@fitlab-ai/agent-infra 0.11.7 → 0.11.9

package/dist/lib/platform/issue-comments.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { createHash } from 'node:crypto';
 import { parseTaskFrontmatter } from '../task/frontmatter.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
+import { coordinatePlatformWrite } from './operation-coordinator.js';
 import { resolvePlatformProviderContext } from './context.js';
 import { platformResult } from './types.js';
 import { providerError, providerOperationContext, providerStatus, providerResourceToken, unsupportedProviderOperation } from './provider-bridge.js';
@@ -29,6 +30,8 @@ const ARTIFACT_TITLES = {
     'review-plan': '技术方案审查',
     code: '实现报告',
     'review-code': '代码审查',
+    'manual-validation': '人工验证',
+    'validation-run': '验证运行证据',
     'pr-review': 'PR 审查报告'
 };
 function normalizeCommentContent(content) {
@@ -98,7 +101,7 @@ function taskCommentLanguage(repoRoot) {
 }
 function artifactIdentity(artifact) {
     const stem = path.basename(artifact, '.md');
-    const match = stem.match(/^(analysis|review-analysis|plan|review-plan|code|review-code|pr-review)(?:-r(\d+))?$/);
+    const match = stem.match(/^(analysis|review-analysis|plan|review-plan|code|review-code|manual-validation|validation-run|pr-review)(?:-r(\d+))?$/);
     if (!match)
         throw new Error(`unsupported artifact '${artifact}'`);
     const base = ARTIFACT_TITLES[match[1]];
@@ -430,7 +433,7 @@ function writeComment(client, repo, issue, cwd, body, id) {
     const endpoint = id ? `repos/${repo}/issues/comments/${id}` : `repos/${repo}/issues/${issue}/comments`;
     return client.json(['api', endpoint, '-X', id ? 'PATCH' : 'POST', '--input', '-'], { cwd, method: id ? 'PATCH' : 'POST', input: JSON.stringify({ body }) });
 }
-async function syncPlatformComment(taskRef, options) {
+async function syncPlatformCommentImpl(taskRef, options) {
     const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
     if (!resolved.ok) {
         return platformResult('failed', {
@@ -452,7 +455,12 @@ async function syncPlatformComment(taskRef, options) {
     }
     let desired;
     try {
-        desired = expectedComments(resolved.taskId, taskContent, resolved.taskDir, resolved.repoRoot, options);
+        const projectedContent = options.kind === 'task' && options.taskProjection ? options.taskProjection.content : taskContent;
+        if (options.kind === 'task' && options.taskProjection
+            && createHash('sha256').update(projectedContent).digest('hex') !== options.taskProjection.sha256) {
+            throw Object.assign(new Error('finalization task projection digest does not match content'), { code: 'FINALIZATION_PROJECTION_INVALID' });
+        }
+        desired = expectedComments(resolved.taskId, projectedContent, resolved.taskDir, resolved.repoRoot, options);
     }
     catch (error) {
         return platformResult('failed', {
@@ -644,6 +652,52 @@ async function syncPlatformComment(taskRef, options) {
     });
     return result;
 }
+async function syncPlatformComment(taskRef, options) {
+    const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
+    if (!resolved.ok)
+        return syncPlatformCommentImpl(taskRef, options);
+    const taskContent = fs.readFileSync(resolved.taskMdPath, 'utf8');
+    if (!taskIssueIdentity(parseTaskFrontmatter(taskContent)))
+        return syncPlatformCommentImpl(taskRef, options);
+    let operation;
+    try {
+        const sourceContent = options.kind === 'task' && options.taskProjection ? options.taskProjection.content : taskContent;
+        const desired = expectedComments(resolved.taskId, sourceContent, resolved.taskDir, resolved.repoRoot, options);
+        const content = desired.map((chunk) => chunk.content).join('\0');
+        const kind = options.kind === 'task' ? 'task-comment' : options.kind === 'summary' ? 'summary-comment'
+            : options.kind === 'cancel' ? 'cancel-comment' : 'artifact-comment';
