@fitlab-ai/agent-infra 0.11.6 → 0.11.7

package/dist/lib/task/verification-engine.js

@@ -4,14 +4,13 @@ import path from "node:path";
 import process from "node:process";
 import { execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { extractReviewBaseline, extractReviewTargetHead, extractReviewedHead, extractReviewDiffBase, extractReviewDiffFingerprint, extractReviewedSnapshotTree, findAuthoritativeReviewCodeArtifact, loadPostReviewConfig, parseReviewVerdict, resolvePostReviewGlobs } from "./verification-review.js";
+import { extractReviewTargetHead, extractReviewedHead, extractReviewDiffBase, findAuthoritativeReviewCodeArtifact, loadPostReviewConfig, parseReviewVerdict, resolvePostReviewGlobs } from "./verification-review.js";
 import { check as checkPlatformSync } from "../platform/verification-sync.js";
 import { check as checkRequiredChecks } from "../platform/verification-required.js";
 import { inspectPlatformPullRequest } from "../platform/pull-requests.js";
 import { resolveMaterializedReviewedHeadRelation } from "../platform/change-request-git-evidence.js";
 import { resolveReviewedHeadRelation } from "../platform/merged-pr-equivalence.js";
 import { resolveLocalReviewedCommitRelation } from "../git/reviewed-commit-equivalence.js";
-import { resolveBranchWorktree } from "../git/branch-worktree.js";
 import { parseTypedTaskFrontmatter } from "./frontmatter.js";
 import { LEDGER_TERMINAL, LEDGER_SECTION_MISSING_CODE, LEDGER_SECTION_MISSING_MESSAGE, parseLedgerDocument, summarizeLedgerStage, validateLedgerRows } from "./ledger.js";
 import { isValidAgentInfraVersion } from "../version.js";
@@ -20,11 +19,9 @@ import { inspectDecisionDetailDuplicates } from "./decision-details.js";
 import { parseImplementationInputs } from "./implementation-inputs.js";
 import { scanVisibleMarkdown } from "./markdown.js";
 import { loadVerificationConfig } from "./verification-config.js";
-import { snapshotReview } from "../git/review-snapshot.js";
 import { inspectActivityLog } from "./activity-log.js";
 import { parseWorkflowWarnings } from "./workflow-warnings.js";
 import { OrchestrationStateError, readRun } from "./orchestration.js";
-import { resolveDeliveryTarget } from "./delivery-target.js";
 import { readPrDeliveryFact } from "./pr-delivery-fact.js";
 import { validateLocalArtifact } from "./local-artifact-finalization.js";
 import { getArtifactSchema } from "./artifact-schema.js";
@@ -35,6 +32,8 @@ import { readManualValidationCompletion } from "./manual-validation-completion.j
 import { sha256File } from "./artifact-receipts.js";
 import { summaryCommentState } from "../platform/pr-summary.js";
 import { taskIssueIdentity } from "../platform/task-identities.js";
+import { hasArtifactCompletionFact, hasArtifactCompletionLog } from './completion-facts.js';
+import { inspectReviewIdentity } from './review-identity.js';
 const TASK_ENUMS = {
     type: ["feature", "bugfix", "refactor", "docs", "chore"],
     workflow: ["feature-development", "bug-fix", "refactoring"],
@@ -1014,12 +1013,16 @@ function checkReviewFact({ taskDir, artifactFile, repositoryRoot }) {
         return failResult("review-fact", task.message);
     }
     const content = fs.readFileSync(resolvedArtifact.path, "utf8");
+    if (!hasArtifactCompletionFact(task.content, resolvedArtifact.path, 'review-code.completed')) {
+        return failResult("review-fact", `Review Code completion fact does not match ${path.basename(resolvedArtifact.path)}`);
+    }
+    if (!hasArtifactCompletionLog(task.content, path.basename(resolvedArtifact.path), 'review-code.completed')) {
+        return failResult("review-fact", `Review Code completion entry does not reference ${path.basename(resolvedArtifact.path)}`);
+    }
     const verdict = parseReviewVerdict(content);
     const reviewTargetHead = extractReviewTargetHead(content);
     const reviewReviewedHead = extractReviewedHead(content);
     const reviewDiffBase = extractReviewDiffBase(content);
-    const reviewedFingerprint = extractReviewDiffFingerprint(content);
-    const reviewedTree = extractReviewedSnapshotTree(content);
     if (!["通过", "需要修改", "拒绝", "Approved", "Changes Requested", "Rejected"].includes(verdict)) {
         return failResult("review-fact", `Unsupported review verdict '${verdict}'`);
     }
@@ -1031,71 +1034,19 @@ function checkReviewFact({ taskDir, artifactFile, repositoryRoot }) {
     if (!reviewTargetHead || !reviewReviewedHead || !reviewDiffBase) {
