failed(resolved.taskId, {
+                        code: 'TASK_FINALIZATION_RECOVERY_PROOF_UNAVAILABLE',
+                        message: 'canonical receipt has no valid host recovery proof', retryable: false
+                    });
+                }
+                if (oldBinding.requestId !== options.controlBinding.requestId && proof === 'not-started') {
+                    if (receipt.lifecycle !== 'pending' || !options.handoffDirectory || !request.handoffSha256) {
+                        return failed(resolved.taskId, {
+                            code: 'TASK_FINALIZATION_RECOVERY_PROOF_UNAVAILABLE',
+                            message: 'pending receipt cannot be rebound without a current handoff', retryable: false
+                        });
+                    }
+                    try {
+                        const handoff = readTaskFinalizationHandoff(options.handoffDirectory, resolved.taskId, options.controlBinding, request.handoffSha256);
+                        const nextReceipt = validateReceipt(handoff.receipt, resolved.taskId);
+                        if (nextReceipt.receiptId !== receipt.receiptId || nextReceipt.intent !== receipt.intent
+                            || nextReceipt.lifecycle !== 'pending')
+                            throw new Error('handoff is not continuous with canonical receipt');
+                        receipt = updateReceipt(repoRoot, receipt, { controlBinding: options.controlBinding });
+                        try {
+                            handoff.cleanup();
+                        }
+                        catch { /* keep the persisted canonical receipt usable */ }
+                    }
+                    catch (error) {
+                        return failed(resolved.taskId, {
+                            code: 'TASK_FINALIZATION_HANDOFF_INVALID',
+                            message: error instanceof Error ? error.message : String(error), retryable: false
+                        });
+                    }
+                }
+            }
             if (receipt.taskComment === 'pending' || receipt.verification === 'pending' || receipt.summary === 'pending' || receipt.warningProjection === 'pending') {
                 return failed(resolved.taskId, {
                     code: 'TASK_FINALIZATION_PREPARATION_REQUIRED', message: 'sandbox preparation has pending external steps', retryable: true

package/dist/lib/task/intermediate-cleanup.js

@@ -7,17 +7,10 @@ import { checkpointCommitMatches } from './commit-identity.js';
 import { readCheckpointIntent } from './commit-intent.js';
 import { parseTaskFrontmatter } from './frontmatter.js';
 import { readTaskFinalizationReceipt } from './finalization.js';
-import { semanticDigest, sha256Content } from './local-artifact-finalization.js';
-import { artifactRecoveryRoot, readArtifactRecoveryIntent } from './artifact-repair-intent.js';
-import { parseArtifactName } from './artifact-name.js';
 import { enumerateAllTaskDirs } from './resolve-ref.js';
 const TASK_ID_RE = /^TASK-\d{8}-\d{6}$/;
-const LOCAL_INTENT_RE = /^(TASK-\d{8}-\d{6})-(analysis|review-analysis|plan|review-plan|code|review-code)-(.+\.md)\.json$/;
 const COMMIT_INTENT_RE = /^(TASK-\d{8}-\d{6})\.json$/;
-const AUXILIARY_ROOTS = [
-    '.local-artifact-finalization-intents',
-    '.task-commit-intents'
-];
+const AUXILIARY_ROOTS = ['.task-commit-intents'];
 function auxiliaryRoot(repoRoot, name) {
     return path.join(repoRoot, '.agents', 'workspace', name);
 }
@@ -98,46 +91,6 @@ function receiptGate(repoRoot, task, options) {
     }
     return null;
 }
-function canonicalLocalIntentPath(taskId, family, artifact) {
-    return `${taskId}-${family}-${artifact}.json`;
-}
-function localIntentCandidate(repoRoot, task, filePath, taskId, family, artifact, identity, options) {
-    const protectedReason = taskGate(task);
-    if (protectedReason)
