@fitlab-ai/agent-infra 0.11.7 → 0.11.9

package/lib/platform/issue-comments.ts

@@ -4,6 +4,7 @@ import { createHash } from 'node:crypto';
 
 import { parseTaskFrontmatter } from '../task/frontmatter.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
+import { coordinatePlatformWrite } from './operation-coordinator.ts';
 import { resolvePlatformProviderContext } from './context.ts';
 import type { PlatformClient } from './context.ts';
 import { platformResult } from './types.ts';
@@ -51,6 +52,9 @@ type SyncOptions = {
   client?: PlatformClient;
   runtimeVersion?: string;
   summaryAuthorization?: { sha256: string };
+  dependency?: 'deferred' | 'required';
+  skipQueue?: boolean;
+  taskProjection?: { content: string; sha256: string };
 };
 
 function providerCommentId(id: string, provider: { identity?: { comment?: string } }): number | string {
@@ -74,6 +78,8 @@ const ARTIFACT_TITLES: Record<string, string> = {
   'review-plan': '技术方案审查',
   code: '实现报告',
   'review-code': '代码审查',
+  'manual-validation': '人工验证',
+  'validation-run': '验证运行证据',
   'pr-review': 'PR 审查报告'
 };
 
@@ -150,7 +156,7 @@ function taskCommentLanguage(repoRoot: string): string {
 
 function artifactIdentity(artifact: string): { stem: string; title: string } {
   const stem = path.basename(artifact, '.md');
-  const match = stem.match(/^(analysis|review-analysis|plan|review-plan|code|review-code|pr-review)(?:-r(\d+))?$/);
+  const match = stem.match(/^(analysis|review-analysis|plan|review-plan|code|review-code|manual-validation|validation-run|pr-review)(?:-r(\d+))?$/);
   if (!match) throw new Error(`unsupported artifact '${artifact}'`);
   const base = ARTIFACT_TITLES[match[1]!]!;
   const round = match[2] ? Number(match[2]) : 1;
@@ -529,7 +535,7 @@ function writeComment(
   );
 }
 
-async function syncPlatformComment(taskRef: string, options: SyncOptions): Promise<PlatformResult> {
+async function syncPlatformCommentImpl(taskRef: string, options: SyncOptions): Promise<PlatformResult> {
   const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
   if (!resolved.ok) {
     return platformResult('failed', {
@@ -547,7 +553,12 @@ async function syncPlatformComment(taskRef: string, options: SyncOptions): Promi
   }
   let desired: RenderedChunk[];
   try {
-    desired = expectedComments(resolved.taskId, taskContent, resolved.taskDir, resolved.repoRoot, options);
+    const projectedContent = options.kind === 'task' && options.taskProjection ? options.taskProjection.content : taskContent;
+    if (options.kind === 'task' && options.taskProjection
+      && createHash('sha256').update(projectedContent).digest('hex') !== options.taskProjection.sha256) {
+      throw Object.assign(new Error('finalization task projection digest does not match content'), { code: 'FINALIZATION_PROJECTION_INVALID' });
+    }
+    desired = expectedComments(resolved.taskId, projectedContent, resolved.taskDir, resolved.repoRoot, options);
   } catch (error) {
     return platformResult('failed', {
       resource: { kind: 'issue', number: resourceIdentityNumber(issueIdentityFromTask) },
@@ -743,6 +754,50 @@ async function syncPlatformComment(taskRef: string, options: SyncOptions): Promi
   return result;
 }
 
