@fitlab-ai/agent-infra 0.11.4 → 0.11.6

package/lib/merge.ts

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import crypto from 'node:crypto';
 import { removeDirRecursive } from './remove-dir.ts';
 import { validateCurrentTaskContract } from './task/current-contract.ts';
 
@@ -107,7 +108,7 @@ function extractTitle(content: string): string | null {
 }
 
 function normalizeTaskRecord(taskDir: string, taskFile: string, dateParts: DateParts): TaskRecord {
-  const taskId = path.basename(taskDir);
+  const taskId = path.basename(taskDir) === 'local' ? path.basename(path.dirname(taskDir)) : path.basename(taskDir);
   const content = fs.readFileSync(taskFile, 'utf8');
   const completedAt = extractField(content, 'completed_at');
   const updatedAt = extractField(content, 'updated_at');
@@ -155,7 +156,7 @@ function scanSourceTasks(sourceDir: string): TaskRecord[] {
             continue;
           }
 
-          const taskDir = path.join(dayDir, taskEntry.name);
+          const taskDir = path.join(dayDir, taskEntry.name, 'local');
           const taskFile = path.join(taskDir, 'task.md');
           if (!fs.existsSync(taskFile)) {
             continue;
@@ -251,7 +252,7 @@ function collectArchiveEntries(archiveDir: string): ArchiveManifestEntry[] {
           }
 
           const taskDir = path.join(dayDir, taskEntry.name);
-          const taskFile = path.join(taskDir, 'task.md');
+          const taskFile = path.join(taskDir, 'local', 'task.md');
           const relativePath = `${yearEntry.name}/${monthEntry.name}/${dayEntry.name}/${taskEntry.name}/`;
           let title = taskEntry.name;
           let type = 'unknown';
@@ -624,10 +625,12 @@ function validateSourceRoot(sourceRoot: string): void {
 function validateTaskDirectory(
   sourceRoot: string,
   taskDir: string,
-  seenTaskIds: Map<string, string>
+  seenTaskIds: Map<string, string>,
+  archived = false
 ): void {
   const taskId = path.basename(taskDir);
-  const taskFile = path.join(taskDir, 'task.md');
+  const contentDir = archived ? path.join(taskDir, 'local') : taskDir;
+  const taskFile = path.join(contentDir, 'task.md');
   const taskDirStat = sourcePathStat(sourceRoot, taskDir);
   if (!taskDirStat || !taskDirStat.isDirectory()) {
     invalidSource(`${sourceRelativePath(sourceRoot, taskDir)} must be a directory`);
@@ -646,6 +649,33 @@ function validateTaskDirectory(
     invalidSource(`${sourceRelativePath(sourceRoot, taskFile)} id '${String(contract.metadata.id ?? 'missing')}' does not match directory '${taskId}'`);
   }
   validateTaskTree(sourceRoot, taskDir);
+  if (archived) {
+    for (const entry of fs.readdirSync(taskDir, { withFileTypes: true })) {
+      if (!['local', 'github', 'derived'].includes(entry.name) || !entry.isDirectory()) {
+        invalidSource(`${sourceRelativePath(sourceRoot, path.join(taskDir, entry.name))} is not an allowed archive source directory`);
+      }
+    }
+    validateArchiveSource(sourceRoot, contentDir);
+    const githubDir = path.join(taskDir, 'github');
+    if (fs.existsSync(githubDir)) {
+      for (const capture of fs.readdirSync(githubDir, { withFileTypes: true })) {
+        const captureDir = path.join(githubDir, capture.name);
+        if (!capture.isDirectory() || !/^capture-[A-Za-z0-9._-]+$/.test(capture.name) || !fs.existsSync(path.join(captureDir, 'capture.md'))) {
+          invalidSource(`${sourceRelativePath(sourceRoot, captureDir)} is not a valid GitHub capture`);
+        }
+        validateArchiveSource(sourceRoot, captureDir);
+      }
+    }
+    const derivedDir = path.join(taskDir, 'derived');
+    if (fs.existsSync(derivedDir)) {
+      for (const view of fs.readdirSync(derivedDir, { withFileTypes: true })) {
+        const viewDir = path.join(derivedDir, view.name);
+        if (!view.isDirectory() || !fs.existsSync(path.join(viewDir, 'inputs.md'))) {
+          invalidSource(`${sourceRelativePath(sourceRoot, viewDir)} requires inputs.md`);
+        }
+      }
+    }
+  }
 
   const previousPath = seenTaskIds.get(taskId);
   if (previousPath) {
@@ -654,6 +684,26 @@ function validateTaskDirectory(
   seenTaskIds.set(taskId, sourceRelativePath(sourceRoot, taskDir));
 }
 