-        return item('LFAI-CONSUMED', taskId, filePath, 'protected', protectedReason, identity);
-    if (path.basename(filePath) !== canonicalLocalIntentPath(taskId, family, artifact)
-        || !parseArtifactName(artifact)?.family || parseArtifactName(artifact).family !== family) {
-        return item('LFAI-CONSUMED', taskId, filePath, 'protected', 'PATH_IDENTITY_MISMATCH', identity);
-    }
-    let intent;
-    try {
-        intent = readArtifactRecoveryIntent(repoRoot, taskId, family, artifact);
-    }
-    catch {
-        return item('LFAI-CONSUMED', taskId, filePath, 'protected', 'LFAI_SCHEMA_INVALID', identity);
-    }
-    if (!intent || intent.state !== 'consumed') {
-        return item('LFAI-CONSUMED', taskId, filePath, 'protected', 'LFAI_STATE_PROTECTED', identity);
-    }
-    const artifactPath = path.join(task.taskDir, artifact);
-    if (safeLstat(task.taskDir, artifactPath, 'file') === null) {
-        return item('LFAI-CONSUMED', taskId, filePath, 'protected', 'ARTIFACT_IDENTITY_MISMATCH', identity);
-    }
-    let content;
-    try {
-        content = fs.readFileSync(artifactPath, 'utf8');
-    }
-    catch {
-        return item('LFAI-CONSUMED', taskId, filePath, 'protected', 'ARTIFACT_UNREADABLE', identity);
-    }
-    if (intent.finalArtifactSha256 !== sha256Content(content) || intent.finalSemanticDigest !== semanticDigest(content)) {
-        return item('LFAI-CONSUMED', taskId, filePath, 'protected', 'ARTIFACT_DIGEST_MISMATCH', identity);
-    }
-    const receiptReason = receiptGate(repoRoot, task, options);
-    if (receiptReason)
-        return item('LFAI-CONSUMED', taskId, filePath, 'protected', receiptReason, identity);
-    return item('LFAI-CONSUMED', taskId, filePath, 'planned', 'LFAI_CONSUMED_AND_VERIFIED', identity);
-}
 function commitIntentCandidate(repoRoot, task, filePath, taskId, identity, options) {
     const protectedReason = taskGate(task);
     if (protectedReason)
@@ -209,24 +162,13 @@ function readAuxiliaryCandidates(repoRoot, tasks, options) {
                 candidates.push(item('AUXILIARY-UNKNOWN', null, filePath, 'protected', 'PATH_IDENTITY_MISMATCH'));
                 continue;
             }
-            if (rootName === '.local-artifact-finalization-intents') {
-                const match = LOCAL_INTENT_RE.exec(entry.name);
-                if (!match || (selected && !selected.has(match[1]))) {
-                    if (!selected || !match)
-                        candidates.push(item('AUXILIARY-UNKNOWN', null, filePath, 'protected', 'PATH_IDENTITY_MISMATCH', identity));
-                    continue;
-                }
-                candidates.push(localIntentCandidate(repoRoot, tasks.get(match[1]), filePath, match[1], match[2], match[3], identity, options));
-            }
-            else {
-                const match = COMMIT_INTENT_RE.exec(entry.name);
-                if (!match || (selected && !selected.has(match[1]))) {
-                    if (!selected || !match)
-                        candidates.push(item('AUXILIARY-UNKNOWN', null, filePath, 'protected', 'PATH_IDENTITY_MISMATCH', identity));
-                    continue;
-                }
-                candidates.push(commitIntentCandidate(repoRoot, tasks.get(match[1]), filePath, match[1], identity, options));
+            const match = COMMIT_INTENT_RE.exec(entry.name);
+            if (!match || (selected && !selected.has(match[1]))) {
+                if (!selected || !match)
+                    candidates.push(item('AUXILIARY-UNKNOWN', null, filePath, 'protected', 'PATH_IDENTITY_MISMATCH', identity));
+                continue;
             }
+            candidates.push(commitIntentCandidate(repoRoot, tasks.get(match[1]), filePath, match[1], identity, options));
         }
         if (entries.length === 0) {
             candidates.push(item('EMPTY-AUX-PARENT', null, root, 'planned', 'EMPTY_CANONICAL_AUXILIARY_ROOT', rootIdentity));