+async function syncPlatformComment(taskRef: string, options: SyncOptions): Promise<PlatformResult> {
+  const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
+  if (!resolved.ok) return syncPlatformCommentImpl(taskRef, options);
+  const taskContent = fs.readFileSync(resolved.taskMdPath, 'utf8');
+  if (!taskIssueIdentity(parseTaskFrontmatter(taskContent))) return syncPlatformCommentImpl(taskRef, options);
+
+  let operation: { kind: 'task-comment' | 'artifact-comment' | 'summary-comment' | 'cancel-comment'; target: string; expectedDigest: string };
+  try {
+    const sourceContent = options.kind === 'task' && options.taskProjection ? options.taskProjection.content : taskContent;
+    const desired = expectedComments(resolved.taskId, sourceContent, resolved.taskDir, resolved.repoRoot, options);
+    const content = desired.map((chunk) => chunk.content).join('\0');
+    const kind = options.kind === 'task' ? 'task-comment' : options.kind === 'summary' ? 'summary-comment'
+      : options.kind === 'cancel' ? 'cancel-comment' : 'artifact-comment';
+    const target = options.kind === 'artifact' ? options.artifact! : options.kind;
+    operation = { kind, target, expectedDigest: createHash('sha256').update(content).digest('hex') };
+  } catch {
+    return syncPlatformCommentImpl(taskRef, options);
+  }
+
+  const execute = () => syncPlatformCommentImpl(taskRef, options);
+  if (options.skipQueue) return execute();
+  return coordinatePlatformWrite({
+    operation: { taskRef: resolved.taskId, cwd: resolved.repoRoot, ...operation, dependency: options.dependency ?? 'deferred' },
+    agent: options.agent,
+    execute,
+    block: (error) => platformResult('blocked', { error }),
+    persistenceFailure: (error) => platformResult('failed', { error })
+  });
+}
+
+function inspectPlatformCommentOperation(taskRef: string, options: SyncOptions): { kind: 'task-comment' | 'artifact-comment' | 'summary-comment' | 'cancel-comment'; target: string; expectedDigest: string; id: string } | null {
+  const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
+  if (!resolved.ok) return null;
+  const taskContent = fs.readFileSync(resolved.taskMdPath, 'utf8');
+  if (!taskIssueIdentity(parseTaskFrontmatter(taskContent))) return null;
+  const sourceContent = options.kind === 'task' && options.taskProjection ? options.taskProjection.content : taskContent;
+  const desired = expectedComments(resolved.taskId, sourceContent, resolved.taskDir, resolved.repoRoot, options);
+  const kind = options.kind === 'task' ? 'task-comment' : options.kind === 'summary' ? 'summary-comment'
+    : options.kind === 'cancel' ? 'cancel-comment' : 'artifact-comment';
+  const target = options.kind === 'artifact' ? options.artifact! : options.kind;
+  const expectedDigest = createHash('sha256').update(desired.map((chunk) => chunk.content).join('\0')).digest('hex');
+  return { kind, target, expectedDigest, id: createHash('sha256').update(`${kind}\0${target}\0${expectedDigest}`).digest('hex') };
+}
+
 async function listPlatformComments(issue: string | number, cwd = process.cwd(), client?: PlatformClient): Promise<PlatformResult & { comments?: RemoteComment[] }> {
   const loaded = await resolvePlatformProviderContext({ cwd, client });
   const context = loaded.ok ? loaded.value.context : loaded.context;
@@ -800,6 +855,7 @@ export {
   COMMENT_BYTE_LIMIT,
   MARKERS,
   chunkArtifactComment,
+  inspectPlatformCommentOperation,
   findMarkerComments,
   listRemoteComments,
   checkPlatformCommentOwner,

package/lib/platform/issues.ts

@@ -2,6 +2,7 @@ import type { PlatformIssueSnapshot as IssueSnapshot } from './snapshots.ts';
 import type { IssueFieldSchema } from './github-data.ts';
 import fs from 'node:fs';
 import path from 'node:path';
+import { createHash } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 
 import { buildDefaultBody } from '../task/commands/issue-body.ts';
@@ -24,6 +25,7 @@ import { platformResult } from './types.ts';
 import type { PlatformResult } from './types.ts';
 import {
   labelDelta,
+  inLabelMappingDigest,
   planInLabelUpdate,
   syncLabelDelta,
   validateInLabelMapping,
@@ -39,9 +41,11 @@ import {
 } from './provider-bridge.ts';
 import { resourceIdentityEquals, resourceIdentityNumber, resourceIdentityString, serializeResourceIdentity } from './resource-identity.ts';
 import { taskIssueIdentity, taskIssueIdentityError } from './task-identities.ts';
+import { coordinatePlatformWrite } from './operation-coordinator.ts';
 import type { ResourceIdentity } from './resource-identity.ts';
 import type { IssueSnapshot as ProviderIssueSnapshot, RepositoryMetadataSnapshot } from './provider-contract.ts';
-type IssueResult = PlatformResult & {
+type IssueResult = Omit<PlatformResult, 'operations'> & {
+  operations: PlannedOperation[];
   task: { id: string | null; issueNumber: number | null };
   issue: IssueSnapshot | null;
 };
@@ -61,6 +65,8 @@ type SyncOptions = SharedOptions & {
   state?: 'open' | 'closed';
   closeReason?: 'completed' | 'not_planned';
   dryRun?: boolean;
+  dependency?: 'deferred' | 'required';
+  skipQueue?: boolean;
 };
 