+function validateArchiveSource(sourceRoot: string, sourceDir: string): void {
+  const hashFile = path.join(sourceDir, 'contents.sha256');
+  const hashStat = sourcePathStat(sourceRoot, hashFile);
+  if (!hashStat?.isFile()) invalidSource(`${sourceRelativePath(sourceRoot, sourceDir)} requires contents.sha256`);
+  const files: string[] = [];
+  const walk = (dir: string) => {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      const target = path.join(dir, entry.name);
+      if (entry.name === 'manifest.md') invalidSource(`${sourceRelativePath(sourceRoot, target)} is forbidden inside a TASK`);
+      if (entry.isDirectory()) walk(target);
+      else if (entry.isFile() && target !== hashFile) files.push(target);
+    }
+  };
+  walk(sourceDir);
+  const expected = files.sort((a, b) => Buffer.compare(Buffer.from(path.relative(sourceDir, a).split(path.sep).join('/')), Buffer.from(path.relative(sourceDir, b).split(path.sep).join('/'))))
+    .map((file) => `${crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex')}  ${path.relative(sourceDir, file).split(path.sep).join('/')}`);
+  const actual = fs.readFileSync(hashFile, 'utf8').trimEnd().split(/\r?\n/).filter(Boolean);
+  if (JSON.stringify(expected) !== JSON.stringify(actual)) invalidSource(`${sourceRelativePath(sourceRoot, hashFile)} does not match local files`);
+}
+
 function validateMutableSection(
   sourceRoot: string,
   section: MutableSection,
@@ -730,9 +780,6 @@ function validateArchiveSection(
       const monthDir = monthPath;
       for (const dayEntry of fs.readdirSync(monthDir, { withFileTypes: true })) {
         const dayPath = path.join(monthDir, dayEntry.name);
-        if (allowManifest(monthDir, dayEntry)) {
-          continue;
-        }
         const dayStat = sourcePathStat(sourceRoot, dayPath);
         if (!dayStat?.isDirectory() || !/^\d{2}$/.test(dayEntry.name)) {
           invalidSource(`${sourceRelativePath(sourceRoot, dayPath)} is not a DD directory or manifest.md`);
@@ -745,7 +792,7 @@ function validateArchiveSection(
           if (!taskStat?.isDirectory() || !TASK_ID_RE.test(taskEntry.name)) {
             invalidSource(`${sourceRelativePath(sourceRoot, taskPath)} is not a TASK-YYYYMMDD-HHMMSS directory`);
           }
-          validateTaskDirectory(sourceRoot, taskPath, seenTaskIds);
+          validateTaskDirectory(sourceRoot, taskPath, seenTaskIds, true);
         }
       }
     }
@@ -904,9 +951,10 @@ function mergeArchiveSection(sourceArchive: string, localArchive: string, report
       continue;
     }
 
+    const sourceTaskDir = path.dirname(task.taskDir);
     const destinationDir = path.join(localArchive, task.relativePath);
     fs.mkdirSync(path.dirname(destinationDir), { recursive: true });
-    fs.cpSync(task.taskDir, destinationDir, { recursive: true });
+    fs.cpSync(sourceTaskDir, destinationDir, { recursive: true });
     recordArchive(report, 'copied', {
       action: 'copied',
       symbol: '✓',
@@ -1045,6 +1093,7 @@ async function cmdMerge(args: string[]): Promise<void> {
   const report = createReport(resolvedSource, backupRootRelative);
   detectSourceMode(resolvedSource);
   validateSourceWorkspace(resolvedSource);
+  validateArchiveSection(workspaceDir, new Map());
 
   for (const section of ALL_SECTIONS) {
     fs.mkdirSync(path.join(workspaceDir, section), { recursive: true });

