@fitlab-ai/agent-infra 0.11.8 → 0.11.10

package/dist/lib/sandbox/control/executor.js

@@ -6,6 +6,7 @@ import { homedir } from 'node:os';
 import { getProcessStartTime } from '../../server/process-state.js';
 import { createTask, projectTaskCreateResult, taskCreateExitCode, taskCreateFailure } from '../../task/create-service.js';
 import { applyTaskFinalization } from '../../task/finalization.js';
+import { serializeTaskFinalizationEnvelope } from '../../task/finalization-envelope.js';
 import { bindSandboxControlTask, validateSandboxControlRequest } from './protocol.js';
 import { atomicWriteJson, executionPath, readActiveLease, terminateSandboxControlExecution } from './state.js';
 import { requestAuditFields, resultAuditFields, appendDiagnosticAudit, createSandboxControlAuditContext, appendCriticalAudit, writeSandboxControlTransition } from './audit.js';
@@ -456,10 +457,14 @@ export async function runSandboxControlExecutor(requestPath, nonce) {
         result = request.family === 'task-finalization'
             ? {
                 exitCode: 1,
-                stdout: `${JSON.stringify({
-                    version: 1, status: 'failed', changed: false, accepted: true, result: null,
+                stdout: serializeTaskFinalizationEnvelope({
+                    status: code === 'SANDBOX_CONTROL_RESULT_UNKNOWN' ? 'unknown' : 'failed',
+                    changed: code === 'SANDBOX_CONTROL_RESULT_UNKNOWN' ? null : false,
+                    accepted: true,
+                    requestId: request.id,
+                    result: null,
                     error: { code, message: detail, retryable: false }
-                })}\n`,
+                }),
                 stderr: ''
             }
             : request.family === 'task-create'

package/dist/lib/sandbox/recovery.js

@@ -4,8 +4,7 @@ import path from 'node:path';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { nodeEntryArgs } from './control/executor.js';
-import { containerNameCandidates, sandboxBranchLabel, sandboxLabel, sandboxRuntimeCapabilityLabel, sandboxTaskIdLabel, sandboxWorkspaceModeLabel, worktreeDirCandidates } from './constants.js';
-import { isAgentClientId } from '../agent-clients/types.js';
+import { containerNameCandidates, sandboxBranchLabel, sandboxLabel, sandboxTaskIdLabel, sandboxWorkspaceModeLabel, worktreeDirCandidates } from './constants.js';
 import { createSandboxCapabilityPlan } from './agent-client-reconciler.js';
 import { toEnginePath } from './engines/wsl2-paths.js';
 import { sandboxCoreBindMounts } from './mounts.js';
@@ -277,12 +276,6 @@ export function classifySandboxRecovery(snapshot) {
                 : `Container identity ${actualIdentity} on branch ${snapshot.actualBranch ?? 'unknown'} does not match requested ${expectedIdentity} on branch ${snapshot.expectedBranch}.`
         });
     }
-    if (snapshot.runtimeCapabilityOk === false) {
-        findings.push({
-            repairKind: 'hard-failure',
-            message: 'Container runtime capability signature does not match the current sandbox plan.'
-        });
-    }
     if (snapshot.workspaceTopology === 'legacy-parent') {
         findings.push({
             repairKind: 'hard-failure',
@@ -307,13 +300,6 @@ export function classifySandboxRecovery(snapshot) {
             path: '/run/agent-infra/runtime'
         });
     }
-    for (const mountPath of snapshot.unexpectedCapabilityMounts ?? []) {
-        findings.push({
-            repairKind: 'hard-failure',
-            message: `Disabled Agent Client capability remains mounted at ${mountPath}.`,
-            path: mountPath
-        });
-    }
     for (const mount of snapshot.mounts) {
         if (snapshot.workspaceTopology === 'legacy-parent'
             && mount.path.startsWith('/workspace/.agents/workspace'))
@@ -679,11 +665,6 @@ export function collectSandboxRecoverySnapshot(params) {
         mode: sandboxWorkspaceModeLabel(params.config),
         taskId: sandboxTaskIdLabel(params.config)
     });
-    const selectedToolIds = new Set(tools.map((tool) => tool.id));
-    const unexpectedCapabilityMounts = capabilityPlan.cleanupInventory
-        .filter((tool) => isAgentClientId(tool.id) && !selectedToolIds.has(tool.id))
-        .map((tool) => tool.containerMount)
-        .filter((mountPath) => mountsByDestination.has(mountPath));
     const mountSnapshots = expectedMounts({
         config: params.config,
         branch: params.branch,
@@ -736,8 +717,6 @@ export function collectSandboxRecoverySnapshot(params) {
         identityOk: typeof inspection.Id === 'string' && inspection.Id.length > 0
             && branchLabel === params.branch
             && sameSandboxWorkspaceIdentity(containerWorkspace, workspace),
-        runtimeCapabilityOk: labels[sandboxRuntimeCapabilityLabel(params.config)] === capabilityPlan.runtimeSignature,
-        unexpectedCapabilityMounts,
         mounts: mountSnapshots,
         tmpfs,
         seeds,