 function result(
@@ -305,7 +311,7 @@ async function createPlatformIssue(taskRef: string, options: CreateOptions): Pro
     platform: base.context.platform, capabilities: base.context.capabilities,
     operations: [{ name: 'issue:create', status: 'planned', reasonCode: null }], error: null
   });
-  {
+  const execute = async (): Promise<IssueResult> => {
     const created = base.provider.issues?.create
       ? await base.provider.issues.create({
         context: providerOperationContext(base.loadedContext),
@@ -344,7 +350,7 @@ async function createPlatformIssue(taskRef: string, options: CreateOptions): Pro
     if (written.status === 'failed') return result('failed', base.resolved.taskId, null, {
       platform: base.context.platform, capabilities: base.context.capabilities,
       resource: { kind: 'issue', number: issueNumber, identity: inspected.value.identity || createdIdentity },
-      error: { code: 'ISSUE_CREATED_BIND_FAILED', message: written.error.message, retryable: false }
+      error: { code: 'ISSUE_CREATED_BIND_FAILED', message: written.error.message, retryable: true }
     });
     return result('applied', base.resolved.taskId, issueNumber, {
       changed: true,
@@ -355,7 +361,26 @@ async function createPlatformIssue(taskRef: string, options: CreateOptions): Pro
       issue: normalizeProviderIssue(inspected.value, repository, issueNumber),
       error: null
     });
-  }
+  };
+  const issueCreate = { title: payload.title, bodyDigest: createHash('sha256').update(payload.body).digest('hex') };
+  const operation = {
+    kind: 'issue-create' as const,
+    target: `task:${base.resolved.taskId}`,
+    expectedDigest: createHash('sha256').update(JSON.stringify({
+      taskId: base.resolved.taskId,
+      title: payload.title,
+      body: createHash('sha256').update(payload.body).digest('hex'),
+      labels: payload.labels || [], assignees: payload.assignees,
+      milestone: typeof payload.milestone === 'string' ? payload.milestone : null
+    })).digest('hex')
+  };
+  return coordinatePlatformWrite({
+    operation: { taskRef: base.resolved.taskId, cwd: base.resolved.repoRoot, ...operation, issueCreate, dependency: 'required' },
+    agent: options.agent,
+    execute,
+    block: (error) => result('blocked', base.resolved.taskId, null, { platform: base.context.platform, capabilities: base.context.capabilities, error }),
+    persistenceFailure: (error) => result('failed', base.resolved.taskId, null, { error })
+  });
 }
 
 async function bindPlatformIssue(taskRef: string, options: BindOptions): Promise<IssueResult> {
@@ -478,7 +503,7 @@ function desiredFieldValues(frontmatter: Record<string, string>, fields: IssueFi
   return desired;
 }
 
-async function syncPlatformIssue(taskRef: string, options: SyncOptions): Promise<IssueResult> {
+async function syncPlatformIssueImpl(taskRef: string, options: SyncOptions): Promise<IssueResult> {
   const base = await resolvedContext(taskRef, options);
   if (!base.ok) return base.output;
   if (!base.issueIdentity) return result('failed', base.resolved.taskId, null, { error: { code: 'ISSUE_NOT_LINKED', message: 'Task has no valid platform issue identity', retryable: false } });
@@ -617,5 +642,78 @@ async function syncPlatformIssue(taskRef: string, options: SyncOptions): Promise
   });
 }
 
