@fitlab-ai/agent-infra 0.11.6 → 0.11.8

package/dist/lib/task/qualification-audit.js

@@ -1,30 +1,26 @@
 import { createHash } from 'node:crypto';
 import { parseArtifactName } from './artifact-name.js';
-import { parseTypedTaskFrontmatter } from './frontmatter.js';
 import { findSectionRange, parseTable } from './sections.js';
 import { scanVisibleMarkdown } from './markdown.js';
 const TASK_CONSTRAINT_HEADINGS = ['约束', 'Constraints'];
 const TASK_CANDIDATE_HEADINGS = ['候选与否决方案', 'Candidate and Rejected Options', 'Candidates and Rejected Options', 'Candidates and Rejected Alternatives'];
 const AUDIT_HEADINGS = ['资格审计', '资格审计复核', 'Qualification Audit', 'Qualification Audit Review'];
 const CONFIRMATION_HEADINGS = ['资格确认记录', 'Qualification Confirmations'];
-const AUDIT_SUBSECTIONS = ['约束依赖', '候选资格', '分类结果', '上游关系', '依赖快照'];
+const AUDIT_SUBSECTIONS = ['约束依赖', '候选资格', '分类结果', '资格快照'];
 const AUDIT_SUBSECTION_HEADINGS = {
     '约束依赖': ['约束依赖', 'Constraint Dependencies'],
     '候选资格': ['候选资格', 'Candidate Qualification'],
     '分类结果': ['分类结果', 'Classification Results'],
-    '上游关系': ['上游关系', 'Upstream Relations'],
-    '依赖快照': ['依赖快照', 'Dependency Snapshot']
+    '资格快照': ['资格快照', 'Qualification Snapshot']
 };
 const CONSTRAINT_COLUMNS = ['constraint_id', 'statement', 'status', 'authority', 'source', 'evidence', 'derived_from', 'approval_evidence'];
 const CANDIDATE_COLUMNS = ['candidate_id', 'statement', 'status', 'constraint_ids', 'impact', 'evidence'];
 const DEPENDENCY_COLUMNS = ['constraint_id', 'constraint_digest', 'role', 'evidence'];
 const QUALIFICATION_COLUMNS = ['candidate_id', 'status', 'impact', 'constraint_ids', 'evidence'];
 const CLASSIFICATION_COLUMNS = ['decision_id', 'classification', 'evidence'];
-const RELATION_COLUMNS = ['upstream_family', 'upstream_artifact', 'upstream_round', 'upstream_sha256', 'relation'];
-const SNAPSHOT_COLUMNS = ['task_input_digest', 'non_constraint_input_digest', 'upstream_artifact_digest'];
+const SNAPSHOT_COLUMNS = ['task_input_digest', 'non_constraint_input_digest'];
 const CONFIRMATION_COLUMNS = ['qcr_id', 'constraint_id', 'actor', 'entrypoint', 'request_id', 'approved_digest', 'confirmed_at', 'rationale'];
 const ARTIFACT_FAMILIES = ['analysis', 'review-analysis', 'plan', 'review-plan', 'code', 'review-code'];
-const RELATIONS = ['required-input', 'reviewed-input', 'review-context', 'approval-context'];
 const CONSTRAINT_STATUSES = ['confirmed', 'derived', 'assumption', 'open', 'conflicted', 'superseded'];
 const CANDIDATE_STATUSES = ['qualified', 'rejected', 'pending', 'needs-human-decision', 'confirmed', 'excluded'];
 const CLASSIFICATIONS = ['deterministic', 'qualified', 'rejected', 'needs-human-decision', 'not-applicable'];
@@ -215,86 +211,20 @@ function parseAuditTable(content, heading, columns) {
     const table = parseTable(`## Qualification Audit Body\n${subsection}`, { sectionAliases: ['Qualification Audit Body'], columns });
     return table?.rows.map((row) => ({ ...row.values })) ?? null;
 }
-function parseAuditArtifactName(value) {
-    const identity = parseArtifactName(value);
-    return identity && ARTIFACT_FAMILIES.includes(identity.family)
-        ? { family: identity.family, round: identity.round } : null;
-}
-function upstreamArtifactDigest(rows) {
-    return digest([...rows].map((row) => ({ ...row })).sort((a, b) => `${a.upstreamFamily}/${a.upstreamArtifact}/${a.relation}`.localeCompare(`${b.upstreamFamily}/${b.upstreamArtifact}/${b.relation}`)));
-}
-function validateUpstreamRelation(row) {
-    const identity = parseAuditArtifactName(row.upstreamArtifact);
-    if (!ARTIFACT_FAMILIES.includes(row.upstreamFamily) || !identity || identity.family !== row.upstreamFamily
-        || identity.round !== row.upstreamRound || !Number.isSafeInteger(row.upstreamRound)
-        || !/^[a-f0-9]{64}$/i.test(row.upstreamSha256) || !RELATIONS.includes(row.relation)) {
-        throw new Error(`invalid qualification upstream relation '${row.upstreamArtifact}'`);
-    }
-}
-function expectedQualificationRelations(taskContent, family) {
-    let frontmatter;
-    try {
-        frontmatter = parseTypedTaskFrontmatter(taskContent);
-    }
-    catch (error) {
-        return { ok: false, code: 'QUALIFICATION_STARTED_INPUT_INVALID', message: error instanceof Error ? error.message : String(error) };
-    }
-    const encoded = frontmatter.qualification_input_relations;
-    if (typeof encoded === 'string' && encoded) {
-        try {
-            const parsed = JSON.parse(encoded);
-            if (!Array.isArray(parsed))
-                throw new Error('qualification_input_relations must be an array');
-            const relations = parsed.map((value) => {
-                if (!value || typeof value !== 'object' || Array.isArray(value))
-                    throw new Error('qualification input relation must be an object');
-                const row = value;
-                const relation = {
-                    upstreamFamily: row.upstreamFamily,
-                    upstreamArtifact: String(row.upstreamArtifact ?? ''),
-                    upstreamRound: Number(row.upstreamRound),
-                    upstreamSha256: String(row.upstreamSha256 ?? ''),
-                    relation: row.relation
-                };
-                validateUpstreamRelation(relation);
-                return relation;
-            });
-            return { ok: true, relations };
-        }
-        catch (error) {
-            return { ok: false, code: 'QUALIFICATION_STARTED_INPUT_INVALID', message: error instanceof Error ? error.message : String(error) };
-        }
-    }