+        const target = options.kind === 'artifact' ? options.artifact : options.kind;
+        operation = { kind, target, expectedDigest: createHash('sha256').update(content).digest('hex') };
+    }
+    catch {
+        return syncPlatformCommentImpl(taskRef, options);
+    }
+    const execute = () => syncPlatformCommentImpl(taskRef, options);
+    if (options.skipQueue)
+        return execute();
+    return coordinatePlatformWrite({
+        operation: { taskRef: resolved.taskId, cwd: resolved.repoRoot, ...operation, dependency: options.dependency ?? 'deferred' },
+        agent: options.agent,
+        execute,
+        block: (error) => platformResult('blocked', { error }),
+        persistenceFailure: (error) => platformResult('failed', { error })
+    });
+}
+function inspectPlatformCommentOperation(taskRef, options) {
+    const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
+    if (!resolved.ok)
+        return null;
+    const taskContent = fs.readFileSync(resolved.taskMdPath, 'utf8');
+    if (!taskIssueIdentity(parseTaskFrontmatter(taskContent)))
+        return null;
+    const sourceContent = options.kind === 'task' && options.taskProjection ? options.taskProjection.content : taskContent;
+    const desired = expectedComments(resolved.taskId, sourceContent, resolved.taskDir, resolved.repoRoot, options);
+    const kind = options.kind === 'task' ? 'task-comment' : options.kind === 'summary' ? 'summary-comment'
+        : options.kind === 'cancel' ? 'cancel-comment' : 'artifact-comment';
+    const target = options.kind === 'artifact' ? options.artifact : options.kind;
+    const expectedDigest = createHash('sha256').update(desired.map((chunk) => chunk.content).join('\0')).digest('hex');
+    return { kind, target, expectedDigest, id: createHash('sha256').update(`${kind}\0${target}\0${expectedDigest}`).digest('hex') };
+}
 async function listPlatformComments(issue, cwd = process.cwd(), client) {
     const loaded = await resolvePlatformProviderContext({ cwd, client });
     const context = loaded.ok ? loaded.value.context : loaded.context;
@@ -708,5 +762,5 @@ async function checkPlatformCommentOwner(taskRef, options = {}) {
     }
     return platformResult('no-op', { ...contextFields(context), resource: { kind: 'issue', number: resourceIdentityNumber(issueIdentity), identity: issueIdentity }, error: null });
 }
-export { COMMENT_BYTE_LIMIT, MARKERS, chunkArtifactComment, findMarkerComments, listRemoteComments, checkPlatformCommentOwner, listPlatformComments, normalizeCommentContent, renderTaskComment, renderTaskCommentResult, isTaskCommentTooLarge, syncPlatformComment, validateRelatedMarkerSet, writeComment };
+export { COMMENT_BYTE_LIMIT, MARKERS, chunkArtifactComment, inspectPlatformCommentOperation, findMarkerComments, listRemoteComments, checkPlatformCommentOwner, listPlatformComments, normalizeCommentContent, renderTaskComment, renderTaskCommentResult, isTaskCommentTooLarge, syncPlatformComment, validateRelatedMarkerSet, writeComment };
 //# sourceMappingURL=issue-comments.js.map

package/dist/lib/platform/issues.js

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { createHash } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { buildDefaultBody } from '../task/commands/issue-body.js';
 import { extractTitle, parseTaskFrontmatter } from '../task/frontmatter.js';
@@ -10,10 +11,11 @@ import { writeTask } from '../task/write.js';
 import { resolvePlatformProviderContext } from './context.js';
 import { DEFAULT_REQUIREMENT_SECTION_ANCHORS, chooseMilestone, desiredIssueType, normalizeOption, planIssueMetadata } from './issue-metadata.js';
 import { platformResult } from './types.js';
-import { labelDelta, planInLabelUpdate, syncLabelDelta, validateInLabelMapping, validateRepositoryLabelPayload } from './in-label-sync.js';
+import { labelDelta, inLabelMappingDigest, planInLabelUpdate, syncLabelDelta, validateInLabelMapping, validateRepositoryLabelPayload } from './in-label-sync.js';