package/dist/lib/sandbox/removal.js

@@ -19,7 +19,6 @@ import { getProcessStartTime } from '../server/process-state.js';
 import { releaseStaleShortIdRegistry } from '../task/short-id.js';
 import { withRepositoryMutationLock } from '../task/task-execution-lock.js';
 import { fetchSandboxRows } from './commands/list-running.js';
-import { formatIntermediateCleanupReport, cleanupIntermediateUnderRemovalCoordinator, protectIntermediateCleanupReport, mergeIntermediateCleanupReports, scanIntermediateCleanup } from '../task/intermediate-cleanup.js';
 import { createSandboxControlBindingEvidence } from './task-cleanup.js';
 import { createCleanPermit, createDiscardPermit, formatWorktreeSnapshot, inspectRecoveredWorktree, inspectWorktrees, verifyWorktreePermit } from './worktree-safety.js';
 function projectToolDirs(config, tools) {

package/dist/lib/sandbox/tools.js

@@ -187,6 +187,7 @@ export function parseCustomTool(entry, index, options, context = `customTools[${
     if (!containerMount.startsWith('/')) {
         throw new Error(`${context}: field "containerMount" must be an absolute path`);
     }
+    const invoke = asOptionalNonEmptyString(entry.invoke, 'invoke', context);
     const tool = {
         id,
         name: asOptionalNonEmptyString(entry.name, 'name', context) ?? id,
@@ -196,6 +197,7 @@ export function parseCustomTool(entry, index, options, context = `customTools[${
         versionCmd: asOptionalNonEmptyString(entry.versionCmd, 'versionCmd', context) ?? `which ${id}`,
         setupHint: asOptionalNonEmptyString(entry.setupHint, 'setupHint', context)
             ?? `Run \`${id}\` inside the container to set up.`,
+        ...(invoke === undefined ? {} : { invoke }),
         envVars: asStringRecord(entry.envVars, 'envVars', context),
         hostPreSeedFiles: parseHostPreSeedFiles(entry.hostPreSeedFiles, context),
         hostPreSeedDirs: parseHostPreSeedDirs(entry.hostPreSeedDirs, context),

package/dist/lib/task/artifact-command.js

@@ -1,4 +1,5 @@
 import fs from 'node:fs';
+import path from 'node:path';
 import { resolveArtifactContext, hasOpenArtifactRound } from './artifact-lifecycle.js';
 import { parseArtifactName } from './artifact-name.js';
 import { resolveTaskRef } from './resolve-ref.js';
@@ -74,7 +75,16 @@ export function executeArtifactCommand(command, options = {}) {
     const input = { repoRoot: resolved.repoRoot, taskId: resolved.taskId, taskDir, family: schema.family, artifact };
     if (operation === 'init') {
         const context = resolveArtifactContext(taskRef, family, { repoRoot: resolved.repoRoot });
-        if (context.status !== 'ready' || (context.next?.name !== artifact && !hasOpenArtifactRound(fs.readFileSync(resolved.taskMdPath, 'utf8'), family, parsed.round))) {
+        const existingCandidate = path.join(taskDir, artifact);
+        let matchingInitializedSkeleton = false;
+        try {
+            const existing = fs.readFileSync(existingCandidate, 'utf8');
+            matchingInitializedSkeleton = existing.includes(`<!-- artifact-context:${resolved.taskId}:${family}:${parsed.round} -->`);
+        }
+        catch { /* an absent candidate is created only for the selected identity */ }
+        if ((context.status !== 'ready' && !matchingInitializedSkeleton) || (context.next?.name !== artifact
+            && !hasOpenArtifactRound(fs.readFileSync(resolved.taskMdPath, 'utf8'), family, parsed.round)
+            && !matchingInitializedSkeleton)) {
             return fail('ARTIFACT_INIT_CONTEXT_INVALID', context.error?.message ?? `artifact '${artifact}' is not the next ${family} artifact`);
         }
         return { ...initializeArtifactSkeleton({ ...input, ...(locale ? { locale } : {}) }), ...identity };