package/lib/platform/github-provider.ts

@@ -923,30 +923,23 @@ function createGitHubOperations(client: GitHubClient): Pick<PlatformProvider, 'i
       if (collected.status === 'failed' || collected.status === 'blocked' || !('pullRequests' in collected)) {
         return { ok: false, error: collected.error || { code: 'RELEASE_NOTES_COLLECTION_FAILED', message: 'Release notes could not be collected', retryable: false } };
       }
-      const mergedPullRequests = collected.pullRequests.map((item: any): ChangeRequestSnapshot => ({
-        id: String(item.number), identity: { kind: 'number', value: Number(item.number) }, number: Number(item.number),
-        state: 'closed', title: String(item.title || ''), body: String(item.body || ''),
+      const mergedPullRequests = collected.pullRequests.map((item: any) => ({
+        id: String(item.number), identity: { kind: 'number' as const, value: Number(item.number) }, number: Number(item.number),
+        title: String(item.title || ''), body: String(item.body || ''),
         mergedAt: new Date(String(item.mergedAt)).toISOString(), displayUrl: String(item.url || ''),
         labels: Array.isArray(item.labels) ? item.labels.map((label: any) => String(label.name || label)) : [],
-        assignees: [], mergeCommitSha: null
-      }));
-      const closingIssues: IssueSnapshot[] = collected.pullRequests.flatMap((item: any) =>
-        Array.isArray(item.closingIssuesReferences) ? item.closingIssuesReferences.map((issue: any) => ({
+        author: item.author,
+        closingIssues: item.closingIssues.map((issue: any) => ({
           id: String(issue.number), identity: { kind: 'number', value: Number(issue.number) }, number: Number(issue.number),
-          state: 'closed' as const, title: String(issue.title || ''), body: '', labels: Array.isArray(issue.labels) ? issue.labels.map((label: any) => String(label.name || label)) : [],
-          assignees: [], milestone: null, fields: {}, displayUrl: String(issue.url || '')
-        })) : []
-      );
-      const actors = [...collected.authors.values()].flatMap((items) => items.map((item: any) => ({
-        ...(item.login ? { id: String(item.login) } : {}), ...(item.name ? { name: String(item.name) } : {})
-      })));
+          title: String(issue.title || ''), displayUrl: String(issue.url || ''), author: issue.author
+        }))
+      }));
       return {
         ok: true,
         value: {
-          history: commitOids.map((sha) => ({ sha, message: '', authoredAt: toTime, author: actors.find((actor) => actor.id) || null })),
+          history: collected.history,
+          commits: collected.commits,
           mergedPullRequests,
-          closingIssues,
-          actors
         }
       };
     }
@@ -1116,7 +1109,7 @@ function createGitHubProvider(
 ): PlatformProvider {
   return {
     type: input.providerType,
-    contractVersion: 1,
+    contractVersion: 2,
     identity: { issue: 'number', 'pull-request': 'number', comment: 'number', release: 'key' },
     ...createGitHubOperations(client),
     context: {

package/lib/platform/github-release-notes.ts

@@ -9,7 +9,6 @@ type GitHubActorInput = {
 
 type ReleaseNoteActor = {
   name: string;
-  email: string | null;
   login: string | null;
   bot: boolean;
   resolution: 'platform-user' | 'platform-noreply' | 'unresolved';
@@ -27,13 +26,23 @@ function normalizeGitHubActor(actor: GitHubActorInput): ReleaseNoteActor {
   const login = platformLogin || noReplyLogin;
   return {
     name,
-    email,
     login,
     bot: Boolean(login?.endsWith('[bot]')),
     resolution: platformLogin ? 'platform-user' : noReplyLogin ? 'platform-noreply' : 'unresolved'
   };
 }
 