-    const inputName = family === 'code' ? frontmatter.code_input_artifact : family.startsWith('review-') ? frontmatter.review_input_artifact : '';
-    const inputSha256 = family === 'code' ? frontmatter.code_input_sha256 : family.startsWith('review-') ? frontmatter.review_input_sha256 : '';
-    if (typeof inputName !== 'string' || !inputName || typeof inputSha256 !== 'string' || !inputSha256)
-        return { ok: true, relations: undefined };
-    const identity = parseAuditArtifactName(inputName);
-    if (!identity)
-        return { ok: false, code: 'QUALIFICATION_STARTED_INPUT_INVALID', message: `started input '${inputName}' is not canonical` };
-    const relation = {
-        upstreamFamily: identity.family, upstreamArtifact: inputName, upstreamRound: identity.round,
-        upstreamSha256: inputSha256, relation: family === 'code' ? 'required-input' : 'reviewed-input'
-    };
-    try {
-        validateUpstreamRelation(relation);
-    }
-    catch (error) {
-        return { ok: false, code: 'QUALIFICATION_STARTED_INPUT_INVALID', message: error instanceof Error ? error.message : String(error) };
-    }
-    return { ok: true, relations: [relation] };
-}
 function parseQualificationAudit(content) {
-    if (sectionBody(content, AUDIT_HEADINGS) === null)
-        return { ok: true, audit: { present: false, constraintDependencies: [], candidateQualifications: [], classifications: [], upstreamRelations: [], snapshot: null } };
+    const auditBody = sectionBody(content, AUDIT_HEADINGS);
+    if (auditBody === null)
+        return { ok: true, audit: { present: false, constraintDependencies: [], candidateQualifications: [], classifications: [], snapshot: null } };
     try {
+        if (sectionBody(auditBody, ['上游关系', 'Upstream Relations'], 3) !== null) {
+            throw new Error('qualification audit uses the obsolete lifecycle-relation format; regenerate it using the current format');
+        }
         const dependencies = parseAuditTable(content, '约束依赖', DEPENDENCY_COLUMNS);
         const qualifications = parseAuditTable(content, '候选资格', QUALIFICATION_COLUMNS);
         const classifications = parseAuditTable(content, '分类结果', CLASSIFICATION_COLUMNS);
-        const relations = parseAuditTable(content, '上游关系', RELATION_COLUMNS);
-        const snapshots = parseAuditTable(content, '依赖快照', SNAPSHOT_COLUMNS);
-        if (!dependencies || !qualifications || !classifications || !relations || !snapshots || snapshots.length !== 1) {
-            throw new Error('qualification audit requires all five canonical tables and exactly one dependency snapshot');
+        const snapshots = parseAuditTable(content, '资格快照', SNAPSHOT_COLUMNS);
+        if (!dependencies || !qualifications || !classifications || !snapshots || snapshots.length !== 1) {
+            throw new Error('qualification audit requires three decision tables and exactly one qualification snapshot');
         }
         const constraintDependencies = dependencies.map((row) => {
             if (!/^C-[1-9]\d*$/.test(row.constraint_id ?? '') || !/^[a-f0-9]{64}$/i.test(row.constraint_digest ?? '') || !ROLES.includes(row.role) || !row.evidence?.trim())
@@ -311,20 +241,15 @@ function parseQualificationAudit(content) {
                 throw new Error(`invalid qualification classification '${row.decision_id ?? ''}'`);
             return { decisionId: row.decision_id, classification: row.classification, evidence: row.evidence };
         });
-        const upstreamRelations = relations.map((row) => {
-            const relation = { upstreamFamily: row.upstream_family, upstreamArtifact: row.upstream_artifact ?? '', upstreamRound: Number(row.upstream_round), upstreamSha256: row.upstream_sha256 ?? '', relation: row.relation };
-            validateUpstreamRelation(relation);
-            return relation;
-        });
         const snapshotRow = snapshots[0];
-        if (!/^[a-f0-9]{64}$/i.test(snapshotRow.task_input_digest ?? '') || !/^[a-f0-9]{64}$/i.test(snapshotRow.non_constraint_input_digest ?? '') || !/^[a-f0-9]{64}$/i.test(snapshotRow.upstream_artifact_digest ?? ''))
-            throw new Error('qualification dependency snapshot has invalid digest');
+        if (!/^[a-f0-9]{64}$/i.test(snapshotRow.task_input_digest ?? '') || !/^[a-f0-9]{64}$/i.test(snapshotRow.non_constraint_input_digest ?? ''))
+            throw new Error('qualification snapshot has invalid digest');
         return {
             ok: true,
             audit: {
                 present: true, constraintDependencies, candidateQualifications,
-                classifications: classificationRows, upstreamRelations,
-                snapshot: { taskInputDigest: snapshotRow.task_input_digest, nonConstraintInputDigest: snapshotRow.non_constraint_input_digest, upstreamArtifactDigest: snapshotRow.upstream_artifact_digest }
+                classifications: classificationRows,
+                snapshot: { taskInputDigest: snapshotRow.task_input_digest, nonConstraintInputDigest: snapshotRow.non_constraint_input_digest }
             }
         };
     }
@@ -367,7 +292,7 @@ function validateQualificationAudit(taskContent, artifactContent, options = {})
     const audit = parseQualificationAudit(artifactContent);
     if (!audit.ok)
         return audit;
-    if (!task.qualification.present && !options.require)
+    if (!audit.audit.present && !options.require)
         return { ok: true, qualification: task.qualification, audit: audit.audit };
     if (!task.qualification.present)
         return { ok: false, code: 'QUALIFICATION_TASK_CONTRACT_MISSING', message: 'task qualification contract is missing' };