+async function syncPlatformIssue(taskRef: string, options: SyncOptions): Promise<IssueResult> {
+  const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
+  if (!resolved.ok || options.dryRun) return syncPlatformIssueImpl(taskRef, options);
+  let frontmatter: Record<string, string>;
+  let taskContent: string;
+  try {
+    taskContent = fs.readFileSync(resolved.taskMdPath, 'utf8');
+    frontmatter = parseTaskFrontmatter(taskContent);
+  }
+  catch { return syncPlatformIssueImpl(taskRef, options); }
+  const identity = taskIssueIdentity(frontmatter);
+  if (!identity || ![
+    options.requirements, options.issueType, options.fields, options.status !== undefined,
+    options.assignees !== undefined, options.milestone !== undefined,
+    options.inLabels !== undefined, options.state !== undefined
+  ].some(Boolean)) return syncPlatformIssueImpl(taskRef, options);
+  let fromDiffFiles: string[] | undefined;
+  let mappingDigest: string | undefined;
+  if (options.inLabels === 'from-diff') {
+    const taskBase = typeof frontmatter.delivery_base_ref === 'string' ? frontmatter.delivery_base_ref.trim() : '';
+    if (taskBase && (!options.base || options.base === taskBase)) {
+      try {
+        fromDiffFiles = execFileSync('git', ['diff', `${taskBase}...HEAD`, '--name-only'], {
+          cwd: resolved.repoRoot, encoding: 'utf8'
+        }).trim().split(/\r?\n/).filter(Boolean).sort();
+        const config = JSON.parse(fs.readFileSync(path.join(resolved.repoRoot, '.agents', '.airc.json'), 'utf8')) as { labels?: { in?: unknown } };
+        const mapping = inLabelMappingDigest(config.labels?.in);
+        if (!mapping.ok) return result('failed', resolved.taskId, resourceIdentityNumber(identity), {
+          error: { code: mapping.error.code, message: mapping.error.message, retryable: false }
+        });
+        mappingDigest = mapping.digest;
+      } catch {
+        return result('failed', resolved.taskId, resourceIdentityNumber(identity), {
+          error: { code: 'IN_LABEL_SYNC_EVIDENCE_UNAVAILABLE', message: 'Unable to derive the current changed-file set for Issue metadata recovery', retryable: false }
+        });
+      }
+    }
+  }
+  const issueMetadata = {
+    requirements: options.requirements === true,
+    issueType: options.issueType === true,
+    fields: options.fields === true,
+    ...(options.status !== undefined ? { status: options.status } : {}),
+    ...(options.assignees !== undefined ? { assignees: options.assignees } : {}),
+    ...(options.milestone !== undefined ? { milestone: options.milestone } : {}),
+    ...(options.inLabels ? { inLabels: options.inLabels } : {}),
+    ...(options.base ? { base: options.base } : {}),
+    ...(fromDiffFiles ? { fromDiffFiles } : {}),
+    ...(mappingDigest ? { inLabelMappingDigest: mappingDigest } : {}),
+    ...(options.state ? { state: options.state } : {}),
+    ...(options.closeReason ? { closeReason: options.closeReason } : {})
+  };
+  const operation = {
+    kind: 'issue-metadata' as const,
+    target: JSON.stringify(identity),
+    expectedDigest: createHash('sha256').update(JSON.stringify({
+      ...issueMetadata,
+      task: resolved.taskId,
+      taskContent: createHash('sha256').update(taskContent).digest('hex')
+    })).digest('hex')
+  };
+  const dependency = options.dependency ?? (options.state === 'closed' && options.closeReason === 'not_planned' ? 'required' : 'deferred');
+  const execute = () => syncPlatformIssueImpl(taskRef, options);
+  if (options.skipQueue) return execute();
+  return coordinatePlatformWrite({
+    operation: { taskRef: resolved.taskId, cwd: resolved.repoRoot, ...operation, issueMetadata, dependency },
+    agent: options.agent,
+    execute,
+    block: (error) => result('blocked', resolved.taskId, resourceIdentityNumber(identity), { error }),
+    persistenceFailure: (error) => result('failed', resolved.taskId, resourceIdentityNumber(identity), { error })
+  });
+}
+
 export { bindPlatformIssue, createPlatformIssue, inspectPlatformIssue, requirementSectionAnchors, syncPlatformIssue };
 export type { BindOptions, CreateOptions, IssueResult, SyncOptions };