         return failResult("review-fact", "Review fact must record target head, reviewed head, and diff base");
     }
-    let gitRoot;
-    let head;
-    let baseline;
-    let targetHead;
-    let diffBase;
-    try {
-        const taskRepositoryRoot = execFileSync("git", ["-C", taskDir, "rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
-        gitRoot = reviewWorktreeForTask(taskRepositoryRoot, String(task.metadata.branch || "").trim()) ?? taskRepositoryRoot;
-        head = execFileSync("git", ["-C", gitRoot, "rev-parse", "HEAD"], { encoding: "utf8" }).trim();
-        const target = resolveDeliveryTarget(gitRoot, { remote: deliveryRemote, baseRef: deliveryBaseRef });
-        if (!target.ok)
-            throw new Error(target.message);
-        const reviewedRef = reviewReviewedHead;
-        baseline = execFileSync("git", ["-C", gitRoot, "rev-parse", `${reviewedRef}^{commit}`], { encoding: "utf8" }).trim();
-        targetHead = execFileSync("git", ["-C", gitRoot, "rev-parse", `${reviewTargetHead}^{commit}`], { encoding: "utf8" }).trim();
-        const computed = execFileSync("git", ["-C", gitRoot, "merge-base", baseline, targetHead], { encoding: "utf8" }).trim();
-        diffBase = execFileSync("git", ["-C", gitRoot, "rev-parse", `${reviewDiffBase}^{commit}`], { encoding: "utf8" }).trim();
-        if (diffBase !== computed)
-            throw new Error('saved review diff base does not match merge-base(reviewed head, target head)');
-    }
-    catch {
-        return blockedResult("review-fact", `Unable to resolve saved review commits in the task repository; re-run review-code`);
-    }
-    if (baseline !== head) {
-        return failResult("review-fact", `Reviewed head ${baseline.slice(0, 8)} does not match current HEAD ${head.slice(0, 8)}; re-run review-code`);
-    }
-    let actualSnapshot;
-    try {
-        actualSnapshot = snapshotReview({
-            cwd: gitRoot,
-            mode: "worktree",
-            baseline,
-            diffBase,
-            globs: resolvePostReviewGlobs({}, loadPostReviewConfig(repositoryRoot))
-        });
-    }
-    catch {
-        return blockedResult("review-fact", `Unable to recompute reviewed diff fingerprint from baseline ${baseline.slice(0, 8)}; re-run review-code`);
-    }
-    if (actualSnapshot.fingerprint !== reviewedFingerprint) {
-        return failResult("review-fact", `Reviewed diff fingerprint does not match the current worktree for baseline ${baseline.slice(0, 8)}; re-run review-code`);
-    }
-    if (!reviewedTree || actualSnapshot.tree !== reviewedTree) {
-        return failResult("review-fact", `Reviewed snapshot tree does not match the current worktree for baseline ${baseline.slice(0, 8)}; re-run review-code`);
+    const identity = inspectReviewIdentity(taskDir, content, repositoryRoot);
+    if (identity.status !== 'matched' || !identity.reviewedHead) {
+        return failResult('review-fact', `Review identity is ${identity.status}: ${identity.message}; re-run review-code`);
     }
+    const baseline = identity.reviewedHead;
     if (["通过", "Approved"].includes(verdict)) {
         const lastReviewedCommit = String(task.metadata.last_reviewed_commit || "").trim();
-        const cleanSnapshot = actualSnapshot.tree === execFileSync("git", ["-C", gitRoot, "rev-parse", `${baseline}^{tree}`], { encoding: "utf8" }).trim();
-        if (cleanSnapshot && lastReviewedCommit !== baseline) {
+        if (lastReviewedCommit !== baseline) {
             return failResult("review-fact", `Approved clean review must set task last_reviewed_commit to reviewed head ${baseline.slice(0, 8)}`);
         }
-        if (!cleanSnapshot && lastReviewedCommit) {
-            return failResult("review-fact", "Approved review with uncommitted changes must remain unanchored until commit");
-        }
     }
     return passResult("review-fact", `Review fact valid for ${path.basename(resolvedArtifact.path)} at ${baseline.slice(0, 8)}`);
 }
-function reviewWorktreeForTask(repositoryRoot, branch) {
-    if (!branch)
-        return null;
-    const worktree = resolveBranchWorktree(repositoryRoot, branch);
-    if (worktree)
-        return worktree;
-    throw new Error(`Task branch '${branch}' is not checked out in a registered worktree`);
-}
 function resolvePostReviewBaseline({ gitRoot, lastReviewedCommit, reviewArtifact }) {
     if (SHA_PATTERN.test(lastReviewedCommit) && gitCommitExists(gitRoot, lastReviewedCommit)) {
         return { ok: true, sha: lastReviewedCommit };