@@ -424,13 +349,8 @@ function validateQualificationAudit(taskContent, artifactContent, options = {})
         return { ok: false, code: 'QUALIFICATION_TASK_DIGEST_MISMATCH', message: 'qualification audit task input digest is stale' };
     if (snapshot.nonConstraintInputDigest !== task.qualification.nonConstraintInputDigest)
         return { ok: false, code: 'QUALIFICATION_NON_CONSTRAINT_DIGEST_MISMATCH', message: 'qualification audit non-constraint input digest is stale' };
-    if (snapshot.upstreamArtifactDigest !== upstreamArtifactDigest(audit.audit.upstreamRelations))
-        return { ok: false, code: 'QUALIFICATION_UPSTREAM_DIGEST_MISMATCH', message: 'qualification audit upstream digest does not match its relation rows' };
-    if (options.expectedUpstreamRelations && (options.expectedUpstreamRelations.length !== audit.audit.upstreamRelations.length
-        || upstreamArtifactDigest(options.expectedUpstreamRelations) !== upstreamArtifactDigest(audit.audit.upstreamRelations)))
-        return { ok: false, code: 'QUALIFICATION_UPSTREAM_RELATION_MISMATCH', message: 'qualification audit upstream relations do not match the started artifact inputs' };
     if (options.family && options.artifact) {
-        const identity = parseAuditArtifactName(options.artifact);
+        const identity = parseArtifactName(options.artifact);
         if (!identity || identity.family !== options.family)
             return { ok: false, code: 'QUALIFICATION_ARTIFACT_IDENTITY_INVALID', message: `artifact '${options.artifact}' is not canonical for '${options.family}'` };
     }
@@ -443,13 +363,12 @@ function renderQualificationAudit(audit) {
         ...rows.map((row) => `| ${row.map((value) => value.replace(/\\/g, '\\\\').replace(/\|/g, '\\|').replace(/[\r\n]/g, ' ')).join(' | ')} |`)
     ].join('\n');
     const list = (values) => values.join(',');
-    const snapshot = audit.snapshot ?? { taskInputDigest: '', nonConstraintInputDigest: '', upstreamArtifactDigest: upstreamArtifactDigest(audit.upstreamRelations) };
+    const snapshot = audit.snapshot ?? { taskInputDigest: '', nonConstraintInputDigest: '' };
     return [
         '### 约束依赖', '', table(DEPENDENCY_COLUMNS, audit.constraintDependencies.map((row) => [row.constraintId, row.constraintDigest, row.role, row.evidence])), '',
         '### 候选资格', '', table(QUALIFICATION_COLUMNS, audit.candidateQualifications.map((row) => [row.candidateId, row.status, row.impact, list(row.constraintIds), row.evidence])), '',
         '### 分类结果', '', table(CLASSIFICATION_COLUMNS, audit.classifications.map((row) => [row.decisionId, row.classification, row.evidence])), '',
-        '### 上游关系', '', table(RELATION_COLUMNS, audit.upstreamRelations.map((row) => [row.upstreamFamily, row.upstreamArtifact, String(row.upstreamRound), row.upstreamSha256, row.relation])), '',
-        '### 依赖快照', '', table(SNAPSHOT_COLUMNS, [[snapshot.taskInputDigest, snapshot.nonConstraintInputDigest, snapshot.upstreamArtifactDigest]])
+        '### 资格快照', '', table(SNAPSHOT_COLUMNS, [[snapshot.taskInputDigest, snapshot.nonConstraintInputDigest]])
     ].join('\n');
 }
 function buildQualificationAudit(taskContent, input = {}) {
@@ -462,15 +381,14 @@ function buildQualificationAudit(taskContent, input = {}) {
     const candidates = input.candidates ?? parsed.qualification.candidates.map((row) => row.candidateId);
     const constraintDependencies = parsed.qualification.constraints.filter((row) => ids.has(row.constraintId)).map((row) => ({ constraintId: row.constraintId, constraintDigest: row.digest, role: 'required', evidence: row.evidence }));
     const candidateQualifications = parsed.qualification.candidates.filter((row) => candidates.includes(row.candidateId)).map((row) => ({ candidateId: row.candidateId, status: row.status, impact: row.impact, constraintIds: row.constraintIds, evidence: row.evidence }));
-    const upstreamRelations = [...(input.upstreamRelations ?? [])];
     return {
         ok: true,
         audit: {
             present: true, constraintDependencies, candidateQualifications,
-            classifications: input.classifications ?? [], upstreamRelations,
-            snapshot: { taskInputDigest: parsed.qualification.taskInputDigest, nonConstraintInputDigest: parsed.qualification.nonConstraintInputDigest, upstreamArtifactDigest: upstreamArtifactDigest(upstreamRelations) }
+            classifications: input.classifications ?? [],
+            snapshot: { taskInputDigest: parsed.qualification.taskInputDigest, nonConstraintInputDigest: parsed.qualification.nonConstraintInputDigest }
         }
     };
 }
-export { ARTIFACT_FAMILIES, AUDIT_HEADINGS, AUDIT_SUBSECTIONS, CONFIRMATION_COLUMNS, CONFIRMATION_HEADINGS, CANDIDATE_COLUMNS, CONSTRAINT_COLUMNS, DEPENDENCY_COLUMNS, QUALIFICATION_COLUMNS, CLASSIFICATION_COLUMNS, RELATION_COLUMNS, SNAPSHOT_COLUMNS, constraintDigest, expectedQualificationRelations, buildQualificationAudit, nonConstraintInputDigest, parseQualificationAudit, parseQualificationConfirmations, parseTaskQualification, renderQualificationAudit, taskInputDigest, upstreamArtifactDigest, validateQualificationAudit };
+export { ARTIFACT_FAMILIES, AUDIT_HEADINGS, AUDIT_SUBSECTIONS, CONFIRMATION_COLUMNS, CONFIRMATION_HEADINGS, CANDIDATE_COLUMNS, CONSTRAINT_COLUMNS, DEPENDENCY_COLUMNS, QUALIFICATION_COLUMNS, CLASSIFICATION_COLUMNS, SNAPSHOT_COLUMNS, constraintDigest, buildQualificationAudit, nonConstraintInputDigest, parseQualificationAudit, parseQualificationConfirmations, parseTaskQualification, renderQualificationAudit, taskInputDigest, validateQualificationAudit };
 //# sourceMappingURL=qualification-audit.js.map