package/lib/platform/operation-coordinator.ts

@@ -0,0 +1,96 @@
+import { recoverPlatformOperations } from '../task/platform-operation-recovery.ts';
+import { recordPlatformOperation } from '../task/platform-operation-journal.ts';
+import type { RecordOperationInput } from '../task/platform-operation-journal.ts';
+import type { PlatformError, PlatformStatus } from './types.ts';
+import type { PlatformClient } from './context.ts';
+
+type OperationResult = Readonly<{
+  status: PlatformStatus;
+  error?: PlatformError | null;
+  warnings?: readonly { code: string }[];
+}>;
+
+type CoordinateInput<T extends OperationResult> = Readonly<{
+  operation: Omit<RecordOperationInput, 'state' | 'lastCode'>;
+  agent: string;
+  client?: PlatformClient;
+  drain?: (taskRef: string, excludeId: string, agent: string, cwd?: string) => Promise<{
+    status: 'applied' | 'no-op' | 'blocked' | 'failed';
+    error: PlatformError | null;
+  }>;
+  execute: () => Promise<T>;
+  block: (error: PlatformError) => T;
+  persistenceFailure: (error: PlatformError) => T;
+}>;
+
+async function coordinatePlatformWrite<T extends OperationResult>(input: CoordinateInput<T>): Promise<T> {
+  let operationId: string;
+  try {
+    const queued = recordPlatformOperation({ ...input.operation, state: 'queued' });
+    operationId = queued.id;
+  } catch (error) {
+    const value = error as { code?: string; message?: string };
+    return input.persistenceFailure({
+      code: value.code || 'PLATFORM_OPERATION_JOURNAL_WRITE_FAILED',
+      message: value.message || 'Unable to queue platform operation',
+      retryable: true
+    });
+  }
+
+  const selection = input.operation.kind === 'issue-metadata' && input.operation.issueMetadata?.state === 'closed'
+    ? 'all' : input.operation.dependency;
+  const drained = input.drain
+    ? await input.drain(input.operation.taskRef, operationId, input.agent, input.operation.cwd)
+    : await recoverPlatformOperations(input.operation.taskRef, selection, {
+      agent: input.agent,
+      client: input.client,
+      cwd: input.operation.cwd,
+      excludeId: operationId
+    });
+  if (drained.status !== 'applied' && drained.status !== 'no-op') {
+    return input.block(drained.error ?? {
+      code: 'PLATFORM_OPERATION_QUEUE_BLOCKED',
+      message: 'A previous platform operation is still unresolved; the current write remains queued',
+      retryable: true
+    });
+  }
+
+  try {
+    recordPlatformOperation({ ...input.operation, state: 'pending' });
+  } catch (error) {
+    const value = error as { code?: string; message?: string };
+    return input.persistenceFailure({
+      code: value.code || 'PLATFORM_OPERATION_JOURNAL_WRITE_FAILED',
+      message: value.message || 'Unable to mark platform operation as started',
+      retryable: true
+    });
+  }
+
+  let output: T;
+  try {
+    output = await input.execute();
+  } catch (error) {
+    const value = error as { code?: string; message?: string };
+    output = input.block({ code: value.code || 'PLATFORM_WRITE_FAILED', message: value.message || String(error), retryable: true });
+  }
+  const succeeded = (output.status === 'applied' || output.status === 'no-op')
+    && !output.error && !(output.warnings?.length);
+  const state = succeeded ? 'succeeded' : output.status === 'failed' && output.error?.retryable === false ? 'failed' : 'unknown';
+  try {
+    recordPlatformOperation({
+      ...input.operation,
+      state,
+      lastCode: output.error?.code ?? output.warnings?.[0]?.code ?? null
+    });
+  } catch (error) {
+    const value = error as { code?: string; message?: string };
+    return input.persistenceFailure({
+      code: value.code || 'PLATFORM_OPERATION_JOURNAL_WRITE_FAILED',
+      message: value.message || 'Unable to persist platform operation outcome',
+      retryable: true
+    });
+  }
+  return output;
+}
+
+export { coordinatePlatformWrite };

