@fitlab-ai/agent-infra 0.11.9 → 0.11.11

package/dist/lib/platform/github-client.js

@@ -59,30 +59,33 @@ function classifyGitHubFailure(result) {
         return {
             code: 'PLATFORM_OUTPUT_TOO_LARGE',
             message: 'GitHub CLI output exceeded the configured limit',
-            retryable: false
+            requestRetryable: false
         };
     }
     const detail = boundedFailureDetail(result);
     const lower = detail.toLowerCase();
     if (/\b401\b|bad credentials|authentication required|not logged into/.test(lower)) {
-        return { code: 'AUTH_REQUIRED', message: detail || 'GitHub authentication is required', retryable: false };
+        return { code: 'AUTH_REQUIRED', message: detail || 'GitHub authentication is required', requestRetryable: false };
     }
     if (/\b429\b|rate limit|secondary rate|\b5\d\d\b|timeout|timed out|econnreset|enotfound|dns|tls|socket|network/.test(lower)) {
-        return { code: 'NETWORK_TRANSIENT', message: detail || 'GitHub request failed temporarily', retryable: true };
+        return { code: 'NETWORK_TRANSIENT', message: detail || 'GitHub request failed temporarily', requestRetryable: true };
     }
     if (/\b403\b|resource not accessible|permission denied/.test(lower)) {
-        return { code: 'PERMISSION_DENIED', message: detail || 'GitHub permission denied', retryable: false };
+        return { code: 'PERMISSION_DENIED', message: detail || 'GitHub permission denied', requestRetryable: false };
     }
     if (/\b404\b/.test(lower)) {
-        return { code: 'RESOURCE_NOT_FOUND', message: detail || 'GitHub resource not found', retryable: false };
+        return { code: 'RESOURCE_NOT_FOUND', message: detail || 'GitHub resource not found', requestRetryable: false };
     }
     if (/\b422\b|validation failed/.test(lower)) {
-        return { code: 'PLATFORM_REQUEST_INVALID', message: detail || 'GitHub rejected the request', retryable: false };
+        return { code: 'PLATFORM_REQUEST_INVALID', message: detail || 'GitHub rejected the request', requestRetryable: false };
     }
     if (errorCode === 'ENOENT') {
-        return { code: 'PLATFORM_DEPENDENCY_MISSING', message: detail || 'GitHub CLI is unavailable', retryable: false };
+        return { code: 'PLATFORM_DEPENDENCY_MISSING', message: detail || 'GitHub CLI is unavailable', requestRetryable: false };
     }
-    return { code: 'PLATFORM_REQUEST_FAILED', message: detail || 'GitHub request failed', retryable: false };
+    return { code: 'PLATFORM_REQUEST_FAILED', message: detail || 'GitHub request failed', requestRetryable: false };
+}
+function clientError(error) {
+    return { code: error.code, message: error.message };
 }
 function responseUrl(args) {
     const endpoint = args.find((arg, index) => index > 0 && !arg.startsWith('-')) || '';
@@ -132,14 +135,14 @@ function createGitHubClient(options = {}) {
             if (result.status === 0)
                 return { ok: true, value: result.stdout };
             const error = classifyGitHubFailure(result);
-            if (!retryableMethod || !error.retryable)
-                return { ok: false, error };
+            if (!retryableMethod || !error.requestRetryable)
+                return { ok: false, error: clientError(error) };
             if (attempt >= delays.length) {
                 return {
                     ok: false,
                     error: error.code === 'NETWORK_TRANSIENT'
-                        ? { ...error, code: 'NETWORK_RETRY_EXHAUSTED', message: `${error.message} (retry exhausted)` }
-                        : error
+                        ? { ...clientError(error), code: 'NETWORK_RETRY_EXHAUSTED', message: `${error.message} (retry exhausted)` }
+                        : clientError(error)
                 };
             }
             sleep(delays[attempt]);
@@ -150,12 +153,12 @@ function createGitHubClient(options = {}) {
         version(request = {}) {
             const result = runner(['--version'], request);
             if (result.status !== 0)
-                return { ok: false, error: classifyGitHubFailure(result) };
+                return { ok: false, error: clientError(classifyGitHubFailure(result)) };
             const version = result.stdout.match(/^gh version (\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)(?:\s|$)/m)?.[1];
             if (!version || !semver.valid(version)) {
                 return {
                     ok: false,
-                    error: { code: 'GH_CLI_VERSION_INVALID', message: 'GitHub CLI returned an invalid version', retryable: false }
+                    error: { code: 'GH_CLI_VERSION_INVALID', message: 'GitHub CLI returned an invalid version' }
                 };
             }
             return { ok: true, value: version };
@@ -174,7 +177,7 @@ function createGitHubClient(options = {}) {
             catch {
                 return {
                     ok: false,
-                    error: { code: 'INVALID_PLATFORM_RESPONSE', message: 'GitHub returned invalid JSON', retryable: true }