package/dist/lib/task/review-finalization.js

@@ -10,6 +10,7 @@ import { resolveTaskRef } from './resolve-ref.js';
 import { validateLifecycleExecution } from './lifecycle-execution.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.js';
 import { getArtifactSchema } from './artifact-schema.js';
+import { validateQualificationAudit } from './qualification-audit.js';
 import { canonicalSemanticDigest, inspectArtifactContract, sha256Content } from './artifact-operations.js';
 const STAGES = {
     analysis: { family: 'review-analysis' },
@@ -186,6 +187,12 @@ function prepareReviewSummaryCandidate(request, artifactContent, options = {}) {
             artifactSha256, semanticDigest: structure.semanticDigest
         });
     }
+    const qualification = validateQualificationAudit(taskContent, artifactContent, { family: spec.family, artifact: request.artifact });
+    if (!qualification.ok) {
+        return reject('REVIEW_ARTIFACT_STRUCTURE_INVALID', `${qualification.code}: ${qualification.message}`, {
+            artifactSha256, semanticDigest
+        });
+    }
     const transformed = finalizeReviewSummaryContent(artifactContent, stageStatus.unresolvedFindingCounts, {
         refreshNumericCounts: true
     });

package/dist/lib/task/review-identity.js

@@ -0,0 +1,69 @@
+import fs from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import path from 'node:path';
+import { resolveBranchWorktree } from '../git/branch-worktree.js';
+import { snapshotReview } from '../git/review-snapshot.js';
+import { resolveDeliveryTarget } from './delivery-target.js';
+import { parseTypedTaskFrontmatter } from './frontmatter.js';
+import { extractReviewDiffBase, extractReviewDiffFingerprint, extractReviewedHead, extractReviewTargetHead, extractReviewedSnapshotTree, loadPostReviewConfig, resolvePostReviewGlobs } from './review-fingerprint.js';
+function git(cwd, args) {
+    return execFileSync('git', ['-C', cwd, ...args], { encoding: 'utf8' }).trim();
+}
+function result(status, message, reviewedHead = null, currentHead = null) {
+    return { status, message, reviewedHead, currentHead };
+}
+export function inspectReviewIdentity(taskDir, reportContent, repositoryRoot) {
+    const reviewedHead = extractReviewedHead(reportContent);
+    const targetHead = extractReviewTargetHead(reportContent);
+    const diffBase = extractReviewDiffBase(reportContent);
+    const fingerprint = extractReviewDiffFingerprint(reportContent);
+    const reviewedTree = extractReviewedSnapshotTree(reportContent);
+    if (!reviewedHead || !targetHead || !diffBase || !fingerprint || !reviewedTree) {
+        return result('indeterminate', 'Review report is missing commit or snapshot identity', reviewedHead || null);
+    }
+    try {
+        const metadata = parseTypedTaskFrontmatter(fs.readFileSync(path.join(taskDir, 'task.md'), 'utf8'));
+        const taskRepositoryRoot = git(taskDir, ['rev-parse', '--show-toplevel']);
+        const branch = String(metadata.branch ?? '').trim();
+        const gitRoot = branch ? resolveBranchWorktree(taskRepositoryRoot, branch) : taskRepositoryRoot;
+        if (!gitRoot)
+            return result('indeterminate', `Task branch '${branch}' is not checked out in a registered worktree`, reviewedHead);
+        const currentHead = git(gitRoot, ['rev-parse', 'HEAD']);
+        const baseline = git(gitRoot, ['rev-parse', `${reviewedHead}^{commit}`]);
+        if (baseline !== currentHead)
+            return result('different', 'Reviewed commit differs from current HEAD', baseline, currentHead);
+        const remote = String(metadata.delivery_remote ?? '').trim();
+        const baseRef = String(metadata.delivery_base_ref ?? '').trim();
+        if (!remote || !baseRef)
+            return result('indeterminate', 'Task delivery target is not bound', baseline, currentHead);
+        const target = resolveDeliveryTarget(gitRoot, { remote, baseRef });
+        if (!target.ok)
+            return result('indeterminate', target.message, baseline, currentHead);
+        const currentTarget = git(gitRoot, ['rev-parse', `${targetHead}^{commit}`]);
+        const computedDiffBase = git(gitRoot, ['merge-base', baseline, currentTarget]);
+        if (git(gitRoot, ['rev-parse', `${diffBase}^{commit}`]) !== computedDiffBase) {
+            return result('different', 'Saved review diff base no longer matches the current target', baseline, currentHead);
+        }
+        const globs = resolvePostReviewGlobs({}, loadPostReviewConfig(repositoryRoot ?? taskRepositoryRoot));
+        const trackedChanges = git(gitRoot, ['diff', '--name-only', '-z', baseline, '--', ...globs]);
+        const untrackedChanges = git(gitRoot, ['ls-files', '-o', '--exclude-standard', '-z', '--', ...globs]);
+        if (trackedChanges || untrackedChanges)
+            return result('different', 'Reviewed worktree contains uncommitted changes', baseline, currentHead);
+        const snapshot = snapshotReview({
+            cwd: gitRoot,
+            mode: 'worktree',
+            baseline,
+            diffBase: computedDiffBase,
+            globs
+        });
+        if (snapshot.fingerprint !== fingerprint)
+            return result('different', 'Reviewed diff fingerprint differs from the current worktree', baseline, currentHead);
+        if (snapshot.tree !== reviewedTree)
+            return result('different', 'Reviewed snapshot tree differs from the current worktree', baseline, currentHead);
+        return result('matched', 'Review report matches the current commit and clean worktree', baseline, currentHead);
+    }
+    catch (error) {
+        return result('indeterminate', error instanceof Error ? error.message : String(error), reviewedHead);
+    }
+}
+//# sourceMappingURL=review-identity.js.map