package/lib/platform/pr-review.ts

@@ -1,3 +1,8 @@
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+import { coordinatePlatformWrite } from './operation-coordinator.ts';
 import { resolvePlatformProviderContext } from './context.ts';
 import type { PlatformClient } from './context.ts';
 import { platformResult } from './types.ts';
@@ -9,8 +14,10 @@ import {
   providerResourceToken,
   unsupportedProviderOperation
 } from './provider-bridge.ts';
-import { isResourceIdentity, resourceIdentityNumber, reviewMarker as resourceReviewMarker } from './resource-identity.ts';
+import { isResourceIdentity, resourceIdentityEquals, resourceIdentityNumber, reviewMarker as resourceReviewMarker } from './resource-identity.ts';
 import type { ResourceIdentity } from './resource-identity.ts';
+import type { PlatformPullRequestReviewIntent } from '../task/platform-operation-journal.ts';
+import { resolveTaskRef } from '../task/resolve-ref.ts';
 
 export type PrReviewEvent = 'COMMENT' | 'APPROVE' | 'REQUEST_CHANGES';
 export type PrReviewIdentity = { scope: string; round: number; commitSha: string; resource?: ResourceIdentity };
@@ -38,6 +45,36 @@ function normalizeBody(body: string): string {
   return String(body || '').replace(/\r\n/g, '\n').replace(/\n+$/, '\n');
 }
 
+function canonicalReviewBody(body: string): string {
+  return normalizeBody(body).replace(/\n$/u, '');
+}
+
+function reviewArtifactName(round: number, artifactFile: string): boolean {
+  return path.basename(artifactFile) === artifactFile
+    && (artifactFile === 'pr-review.md' && round === 1 || artifactFile === `pr-review-r${round}.md`);
+}
+
+export function readReviewBodyFile(taskRef: string, round: number, artifactFile: string, bodyDigest: string, cwd?: string): string {
+  if (!/^TASK-\d{8}-\d{6}$/u.test(taskRef) || path.basename(artifactFile) !== artifactFile
+    || !reviewArtifactName(round, artifactFile)) {
+    throw Object.assign(new Error('Pull-request review artifact identity is invalid'), { code: 'PLATFORM_OPERATION_PAYLOAD_INVALID' });
+  }
+  const task = resolveTaskRef(taskRef, cwd ? { repoRoot: cwd } : {});
+  if (!task.ok) throw Object.assign(new Error(task.message), { code: 'PLATFORM_OPERATION_PAYLOAD_INVALID' });
+  const bodyFile = artifactFile.replace(/^pr-review/u, 'pr-review-body');
+  const report = fs.readFileSync(path.join(task.taskDir, artifactFile), 'utf8');
+  const bodyReferences = [...report.matchAll(/^\*\*(?:正文文件|Body file)\*\*(?:：|:)\s*`([^`]+)`[^\r\n]*$/gmu)]
+    .map((match) => match[1]);
+  if (bodyReferences.length !== 1 || bodyReferences[0] !== bodyFile) {
+    throw Object.assign(new Error('Pull-request review artifact does not reference its canonical body file'), { code: 'PLATFORM_OPERATION_PAYLOAD_INVALID' });
+  }
+  const body = canonicalReviewBody(fs.readFileSync(path.join(task.taskDir, bodyFile), 'utf8'));
+  if (!body || createHash('sha256').update(body).digest('hex') !== bodyDigest) {
+    throw Object.assign(new Error('Canonical pull-request review body does not match its persisted digest'), { code: 'PLATFORM_OPERATION_PAYLOAD_INVALID' });
+  }
+  return body;
+}
+
 function firstLine(body: string): string {
   return normalizeBody(String(body || '')).split('\n', 1)[0] || '';
 }
@@ -90,6 +127,11 @@ export async function publishPrReview(options: {
   cwd?: string;
   client?: PlatformClient;
   dryRun?: boolean;
+  agent?: string;
+  skipQueue?: boolean;
+  expectedResource?: ResourceIdentity;
+  expectedProviderScopeId?: string;
+  recoveryArtifact?: string;
   prNumber: PrToken;
   identity: PrReviewIdentity;
   event: PrReviewEvent;
@@ -100,6 +142,13 @@ export async function publishPrReview(options: {
   if (!hasUsableContext(context)) {
     return platformResult(context.status, { platform: context.platform, capabilities: context.capabilities, error: context.error });
   }
+  const providerScopeId = loaded.ok ? loaded.value.snapshot.scope.id : null;
+  if (options.expectedProviderScopeId && providerScopeId !== options.expectedProviderScopeId) {
+    return platformResult('failed', {
+      platform: context.platform, capabilities: context.capabilities,
+      error: { code: 'PLATFORM_OPERATION_IDENTITY_MISMATCH', message: 'Current provider scope differs from the persisted operation target', retryable: false }
+    });
+  }
   const identity = loaded.ok ? (() => { try { return providerResourceToken(loaded.value.provider, 'pull-request', String(options.prNumber)); } catch { return null; } })() : null;
   if (!identity) {
     return platformResult('failed', {
@@ -108,6 +157,13 @@ export async function publishPrReview(options: {
     });
   }
   const identityNumber = resourceIdentityNumber(identity);
+  if (options.expectedResource && !resourceIdentityEquals(identity, options.expectedResource)) {
+    return platformResult('failed', {
+      platform: context.platform, capabilities: context.capabilities,
+      resource: { kind: 'pull-request', number: identityNumber, identity },
+      error: { code: 'PLATFORM_OPERATION_IDENTITY_MISMATCH', message: 'Current pull request identity differs from the persisted operation target', retryable: false }
+    });
+  }
   if (!REVIEW_EVENTS.includes(options.event)) {
     return platformResult('failed', {
       platform: context.platform, capabilities: context.capabilities,
@@ -123,6 +179,62 @@ export async function publishPrReview(options: {
     });
   }
 