+function normalizePlatformAuthor(author: { login?: string | null } | null | undefined): ReleaseNoteActor | null {
+  if (!author) return null;
+  const login = author.login?.trim().toLowerCase() || null;
+  return {
+    name: login || '',
+    login,
+    bot: Boolean(login?.endsWith('[bot]')),
+    resolution: login ? 'platform-user' : 'unresolved'
+  };
+}
+
 function failure(error: { code: string; message: string; retryable: boolean }) {
   return {
     status: error.retryable ? 'blocked' as const : 'failed' as const,
@@ -89,7 +98,7 @@ function fetchGitHubReleaseNoteData(
     { cwd: options.cwd }
   );
   if (!releases.ok) return failure(releases.error);
-  const history = [];
+  const history: Array<{ tag: string; body: string; url: string | null }> = [];
   for (const item of releases.value.filter((entry) => !entry.isDraft && !entry.isPrerelease).slice(0, input.historyLimit)) {
     const viewed = client.json<{ body?: string; url?: string }>(
       ['release', 'view', String(item.tagName), '--repo', input.repository, '--json', 'body,url'],
@@ -99,33 +108,99 @@ function fetchGitHubReleaseNoteData(
     history.push({ tag: String(item.tagName), body: String(viewed.value.body || ''), url: viewed.value.url || null });
   }
   const prs = client.json<Array<Record<string, unknown>>>(
-    ['pr', 'list', '--repo', input.repository, '--state', 'merged', '--base', input.branch, '--limit', '1000', '--json', 'number,title,body,url,mergedAt,labels,author,closingIssuesReferences'],
+    ['pr', 'list', '--repo', input.repository, '--state', 'merged', '--base', input.branch, '--limit', '1000', '--json', 'number,title,body,url,mergedAt,labels,author'],
     { cwd: options.cwd }
   );
   if (!prs.ok) return failure(prs.error);
   const authors = new Map<string, ReleaseNoteActor[]>();
+  const fromTime = Date.parse(input.fromTime);
+  const toTime = Date.parse(input.toTime);
+  const pullRequests = prs.value.filter((item) => {
+    const mergedAt = Date.parse(String(item.mergedAt || ''));
+    return Number.isFinite(mergedAt) && mergedAt > fromTime && mergedAt <= toTime;
+  });
+  const eligiblePullRequestNumbers = new Set(pullRequests.map((item) => Number(item.number)));
+  const pullRequestNumbersByCommit = new Map<string, number[]>();
   for (const oid of input.commitOids) {
-    const query = `query($owner:String!,$name:String!,$oid:GitObjectID!){repository(owner:$owner,name:$name){object(oid:$oid){... on Commit{authors(first:100){nodes{name email user{login}} pageInfo{hasNextPage}}}}}}`;
+    const query = `query($owner:String!,$name:String!,$oid:GitObjectID!){repository(owner:$owner,name:$name){object(oid:$oid){... on Commit{authors(first:100){nodes{name email user{login}} pageInfo{hasNextPage}} associatedPullRequests(first:100){nodes{number} pageInfo{hasNextPage}}}}}}`;
     const [owner, name] = input.repository.split('/');
     const result = client.json<{
-      data?: { repository?: { object?: { authors?: { nodes?: GitHubActorInput[]; pageInfo?: { hasNextPage?: boolean } } } } };
+      data?: { repository?: { object?: {
+        authors?: { nodes?: GitHubActorInput[]; pageInfo?: { hasNextPage?: boolean } };
+        associatedPullRequests?: {
+          nodes?: Array<{ number?: number | null }>;
+          pageInfo?: { hasNextPage?: boolean };
+        };
+      } } };
     }>([
       'api', 'graphql', '-f', `query=${query}`, '-F', `owner=${owner}`, '-F', `name=${name}`, '-F', `oid=${oid}`
     ], { cwd: options.cwd });
     if (!result.ok) return failure(result.error);
-    const connection = result.value.data?.repository?.object?.authors;
+    const object = result.value.data?.repository?.object;
+    const connection = object?.authors;
     if (connection?.pageInfo?.hasNextPage) {
       return failure({ code: 'RELEASE_NOTES_AUTHORS_TRUNCATED', message: `Commit authors exceeded the supported page size for ${oid}`, retryable: false });
     }
     authors.set(oid, (connection?.nodes || []).map(normalizeGitHubActor));
+    const associatedPullRequests = object?.associatedPullRequests;
+    if (!associatedPullRequests || !Array.isArray(associatedPullRequests.nodes) || !associatedPullRequests.pageInfo || typeof associatedPullRequests.pageInfo.hasNextPage !== 'boolean') {
+      return failure({ code: 'INVALID_PLATFORM_RESPONSE', message: `Associated pull request data is incomplete for commit ${oid}`, retryable: false });
+    }
+    if (associatedPullRequests.pageInfo.hasNextPage) {
+      return failure({ code: 'RELEASE_NOTES_ASSOCIATED_PULL_REQUESTS_TRUNCATED', message: `Associated pull requests exceeded the supported page size for ${oid}`, retryable: false });
+    }
+    const numbers: number[] = [];
+    for (const association of associatedPullRequests.nodes) {
+      if (typeof association?.number !== 'number' || !Number.isSafeInteger(association.number)) {
+        return failure({ code: 'INVALID_PLATFORM_RESPONSE', message: `Associated pull request identity is incomplete for commit ${oid}`, retryable: false });
+      }
+      if (eligiblePullRequestNumbers.has(association.number)) numbers.push(association.number);
+    }
+    pullRequestNumbersByCommit.set(oid, [...new Set(numbers)]);
   }
-  const fromTime = Date.parse(input.fromTime);
-  const toTime = Date.parse(input.toTime);
-  const pullRequests = prs.value.filter((item) => {
-    const mergedAt = Date.parse(String(item.mergedAt || ''));
-    return Number.isFinite(mergedAt) && mergedAt > fromTime && mergedAt <= toTime;
-  });
-  return { status: 'no-op' as const, changed: false, history, pullRequests, authors, error: null };
+  const resolvedPullRequests = [];
+  const [owner, name] = input.repository.split('/');
+  const closingIssuesQuery = 'query($owner:String!,$name:String!,$number:Int!,$cursor:String){repository(owner:$owner,name:$name){pullRequest(number:$number){closingIssuesReferences(first:100,after:$cursor){nodes{number title url author{login}} pageInfo{hasNextPage endCursor}}}}}';
+  for (const item of pullRequests) {
+    const closingIssues = [];
+    let cursor: string | null = null;
+    for (;;) {
+      const args = ['api', 'graphql', '-f', `query=${closingIssuesQuery}`, '-F', `owner=${owner}`, '-F', `name=${name}`, '-F', `number=${String(item.number)}`];
+      if (cursor) args.push('-F', `cursor=${cursor}`);
+      const response = client.json<{
+        data?: { repository?: { pullRequest?: { closingIssuesReferences?: {
+          nodes?: Array<{ number?: number; title?: string; url?: string; author?: { login?: string | null } | null }>;
+          pageInfo?: { hasNextPage?: boolean; endCursor?: string | null };
+        } } } };
+      }>(args, { cwd: options.cwd });
+      if (!response.ok) return failure(response.error);
+      const connection = response.value.data?.repository?.pullRequest?.closingIssuesReferences;
+      if (!connection || !Array.isArray(connection.nodes) || !connection.pageInfo || typeof connection.pageInfo.hasNextPage !== 'boolean') {
+        return failure({ code: 'INVALID_PLATFORM_RESPONSE', message: `Closing Issue data is incomplete for pull request ${String(item.number)}`, retryable: false });
+      }
+      closingIssues.push(...connection.nodes.map((issue) => ({
+        number: Number(issue.number), title: String(issue.title || ''), url: String(issue.url || ''),
+        author: normalizePlatformAuthor(issue.author)
+      })));
+      if (!connection.pageInfo.hasNextPage) break;
+      if (!connection.pageInfo.endCursor || connection.pageInfo.endCursor === cursor) {
+        return failure({ code: 'PAGINATION_INVALID', message: `Closing Issue pagination is incomplete for pull request ${String(item.number)}`, retryable: false });
+      }
+      cursor = connection.pageInfo.endCursor;
+    }
+    resolvedPullRequests.push({
+      ...item,
+      author: normalizePlatformAuthor((item.author as { login?: string | null } | null) || null),
+      closingIssues
+    });
+  }
+  const commits = input.commitOids.map((sha) => ({
+    sha,
+    url: `https://github.com/${input.repository}/commit/${sha}`,
+    pullRequestNumbers: pullRequestNumbersByCommit.get(sha) || [],
+    authors: authors.get(sha) || []
+  }));
+  return { status: 'no-op' as const, changed: false, history, pullRequests: resolvedPullRequests, commits, error: null };
 }
 