 import { providerError, providerOperationContext, providerStatus, providerResourceIdentity, providerResourceToken, unsupportedProviderOperation } from './provider-bridge.js';
 import { resourceIdentityEquals, resourceIdentityNumber, resourceIdentityString, serializeResourceIdentity } from './resource-identity.js';
 import { taskIssueIdentity, taskIssueIdentityError } from './task-identities.js';
+import { coordinatePlatformWrite } from './operation-coordinator.js';
 function result(status, taskId, issueNumber, overrides = {}) {
     return {
         ...platformResult(status),
@@ -247,7 +249,7 @@ async function createPlatformIssue(taskRef, options) {
             platform: base.context.platform, capabilities: base.context.capabilities,
             operations: [{ name: 'issue:create', status: 'planned', reasonCode: null }], error: null
         });
-    {
+    const execute = async () => {
         const created = base.provider.issues?.create
             ? await base.provider.issues.create({
                 context: providerOperationContext(base.loadedContext),
@@ -290,7 +292,7 @@ async function createPlatformIssue(taskRef, options) {
             return result('failed', base.resolved.taskId, null, {
                 platform: base.context.platform, capabilities: base.context.capabilities,
                 resource: { kind: 'issue', number: issueNumber, identity: inspected.value.identity || createdIdentity },
-                error: { code: 'ISSUE_CREATED_BIND_FAILED', message: written.error.message, retryable: false }
+                error: { code: 'ISSUE_CREATED_BIND_FAILED', message: written.error.message, retryable: true }
             });
         return result('applied', base.resolved.taskId, issueNumber, {
             changed: true,
@@ -301,7 +303,26 @@ async function createPlatformIssue(taskRef, options) {
             issue: normalizeProviderIssue(inspected.value, repository, issueNumber),
             error: null
         });
-    }
+    };
+    const issueCreate = { title: payload.title, bodyDigest: createHash('sha256').update(payload.body).digest('hex') };
+    const operation = {
+        kind: 'issue-create',
+        target: `task:${base.resolved.taskId}`,
+        expectedDigest: createHash('sha256').update(JSON.stringify({
+            taskId: base.resolved.taskId,
+            title: payload.title,
+            body: createHash('sha256').update(payload.body).digest('hex'),
+            labels: payload.labels || [], assignees: payload.assignees,
+            milestone: typeof payload.milestone === 'string' ? payload.milestone : null
+        })).digest('hex')
+    };
+    return coordinatePlatformWrite({
+        operation: { taskRef: base.resolved.taskId, cwd: base.resolved.repoRoot, ...operation, issueCreate, dependency: 'required' },
+        agent: options.agent,
+        execute,
+        block: (error) => result('blocked', base.resolved.taskId, null, { platform: base.context.platform, capabilities: base.context.capabilities, error }),
+        persistenceFailure: (error) => result('failed', base.resolved.taskId, null, { error })
+    });
 }
 async function bindPlatformIssue(taskRef, options) {
     const base = await resolvedContext(taskRef, options);
@@ -435,7 +456,7 @@ function desiredFieldValues(frontmatter, fields) {
     }
     return desired;
 }
-async function syncPlatformIssue(taskRef, options) {
+async function syncPlatformIssueImpl(taskRef, options) {
     const base = await resolvedContext(taskRef, options);
     if (!base.ok)
         return base.output;
@@ -582,5 +603,84 @@ async function syncPlatformIssue(taskRef, options) {
         operations: plan.operations.map((operation) => operation.status === 'planned' ? { ...operation, status: 'applied' } : operation), error: null
     });
 }
+async function syncPlatformIssue(taskRef, options) {
+    const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
+    if (!resolved.ok || options.dryRun)
+        return syncPlatformIssueImpl(taskRef, options);