package/dist/lib/task/verification.js

@@ -89,47 +89,44 @@ async function verifyTaskEvent(request, options = {}) {
 function statusLabel(status) {
     return status === 'fail' ? 'FAIL' : status === 'blocked' ? 'BLOCKED' : 'pass';
 }
-function renderPayload(payload) {
-    const lines = [];
-    if (Array.isArray(payload.checks)) {
-        const gateMode = typeof payload.gate === 'string';
-        lines.push(gateMode
-            ? `Verification: ${payload.gate} | Skill: ${payload.skill}`
-            : `Check: ${payload.status} | Skill: ${payload.skill} | Type: ${payload.type}`, '');
-        for (const check of payload.checks) {
-            const raw = statusLabel(check.status);
-            const effective = statusLabel(check.effectiveStatus ?? check.status);
-            const reason = check.reason ?? 'CHECK_FAILED';
-            const message = check.message ?? reason;
-            lines.push(`  [${effective}] ${check.checkId ?? check.type} (${check.classification ?? 'hard'}; raw ${raw}; reason ${reason}) - ${message}; ${check.action ?? 'Review validation output'}`);
-        }
-        const summary = payload.summary ?? (() => {
-            const checks = payload.checks;
-            const statuses = checks.map((check) => check.effectiveStatus ?? check.status);
-            return `${statuses.filter((status) => status === 'pass').length} passed, ${statuses.filter((status) => status === 'fail').length} failed${statuses.includes('blocked') ? `, ${statuses.filter((status) => status === 'blocked').length} blocked` : ''}`;
-        })();
-        lines.push('', `Result: ${summary} - ${payload.action}`);
-    }
-    else {
-        lines.push(`Check: ${payload.status} | Skill: ${payload.skill} | Type: ${payload.type}`, '');
-        const raw = statusLabel(payload.status);
-        const effective = statusLabel(payload.effectiveStatus ?? payload.status);
-        const reason = payload.reason ?? 'CHECK_FAILED';
-        lines.push(`  [${effective}] ${payload.checkId ?? payload.type} (${payload.classification ?? 'hard'}; raw ${raw}; reason ${reason}) - ${payload.message ?? reason}; ${payload.action ?? 'Review validation output'}`);
-        const status = payload.effectiveStatus ?? payload.status;
-        const summary = status === 'pass' ? '1 passed, 0 failed'
-            : status === 'blocked' ? '0 passed, 0 failed, 1 blocked' : '0 passed, 1 failed';
-        const action = status === 'pass' ? 'Requested check passed'
-            : status === 'blocked' ? `Resolve blocked ${payload.type} check and re-run check`
-                : `Fix ${payload.type} issues and re-run check`;
-        lines.push('', `Result: ${summary} - ${action}`);
-    }
-    return `${lines.join('\n')}\n`;
-}
 function renderTaskVerification(result) {
     if (result.status === 'failed')
         return `Verification failed: ${result.error?.code ?? 'VERIFY_FAILED'} - ${result.error?.message ?? 'unknown error'}\n`;
-    return result.invocations.map((invocation) => renderPayload(invocation.payload)).join('');
+    const target = `${result.event}${result.artifact ? ` (${result.artifact})` : ''}`;
+    const lines = [`Verification: ${result.status} | Target: ${target} | Skill: ${result.skill}`];
+    const checks = result.invocations.flatMap(({ payload }) => {
+        if (Array.isArray(payload.checks))
+            return payload.checks;
+        return [payload];
+    });
+    const counts = {
+        pass: checks.filter((check) => (check.effectiveStatus ?? check.status) === 'pass').length,
+        fail: checks.filter((check) => (check.effectiveStatus ?? check.status) === 'fail').length,
+        blocked: checks.filter((check) => (check.effectiveStatus ?? check.status) === 'blocked').length
+    };
+    const summary = `${counts.pass} passed, ${counts.fail} failed${counts.blocked > 0 ? `, ${counts.blocked} blocked` : ''}`;
+    lines.push('', `Result: ${summary}`);
+    for (const check of checks) {
+        const rawStatus = check.status;
+        const effectiveStatus = check.effectiveStatus ?? rawStatus;
+        const isSoftWarning = (rawStatus === 'fail' || rawStatus === 'blocked') && effectiveStatus === 'pass';
+        const reason = check.reason ?? 'CHECK_FAILED';
+        const message = check.message ?? reason;
+        const action = check.action ?? 'Review validation output';
+        const id = check.checkId ?? check.type;
+        const isHumanExemptionNotice = id === 'post-review-commit'
+            && typeof message === 'string'
+            && /\bhuman-decided (?:post-review )?exemption\b/i.test(message)
+            && /\bPRC-\d+\s*:/.test(message);
+        if (effectiveStatus === 'pass' && !isSoftWarning && !isHumanExemptionNotice)
+            continue;
+        lines.push(isSoftWarning
+            ? `Warning: ${id} (${rawStatus === 'blocked' ? `raw BLOCKED; ` : ''}${reason}) - ${message}; ${action}`
+            : isHumanExemptionNotice
+                ? `Notice: ${id} - ${message}; ${action}`
+                : `  [${statusLabel(effectiveStatus)}] ${id} (${reason}) - ${message}; ${action}`);
+    }
+    return `${lines.join('\n')}\n`;
 }
 export { VERIFICATION_CATALOG, renderTaskVerification, verifyTaskEvent };
 //# sourceMappingURL=verification.js.map