@@ -255,85 +197,7 @@ function scanIntermediateCleanup(repoRoot, options = {}) {
     const candidates = scanInternal(repoRoot, options);
     return buildIntermediateCleanupReport(candidates, true);
 }
-function cleanupConsumedRecoveryFiles(repoRoot, task, candidate) {
-    if (candidate.kind !== 'LFAI-CONSUMED' || !candidate.taskId)
-        return true;
-    if (!task)
-        return false;
-    const match = LOCAL_INTENT_RE.exec(path.basename(candidate.path));
-    if (!match)
-        return false;
-    let intent;
-    try {
-        intent = readArtifactRecoveryIntent(repoRoot, candidate.taskId, match[2], match[3]);
-    }
-    catch {
-        return false;
-    }
-    if (!intent || intent.state !== 'consumed')
-        return false;
-    const recovery = artifactRecoveryRoot(task.taskDir, intent.recoveryOperationId);
-    let stat = null;
-    try {
-        stat = fs.lstatSync(recovery);
-    }
-    catch (error) {
-        if (errorCode(error) === 'ENOENT')
-            return true;
-        return false;
-    }
-    if (!stat.isDirectory() || stat.isSymbolicLink())
-        return false;
-    let entries;
-    try {
-        entries = fs.readdirSync(recovery, { withFileTypes: true });
-    }
-    catch {
-        return false;
-    }
-    for (const entry of entries) {
-        if (entry.isSymbolicLink())
-            return false;
-        if (entry.isFile()) {
-            if (!['baseline.md', 'candidate.md', 'final.md', 'publish.md'].includes(entry.name))
-                return false;
-            continue;
-        }
-        if (!entry.isDirectory() || entry.name !== 'generations')
-            return false;
-        let generations;
-        try {
-            generations = fs.readdirSync(path.join(recovery, entry.name), { withFileTypes: true });
-        }
-        catch {
-            return false;
-        }
-        if (generations.some((generation) => generation.isSymbolicLink()
-            || !generation.isFile() || !/^[a-f0-9]{64}\.md$/u.test(generation.name)))
-            return false;
-    }
-    try {
-        for (const entry of entries) {
-            const target = path.join(recovery, entry.name);
-            if (entry.isFile())
-                fs.unlinkSync(target);
-            else {
-                for (const generation of fs.readdirSync(target, { withFileTypes: true }))
-                    fs.unlinkSync(path.join(target, generation.name));
-                fs.rmdirSync(target);
-            }
-        }
-        fs.rmdirSync(recovery);
-        const recoveryRoot = path.dirname(recovery);
-        if (fs.readdirSync(recoveryRoot).length === 0)
-            fs.rmdirSync(recoveryRoot);
-        return true;
-    }
-    catch (error) {
-        return errorCode(error) === 'ENOENT';
-    }
-}
-function removeCandidate(repoRoot, candidate, task) {
+function removeCandidate(repoRoot, candidate) {
     if (candidate.disposition !== 'planned')
         return candidate;
     const root = candidate.kind === 'EMPTY-AUX-PARENT'
@@ -358,9 +222,6 @@ function removeCandidate(repoRoot, candidate, task) {
         return { ...candidate, disposition: 'protected', reason: 'PATH_IDENTITY_CHANGED' };
     if (!sameFileIdentity(expected, actual))
         return { ...candidate, disposition: 'protected', reason: 'PATH_IDENTITY_CHANGED' };
-    if (!cleanupConsumedRecoveryFiles(repoRoot, task, candidate)) {
-        return { ...candidate, disposition: 'protected', reason: 'RECOVERY_STAGING_NOT_SAFE_TO_REMOVE' };
-    }
     try {
         if (candidate.kind === 'EMPTY-AUX-PARENT') {
             if (fs.readdirSync(candidate.path).length !== 0)
@@ -413,7 +274,7 @@ function cleanupIntermediateUnderRemovalCoordinator(repoRoot, options = {}) {
                     continue;
                 const current = refreshedByKey.get(intermediateCleanupKey(initialCandidate));
                 items[index] = current
-                    ? removeCandidate(repoRoot, current, tasks.get(taskId))