package/dist/lib/task/sections.js

@@ -17,8 +17,8 @@ function parseTable(content, input) {
         new Set(input.columns).size !== input.columns.length) {
         throw new DocumentMutationError('MUTATION_INVALID', 'table columns are invalid');
     }
-    const keyColumn = input.keyColumn ?? input.columns[0];
-    if (!input.columns.includes(keyColumn)) {
+    const keyColumn = input.keyColumn === undefined ? input.columns[0] : input.keyColumn;
+    if (keyColumn !== null && !input.columns.includes(keyColumn)) {
         throw new DocumentMutationError('MUTATION_INVALID', 'table key column is invalid');
     }
     const sections = matchingSections(content, input.sectionAliases);
@@ -68,11 +68,12 @@ function parseTable(content, input) {
             column,
             decodeCell(parsed.cells[columnIndex]).trim()
         ]));
-        const key = values[keyColumn];
-        if (seen.has(key)) {
+        const key = keyColumn === null ? null : values[keyColumn];
+        if (key !== null && seen.has(key)) {
             throw new DocumentMutationError('TABLE_DUPLICATE_KEY', `duplicate table key '${key}'`);
         }
-        seen.add(key);
+        if (key !== null)
+            seen.add(key);
         rows.push({ values, sourceLine: index - Math.max(firstContent, 0) });
     }
     return { heading: section.heading, rows };

package/dist/lib/task/task-execution-lock.js

@@ -29,9 +29,12 @@ function mapLinkError(operation, error, key) {
     }
     return new TaskExecutionLockError('ORCHESTRATION_LOCK_FAILED', `lifecycle lock hard-link operation '${operation}' failed`, detail);
 }
-function lockKey(repoRoot, taskId) {
+function lockKey(repoRoot, taskId, identityScope) {
     const canonicalRepoRoot = fs.realpathSync.native(repoRoot);
-    const key = createHash('sha256').update(`${canonicalRepoRoot}\0${taskId}`).digest('hex');
+    const identity = identityScope === undefined
+        ? `${canonicalRepoRoot}\0${taskId}`
+        : `${identityScope}\0${taskId}`;
+    const key = createHash('sha256').update(identity).digest('hex');
     return { canonicalRepoRoot, key };
 }
 function parseOwner(raw, key) {
@@ -133,7 +136,7 @@ function cleanStaleCandidates(lockRoot, key, identityMatches) {
 function withTaskExecutionLock(repoRoot, taskId, ownerName, callback, options = {}) {
     let identity;
     try {
-        identity = lockKey(repoRoot, taskId);
+        identity = lockKey(repoRoot, taskId, options.identityScope);
     }
     catch (error) {
         throw new TaskExecutionLockError('ORCHESTRATION_LOCK_FAILED', 'failed to canonicalize the repository for lifecycle locking', { operation: 'canonicalize', errno: errno(error), key: 'unresolved' });