package/dist/lib/task/artifact-lifecycle.js

@@ -4,15 +4,16 @@ import { ARTIFACT_FAMILY_CATALOG, artifactName, parseArtifactName } from './arti
 import { resolveTaskRef } from './resolve-ref.js';
 import { locateActivityLog, pairEntries, startedBackedRows } from './activity-log.js';
 import { parseImplementationInputs, selectPendingImplementationInput } from './implementation-inputs.js';
+import { parseTypedTaskFrontmatter } from './frontmatter.js';
 import { parseVerdict } from './review-artifacts.js';
 import { extractSection, findSectionHeading } from './sections.js';
-import { receiptForOutput, sha256File } from './artifact-receipts.js';
-import { hasArtifactCompletionFact, hasArtifactCompletionLog } from './completion-facts.js';
+import { receiptForOutput, receiptsForOutput, sha256File } from './artifact-receipts.js';
+import { artifactCompletionOrder, hasArtifactCompletionFact, hasArtifactCompletionLog, parseCompletionFacts } from './completion-facts.js';
 import { inspectReviewIdentity } from './review-identity.js';
-import { isArtifactInvalidated, parseInvalidationDocument } from './invalidation.js';
 import { parseLifecyclePathDecision } from './lifecycle-path.js';
 import { parseReworkIntentDocument } from './rework-intent.js';
 import { selectArtifactDisposition } from './artifact-selection.js';
+import { executionInputsMatchLatest } from './execution-inputs.js';
 const artifactFamilyCatalog = ARTIFACT_FAMILY_CATALOG;
 const ARTIFACT_STEPS = {
     analysis: 'Analyze Task', 'review-analysis': 'Review Analysis',
@@ -21,28 +22,46 @@ const ARTIFACT_STEPS = {
 };
 /** Init, repair and finalization share the same authoritative round identity. */
 export function hasOpenArtifactRound(content, family, round) {
+    return openArtifactRounds(content, family).includes(round);
+}
+function openArtifactRounds(content, family) {
     const activity = locateActivityLog(content);
     const step = ARTIFACT_STEPS[family];
     if (!activity || !step)
-        return false;
+        return [];
     const qualifier = family === 'code'
         ? '(?:, (?:fix for review-code(?:-r(?:[2-9]|[1-9]\\d+))?\\.md|decision II-[1-9]\\d*))?'
         : '';
-    const expected = new RegExp(`^${step} \\(Round ${round}${qualifier}\\)$`);
-    return startedBackedRows(pairEntries(activity.entries)).filter((row) => expected.test(row.step) && !row.done).length === 1;
+    const expected = new RegExp(`^${step} \\(Round ([1-9]\\d*)${qualifier}\\)$`);
+    return [...new Set(startedBackedRows(pairEntries(activity.entries))
+            .filter((row) => expected.test(row.step) && !row.done)
+            .map((row) => Number(expected.exec(row.step)?.[1])))].sort((left, right) => left - right);
 }
 function hasCompletedArtifactRound(content, family, round, name) {
-    const activity = locateActivityLog(content);
-    const step = ARTIFACT_STEPS[family];
-    if (!activity || !step)
-        return false;
-    const expected = new RegExp(`^${escapeRegExp(step)} \\(Round ${round}(?:, [^)]+)?\\)$`);
-    return startedBackedRows(pairEntries(activity.entries)).some((row) => expected.test(row.step) && Boolean(row.done) && row.note.includes(`→ ${name}`));
+    const event = completionEvent(family);
+    return Boolean(event && parseArtifactName(name)?.round === round
+        && artifactCompletionOrder(content, name, event) !== null
+        && hasArtifactCompletionFact(content, name, event));
+}
+function completionEvent(family) {
+    if (family === 'analysis')
+        return 'analyze.completed';
+    if (family === 'review-analysis')
+        return 'review-analysis.completed';
+    if (family === 'plan')
+        return 'plan.completed';
+    if (family === 'review-plan')
+        return 'review-plan.completed';
+    if (family === 'code')
+        return 'code.completed';
+    if (family === 'review-code')
+        return 'review-code.completed';
+    return null;