+                    ? removeCandidate(repoRoot, current)
                     : { ...initialCandidate, disposition: 'protected', reason: 'CANDIDATE_NO_LONGER_ELIGIBLE' };
             }
         };

package/dist/lib/task/ledger-intents.js

@@ -6,7 +6,6 @@ import { parseArtifactName } from './artifact-name.js';
 import { LEDGER_COLUMNS, LEDGER_HEADINGS, LEDGER_SECTION_MISSING_CODE, LEDGER_SECTION_MISSING_MESSAGE, nextHdId, parseLedgerDocument, validateLedgerRows } from './ledger.js';
 import { resolveTaskRef } from './resolve-ref.js';
 import { writeTask } from './write.js';
-import { allowsManualOverride } from './guard-override.js';
 import { parseLegacyReworkIntentDocument, parseReworkIntentDocument, reworkIntentMutation, upsertReworkIntent } from './rework-intent.js';
 import { extractSection, extractSubSection } from './sections.js';
 import { parseLifecyclePathDecision } from './lifecycle-path.js';
@@ -105,8 +104,7 @@ function applyLedgerIntent(intent, options = {}) {
     const resolved = resolveTaskRef(intent.taskRef, { repoRoot: options.repoRoot });
     if (!resolved.ok)
         return failed(intent, resolved.code, resolved.message, resolved.taskId);
-    const stateOverride = allowsManualOverride(options.manualOverride, 'ledger-intent', 'TASK_STATE_MISMATCH');
-    if (resolved.state !== 'active' && !stateOverride)
+    if (resolved.state !== 'active')
         return failed(intent, 'TASK_STATE_MISMATCH', `task ${resolved.taskId} is ${resolved.state}, expected active`, resolved.taskId);
     let content;
     let rows;
@@ -341,8 +339,7 @@ function applyLedgerIntent(intent, options = {}) {
                         ? new Set(['confirmed', 'open', 'needs-human-decision'])
                         : before.status === 'cannot-judge' ? new Set(['open', 'needs-human-decision']) : new Set();
                 const sameRoundMinorClose = before.status === 'open' && before.severity === 'minor' && intent.status === 'closed';
-                if ((!sameRoundMinorClose && !allowed.has(intent.status))
-                    && !allowsManualOverride(options.manualOverride, 'ledger-intent', 'LEDGER_TRANSITION_INVALID')) {
+                if (!sameRoundMinorClose && !allowed.has(intent.status)) {
                     return failed(intent, 'LEDGER_TRANSITION_INVALID', `finding '${intent.id}' cannot transition from ${before.status} to ${intent.status}`, resolved.taskId, intent.id);
                 }
                 after = { ...before, status: intent.status, evidence };
@@ -375,7 +372,7 @@ function applyLedgerIntent(intent, options = {}) {
         }
     }
     const result = writeTask({
-        taskRef: intent.taskRef, expectedState: stateOverride ? resolved.state : 'active',
+        taskRef: intent.taskRef, expectedState: 'active',
         mutations: [rowMutation(after), ...(implementationMutation ? [implementationMutation] : [])],
         dryRun: 'dryRun' in intent ? intent.dryRun : false
     }, { ...options, taskLocation: { repoRoot: resolved.repoRoot, taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, state: resolved.state } });

package/dist/lib/task/lifecycle.js

@@ -43,9 +43,6 @@ const lifecycleProducerCatalog = lifecycleFailureCatalog.map((code) => ({
     guardId: 'G-03',
     code
 }));
-function allowsManualOverride(options, code) {
-    return options.manualOverride?.failureId === `lifecycle.apply:${code}`;
-}
 const STEPS = ['task-written', 'directory-moved', 'registry-committed'];
 const DEFAULT_IO = {
     renameSync: (source, target) => fs.renameSync(source, target),
@@ -320,6 +317,49 @@ export function readLifecycleJournalEvidence(repoRoot, taskId) {
         return { exists: true, completedSteps: [], failure: 'SANDBOX_CONTROL_LIFECYCLE_JOURNAL_INVALID' };
     }
 }
+export function inspectTaskLifecycleProgress(repoRoot, taskId, agent) {
+    try {
+        const hot = locateHotTaskDirs(repoRoot, taskId);