package/dist/lib/task/verification-engine.js

@@ -4,14 +4,13 @@ import path from "node:path";
 import process from "node:process";
 import { execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { extractReviewBaseline, extractReviewTargetHead, extractReviewedHead, extractReviewDiffBase, extractReviewDiffFingerprint, extractReviewedSnapshotTree, findAuthoritativeReviewCodeArtifact, loadPostReviewConfig, parseReviewVerdict, resolvePostReviewGlobs } from "./verification-review.js";
+import { extractReviewTargetHead, extractReviewedHead, extractReviewDiffBase, findAuthoritativeReviewCodeArtifact, loadPostReviewConfig, parseReviewVerdict, resolvePostReviewGlobs } from "./verification-review.js";
 import { check as checkPlatformSync } from "../platform/verification-sync.js";
 import { check as checkRequiredChecks } from "../platform/verification-required.js";
 import { inspectPlatformPullRequest } from "../platform/pull-requests.js";
 import { resolveMaterializedReviewedHeadRelation } from "../platform/change-request-git-evidence.js";
 import { resolveReviewedHeadRelation } from "../platform/merged-pr-equivalence.js";
 import { resolveLocalReviewedCommitRelation } from "../git/reviewed-commit-equivalence.js";
-import { resolveBranchWorktree } from "../git/branch-worktree.js";
 import { parseTypedTaskFrontmatter } from "./frontmatter.js";
 import { LEDGER_TERMINAL, LEDGER_SECTION_MISSING_CODE, LEDGER_SECTION_MISSING_MESSAGE, parseLedgerDocument, summarizeLedgerStage, validateLedgerRows } from "./ledger.js";
 import { isValidAgentInfraVersion } from "../version.js";
@@ -20,11 +19,9 @@ import { inspectDecisionDetailDuplicates } from "./decision-details.js";
 import { parseImplementationInputs } from "./implementation-inputs.js";
 import { scanVisibleMarkdown } from "./markdown.js";
 import { loadVerificationConfig } from "./verification-config.js";
-import { snapshotReview } from "../git/review-snapshot.js";
 import { inspectActivityLog } from "./activity-log.js";
 import { parseWorkflowWarnings } from "./workflow-warnings.js";
 import { OrchestrationStateError, readRun } from "./orchestration.js";
-import { resolveDeliveryTarget } from "./delivery-target.js";
 import { readPrDeliveryFact } from "./pr-delivery-fact.js";
 import { validateLocalArtifact } from "./local-artifact-finalization.js";
 import { getArtifactSchema } from "./artifact-schema.js";
@@ -35,6 +32,8 @@ import { readManualValidationCompletion } from "./manual-validation-completion.j
 import { sha256File } from "./artifact-receipts.js";
 import { summaryCommentState } from "../platform/pr-summary.js";
 import { taskIssueIdentity } from "../platform/task-identities.js";
+import { hasArtifactCompletionFact, hasArtifactCompletionLog } from './completion-facts.js';
+import { inspectReviewIdentity } from './review-identity.js';
 const TASK_ENUMS = {
     type: ["feature", "bugfix", "refactor", "docs", "chore"],
     workflow: ["feature-development", "bug-fix", "refactoring"],
@@ -1014,12 +1013,16 @@ function checkReviewFact({ taskDir, artifactFile, repositoryRoot }) {
         return failResult("review-fact", task.message);
     }
     const content = fs.readFileSync(resolvedArtifact.path, "utf8");
+    if (!hasArtifactCompletionFact(task.content, resolvedArtifact.path, 'review-code.completed')) {
+        return failResult("review-fact", `Review Code completion fact does not match ${path.basename(resolvedArtifact.path)}`);
+    }
+    if (!hasArtifactCompletionLog(task.content, path.basename(resolvedArtifact.path), 'review-code.completed')) {
+        return failResult("review-fact", `Review Code completion entry does not reference ${path.basename(resolvedArtifact.path)}`);
+    }
     const verdict = parseReviewVerdict(content);
     const reviewTargetHead = extractReviewTargetHead(content);
     const reviewReviewedHead = extractReviewedHead(content);
     const reviewDiffBase = extractReviewDiffBase(content);
-    const reviewedFingerprint = extractReviewDiffFingerprint(content);
-    const reviewedTree = extractReviewedSnapshotTree(content);
     if (!["通过", "需要修改", "拒绝", "Approved", "Changes Requested", "Rejected"].includes(verdict)) {
         return failResult("review-fact", `Unsupported review verdict '${verdict}'`);
     }
@@ -1031,71 +1034,19 @@ function checkReviewFact({ taskDir, artifactFile, repositoryRoot }) {
     if (!reviewTargetHead || !reviewReviewedHead || !reviewDiffBase) {