package/dist/lifecycle-build-manifest.json

@@ -1,6 +1,6 @@
 {
   "protocolVersion": 3,
-  "packageVersion": "0.11.6",
-  "sourceInputHash": "402048e73650c5ac4edfb1bc4b48ca3fceb7b9068790b1321281c4994121e80c",
-  "internalExecutableBuildHash": "47ecd04ac30183443b2b86f83d1668b8bdf9e59162cc9e2cedd333d3011843e9"
+  "packageVersion": "0.11.7",
+  "sourceInputHash": "095f0cf30aa29fcd2dd45123dc755e5097d7a9f81de33420461fd943cff122b2",
+  "internalExecutableBuildHash": "a956f2ed366e025a111a87bc1f542b87d83d4025e068304f95b1aae704709d3f"
 }

package/lib/git/primary-worktree.ts

@@ -0,0 +1,62 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+
+import { sameFilesystemEntry } from './worktree-identity.ts';
+
+function gitText(repositoryRoot: string, args: string[]): string {
+  return execFileSync('git', ['-C', repositoryRoot, ...args], {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe']
+  }).replace(/\r?\n$/, '');
+}
+
+function isPrimaryWorktree(candidate: string, expectedCommonDirectory: string): boolean {
+  try {
+    const root = fs.realpathSync.native(candidate);
+    if (!fs.statSync(root).isDirectory()) return false;
+    if (gitText(root, ['rev-parse', '--show-prefix']) !== '') return false;
+
+    const commonDirectory = gitText(root, ['rev-parse', '--path-format=absolute', '--git-common-dir']);
+    const gitDirectory = gitText(root, ['rev-parse', '--absolute-git-dir']);
+    return sameFilesystemEntry(commonDirectory, expectedCommonDirectory) &&
+      sameFilesystemEntry(gitDirectory, expectedCommonDirectory);
+  } catch {
+    return false;
+  }
+}
+
+function worktreePaths(repositoryRoot: string): string[] {
+  const output = execFileSync('git', ['-C', repositoryRoot, 'worktree', 'list', '--porcelain', '-z'], {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe']
+  });
+
+  return output
+    .split('\0\0')
+    .flatMap((record) => record.split('\0'))
+    .filter((field) => field.startsWith('worktree '))
+    .map((field) => field.slice('worktree '.length));
+}
+
+export function resolvePrimaryWorktreeRoot(repositoryRoot: string): string {
+  try {
+    const root = fs.realpathSync.native(repositoryRoot);
+    if (!fs.statSync(root).isDirectory() || gitText(root, ['rev-parse', '--show-prefix']) !== '') {
+      throw new Error('repository root is not a worktree root');
+    }
+
+    const commonDirectory = gitText(root, ['rev-parse', '--path-format=absolute', '--git-common-dir']);
+    const gitDirectory = gitText(root, ['rev-parse', '--absolute-git-dir']);
+    if (sameFilesystemEntry(gitDirectory, commonDirectory)) return root;
+
+    const matches = worktreePaths(root).filter((candidate) => isPrimaryWorktree(candidate, commonDirectory));
+    if (matches.length !== 1) {
+      throw new Error(matches.length === 0 ? 'primary worktree metadata was not found' : 'primary worktree metadata is ambiguous');
+    }
+
+    return fs.realpathSync.native(matches[0]!);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(`server: unable to locate primary worktree: ${detail}`);
+  }
+}