 export { fetchGitHubReleaseNoteData, normalizeGitHubActor, publishGitHubReleaseNotes };

package/lib/platform/none-provider.ts

@@ -8,7 +8,7 @@ import type {
 function createNoneProvider(input: PlatformProviderFactoryInput): PlatformProvider {
   return {
     type: input.providerType,
-    contractVersion: 1,
+    contractVersion: 2,
     context: {
       async resolve(): Promise<ProviderResult<PlatformContextSnapshot>> {
         return {

package/lib/platform/pr-summary.ts

@@ -3,7 +3,6 @@ import path from 'node:path';
 
 import { enumerateArtifacts } from '../task/artifacts.ts';
 import { parseTypedTaskFrontmatter } from '../task/frontmatter.ts';
-import { renderHumanOverrideAudit } from '../task/human-override.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.ts';
 import { readPrDeliveryFact } from '../task/pr-delivery-fact.ts';
@@ -11,7 +10,7 @@ import type { PrDeliveryFact } from '../task/pr-delivery-fact.ts';
 import { resolvePlatformProviderContext } from './context.ts';
 import type { LoadedContext, PlatformClient } from './context.ts';
 import { normalizeCommentContent } from './issue-comments.ts';
-import { CONTROL_MARKER_PATTERN, escapeHtmlText, sanitizeMarkdownDocument, splitDocumentPlaceholder } from './comment-safety.ts';
+import { CONTROL_MARKER_PATTERN, sanitizeMarkdownDocument, splitDocumentPlaceholder } from './comment-safety.ts';
 import { platformResult } from './types.ts';
 import type { PlatformResult } from './types.ts';
 import type { OperationWarning } from '../task/operation-outcome.ts';
@@ -74,25 +73,6 @@ function summaryMarker(taskId: string): string {
   return `<!-- sync-pr:${taskId}:summary -->`;
 }
 