         return failResult("review-fact", "Review fact must record target head, reviewed head, and diff base");
     }
-    let gitRoot;
-    let head;
-    let baseline;
-    let targetHead;
-    let diffBase;
-    try {
-        const taskRepositoryRoot = execFileSync("git", ["-C", taskDir, "rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
-        gitRoot = reviewWorktreeForTask(taskRepositoryRoot, String(task.metadata.branch || "").trim()) ?? taskRepositoryRoot;
-        head = execFileSync("git", ["-C", gitRoot, "rev-parse", "HEAD"], { encoding: "utf8" }).trim();
-        const target = resolveDeliveryTarget(gitRoot, { remote: deliveryRemote, baseRef: deliveryBaseRef });
-        if (!target.ok)
-            throw new Error(target.message);
-        const reviewedRef = reviewReviewedHead;
-        baseline = execFileSync("git", ["-C", gitRoot, "rev-parse", `${reviewedRef}^{commit}`], { encoding: "utf8" }).trim();
-        targetHead = execFileSync("git", ["-C", gitRoot, "rev-parse", `${reviewTargetHead}^{commit}`], { encoding: "utf8" }).trim();
-        const computed = execFileSync("git", ["-C", gitRoot, "merge-base", baseline, targetHead], { encoding: "utf8" }).trim();
-        diffBase = execFileSync("git", ["-C", gitRoot, "rev-parse", `${reviewDiffBase}^{commit}`], { encoding: "utf8" }).trim();
-        if (diffBase !== computed)
-            throw new Error('saved review diff base does not match merge-base(reviewed head, target head)');
-    }
-    catch {
-        return blockedResult("review-fact", `Unable to resolve saved review commits in the task repository; re-run review-code`);
-    }
-    if (baseline !== head) {
-        return failResult("review-fact", `Reviewed head ${baseline.slice(0, 8)} does not match current HEAD ${head.slice(0, 8)}; re-run review-code`);
-    }
-    let actualSnapshot;
-    try {
-        actualSnapshot = snapshotReview({
-            cwd: gitRoot,
-            mode: "worktree",
-            baseline,
-            diffBase,
-            globs: resolvePostReviewGlobs({}, loadPostReviewConfig(repositoryRoot))
-        });
-    }
-    catch {
-        return blockedResult("review-fact", `Unable to recompute reviewed diff fingerprint from baseline ${baseline.slice(0, 8)}; re-run review-code`);
-    }
-    if (actualSnapshot.fingerprint !== reviewedFingerprint) {
-        return failResult("review-fact", `Reviewed diff fingerprint does not match the current worktree for baseline ${baseline.slice(0, 8)}; re-run review-code`);
-    }
-    if (!reviewedTree || actualSnapshot.tree !== reviewedTree) {
-        return failResult("review-fact", `Reviewed snapshot tree does not match the current worktree for baseline ${baseline.slice(0, 8)}; re-run review-code`);
+    const identity = inspectReviewIdentity(taskDir, content, repositoryRoot);
+    if (identity.status !== 'matched' || !identity.reviewedHead) {
+        return failResult('review-fact', `Review identity is ${identity.status}: ${identity.message}; re-run review-code`);
     }
+    const baseline = identity.reviewedHead;
     if (["通过", "Approved"].includes(verdict)) {
         const lastReviewedCommit = String(task.metadata.last_reviewed_commit || "").trim();
-        const cleanSnapshot = actualSnapshot.tree === execFileSync("git", ["-C", gitRoot, "rev-parse", `${baseline}^{tree}`], { encoding: "utf8" }).trim();
-        if (cleanSnapshot && lastReviewedCommit !== baseline) {
+        if (lastReviewedCommit !== baseline) {
             return failResult("review-fact", `Approved clean review must set task last_reviewed_commit to reviewed head ${baseline.slice(0, 8)}`);
         }
-        if (!cleanSnapshot && lastReviewedCommit) {
-            return failResult("review-fact", "Approved review with uncommitted changes must remain unanchored until commit");
-        }
     }
     return passResult("review-fact", `Review fact valid for ${path.basename(resolvedArtifact.path)} at ${baseline.slice(0, 8)}`);
 }
-function reviewWorktreeForTask(repositoryRoot, branch) {
-    if (!branch)
-        return null;
-    const worktree = resolveBranchWorktree(repositoryRoot, branch);
-    if (worktree)
-        return worktree;
-    throw new Error(`Task branch '${branch}' is not checked out in a registered worktree`);
-}
 function resolvePostReviewBaseline({ gitRoot, lastReviewedCommit, reviewArtifact }) {
     if (SHA_PATTERN.test(lastReviewedCommit) && gitCommitExists(gitRoot, lastReviewedCommit)) {
         return { ok: true, sha: lastReviewedCommit };