+                    error: { code: 'INVALID_PLATFORM_RESPONSE', message: 'GitHub returned invalid JSON' }
                 };
             }
         },
@@ -189,12 +192,12 @@ function createGitHubClient(options = {}) {
             if (!parsed) {
                 return {
                     ok: false,
-                    error: { code: 'INVALID_PLATFORM_RESPONSE', message: 'GitHub response metadata or JSON is invalid', retryable: true }
+                    error: { code: 'INVALID_PLATFORM_RESPONSE', message: 'GitHub response metadata or JSON is invalid' }
                 };
             }
             return { ok: true, value: parsed };
         }
     };
 }
-export { classifyGitHubFailure, createGitHubClient, MINIMUM_GITHUB_CLI_VERSION, parseIncludedResponse };
+export { createGitHubClient, MINIMUM_GITHUB_CLI_VERSION, parseIncludedResponse };
 //# sourceMappingURL=github-client.js.map

package/dist/lib/platform/github-provider.js

@@ -7,6 +7,32 @@ import semver from 'semver';
 import { createGitHubClient, MINIMUM_GITHUB_CLI_VERSION } from './github-client.js';
 import { resourceIdentityNumber, resourceIdentityString } from './resource-identity.js';
 import { extractPullRequestFileNames, syncLabelDelta } from './in-label-sync.js';
+function providerError(error) {
+    return { code: error.code, message: error.message };
+}
+function publicProviderErrors(provider) {
+    const sanitize = async (call) => {
+        const result = await call();
+        if (!result || typeof result !== 'object' || result.ok !== false)
+            return result;
+        const envelope = result;
+        return envelope.error ? { ...result, error: providerError(envelope.error) } : result;
+    };
+    const wrapped = { ...provider, context: { ...provider.context } };
+    wrapped.context.resolve = (input) => sanitize(() => provider.context.resolve(input));
+    for (const groupName of ['issues', 'comments', 'changeRequests', 'checks', 'reviews', 'releases', 'securityAlerts', 'repositoryMetadata', 'verification']) {
+        const group = provider[groupName];
+        if (!group)
+            continue;
+        const target = { ...group };
+        for (const method of Object.keys(group)) {
+            const original = group[method];
+            target[method] = (input) => sanitize(() => original(input));
+        }
+        wrapped[groupName] = target;
+    }
+    return wrapped;
+}
 const CURRENT_USER_QUERY = 'query { viewer { login } }';
 const ISSUE_TYPES_QUERY = `query($owner:String!){organization(login:$owner){issueTypes(first:20){nodes{id name pinnedFields{__typename ... on IssueFieldSingleSelect{id name options{id name}} ... on IssueFieldDate{id name} ... on IssueFieldText{id name} ... on IssueFieldNumber{id name}}}}}}`;
 const CLOSING_ISSUES_QUERY = 'query($owner:String!,$name:String!,$number:Int!,$cursor:String){repository(owner:$owner,name:$name){pullRequest(number:$number){closingIssuesReferences(first:100,after:$cursor){nodes{number} pageInfo{hasNextPage endCursor}}}}}';
@@ -57,7 +83,6 @@ function resolveGitHubChangeRequestGitEvidence({ cwd, repository, number, baseRe
             error: {
                 code: 'PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE',
                 message: 'Pull request repository identity is inconsistent',
-                retryable: false
             }
         };
     }
@@ -80,7 +105,6 @@ function resolveGitHubChangeRequestGitEvidence({ cwd, repository, number, baseRe
             error: {
                 code: 'PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE',
                 message: 'Pull request Git refs are invalid',
-                retryable: false
             }
         };
     }
@@ -97,7 +121,6 @@ function resolveGitHubChangeRequestGitEvidence({ cwd, repository, number, baseRe
             error: {
                 code: 'PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE',
                 message: `No GitHub remote can provide evidence for ${repository}`,
-                retryable: false
             }
         };
     }
@@ -107,7 +130,7 @@ function resolveGitHubChangeRequestGitEvidence({ cwd, repository, number, baseRe
     };
 }
 function failure(error) {
-    return { ok: false, error };
+    return { ok: false, error: providerError(error) };
 }
 function resolveContext(client, input) {
     const cwd = input.workingDirectory;
@@ -118,19 +141,17 @@ function resolveContext(client, input) {
         return failure({
             code: 'GH_CLI_VERSION_UNSUPPORTED',
             message: 'GitHub CLI ' + version.value + ' is unsupported; install gh >= ' + MINIMUM_GITHUB_CLI_VERSION,
-            retryable: false
         });
     }
     const remote = input.gitRemote || defaultGitRemote(cwd);
     if (!remote) {
-        return failure({ code: 'REMOTE_MISSING', message: 'Git origin remote is not configured', retryable: false });
+        return failure({ code: 'REMOTE_MISSING', message: 'Git origin remote is not configured' });