+    let frontmatter;
+    let taskContent;
+    try {
+        taskContent = fs.readFileSync(resolved.taskMdPath, 'utf8');
+        frontmatter = parseTaskFrontmatter(taskContent);
+    }
+    catch {
+        return syncPlatformIssueImpl(taskRef, options);
+    }
+    const identity = taskIssueIdentity(frontmatter);
+    if (!identity || ![
+        options.requirements, options.issueType, options.fields, options.status !== undefined,
+        options.assignees !== undefined, options.milestone !== undefined,
+        options.inLabels !== undefined, options.state !== undefined
+    ].some(Boolean))
+        return syncPlatformIssueImpl(taskRef, options);
+    let fromDiffFiles;
+    let mappingDigest;
+    if (options.inLabels === 'from-diff') {
+        const taskBase = typeof frontmatter.delivery_base_ref === 'string' ? frontmatter.delivery_base_ref.trim() : '';
+        if (taskBase && (!options.base || options.base === taskBase)) {
+            try {
+                fromDiffFiles = execFileSync('git', ['diff', `${taskBase}...HEAD`, '--name-only'], {
+                    cwd: resolved.repoRoot, encoding: 'utf8'
+                }).trim().split(/\r?\n/).filter(Boolean).sort();
+                const config = JSON.parse(fs.readFileSync(path.join(resolved.repoRoot, '.agents', '.airc.json'), 'utf8'));
+                const mapping = inLabelMappingDigest(config.labels?.in);
+                if (!mapping.ok)
+                    return result('failed', resolved.taskId, resourceIdentityNumber(identity), {
+                        error: { code: mapping.error.code, message: mapping.error.message, retryable: false }
+                    });
+                mappingDigest = mapping.digest;
+            }
+            catch {
+                return result('failed', resolved.taskId, resourceIdentityNumber(identity), {
+                    error: { code: 'IN_LABEL_SYNC_EVIDENCE_UNAVAILABLE', message: 'Unable to derive the current changed-file set for Issue metadata recovery', retryable: false }
+                });
+            }
+        }
+    }
+    const issueMetadata = {
+        requirements: options.requirements === true,
+        issueType: options.issueType === true,
+        fields: options.fields === true,
+        ...(options.status !== undefined ? { status: options.status } : {}),
+        ...(options.assignees !== undefined ? { assignees: options.assignees } : {}),
+        ...(options.milestone !== undefined ? { milestone: options.milestone } : {}),
+        ...(options.inLabels ? { inLabels: options.inLabels } : {}),
+        ...(options.base ? { base: options.base } : {}),
+        ...(fromDiffFiles ? { fromDiffFiles } : {}),
+        ...(mappingDigest ? { inLabelMappingDigest: mappingDigest } : {}),
+        ...(options.state ? { state: options.state } : {}),
+        ...(options.closeReason ? { closeReason: options.closeReason } : {})
+    };
+    const operation = {
+        kind: 'issue-metadata',
+        target: JSON.stringify(identity),
+        expectedDigest: createHash('sha256').update(JSON.stringify({
+            ...issueMetadata,
+            task: resolved.taskId,
+            taskContent: createHash('sha256').update(taskContent).digest('hex')
+        })).digest('hex')
+    };
+    const dependency = options.dependency ?? (options.state === 'closed' && options.closeReason === 'not_planned' ? 'required' : 'deferred');
+    const execute = () => syncPlatformIssueImpl(taskRef, options);
+    if (options.skipQueue)
+        return execute();
+    return coordinatePlatformWrite({
+        operation: { taskRef: resolved.taskId, cwd: resolved.repoRoot, ...operation, issueMetadata, dependency },
+        agent: options.agent,
+        execute,
+        block: (error) => result('blocked', resolved.taskId, resourceIdentityNumber(identity), { error }),
+        persistenceFailure: (error) => result('failed', resolved.taskId, resourceIdentityNumber(identity), { error })
+    });
+}