+  if (/^TASK-\d{8}-\d{6}$/u.test(options.identity.scope) && !options.skipQueue && !options.dryRun) {
+    if (!options.agent) return platformResult('failed', {
+      platform: context.platform, capabilities: context.capabilities,
+      resource: { kind: 'pull-request', number: identityNumber, identity },
+      error: { code: 'PR_REVIEW_AGENT_REQUIRED', message: 'task-scoped review publication requires an agent token', retryable: false }
+    });
+    if (!options.recoveryArtifact || !reviewArtifactName(options.identity.round, options.recoveryArtifact)) return platformResult('failed', {
+      platform: context.platform, capabilities: context.capabilities,
+      resource: { kind: 'pull-request', number: identityNumber, identity },
+      error: { code: 'PR_REVIEW_ARTIFACT_REQUIRED', message: 'task-scoped review publication requires its canonical review artifact', retryable: false }
+    });
+    const body = canonicalReviewBody(options.body);
+    const bodyDigest = createHash('sha256').update(body).digest('hex');
+    try {
+      if (readReviewBodyFile(options.identity.scope, options.identity.round, options.recoveryArtifact, bodyDigest, options.cwd) !== body) throw new Error('body mismatch');
+    } catch {
+      return platformResult('failed', {
+        platform: context.platform, capabilities: context.capabilities,
+        resource: { kind: 'pull-request', number: identityNumber, identity },
+        error: { code: 'PR_REVIEW_ARTIFACT_MISMATCH', message: 'Review body must match the canonical review body file', retryable: false }
+      });
+    }
+    const pullRequestReview: PlatformPullRequestReviewIntent = {
+      prNumber: String(options.prNumber),
+      resource: identity,
+      providerScopeId: providerScopeId!,
+      scope: options.identity.scope,
+      round: options.identity.round,
+      commitSha: options.identity.commitSha,
+      event: options.event,
+      artifactFile: options.recoveryArtifact,
+      bodyDigest
+    };
+    return coordinatePlatformWrite({
+      operation: {
+        taskRef: options.identity.scope,
+        cwd: options.cwd || process.cwd(),
+        kind: 'pull-request-review',
+        target: JSON.stringify(identity),
+        expectedDigest: createHash('sha256').update(JSON.stringify(pullRequestReview)).digest('hex'),
+        dependency: 'deferred',
+        pullRequestReview
+      },
+      agent: options.agent,
+      execute: () => publishPrReview({ ...options, expectedProviderScopeId: providerScopeId!, skipQueue: true }),
+      block: (error) => platformResult('blocked', {
+        platform: context.platform, capabilities: context.capabilities,
+        resource: { kind: 'pull-request', number: identityNumber, identity }, error
+      }),
+      persistenceFailure: (error) => platformResult('failed', {
+        platform: context.platform, capabilities: context.capabilities,
+        resource: { kind: 'pull-request', number: identityNumber, identity }, error
+      })
+    });
+  }
+
   const marker = reviewMarker({ ...options.identity, resource: identity });
   const listed = await listPrReviews(options.prNumber, { cwd: options.cwd, client: options.client });
   if (listed.status === 'failed' || listed.status === 'blocked') return listed;