package/lib/platform/pull-requests.ts

@@ -1140,9 +1140,33 @@ async function createExternalPullRequest(
   }
   if (base.prIdentity) {
     const inspected = await inspectExternalPullRequest(base, base.prIdentity!);
-    return inspected.status === 'failed' || inspected.status === 'blocked'
-      ? withCreation(inspected, PRECONDITION_NOT_CREATED)
-      : withCreation({ ...inspected, result: 'no_op' }, { kind: 'no-op', createdByCurrentOperation: false });
+    if (inspected.status === 'failed' || inspected.status === 'blocked') {
+      return withCreation(inspected, PRECONDITION_NOT_CREATED);
+    }
+    const deliveredHeadSha = typeof base.frontmatter.delivery_remote_head === 'string'
+      ? base.frontmatter.delivery_remote_head
+      : undefined;
+    const expectedHeadSha = verifiedHeadSha ?? deliveredHeadSha;
+    if (!expectedHeadSha) return withCreation(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+      platform: base.context.platform,
+      capabilities: base.context.capabilities,
+      resource: { kind: 'pull-request', number: base.prNumber, identity: base.prIdentity },
+      pullRequest: inspected.pullRequest,
+      error: { code: 'PR_HEAD_UNVERIFIED', message: 'Unable to verify the bound pull request head SHA', retryable: false }
+    }), PRECONDITION_NOT_CREATED);
+    const identity = validateWriterIdentity(base, inspected.pullRequest ?? null, {
+      expectedHead: options.head,
+      expectedHeadSha,
+      errorCode: 'PR_BIND_IDENTITY_MISMATCH'
+    });
+    if (!identity.ok) return withCreation(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+      platform: base.context.platform,
+      capabilities: base.context.capabilities,
+      resource: { kind: 'pull-request', number: base.prNumber, identity: base.prIdentity },
+      pullRequest: inspected.pullRequest,
+      error: identity.error
+    }), PRECONDITION_NOT_CREATED);
+    return withCreation({ ...inspected, result: 'no_op' }, { kind: 'no-op', createdByCurrentOperation: false });
   }
   if (options.dryRun) return withCreation(result('planned', base.resolved.taskId, base.issueNumber, null, {
     platform: base.context.platform,

package/lib/sandbox/control/server.ts

@@ -272,12 +272,15 @@ function taskCreateDomainEvidence(
     ? output.task as Record<string, unknown> : null;
   const taskId = typeof task?.id === 'string' ? task.id : null;
   const shortId = typeof task?.shortId === 'string' ? task.shortId : null;
-  if (!taskId || !shortId) return { consistent: false };
+  const state = task?.state;
+  if (!taskId || !['active', 'blocked', 'completed', 'archive'].includes(String(state))) return { consistent: false };
+  if (state === 'active' ? !shortId : output.status !== 'no-op' || shortId !== null) return { consistent: false };
   try {
     const resolved = resolveTaskRef(taskId, { repoRoot: manifest.repoRoot });
     const shortIds = loadShortIdByTaskId(manifest.repoRoot);
     return {
-      consistent: resolved.ok && resolved.taskId === taskId && resolved.state === 'active' && shortIds.get(taskId) === shortId,
+      consistent: resolved.ok && resolved.taskId === taskId && resolved.state === state
+        && (state === 'active' ? shortIds.get(taskId) === shortId : !shortIds.has(taskId)),
       taskId,
       shortId
     };

package/lib/server/config.ts

@@ -1,8 +1,8 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { homedir } from 'node:os';
-import { createHash } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
+import { resolvePrimaryWorktreeRoot } from '../git/primary-worktree.ts';
 
 export type ServerLogConfig = {
   path: string;
@@ -52,17 +52,7 @@ function isPlainObject(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
 