 export { bindPlatformIssue, createPlatformIssue, inspectPlatformIssue, requirementSectionAnchors, syncPlatformIssue };
 //# sourceMappingURL=issues.js.map

package/dist/lib/platform/operation-coordinator.js

@@ -0,0 +1,74 @@
+import { recoverPlatformOperations } from '../task/platform-operation-recovery.js';
+import { recordPlatformOperation } from '../task/platform-operation-journal.js';
+async function coordinatePlatformWrite(input) {
+    let operationId;
+    try {
+        const queued = recordPlatformOperation({ ...input.operation, state: 'queued' });
+        operationId = queued.id;
+    }
+    catch (error) {
+        const value = error;
+        return input.persistenceFailure({
+            code: value.code || 'PLATFORM_OPERATION_JOURNAL_WRITE_FAILED',
+            message: value.message || 'Unable to queue platform operation',
+            retryable: true
+        });
+    }
+    const selection = input.operation.kind === 'issue-metadata' && input.operation.issueMetadata?.state === 'closed'
+        ? 'all' : input.operation.dependency;
+    const drained = input.drain
+        ? await input.drain(input.operation.taskRef, operationId, input.agent, input.operation.cwd)
+        : await recoverPlatformOperations(input.operation.taskRef, selection, {
+            agent: input.agent,
+            client: input.client,
+            cwd: input.operation.cwd,
+            excludeId: operationId
+        });
+    if (drained.status !== 'applied' && drained.status !== 'no-op') {
+        return input.block(drained.error ?? {
+            code: 'PLATFORM_OPERATION_QUEUE_BLOCKED',
+            message: 'A previous platform operation is still unresolved; the current write remains queued',
+            retryable: true
+        });
+    }
+    try {
+        recordPlatformOperation({ ...input.operation, state: 'pending' });
+    }
+    catch (error) {
+        const value = error;
+        return input.persistenceFailure({
+            code: value.code || 'PLATFORM_OPERATION_JOURNAL_WRITE_FAILED',
+            message: value.message || 'Unable to mark platform operation as started',
+            retryable: true
+        });
+    }
+    let output;
+    try {
+        output = await input.execute();
+    }
+    catch (error) {
+        const value = error;
+        output = input.block({ code: value.code || 'PLATFORM_WRITE_FAILED', message: value.message || String(error), retryable: true });
+    }
+    const succeeded = (output.status === 'applied' || output.status === 'no-op')
+        && !output.error && !(output.warnings?.length);
+    const state = succeeded ? 'succeeded' : output.status === 'failed' && output.error?.retryable === false ? 'failed' : 'unknown';
+    try {
+        recordPlatformOperation({
+            ...input.operation,
+            state,
+            lastCode: output.error?.code ?? output.warnings?.[0]?.code ?? null
+        });
+    }
+    catch (error) {
+        const value = error;
+        return input.persistenceFailure({
+            code: value.code || 'PLATFORM_OPERATION_JOURNAL_WRITE_FAILED',
+            message: value.message || 'Unable to persist platform operation outcome',
+            retryable: true
+        });
+    }
+    return output;
+}
+export { coordinatePlatformWrite };
+//# sourceMappingURL=operation-coordinator.js.map

package/dist/lib/platform/pr-review.js

@@ -1,7 +1,12 @@
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { coordinatePlatformWrite } from './operation-coordinator.js';
 import { resolvePlatformProviderContext } from './context.js';
 import { platformResult } from './types.js';
 import { providerError, providerOperationContext, providerStatus, providerResourceToken, unsupportedProviderOperation } from './provider-bridge.js';
-import { isResourceIdentity, resourceIdentityNumber, reviewMarker as resourceReviewMarker } from './resource-identity.js';
+import { isResourceIdentity, resourceIdentityEquals, resourceIdentityNumber, reviewMarker as resourceReviewMarker } from './resource-identity.js';