-function escapeSummaryAuditText(value: string): string {
-  return escapeHtmlText(value).replace(/\r\n?/g, '\n');
-}
-
-function renderSummaryAuditLine(value: string): string {
-  const safe = escapeSummaryAuditText(value);
-  const longestRun = Math.max(0, ...(safe.match(/`+/g) || []).map((run) => run.length));
-  const delimiter = '`'.repeat(longestRun + 1);
-  return `${delimiter} ${safe} ${delimiter}`;
-}
-
-function renderSafeHumanOverrideAudit(value: string): string {
-  const normalized = value.trim().replace(/\r\n?/g, '\n');
-  if (!normalized) return '';
-  const [heading, ...rows] = normalized.split('\n');
-  const safeHeading = heading === '## Human Override Audit' ? heading : renderSummaryAuditLine(heading || '');
-  return [safeHeading, ...rows.map((row) => row ? renderSummaryAuditLine(row) : '')].join('\n');
-}
-
 function isSafeSummaryEnvelope(value: string, taskId: string): boolean {
   return value.includes(summaryMarker(taskId))
     && (value.match(/<!--\s*sync-pr:/gi) || []).length === 1
@@ -136,9 +116,8 @@ function platformError(error: { code: string; message: string; retryable?: boole
   return { code: error.code, message: error.message, retryable: error.retryable ?? false };
 }
 
-function buildPullRequestSummary(taskId: string, body: string, headSha: string, humanOverrideAudit = ''): string {
-  const sections = [body.replace(/\s+$/, ''), renderSafeHumanOverrideAudit(humanOverrideAudit)].filter(Boolean).join('\n\n');
-  return normalizeCommentContent(`${summaryMarker(taskId)}\n<!-- last-commit: ${headSha} -->\n\n${sections}\n`);
+function buildPullRequestSummary(taskId: string, body: string, headSha: string): string {
+  return normalizeCommentContent(`${summaryMarker(taskId)}\n<!-- last-commit: ${headSha} -->\n\n${body.replace(/\s+$/, '')}\n`);
 }
 
 function reconcileSummaryComment(comments: SummaryComment[], taskId: string, desired: string):
@@ -643,7 +622,7 @@ async function syncPullRequestSummary(
           `<!-- manual-validation-receipt: transaction=${manual.transactionId}; receipt=${manual.receiptDigest}; evidence=${manualEvidenceDigest}; head=${manual.prHeadSha} -->`
         )
         : replaced.value;
-      const desired = buildPullRequestSummary(resolved.taskId, renderedBody, initial.value.head.sha, renderHumanOverrideAudit(taskContent));
+      const desired = buildPullRequestSummary(resolved.taskId, renderedBody, initial.value.head.sha);
       if (!isSafeSummaryEnvelope(desired, resolved.taskId)) return fail('failed', context, {
         code: 'PR_SUMMARY_RENDER_INVALID',
         message: 'Summary contains an invalid or duplicated reserved control marker',

package/lib/platform/provider-contract.ts

@@ -221,16 +221,39 @@ type RepositoryMetadataSnapshot = {
   }>;
 };
 
+type ReleaseNoteAuthor = {
+  name: string;
+  login: string | null;
+  bot: boolean;
+  resolution: 'platform-user' | 'platform-noreply' | 'unresolved';
+};
+
+type ReleaseNoteIssue = {
+  id: string;
+  identity: ResourceIdentity;
+  number: number;
+  title: string;
+  displayUrl: string;
+  author: ReleaseNoteAuthor | null;
+};
+
+type ReleaseNotePullRequest = {
+  id: string;
+  identity: ResourceIdentity;
+  number: number;
+  title: string;
+  body: string;
+  mergedAt: string;
+  displayUrl: string;
+  labels: string[];
+  author: ReleaseNoteAuthor | null;
+  closingIssues: ReleaseNoteIssue[];
+};
+
 type ReleaseNotesFacts = {
-  history: Array<{
-    sha: string;
-    message: string;
-    authoredAt: string;
-    author: { id?: string; name?: string } | null;
-  }>;
-  mergedPullRequests: Array<ChangeRequestSnapshot>;
-  closingIssues: Array<IssueSnapshot>;
-  actors: Array<{ id?: string; name?: string }>;
+  history: Array<{ tag: string; body: string; url: string | null }>;
+  commits: Array<{ sha: string; url: string | null; pullRequestNumbers: number[]; authors: ReleaseNoteAuthor[] }>;
+  mergedPullRequests: ReleaseNotePullRequest[];
 };
 
 type MilestoneReconciliation = {
@@ -249,14 +272,14 @@ type VerificationRemoteFacts = {
 
 type PlatformProviderFactoryInput = {
   providerType: string;
-  contractVersion: 1;
+  contractVersion: 2;
   repositoryRoot: string;
   config: Readonly<Record<string, JsonValue>>;
 };
 
 type PlatformProvider = {
   type: string;
-  contractVersion: 1;
+  contractVersion: 2;
   identity?: ProviderIdentityDeclaration;
   context: {
     resolve(input: {
@@ -466,7 +489,7 @@ type PlatformProviderFactory = (
   input: PlatformProviderFactoryInput
 ) => Promise<PlatformProvider>;
 