-// Daemon runtime state (log + PID) lives OUTSIDE the repo, under the user's home
-// directory, keyed by the .airc.json "project" AND a stable hash of the repo
-// root path:
-//   ~/.agent-infra/logs/<project>/<repo-hash>/server.log
-//   ~/.agent-infra/run/<project>/<repo-hash>/server.pid
-// The <project> segment groups a project's checkouts for readability; the
-// <repo-hash> segment guarantees that two checkouts/worktrees of the same
-// project (same "project" but different absolute path) get ISOLATED runtime
-// dirs, so they never read/control each other's daemon. Using os.homedir() +
-// path.join keeps this correct on Windows too (C:\Users\<name>\.agent-infra\...).
-// An explicit log.path in server.json/.local/env still overrides the log default.
+// Runtime state is shared by all worktrees through the primary checkout.
 function resolveProjectKey(repoRoot: string): string {
   try {
     const airc = JSON.parse(
@@ -77,13 +67,8 @@ function resolveProjectKey(repoRoot: string): string {
   return path.basename(repoRoot);
 }
 
-// Short, stable, filesystem-safe discriminator for a checkout's absolute path.
-function repoKey(repoRoot: string): string {
-  return createHash('sha256').update(repoRoot).digest('hex').slice(0, 12);
-}
-
-function runtimePath(repoRoot: string, projectKey: string, kind: 'logs' | 'run', file: string): string {
-  return path.join(homedir(), '.agent-infra', kind, projectKey, repoKey(repoRoot), file);
+function runtimePath(projectKey: string, kind: 'logs' | 'run', file: string): string {
+  return path.join(homedir(), '.agent-infra', kind, projectKey, file);
 }
 
 function detectRepoRoot(): string {
@@ -185,7 +170,7 @@ export function validateServerConfig(committed: Record<string, unknown>): Server
 }
 
 export function loadServerConfig({ rootDir }: { rootDir?: string } = {}): ServerConfig {
-  const repoRoot = rootDir ?? detectRepoRoot();
+  const repoRoot = resolvePrimaryWorktreeRoot(rootDir ?? detectRepoRoot());
   const agentsDir = path.join(repoRoot, '.agents');
 
   const committed = readJsonIfPresent(path.join(agentsDir, 'server.json'));
@@ -205,18 +190,11 @@ export function loadServerConfig({ rootDir }: { rootDir?: string } = {}): Server
   const projectKey = resolveProjectKey(repoRoot);
 
   const log = isPlainObject(merged.log) ? merged.log : {};
-  // No explicit log.path → default under ~/.agent-infra/logs/<project>/.
-  // Explicit relative path resolves against the repo root; absolute is used as-is.
-  const explicitPath = typeof log.path === 'string' ? log.path : null;
-  const resolvedLogPath = explicitPath === null
-    ? runtimePath(repoRoot, projectKey, 'logs', 'server.log')
-    : (path.isAbsolute(explicitPath) ? explicitPath : path.join(repoRoot, explicitPath));
-
   return {
     repoRoot,
-    pidFile: runtimePath(repoRoot, projectKey, 'run', 'server.pid'),
+    pidFile: runtimePath(projectKey, 'run', 'server.pid'),
     log: {
-      path: resolvedLogPath,
+      path: runtimePath(projectKey, 'logs', 'server.log'),
       rotateAtBytes: typeof log.rotateAtBytes === 'number' ? log.rotateAtBytes : DEFAULT_ROTATE_BYTES
     },
     heartbeatMs: typeof merged.heartbeatMs === 'number' ? merged.heartbeatMs : DEFAULT_SERVER_CONFIG.heartbeatMs,

package/lib/server/daemon.ts

@@ -83,7 +83,7 @@ export function createMessageDispatcher(options: MessageDispatcherOptions): (mes
           chunkChars: typeof options.config.stream?.chunkChars === 'number' ? options.config.stream.chunkChars : 4000,
           throttleMs: typeof options.config.stream?.throttleMs === 'number' ? options.config.stream.throttleMs : 1500
         },
-        (emit) => runAiImpl(plan.argv, { onChunk: emit }),
+        (emit) => runAiImpl(plan.argv, { onChunk: emit, cwd: options.config.repoRoot }),
         (outbound) => replyOutbound(message, outbound)
       );
     }
@@ -100,15 +100,17 @@ export function createMessageDispatcher(options: MessageDispatcherOptions): (mes
 //   - runDaemon() awaits a shutdown promise that only resolves once a
 //     SIGINT/SIGTERM handler has finished graceful cleanup. We never unref()
 //     the only keep-alive timer (that would let the process exit immediately).
-export async function runDaemon(): Promise<void> {
+export async function runDaemon({ rootDir }: { rootDir?: string } = {}): Promise<void> {
   let config;
   try {
-    config = loadServerConfig();
+    config = loadServerConfig({ rootDir });
   } catch (error) {
     process.stderr.write(`${errorMessage(error)}\n`);
     process.exit(1);
   }
 