+        if (hot.length !== 1 || (hot[0].state !== 'active' && hot[0].state !== 'completed'))
+            return 'unknown';
+        const { state, taskDir } = hot[0];
+        const content = fs.readFileSync(path.join(taskDir, 'task.md'), 'utf8');
+        const frontmatter = parseTypedTaskFrontmatter(content);
+        if (frontmatter.id !== taskId)
+            return 'unknown';
+        const journalPath = path.join(taskDir, '.task-lifecycle.json');
+        if (!fs.existsSync(journalPath)) {
+            if (state === 'active')
+                return frontmatter.status === 'active' ? 'not-started' : 'unknown';
+            return matchingCompletion(content, { taskRef: taskId, intent: 'complete', agent })
+                ? 'started-recoverable' : 'unknown';
+        }
+        const journal = parseJournal(fs.readFileSync(journalPath, 'utf8'));
+        const request = { taskRef: taskId, intent: 'complete', agent };
+        if (journal.taskId !== taskId || journal.intent !== 'complete'
+            || journal.intentDigest !== intentIdentity(request, taskId)
+            || journal.sourceState !== 'active' || journal.targetState !== 'completed')
+            return 'unknown';
+        if (journal.completedSteps.some((step, index) => STEPS[index] !== step))
+            return 'unknown';
+        const directoryMoved = journal.completedSteps.includes('directory-moved');
+        const registryCommitted = journal.completedSteps.includes('registry-committed');
+        const hasShortId = loadShortIdByTaskId(repoRoot).has(taskId);
+        if (state === 'active' && (directoryMoved || !hasShortId))
+            return 'unknown';
+        if (state === 'completed' && (!journal.completedSteps.includes('task-written')
+            || !matchingCompletion(content, request) || (registryCommitted && hasShortId)))
+            return 'unknown';
+        if (frontmatter.status !== state
+            && !(state === 'active' && frontmatter.status === 'completed' && matchingCompletion(content, request))) {
+            return 'unknown';
+        }
+        return 'started-recoverable';
+    }
+    catch {
+        return 'unknown';
+    }
+}
 function directoryManifest(root) {
     const entries = [];
     const visit = (current, relative = '') => {
@@ -440,7 +480,7 @@ function applyTaskLifecycle(requestInput, options = {}) {
         }
         return failed(request, { code: 'LIFECYCLE_INTENT_CONFLICT', message: `task ${taskId} is already ${spec.target} with a different lifecycle intent` }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
     }
-    if (!spec.sources.includes(sourceState) && !existingJournal && !allowsManualOverride(options, 'LIFECYCLE_SOURCE_INVALID')) {
+    if (!spec.sources.includes(sourceState) && !existingJournal) {
         return failed(request, { code: 'LIFECYCLE_SOURCE_INVALID', message: `${request.intent} is not allowed from ${sourceState}` }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
     }
     if (sourcePath !== targetPath && fs.existsSync(targetPath) && !existingJournal) {
@@ -456,7 +496,7 @@ function applyTaskLifecycle(requestInput, options = {}) {
     }
     if (frontmatter.id !== taskId)
         return failed(request, { code: 'LIFECYCLE_IDENTITY_INVALID', message: 'task.md id does not match its lifecycle task id' }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
-    if (!locateActivityLog(content) && !allowsManualOverride(options, 'LIFECYCLE_LOG_MISSING'))
+    if (!locateActivityLog(content))
         return failed(request, { code: 'LIFECYCLE_LOG_MISSING', message: 'task has no unique Activity Log section' }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
     if (spec.target === 'active') {
         const contract = validateCurrentTaskContract(content);
@@ -472,10 +512,10 @@ function applyTaskLifecycle(requestInput, options = {}) {
     }
     const registry = JSON.parse(registryRequest.output || '{"version":1,"ids":{}}');