package/dist/lib/task/verification.js

@@ -89,47 +89,44 @@ async function verifyTaskEvent(request, options = {}) {
 function statusLabel(status) {
     return status === 'fail' ? 'FAIL' : status === 'blocked' ? 'BLOCKED' : 'pass';
 }
-function renderPayload(payload) {
-    const lines = [];
-    if (Array.isArray(payload.checks)) {
-        const gateMode = typeof payload.gate === 'string';
-        lines.push(gateMode
-            ? `Verification: ${payload.gate} | Skill: ${payload.skill}`
-            : `Check: ${payload.status} | Skill: ${payload.skill} | Type: ${payload.type}`, '');
-        for (const check of payload.checks) {
-            const raw = statusLabel(check.status);
-            const effective = statusLabel(check.effectiveStatus ?? check.status);
-            const reason = check.reason ?? 'CHECK_FAILED';
-            const message = check.message ?? reason;
-            lines.push(`  [${effective}] ${check.checkId ?? check.type} (${check.classification ?? 'hard'}; raw ${raw}; reason ${reason}) - ${message}; ${check.action ?? 'Review validation output'}`);
-        }
-        const summary = payload.summary ?? (() => {
-            const checks = payload.checks;
-            const statuses = checks.map((check) => check.effectiveStatus ?? check.status);
-            return `${statuses.filter((status) => status === 'pass').length} passed, ${statuses.filter((status) => status === 'fail').length} failed${statuses.includes('blocked') ? `, ${statuses.filter((status) => status === 'blocked').length} blocked` : ''}`;
-        })();
-        lines.push('', `Result: ${summary} - ${payload.action}`);
-    }
-    else {
-        lines.push(`Check: ${payload.status} | Skill: ${payload.skill} | Type: ${payload.type}`, '');
-        const raw = statusLabel(payload.status);
-        const effective = statusLabel(payload.effectiveStatus ?? payload.status);
-        const reason = payload.reason ?? 'CHECK_FAILED';
-        lines.push(`  [${effective}] ${payload.checkId ?? payload.type} (${payload.classification ?? 'hard'}; raw ${raw}; reason ${reason}) - ${payload.message ?? reason}; ${payload.action ?? 'Review validation output'}`);
-        const status = payload.effectiveStatus ?? payload.status;
-        const summary = status === 'pass' ? '1 passed, 0 failed'
-            : status === 'blocked' ? '0 passed, 0 failed, 1 blocked' : '0 passed, 1 failed';
-        const action = status === 'pass' ? 'Requested check passed'
-            : status === 'blocked' ? `Resolve blocked ${payload.type} check and re-run check`
-                : `Fix ${payload.type} issues and re-run check`;
-        lines.push('', `Result: ${summary} - ${action}`);
-    }
-    return `${lines.join('\n')}\n`;
-}
 function renderTaskVerification(result) {
     if (result.status === 'failed')
         return `Verification failed: ${result.error?.code ?? 'VERIFY_FAILED'} - ${result.error?.message ?? 'unknown error'}\n`;
-    return result.invocations.map((invocation) => renderPayload(invocation.payload)).join('');
+    const target = `${result.event}${result.artifact ? ` (${result.artifact})` : ''}`;
+    const lines = [`Verification: ${result.status} | Target: ${target} | Skill: ${result.skill}`];
+    const checks = result.invocations.flatMap(({ payload }) => {
+        if (Array.isArray(payload.checks))
+            return payload.checks;
+        return [payload];
+    });
+    const counts = {
+        pass: checks.filter((check) => (check.effectiveStatus ?? check.status) === 'pass').length,
+        fail: checks.filter((check) => (check.effectiveStatus ?? check.status) === 'fail').length,
+        blocked: checks.filter((check) => (check.effectiveStatus ?? check.status) === 'blocked').length
+    };
+    const summary = `${counts.pass} passed, ${counts.fail} failed${counts.blocked > 0 ? `, ${counts.blocked} blocked` : ''}`;
+    lines.push('', `Result: ${summary}`);
+    for (const check of checks) {
+        const rawStatus = check.status;
+        const effectiveStatus = check.effectiveStatus ?? rawStatus;
+        const isSoftWarning = (rawStatus === 'fail' || rawStatus === 'blocked') && effectiveStatus === 'pass';
+        const reason = check.reason ?? 'CHECK_FAILED';
+        const message = check.message ?? reason;
+        const action = check.action ?? 'Review validation output';
+        const id = check.checkId ?? check.type;
+        const isHumanExemptionNotice = id === 'post-review-commit'
+            && typeof message === 'string'
+            && /\bhuman-decided (?:post-review )?exemption\b/i.test(message)
+            && /\bPRC-\d+\s*:/.test(message);
+        if (effectiveStatus === 'pass' && !isSoftWarning && !isHumanExemptionNotice)
+            continue;
+        lines.push(isSoftWarning
+            ? `Warning: ${id} (${rawStatus === 'blocked' ? `raw BLOCKED; ` : ''}${reason}) - ${message}; ${action}`
+            : isHumanExemptionNotice
+                ? `Notice: ${id} - ${message}; ${action}`
+                : `  [${statusLabel(effectiveStatus)}] ${id} (${reason}) - ${message}; ${action}`);
+    }
+    return `${lines.join('\n')}\n`;
 }
 export { VERIFICATION_CATALOG, renderTaskVerification, verifyTaskEvent };
 //# sourceMappingURL=verification.js.map

package/dist/lib/task/workflow-warning-intents.js

@@ -1,4 +1,5 @@
 import fs from 'node:fs';
+import path from 'node:path';
 import { resolveTaskRef } from './resolve-ref.js';
 import { parseTaskFrontmatter } from './frontmatter.js';
 import { WORKFLOW_WARNING_COLUMNS, WORKFLOW_WARNING_HEADINGS, WORKFLOW_WARNING_SEVERITIES, WORKFLOW_WARNING_STATUSES, parseWorkflowWarnings } from './workflow-warnings.js';
@@ -120,7 +121,12 @@ function projectFinalizationWarning(taskRef, warning, options = {}) {
     let prepared = resolved.state === 'completed';
     if (!prepared && resolved.state === 'active') {
         try {
-            prepared = parseTaskFrontmatter(fs.readFileSync(resolved.taskMdPath, 'utf8')).status === 'completed';
+            const taskContent = fs.readFileSync(resolved.taskMdPath, 'utf8');
+            prepared = parseTaskFrontmatter(taskContent).status === 'completed';
+            if (!prepared) {
+                const lifecycle = JSON.parse(fs.readFileSync(path.join(resolved.taskDir, '.task-lifecycle.json'), 'utf8'));
+                prepared = lifecycle.taskId === resolved.taskId && lifecycle.intent === 'complete';
+            }
         }
         catch {
             prepared = false;

package/dist/lifecycle-build-manifest.json

@@ -1,6 +1,6 @@
 {
   "protocolVersion": 3,
-  "packageVersion": "0.11.6",
-  "sourceInputHash": "402048e73650c5ac4edfb1bc4b48ca3fceb7b9068790b1321281c4994121e80c",
-  "internalExecutableBuildHash": "47ecd04ac30183443b2b86f83d1668b8bdf9e59162cc9e2cedd333d3011843e9"
+  "packageVersion": "0.11.8",
+  "sourceInputHash": "6ddb72f8b50137d5148a47172bd7eb2628b17a937ae647ac38350e582ba08124",
+  "internalExecutableBuildHash": "c886e015506879620bb490f1ea5977d9952f2bbb4515d3a0b49e0ec184b48028"
 }

package/lib/agent-clients/adapters/codex.ts

@@ -54,7 +54,7 @@ const codexAdapter = defineAgentClientAdapter({
       containerMount: '/home/devuser/.codex',
       versionCmd: 'codex --version',
       setupHint: 'Run codex once inside the container and choose Device Code login if needed.',
-      tmpfs: { size: '512m', seed: ['config.toml', 'model-catalogs'] },
+      tmpfs: { size: '512m', seed: ['config.toml', 'model-catalogs'], exec: true },
       hostLiveMounts: [
         {
           hostPath: hostJoin(home, '.codex', 'auth.json'),