+  process.chdir(config.repoRoot);
+
   const logger = createLogger(config.log);
   logger.info(`daemon starting agent-infra ${VERSION} pid=${process.pid}`);
   const ownStartTime = getProcessStartTime(process.pid);

package/lib/server/process-control.ts

@@ -1,4 +1,5 @@
 import fs from 'node:fs';
+import path from 'node:path';
 import { spawn, execFileSync } from 'node:child_process';
 import { loadServerConfig } from './config.ts';
 import type { ServerConfig } from './config.ts';
@@ -91,7 +92,7 @@ export async function start({ foreground = false }: StartOptions = {}): Promise<
   }
 
   if (foreground) {
-    await runDaemon();
+    await runDaemon({ rootDir: config.repoRoot });
     return;
   }
 
@@ -103,8 +104,9 @@ export async function start({ foreground = false }: StartOptions = {}): Promise<
   // Re-spawn ourselves detached. process.execArgv is forwarded so the dev path
   // (node --experimental-strip-types ./bin/cli.ts) and the built path
   // (node dist/bin/cli.js) both work.
-  const child = spawn(process.execPath, [...process.execArgv, cliEntry, 'server', '__daemon'], {
+  const child = spawn(process.execPath, [...process.execArgv, path.resolve(cliEntry), 'server', '__daemon'], {
     detached: true,
+    cwd: config.repoRoot,
     stdio: 'ignore'
   });
   child.unref();

package/lib/server/runner.ts

@@ -10,8 +10,9 @@ export type RunnerResult = {
 };
 
 export type RunnerOptions = {
-  spawn?: (file: string, args: string[], onChunk?: (chunk: string) => void | Promise<void>) => Promise<RunnerResult>;
+  spawn?: (file: string, args: string[], onChunk?: (chunk: string) => void | Promise<void>, cwd?: string) => Promise<RunnerResult>;
   onChunk?: (chunk: string) => void | Promise<void>;
+  cwd?: string;
 };
 
 function resolveCommand(file: string): string {
@@ -40,13 +41,15 @@ function needsShell(file: string): boolean {
 function spawnCapture(
   file: string,
   args: string[],
-  onChunk?: (chunk: string) => void | Promise<void>
+  onChunk?: (chunk: string) => void | Promise<void>,
+  cwd?: string
 ): Promise<RunnerResult> {
   return new Promise((resolve, reject) => {
     const resolvedFile = resolveCommand(file);
     const child = spawn(resolvedFile, args, {
       stdio: ['ignore', 'pipe', 'pipe'],
-      shell: needsShell(resolvedFile)
+      shell: needsShell(resolvedFile),
+      ...(cwd === undefined ? {} : { cwd })
     });
     let stdout = '';
     let stderr = '';
@@ -91,5 +94,5 @@ function spawnCapture(
 }
 
 export async function runAi(args: string[], options: RunnerOptions = {}): Promise<RunnerResult> {
-  return (options.spawn ?? spawnCapture)('ai', args, options.onChunk);
+  return (options.spawn ?? spawnCapture)('ai', args, options.onChunk, options.cwd);
 }

package/lib/server/server.schema.json

@@ -13,10 +13,6 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
-        "path": {
-          "type": "string",
-          "description": "Log file path. Defaults to ~/.agent-infra/logs/<project>/<repo-hash>/server.log (outside the repo; the repo-hash isolates checkouts that share a project). Relative paths resolve against the repo root; absolute paths are used as-is."
-        },
         "rotateAtBytes": {
           "type": "integer",
           "minimum": 0,

package/lib/task/artifact-lifecycle.ts

@@ -9,6 +9,8 @@ import { parseImplementationInputs, selectPendingImplementationInput } from './i
 import { parseVerdict } from './review-artifacts.ts';
 import { extractSection, findSectionHeading } from './sections.ts';
 import { receiptForOutput, sha256File } from './artifact-receipts.ts';
+import { hasArtifactCompletionFact, hasArtifactCompletionLog } from './completion-facts.ts';
+import { inspectReviewIdentity } from './review-identity.ts';
 import { isArtifactInvalidated, parseInvalidationDocument } from './invalidation.ts';
 import type { InvalidationDocument } from './invalidation.ts';
 import type { ArtifactFamily, ArtifactFamilySpec } from './artifact-name.ts';
@@ -228,7 +230,12 @@ function inspectArtifactDirectory(
     if (!knownRounds.has(round)) diagnostics.push(diagnostic('ROUND_GAP', family, null, `${artifactName(family, round)} is missing`));
   }
   const latest = artifacts.at(-1) ?? null;
-  const reviewedInput = family.startsWith('review-') && latest
+  let hasReviewCodeReceipt = false;
+  if (family === 'review-code' && latest) {
+    try { hasReviewCodeReceipt = Boolean(receiptForOutput(fs.readFileSync(path.join(taskDir, 'task.md'), 'utf8'), latest.name)); }
+    catch { hasReviewCodeReceipt = false; }
+  }
+  const reviewedInput = family.startsWith('review-') && latest && (family !== 'review-code' || hasReviewCodeReceipt)
     ? resolveReviewedInput(taskDir, latest, family === 'review-analysis' ? 'analysis' : family === 'review-plan' ? 'plan' : 'code', diagnostics)
     : null;
   return {
@@ -316,14 +323,16 @@ function assertWritableInventory(inventory: ArtifactInventoryResult): ArtifactEr
 }
 