     const registeredKey = Object.entries(registry.ids).find(([, candidate]) => candidate === taskId)?.[0];
-    if (spec.registry === 'release' && sourceState === 'active' && !registeredKey && !allowsManualOverride(options, 'LIFECYCLE_SHORT_ID_PRECONDITION')) {
+    if (spec.registry === 'release' && sourceState === 'active' && !registeredKey) {
         return failed(request, { code: 'LIFECYCLE_SHORT_ID_PRECONDITION', message: 'active source has no short-id registry entry' }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
     }
-    if (spec.registry === 'alloc' && !registeredKey && Object.keys(registry.ids).length >= 10 ** configuredShortIdLength(repoRoot) - 1 && !allowsManualOverride(options, 'SHORT_ID_CAPACITY_EXCEEDED')) {
+    if (spec.registry === 'alloc' && !registeredKey && Object.keys(registry.ids).length >= 10 ** configuredShortIdLength(repoRoot) - 1) {
         return failed(request, { code: 'SHORT_ID_CAPACITY_EXCEEDED', message: 'short-id registry has no free slot' }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
     }
     const digest = intentIdentity(request, taskId);
@@ -499,8 +539,7 @@ function applyTaskLifecycle(requestInput, options = {}) {
                 return failed(request, { code: 'LIFECYCLE_JOURNAL_INVALID', message: 'existing lifecycle journal has no durable failure evidence for a read-only probe' }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath, journalPath: initialJournalPath });
             return failed(request, journal.failure, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath, journalPath: initialJournalPath, completedSteps: journal.completedSteps, pendingSteps: STEPS.filter((step) => !journal.completedSteps.includes(step)) });
         }
-        const overrideResumesRecordedFailure = journal.failure && allowsManualOverride(options, journal.failure.code);
-        if (journal.intentDigest !== digest && !overrideResumesRecordedFailure)
+        if (journal.intentDigest !== digest)
             return failed(request, { code: 'LIFECYCLE_INTENT_CONFLICT', message: 'an in-progress lifecycle journal belongs to a different request' }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath, journalPath: initialJournalPath });
     }
     else {
@@ -516,7 +555,7 @@ function applyTaskLifecycle(requestInput, options = {}) {
         }
         journal = { version: 1, taskId, intent: request.intent, intentDigest: digest, sourceState, targetState: spec.target, metadata, completedSteps: [] };
         if (request.dryRun) {
-            const plannedMutations = mutationsFor(request, content, metadata, restoredFiles, allowsManualOverride(options, 'LIFECYCLE_LOG_MISSING'));
+            const plannedMutations = mutationsFor(request, content, metadata, restoredFiles, false);
             if ('code' in plannedMutations)
                 return failed(request, plannedMutations, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
             const taskPlan = writeTask({ taskRef: taskId, expectedState: sourceState === 'blocked' ? 'blocked' : 'active', mutations: plannedMutations, dryRun: true }, {
@@ -558,7 +597,7 @@ function applyTaskLifecycle(requestInput, options = {}) {
         completed.add('task-written');
     if (!completed.has('task-written')) {
         const current = io.readFileSync(path.join(sourcePath, 'task.md'));
-        const mutations = mutationsFor(request, current, journal.metadata, restoredFiles, allowsManualOverride(options, 'LIFECYCLE_LOG_MISSING'));
+        const mutations = mutationsFor(request, current, journal.metadata, restoredFiles, false);
         if ('code' in mutations)
             return failed(request, mutations, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath, journalPath, completedSteps: [...completed], changed: completed.size > 0 });
         const writeResult = writeTask({ taskRef: taskId, expectedState: sourceState === 'blocked' ? 'blocked' : 'active', mutations }, {