 }
 const BLOCKING_DIAGNOSTICS = new Set([
     'NONCANONICAL_NAME', 'ROUND_OUT_OF_RANGE', 'MISSING_BASE', 'ROUND_GAP',
     'DUPLICATE_LOGICAL_ROUND', 'NON_REGULAR_FILE', 'SYMBOLIC_LINK',
-    'FILESYSTEM_RACE', 'CATALOG_CONFLICT'
+    'FILESYSTEM_RACE', 'CATALOG_CONFLICT', 'MULTIPLE_OPEN_ROUNDS'
 ]);
 function familySpec(family) {
     return artifactFamilyCatalog.find((item) => item.family === family) ?? null;
@@ -53,7 +72,7 @@ function escapeRegExp(value) {
 function failure(requestRef, family, error, extra = {}) {
     return {
         status: 'failed', changed: false, requestRef, taskId: null, taskDir: null,
-        taskState: null, family, artifacts: [], latest: null, next: null,
+        taskState: null, family, artifacts: [], completed: [], latest: null, next: null, openRounds: [],
         reviewedInput: null, diagnostics: [], error, ...extra
     };
 }
@@ -82,19 +101,12 @@ function inspectArtifactDirectory(taskDir, family, identity = {}) {
             taskId: identity.taskId ?? null, taskDir, taskState: identity.taskState ?? null
         });
     }
-    let invalidation = { operations: [], targets: [] };
+    let taskContent;
     try {
-        const taskContent = fs.readFileSync(path.join(taskDir, 'task.md'), 'utf8');
-        const parsed = parseInvalidationDocument(taskContent);
-        if (!parsed.ok) {
-            return failure(requestRef, family, { code: 'ARTIFACT_INVALIDATION_INVALID', message: parsed.message }, {
-                taskId: identity.taskId ?? null, taskDir, taskState: identity.taskState ?? null
-            });
-        }
-        invalidation = parsed.document;
+        taskContent = fs.readFileSync(path.join(taskDir, 'task.md'), 'utf8');
     }
     catch (error) {
-        return failure(requestRef, family, { code: 'ARTIFACT_INVALIDATION_INVALID', message: String(error) }, {
+        return failure(requestRef, family, { code: 'ARTIFACT_DIRECTORY_READ_FAILED', message: String(error) }, {
             taskId: identity.taskId ?? null, taskDir, taskState: identity.taskState ?? null
         });
     }
@@ -133,8 +145,7 @@ function inspectArtifactDirectory(taskDir, family, identity = {}) {
             }
             const identity = { ...parsed, path: abs, size: stat.size, mtimeMs: stat.mtimeMs };
             knownArtifacts.push(identity);
-            if (!isArtifactInvalidated(invalidation, family, entry.name))
-                artifacts.push(identity);
+            artifacts.push(identity);
         }
         catch (error) {
             diagnostics.push(diagnostic('FILESYSTEM_RACE', family, entry.name, String(error)));
@@ -142,19 +153,32 @@ function inspectArtifactDirectory(taskDir, family, identity = {}) {
     }
     artifacts.sort((left, right) => left.round - right.round);
     knownArtifacts.sort((left, right) => left.round - right.round);
+    const openRounds = openArtifactRounds(taskContent, family);
     const knownRounds = new Set(knownArtifacts.map((item) => item.round));
-    if (knownArtifacts.length > 0 && !knownRounds.has(1))
+    for (const round of openRounds)
+        knownRounds.add(round);
+    const max = Math.max(...knownRounds, 0);
+    if (max > 0 && !knownRounds.has(1))
         diagnostics.push(diagnostic('MISSING_BASE', family, null, `${family}.md is missing`));
-    const max = knownArtifacts.at(-1)?.round ?? 0;
     for (let round = 1; round <= max; round += 1) {
         if (!knownRounds.has(round))
             diagnostics.push(diagnostic('ROUND_GAP', family, null, `${artifactName(family, round)} is missing`));
     }
-    const latest = artifacts.at(-1) ?? null;
+    const event = completionEvent(family);
+    const completed = event
+        ? artifacts.flatMap((artifact) => {
+            const order = artifactCompletionOrder(taskContent, artifact.name, event);
+            return order !== null && hasArtifactCompletionFact(taskContent, artifact.path, event)