 const REQUIRED_INPUT: Partial<Record<ArtifactFamily, ArtifactFamily>> = {
-  'review-analysis': 'analysis', plan: 'analysis', 'review-plan': 'plan', 'review-code': 'code'
+  'review-analysis': 'analysis', plan: 'analysis', 'review-plan': 'plan'
 };
-const OPTIONAL_CONTEXT: Partial<Record<ArtifactFamily, { family: ArtifactFamily }>> = {
-  analysis: { family: 'review-analysis' },
-  plan: { family: 'review-plan' },
-  'review-code': { family: 'review-plan' },
-  'manual-validation': { family: 'review-code' },
-  'validation-run': { family: 'review-code' }
+const OPTIONAL_CONTEXT: Partial<Record<ArtifactFamily, readonly ArtifactFamily[]>> = {
+  analysis: ['review-analysis'],
+  plan: ['review-analysis', 'review-plan'],
+  'review-plan': ['review-analysis'],
+  code: ['review-plan'],
+  'review-code': ['code', 'plan', 'review-plan'],
+  'manual-validation': ['review-code'],
+  'validation-run': ['review-code']
 };
 function hasSelectionEvidence(
   content: string,
@@ -336,6 +345,18 @@ function hasSelectionEvidence(
   if (family.startsWith('review-')) {
     const reviewedFamily = family === 'review-analysis' ? 'analysis' : family === 'review-plan' ? 'plan' : 'code';
     const currentInput = context.inputs.find((input) => input.family === reviewedFamily);
+    if (family === 'review-code') {
+      if (!context.latest) return false;
+      try {
+        const reportContent = fs.readFileSync(context.latest.path, 'utf8');
+        const identity = inspectReviewIdentity(context.taskDir!, reportContent, options.repoRoot);
+        return identity.status !== 'matched'
+          || !hasArtifactCompletionFact(content, context.latest.path, 'review-code.completed')
+          || !hasArtifactCompletionLog(content, context.latest.name, 'review-code.completed');
+      } catch {
+        return true;
+      }
+    }
     if (currentInput && context.reviewedInput?.name !== currentInput.name) return true;
   }
   const target = family === 'analysis' ? 'analysis' : family === 'plan' ? 'plan' : family === 'code' ? 'code' : null;
@@ -450,9 +471,9 @@ function resolveArtifactContext(taskRef: string, family: string, options: Inspec
   }
   const optional = OPTIONAL_CONTEXT[inventory.family as ArtifactFamily];
   if (optional) {
-    const context = inspectTaskArtifacts(taskRef, optional.family, options);
-    if (context.status === 'ready' && context.latest) {
-      inputs.push(context.latest);
+    for (const family of optional) {
+      const context = inspectTaskArtifacts(taskRef, family, options);
+      if (context.status === 'ready' && context.latest) inputs.push(context.latest);
     }
   }
   if (inventory.family === 'manual-validation' || inventory.family === 'validation-run') {
@@ -473,6 +494,9 @@ function resolveCodeContext(inventory: ArtifactInventoryResult, options: Inspect
   const codeMax = latestCode?.round ?? 0;
   const reviewMax = reviewCode.latest?.round ?? 0;
   const inputs = [source.latest];
+  const sourceReviewFamily = inputFamily === 'analysis' ? 'review-analysis' : 'review-plan';
+  const sourceReview = inspectTaskArtifacts(taskRef, sourceReviewFamily, options);
+  if (sourceReview.status === 'ready' && sourceReview.latest && sourceReview.reviewedInput?.name === source.latest.name) inputs.push(sourceReview.latest);
   if (latestCode) {
     try {
       const taskContent = fs.readFileSync(path.join(inventory.taskDir!, 'task.md'), 'utf8');