+import { resolveTaskRef } from '../task/resolve-ref.js';
 const REVIEW_EVENTS = ['COMMENT', 'APPROVE', 'REQUEST_CHANGES'];
 // Marker-safe scope: a task id (`TASK-YYYYMMDD-HHMMSS`) or a bare PR number
 // (`pr{N}`). Any other value (e.g. one containing `\r\n` or `-->`) would break
@@ -19,6 +24,34 @@ export function reviewedCommitMarker(sha) {
 function normalizeBody(body) {
     return String(body || '').replace(/\r\n/g, '\n').replace(/\n+$/, '\n');
 }
+function canonicalReviewBody(body) {
+    return normalizeBody(body).replace(/\n$/u, '');
+}
+function reviewArtifactName(round, artifactFile) {
+    return path.basename(artifactFile) === artifactFile
+        && (artifactFile === 'pr-review.md' && round === 1 || artifactFile === `pr-review-r${round}.md`);
+}
+export function readReviewBodyFile(taskRef, round, artifactFile, bodyDigest, cwd) {
+    if (!/^TASK-\d{8}-\d{6}$/u.test(taskRef) || path.basename(artifactFile) !== artifactFile
+        || !reviewArtifactName(round, artifactFile)) {
+        throw Object.assign(new Error('Pull-request review artifact identity is invalid'), { code: 'PLATFORM_OPERATION_PAYLOAD_INVALID' });
+    }
+    const task = resolveTaskRef(taskRef, cwd ? { repoRoot: cwd } : {});
+    if (!task.ok)
+        throw Object.assign(new Error(task.message), { code: 'PLATFORM_OPERATION_PAYLOAD_INVALID' });
+    const bodyFile = artifactFile.replace(/^pr-review/u, 'pr-review-body');
+    const report = fs.readFileSync(path.join(task.taskDir, artifactFile), 'utf8');
+    const bodyReferences = [...report.matchAll(/^\*\*(?:正文文件|Body file)\*\*(?:：|:)\s*`([^`]+)`[^\r\n]*$/gmu)]
+        .map((match) => match[1]);
+    if (bodyReferences.length !== 1 || bodyReferences[0] !== bodyFile) {
+        throw Object.assign(new Error('Pull-request review artifact does not reference its canonical body file'), { code: 'PLATFORM_OPERATION_PAYLOAD_INVALID' });
+    }
+    const body = canonicalReviewBody(fs.readFileSync(path.join(task.taskDir, bodyFile), 'utf8'));
+    if (!body || createHash('sha256').update(body).digest('hex') !== bodyDigest) {
+        throw Object.assign(new Error('Canonical pull-request review body does not match its persisted digest'), { code: 'PLATFORM_OPERATION_PAYLOAD_INVALID' });
+    }
+    return body;
+}
 function firstLine(body) {
     return normalizeBody(String(body || '')).split('\n', 1)[0] || '';
 }
@@ -74,6 +107,13 @@ export async function publishPrReview(options) {
     if (!hasUsableContext(context)) {
         return platformResult(context.status, { platform: context.platform, capabilities: context.capabilities, error: context.error });
     }
+    const providerScopeId = loaded.ok ? loaded.value.snapshot.scope.id : null;
+    if (options.expectedProviderScopeId && providerScopeId !== options.expectedProviderScopeId) {
+        return platformResult('failed', {
+            platform: context.platform, capabilities: context.capabilities,
+            error: { code: 'PLATFORM_OPERATION_IDENTITY_MISMATCH', message: 'Current provider scope differs from the persisted operation target', retryable: false }
+        });
+    }
     const identity = loaded.ok ? (() => { try {
         return providerResourceToken(loaded.value.provider, 'pull-request', String(options.prNumber));
     }
@@ -87,6 +127,13 @@ export async function publishPrReview(options) {
         });
     }
     const identityNumber = resourceIdentityNumber(identity);
+    if (options.expectedResource && !resourceIdentityEquals(identity, options.expectedResource)) {
+        return platformResult('failed', {
+            platform: context.platform, capabilities: context.capabilities,
+            resource: { kind: 'pull-request', number: identityNumber, identity },
+            error: { code: 'PLATFORM_OPERATION_IDENTITY_MISMATCH', message: 'Current pull request identity differs from the persisted operation target', retryable: false }
+        });
+    }
     if (!REVIEW_EVENTS.includes(options.event)) {