+                ? [{ artifact, order }] : [];
+        }).sort((left, right) => left.order - right.order).map(({ artifact }) => artifact)
+        : [];
+    if (openRounds.length > 1)
+        diagnostics.push(diagnostic('MULTIPLE_OPEN_ROUNDS', family, null, `multiple incomplete ${family} rounds are open: ${openRounds.join(', ')}`));
+    const latest = completed.at(-1) ?? null;
     let hasReviewCodeReceipt = false;
     if (family === 'review-code' && latest) {
         try {
-            hasReviewCodeReceipt = Boolean(receiptForOutput(fs.readFileSync(path.join(taskDir, 'task.md'), 'utf8'), latest.name));
+            hasReviewCodeReceipt = Boolean(receiptForOutput(taskContent, latest.name));
         }
         catch {
             hasReviewCodeReceipt = false;
@@ -165,9 +189,9 @@ function inspectArtifactDirectory(taskDir, family, identity = {}) {
         : null;
     return {
         status: 'ready', changed: false, requestRef, taskId: identity.taskId ?? null,
-        taskDir, taskState: identity.taskState ?? null, family, artifacts, latest,
+        taskDir, taskState: identity.taskState ?? null, family, artifacts, completed, latest,
         next: { round: max + 1, name: artifactName(family, max + 1) },
-        reviewedInput, diagnostics, error: null
+        openRounds, reviewedInput, diagnostics, error: null
     };
 }
 function resolveReviewedInput(taskDir, review, expectedFamily, diagnostics) {
@@ -184,11 +208,6 @@ function resolveReviewedInput(taskDir, review, expectedFamily, diagnostics) {
         const stat = fs.lstatSync(abs);
         if (!stat.isFile() || stat.isSymbolicLink())
             throw new Error('referenced input is not a regular file');
-        const invalidation = parseInvalidationDocument(taskContent);
-        if (!invalidation.ok)
-            throw new Error(invalidation.message);
-        if (isArtifactInvalidated(invalidation.document, expectedFamily, input.name))
-            throw new Error(`${input.name} is invalidated`);
         const actualSha256 = sha256File(abs);
         if (actualSha256 !== receipt.inputSha256) {
             throw new Error(`${input.name} content digest does not match receipt`);
@@ -270,11 +289,27 @@ const OPTIONAL_CONTEXT = {
     'manual-validation': ['review-code'],
     'validation-run': ['review-code']
 };
-function hasSelectionEvidence(content, family, options, context) {
+function hasSelectionEvidence(content, family, options, context, pathState) {
     if (options.sourceFinding && options.sourceArtifact && options.sourceSha256)
         return true;
     if (options.reasonCode === 'new-requirement' || options.reasonCode === 'upstream-fact-doubt')
         return true;
+    if ((family === 'plan' || family === 'code') && context.latest) {
+        const latestInputs = Object.fromEntries(context.inputs.map((input) => [input.family, input.name]));
+        const capturedInputs = receiptsForOutput(content, context.latest.name)
+            .filter((receipt) => receipt.event === `${family}.completed`)
+            .filter((receipt) => {
+            try {
+                return sha256File(path.join(context.taskDir, receipt.input)) === receipt.inputSha256;
+            }
+            catch {
+                return false;
+            }
+        })
+            .map((receipt) => receipt.input);
+        if (!executionInputsMatchLatest(family, pathState, latestInputs, capturedInputs))
+            return true;
+    }
     if (family.startsWith('review-')) {
         const reviewedFamily = family === 'review-analysis' ? 'analysis' : family === 'review-plan' ? 'plan' : 'code';
         const currentInput = context.inputs.find((input) => input.family === reviewedFamily);
@@ -337,16 +372,20 @@ function attachArtifactSelection(context, pathState, options) {
     catch (error) {
         return fail('ARTIFACT_SELECTION_INDETERMINATE', error instanceof Error ? error.message : String(error));