-const PLATFORM_PROVIDER_CONTRACT_VERSION = 1 as const;
+const PLATFORM_PROVIDER_CONTRACT_VERSION = 2 as const;
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
@@ -605,6 +628,9 @@ export type {
   RequiredCheckSnapshot,
   RepositoryMetadataSnapshot,
   ReleaseNotesFacts,
+  ReleaseNoteAuthor,
+  ReleaseNoteIssue,
+  ReleaseNotePullRequest,
   ResourceIdentity,
   SecurityAlertKind,
   SecurityAlertSnapshot,

package/lib/platform/provider-validation.ts

@@ -16,6 +16,8 @@ import type {
   PlatformError,
   PlatformProvider,
   ProviderResult,
+  ReleaseNoteAuthor,
+  ReleaseNoteIssue,
   ReleaseNotesFacts,
   ReleaseSnapshot,
   RemoteCommentSnapshot,
@@ -109,6 +111,15 @@ function arrayValue(value: unknown, label: string): unknown[] {
   return value;
 }
 
+function positiveNumberValue(value: unknown, label: string): number {
+  if (!Number.isSafeInteger(value) || Number(value) <= 0) throw new Error(`${label} must be a positive integer`);
+  return Number(value);
+}
+
+function stringArray(value: unknown, label: string): string[] {
+  return arrayValue(value, label).map((entry, index) => stringValue(entry, `${label}[${index}]`));
+}
+
 function stableUnique<T>(values: T[], key: (value: T) => string, label: string): T[] {
   const seen = new Set<string>();
   for (const value of values) {
@@ -119,6 +130,16 @@ function stableUnique<T>(values: T[], key: (value: T) => string, label: string):
   return [...values].sort((left, right) => key(left).localeCompare(key(right)));
 }
 
+function uniqueInOrder<T>(values: T[], key: (value: T) => string, label: string): T[] {
+  const seen = new Set<string>();
+  for (const value of values) {
+    const identityKey = key(value);
+    if (seen.has(identityKey)) throw new Error(`${label} contains duplicate identities`);
+    seen.add(identityKey);
+  }
+  return values;
+}
+
 function declaredIdentityKind(
   declaration: ProviderIdentityDeclaration | undefined,
   resourceKind: 'issue' | 'pull-request' | 'comment' | 'release'
@@ -389,20 +410,70 @@ function validateMetadata(value: unknown): RepositoryMetadataSnapshot {
 