         return platformResult('failed', {
             platform: context.platform, capabilities: context.capabilities,
@@ -101,6 +148,65 @@ export async function publishPrReview(options) {
             error: { code: 'REVIEW_IDENTITY_INVALID', message: 'review scope must be a task id or pr{N}; commitSha is required', retryable: false }
         });
     }
+    if (/^TASK-\d{8}-\d{6}$/u.test(options.identity.scope) && !options.skipQueue && !options.dryRun) {
+        if (!options.agent)
+            return platformResult('failed', {
+                platform: context.platform, capabilities: context.capabilities,
+                resource: { kind: 'pull-request', number: identityNumber, identity },
+                error: { code: 'PR_REVIEW_AGENT_REQUIRED', message: 'task-scoped review publication requires an agent token', retryable: false }
+            });
+        if (!options.recoveryArtifact || !reviewArtifactName(options.identity.round, options.recoveryArtifact))
+            return platformResult('failed', {
+                platform: context.platform, capabilities: context.capabilities,
+                resource: { kind: 'pull-request', number: identityNumber, identity },
+                error: { code: 'PR_REVIEW_ARTIFACT_REQUIRED', message: 'task-scoped review publication requires its canonical review artifact', retryable: false }
+            });
+        const body = canonicalReviewBody(options.body);
+        const bodyDigest = createHash('sha256').update(body).digest('hex');
+        try {
+            if (readReviewBodyFile(options.identity.scope, options.identity.round, options.recoveryArtifact, bodyDigest, options.cwd) !== body)
+                throw new Error('body mismatch');
+        }
+        catch {
+            return platformResult('failed', {
+                platform: context.platform, capabilities: context.capabilities,
+                resource: { kind: 'pull-request', number: identityNumber, identity },
+                error: { code: 'PR_REVIEW_ARTIFACT_MISMATCH', message: 'Review body must match the canonical review body file', retryable: false }
+            });
+        }
+        const pullRequestReview = {
+            prNumber: String(options.prNumber),
+            resource: identity,
+            providerScopeId: providerScopeId,
+            scope: options.identity.scope,
+            round: options.identity.round,
+            commitSha: options.identity.commitSha,
+            event: options.event,
+            artifactFile: options.recoveryArtifact,
+            bodyDigest
+        };
+        return coordinatePlatformWrite({
+            operation: {
+                taskRef: options.identity.scope,
+                cwd: options.cwd || process.cwd(),
+                kind: 'pull-request-review',
+                target: JSON.stringify(identity),
+                expectedDigest: createHash('sha256').update(JSON.stringify(pullRequestReview)).digest('hex'),
+                dependency: 'deferred',
+                pullRequestReview
+            },
+            agent: options.agent,
+            execute: () => publishPrReview({ ...options, expectedProviderScopeId: providerScopeId, skipQueue: true }),
+            block: (error) => platformResult('blocked', {
+                platform: context.platform, capabilities: context.capabilities,
+                resource: { kind: 'pull-request', number: identityNumber, identity }, error
+            }),
+            persistenceFailure: (error) => platformResult('failed', {
+                platform: context.platform, capabilities: context.capabilities,
+                resource: { kind: 'pull-request', number: identityNumber, identity }, error
+            })
+        });
+    }
     const marker = reviewMarker({ ...options.identity, resource: identity });
     const listed = await listPrReviews(options.prNumber, { cwd: options.cwd, client: options.client });
     if (listed.status === 'failed' || listed.status === 'blocked')