     }
-    const openLatest = context.latest ? hasOpenArtifactRound(taskContent, family, context.latest.round) : false;
-    const openNext = hasOpenArtifactRound(taskContent, family, context.next.round);
-    const open = openLatest || openNext;
-    const selectedIdentity = openLatest ? context.latest : context.next;
+    const openRounds = openArtifactRounds(taskContent, family);
+    if (openRounds.length > 1)
+        return fail('ARTIFACT_TOPOLOGY_CONFLICT', `multiple incomplete ${family} rounds are open: ${openRounds.join(', ')}`);
+    const openRound = openRounds[0] ?? null;
+    const selectedIdentity = openRound === null ? context.next : {
+        family, round: openRound, name: artifactName(family, openRound),
+        path: path.join(context.taskDir, artifactName(family, openRound)), size: 0, mtimeMs: 0
+    };
     try {
-        const hasChangeEvidence = hasSelectionEvidence(taskContent, family, options, context);
+        const hasChangeEvidence = hasSelectionEvidence(taskContent, family, options, context, pathState);
         const selection = selectArtifactDisposition({
             next: { family, round: selectedIdentity.round, name: selectedIdentity.name },
             latest: context.latest,
-            open,
+            open: openRound !== null,
             hasChangeEvidence
         });
         return {
@@ -377,7 +416,8 @@ function resolveArtifactContext(taskRef, family, options = {}) {
             return selected;
         if (selected.selection.disposition === 'reuse')
             return selected;
-        if (selected.codeMode?.mode === 'error') {
+        if (selected.codeMode?.mode === 'error'
+            && selected.codeMode.message.includes('is not captured by the latest code input receipt')) {
             return {
                 ...selected,
                 status: 'ready',
@@ -435,32 +475,42 @@ function resolveCodeContext(inventory, options) {
     if (source.status === 'failed' || !source.latest)
         return contextFailure(inventory, 'ARTIFACT_INPUT_MISSING', `latest ${inputFamily} artifact is required`);
     const reviewCode = inspectTaskArtifacts(taskRef, 'review-code', options);
+    try {
+        const taskContent = fs.readFileSync(path.join(inventory.taskDir, 'task.md'), 'utf8');
+        const hasPendingImplementation = parseImplementationInputs(taskContent).rows.some((input) => input.needsImplementation && input.status === 'pending');
+        if (hasPendingImplementation && !reviewCode.latest) {
+            const candidate = reviewCode.artifacts.at(-1)?.name ?? 'review-code.md';
+            return contextFailure(inventory, 'ARTIFACT_REFERENCE_INVALID', `cannot find completed Activity Log identity for ${candidate}`);
+        }
+    }
+    catch (error) {
+        return contextFailure(inventory, 'ARTIFACT_REFERENCE_INVALID', error instanceof Error ? error.message : String(error));
+    }
     const latestCode = inventory.latest;
-    const codeMax = latestCode?.round ?? 0;
+    const codeMax = inventory.next?.round ? inventory.next.round - 1 : latestCode?.round ?? 0;
     const reviewMax = reviewCode.latest?.round ?? 0;
     const inputs = [source.latest];
     const sourceReviewFamily = inputFamily === 'analysis' ? 'review-analysis' : 'review-plan';
     const sourceReview = inspectTaskArtifacts(taskRef, sourceReviewFamily, options);
     if (sourceReview.status === 'ready' && sourceReview.latest && sourceReview.reviewedInput?.name === source.latest.name)
         inputs.push(sourceReview.latest);
-    if (latestCode) {
+    if (inventory.openRounds.length > 0) {
         try {
             const taskContent = fs.readFileSync(path.join(inventory.taskDir, 'task.md'), 'utf8');
-            if (hasOpenArtifactRound(taskContent, 'code', latestCode.round)) {
-                const review = reviewCode.latest;