 function validateReleaseNotes(value: unknown, declaration?: ProviderIdentityDeclaration): ReleaseNotesFacts {
   const item = record(value, 'release notes');
-  exactKeys(item, ['history', 'mergedPullRequests', 'closingIssues', 'actors'], 'release notes');
+  exactKeys(item, ['history', 'commits', 'mergedPullRequests'], 'release notes');
+  const releaseAuthor = (raw: unknown, label: string): ReleaseNoteAuthor | null => {
+    if (raw === null) return null;
+    const entry = record(raw, label);
+    exactKeys(entry, ['name', 'login', 'bot', 'resolution'], label);
+    if (typeof entry.bot !== 'boolean') throw new Error(`${label}.bot must be boolean`);
+    if (!['platform-user', 'platform-noreply', 'unresolved'].includes(String(entry.resolution))) {
+      throw new Error(`${label}.resolution is invalid`);
+    }
+    return {
+      name: stringValue(entry.name, `${label}.name`, true),
+      login: nullableString(entry.login, `${label}.login`),
+      bot: entry.bot,
+      resolution: entry.resolution as ReleaseNoteAuthor['resolution']
+    };
+  };
+  const issue = (raw: unknown, label: string): ReleaseNoteIssue => {
+    const entry = record(raw, label);
+    exactKeys(entry, ['id', 'identity', 'number', 'title', 'displayUrl', 'author'], label);
+    return {
+      id: stringValue(entry.id, `${label}.id`),
+      identity: identity(entry.identity, `${label}.identity`, declaredIdentityKind(declaration, 'issue')),
+      number: positiveNumberValue(entry.number, `${label}.number`),
+      title: stringValue(entry.title, `${label}.title`, true),
+      displayUrl: stringValue(entry.displayUrl, `${label}.displayUrl`, true),
+      author: releaseAuthor(entry.author, `${label}.author`)
+    };
+  };
   return {
-    history: stableUnique(arrayValue(item.history, 'release notes.history').map((raw) => {
+    history: uniqueInOrder(arrayValue(item.history, 'release notes.history').map((raw) => {
       const entry = record(raw, 'release notes.history[]');
-      exactKeys(entry, ['sha', 'message', 'authoredAt', 'author'], 'release notes.history[]');
-      return { sha: stringValue(entry.sha, 'history.sha'), message: stringValue(entry.message, 'history.message', true), authoredAt: utcTimestamp(entry.authoredAt, 'history.authoredAt'), author: author(entry.author, 'history.author') };
-    }), (entry) => entry.sha, 'release notes.history'),
-    mergedPullRequests: stableUnique(arrayValue(item.mergedPullRequests, 'release notes.mergedPullRequests').map((entry) => validateChangeRequest(entry, declaredIdentityKind(declaration, 'pull-request'), true)), (entry) => serializeResourceIdentity(entry.identity!), 'release notes.mergedPullRequests'),
-    closingIssues: stableUnique(arrayValue(item.closingIssues, 'release notes.closingIssues').map((entry) => validateIssue(entry, declaredIdentityKind(declaration, 'issue'), true)), (entry) => serializeResourceIdentity(entry.identity!), 'release notes.closingIssues'),
-    actors: stableUnique(arrayValue(item.actors, 'release notes.actors').map((entry) => {
-      const actor = author(entry, 'release notes.actor');
-      if (!actor) throw new Error('release notes.actor must identify an actor');
-      return actor;
-    }), (entry) => entry.id || entry.name || '', 'release notes.actors')
+      exactKeys(entry, ['tag', 'body', 'url'], 'release notes.history[]');
+      return { tag: stringValue(entry.tag, 'history.tag'), body: stringValue(entry.body, 'history.body', true), url: nullableString(entry.url, 'history.url') };
+    }), (entry) => entry.tag, 'release notes.history'),
+    commits: stableUnique(arrayValue(item.commits, 'release notes.commits').map((raw) => {
+      const entry = record(raw, 'release notes.commits[]');
+      exactKeys(entry, ['sha', 'url', 'pullRequestNumbers', 'authors'], 'release notes.commits[]');
+      return {
+        sha: stringValue(entry.sha, 'commits.sha'),
+        url: nullableString(entry.url, 'commits.url'),
+        pullRequestNumbers: stableUnique(arrayValue(entry.pullRequestNumbers, 'commits.pullRequestNumbers').map((number) => positiveNumberValue(number, 'commits.pullRequestNumbers[]')), (number) => String(number), 'commits.pullRequestNumbers'),
+        authors: arrayValue(entry.authors, 'commits.authors').map((rawAuthor) => {
+          const normalized = releaseAuthor(rawAuthor, 'commits.author');
+          if (!normalized) throw new Error('commits.author must identify an author');
+          return normalized;
+        })
+      };
+    }), (entry) => entry.sha, 'release notes.commits'),
+    mergedPullRequests: stableUnique(arrayValue(item.mergedPullRequests, 'release notes.mergedPullRequests').map((raw) => {
+      const entry = record(raw, 'release notes.mergedPullRequests[]');
+      exactKeys(entry, ['id', 'identity', 'number', 'title', 'body', 'mergedAt', 'displayUrl', 'labels', 'author', 'closingIssues'], 'release notes.mergedPullRequests[]');
+      return {
+        id: stringValue(entry.id, 'pullRequest.id'),
+        identity: identity(entry.identity, 'pullRequest.identity', declaredIdentityKind(declaration, 'pull-request')),
+        number: positiveNumberValue(entry.number, 'pullRequest.number'),
+        title: stringValue(entry.title, 'pullRequest.title', true),
+        body: stringValue(entry.body, 'pullRequest.body', true),
+        mergedAt: utcTimestamp(entry.mergedAt, 'pullRequest.mergedAt'),
+        displayUrl: stringValue(entry.displayUrl, 'pullRequest.displayUrl', true),
+        labels: stringArray(entry.labels, 'pullRequest.labels'),
+        author: releaseAuthor(entry.author, 'pullRequest.author'),
+        closingIssues: stableUnique(arrayValue(entry.closingIssues, 'pullRequest.closingIssues').map((entry) => issue(entry, 'pullRequest.closingIssues[]')), (entry) => serializeResourceIdentity(entry.identity), 'pullRequest.closingIssues')
+      };
+    }), (entry) => serializeResourceIdentity(entry.identity), 'release notes.mergedPullRequests')
   };
 }