package/lib/platform/pr-summary.ts

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { createHash } from 'node:crypto';
 
 import { enumerateArtifacts } from '../task/artifacts.ts';
 import { parseTypedTaskFrontmatter } from '../task/frontmatter.ts';
@@ -13,6 +14,7 @@ import { normalizeCommentContent } from './issue-comments.ts';
 import { CONTROL_MARKER_PATTERN, sanitizeMarkdownDocument, splitDocumentPlaceholder } from './comment-safety.ts';
 import { platformResult } from './types.ts';
 import type { PlatformResult } from './types.ts';
+import { coordinatePlatformWrite } from './operation-coordinator.ts';
 import type { OperationWarning } from '../task/operation-outcome.ts';
 import { providerError, providerOperationContext, providerStatus, providerResourceToken, resourceIdentityNumber, unsupportedProviderOperation } from './provider-bridge.ts';
 import { resourceIdentityEquals } from './resource-identity.ts';
@@ -491,7 +493,7 @@ async function reportWrite(taskRef: string, options: ReportWriteOptions): Promis
 
 async function syncPullRequestSummary(
   taskRef: string,
-  options: { agent: string; body: string; changeReportFile?: string; cwd?: string; client?: PlatformClient; dryRun?: boolean; strict?: boolean; primaryResult: PullRequestPrimaryResult; runtimeVersion?: string; manualValidation?: ManualValidationSummaryOptions; lockAlreadyHeld?: boolean }
+  options: { agent: string; body: string; changeReportFile?: string; cwd?: string; client?: PlatformClient; dryRun?: boolean; strict?: boolean; primaryResult: PullRequestPrimaryResult; runtimeVersion?: string; manualValidation?: ManualValidationSummaryOptions; lockAlreadyHeld?: boolean; skipQueue?: boolean }
 ): Promise<PullRequestSummaryResult> {
   const warningResult = warningResultForPrimary(options.primaryResult);
   let knownPrNumber: number | null = null;
@@ -657,6 +659,7 @@ async function syncPullRequestSummary(
         operations: [{ name: `summary:${reconciliation.action}`, status: 'planned', reasonCode: null }],
         result: null, warnings: [], ...info
       };
+      const publish = async (): Promise<PullRequestSummaryResult> => {
       const existingComment = reconciliation.commentId === null
         ? undefined
         : providerResourceToken(loaded.value.provider, 'comment', String(reconciliation.commentId));
@@ -722,6 +725,24 @@ async function syncPullRequestSummary(
         operations: [{ name: `summary:${reconciliation.action}`, status: 'applied', reasonCode: null }],
         result: null, warnings: [], ...info
       };
+      };
+      const operation = {
+        taskRef: resolved.taskId,
+        cwd: resolved.repoRoot,
+        kind: 'pull-request-summary' as const,
+        target: JSON.stringify(prIdentity),
+        expectedDigest: createHash('sha256').update(desired).digest('hex'),
+        dependency: 'deferred' as const,
+        pullRequestSummary: { body: options.body, changeReportFile: options.changeReportFile! }
+      };
+      if (options.skipQueue) return publish();
+      return coordinatePlatformWrite({
+        operation,
+        agent: options.agent,
+        execute: publish,
+        block: (error) => fail('blocked', context, error, prNumber),
+        persistenceFailure: (error) => fail('failed', context, error, prNumber)
+      });
     };
     return await (options.lockAlreadyHeld
       ? execute()