-                const openInputs = review ? [...inputs, review] : inputs;
-                const openVerdict = review ? parseVerdict(review.path) : null;
-                const openRow = locateActivityLog(taskContent)
-                    ? startedBackedRows(pairEntries(locateActivityLog(taskContent).entries))
-                        .find((row) => row.step.startsWith(`Code Task (Round ${latestCode.round}`) && !row.done)
-                    : null;
-                const decisionInput = /, decision (II-[1-9]\d*)\)$/u.exec(openRow?.step ?? '')?.[1] ?? null;
-                const fixInput = /, fix for (review-code(?:-r\d+)?\.md)\)$/u.exec(openRow?.step ?? '')?.[1] ?? null;
-                const mode = decisionInput ? 'decision'
-                    : fixInput || (openVerdict?.ok && openVerdict.verdict === 'Changes Requested') ? 'fix'
-                        : 'init';
-                return withCodeMode(inventory, openInputs, 'ready', mode, codeMax, reviewMax, openVerdict?.ok ? openVerdict.verdict : null, fixInput ?? review?.name ?? null, `Resuming open code round ${latestCode.round}.`, decisionInput);
-            }
+            const openRound = inventory.openRounds[0];
+            const review = reviewCode.latest;
+            const openInputs = review ? [...inputs, review] : inputs;
+            const openVerdict = review ? parseVerdict(review.path) : null;
+            const openRow = locateActivityLog(taskContent)
+                ? startedBackedRows(pairEntries(locateActivityLog(taskContent).entries))
+                    .find((row) => row.step.startsWith(`Code Task (Round ${openRound}`) && !row.done)
+                : null;
+            const decisionInput = /, decision (II-[1-9]\d*)\)$/u.exec(openRow?.step ?? '')?.[1] ?? null;
+            const fixInput = /, fix for (review-code(?:-r\d+)?\.md)\)$/u.exec(openRow?.step ?? '')?.[1] ?? null;
+            const mode = decisionInput ? 'decision'
+                : fixInput || (openVerdict?.ok && openVerdict.verdict === 'Changes Requested') ? 'fix'
+                    : 'init';
+            return withCodeMode(inventory, openInputs, 'ready', mode, codeMax, reviewMax, openVerdict?.ok ? openVerdict.verdict : null, fixInput ?? review?.name ?? null, `Resuming open code round ${openRound}.`, decisionInput);
         }
         catch (error) {
             return contextFailure(inventory, 'ARTIFACT_REFERENCE_INVALID', error instanceof Error ? error.message : String(error));
@@ -599,6 +649,13 @@ export function validateArtifactPublication(taskDir, family, name) {
             if (hasCompletedArtifactRound(task, family, existing.round, name)) {
                 return { code: 'ARTIFACT_IDENTITY_INVALID', message: `completed artifact '${name}' is immutable` };
             }
+            const event = completionEvent(family);
+            const frontmatter = parseTypedTaskFrontmatter(task);
+            const completionFactExists = event !== null && parseCompletionFacts(frontmatter.completion_facts)
+                .some((fact) => fact.event === event && fact.output === name);
+            if (event && completionFactExists && artifactCompletionOrder(task, name, event) !== null) {
+                return { code: 'ARTIFACT_IDENTITY_INVALID', message: `completion evidence for '${name}' does not match its current content` };
+            }
         }
         catch (error) {
             return { code: 'ARTIFACT_SELECTION_INDETERMINATE', message: error instanceof Error ? error.message : String(error) };

package/dist/lib/task/artifact-selection.js

@@ -8,7 +8,7 @@ function selectArtifactDisposition(request) {
     if (!request.latest) {
         return {
             disposition: 'create',
-            reasonCode: request.next.round === 1 ? 'no-history' : 'invalidated-history',
+            reasonCode: 'no-completed-history',
             artifact: request.next, writeRequired: true
         };
     }