     }
     const ownerRepo = parseGitHubRemote(remote);
     if (!ownerRepo) {
         return failure({
             code: /github\.com/i.test(remote) ? 'REMOTE_INVALID' : 'PLATFORM_UNSUPPORTED',
             message: 'Unable to parse GitHub owner/repo from configured remote',
-            retryable: false
         });
     }
     const repository = client.json(['api', 'repos/' + ownerRepo], { cwd });
@@ -142,7 +163,6 @@ function resolveContext(client, input) {
         return failure({
             code: 'UPSTREAM_UNRESOLVED',
             message: 'Unable to resolve the upstream repository',
-            retryable: false
         });
     const user = client.json(['api', 'graphql', '-f', 'query=' + CURRENT_USER_QUERY], { cwd });
     if (!user.ok)
@@ -193,7 +213,7 @@ function verifyRemoteBranch(cwd, repositoryName, head) {
     if (!wanted.ref || !/^[A-Za-z0-9._/-]+$/.test(wanted.ref))
         return {
             ok: false,
-            error: { code: 'PR_HEAD_INVALID', message: 'Pull request head ref is invalid', retryable: false }
+            error: { code: 'PR_HEAD_INVALID', message: 'Pull request head ref is invalid' }
         };
     const remotes = configuredGitRemotes(cwd);
     const remote = remotes.find((item) => item.repository.toLowerCase() === wanted.repository.toLowerCase())
@@ -201,7 +221,7 @@ function verifyRemoteBranch(cwd, repositoryName, head) {
     if (!remote)
         return {
             ok: false,
-            error: { code: 'PR_REMOTE_BRANCH_MISSING', message: `No configured remote can verify ${wanted.repository}:${wanted.ref}`, retryable: false }
+            error: { code: 'PR_REMOTE_BRANCH_MISSING', message: `No configured remote can verify ${wanted.repository}:${wanted.ref}` }
         };
     try {
         const output = execFileSync('git', ['ls-remote', '--refs', remote.name, `refs/heads/${wanted.ref}`], {
@@ -212,19 +232,19 @@ function verifyRemoteBranch(cwd, repositoryName, head) {
         if (!sha || !/^[a-f0-9]{40}$/i.test(sha))
             return {
                 ok: false,
-                error: { code: 'PR_REMOTE_BRANCH_MISSING', message: `Remote branch ${wanted.repository}:${wanted.ref} does not exist`, retryable: false }
+                error: { code: 'PR_REMOTE_BRANCH_MISSING', message: `Remote branch ${wanted.repository}:${wanted.ref} does not exist` }
             };
         return { ok: true, value: sha };
     }
     catch (error) {
         return {
             ok: false,
-            error: { code: 'PR_REMOTE_BRANCH_UNAVAILABLE', message: error instanceof Error ? error.message : String(error), retryable: true }
+            error: { code: 'PR_REMOTE_BRANCH_UNAVAILABLE', message: error instanceof Error ? error.message : String(error) }
         };
     }
 }
 function invalid(code, message) {
-    return { ok: false, error: { code, message, retryable: false } };
+    return { ok: false, error: { code, message } };
 }
 function changeRequestSnapshot(value) {
     return {
@@ -292,7 +312,7 @@ function createReceipt(remoteId) {
     return { ok: true, value: { changed: true, remoteId } };
 }
 function partialFailure(response, value) {
-    return { ok: false, error: response.error, value };
+    return { ok: false, error: providerError(response.error), value };
 }
 function labelReconciliation(created, updated, removed, skipped) {
     return {
@@ -319,8 +339,8 @@ function syncLabels(client, repositoryName, number, cwd, current, target, prefix
                     status: 'blocked',
                     changed: true,
                     error: synced.error
-                        ? { ...synced.error, code: 'IN_LABEL_SYNC_PARTIAL', message: `In-label synchronization is partial or unknown: ${synced.error.message}` }
-                        : { code: 'IN_LABEL_SYNC_PARTIAL', message: 'In-label synchronization is partial or unknown', retryable: true }
+                        ? { ...providerError(synced.error), code: 'IN_LABEL_SYNC_PARTIAL', message: `In-label synchronization is partial or unknown: ${synced.error.message}` }
+                        : { code: 'IN_LABEL_SYNC_PARTIAL', message: 'In-label synchronization is partial or unknown' }
                 };
             return synced;
         }
@@ -599,7 +619,7 @@ function createGitHubOperations(client) {
                 localHead = repositoryHead(context.workingDirectory);
             }
             catch (error) {
-                return { ok: false, error: { code: 'PR_LOCAL_HEAD_UNAVAILABLE', message: error instanceof Error ? error.message : String(error), retryable: false } };
+                return { ok: false, error: { code: 'PR_LOCAL_HEAD_UNAVAILABLE', message: error instanceof Error ? error.message : String(error) } };
             }
             const remote = verifyRemoteBranch(context.workingDirectory, repository(context), head);
             if (!remote.ok)
@@ -607,7 +627,7 @@ function createGitHubOperations(client) {
             if (remote.value !== localHead)
                 return {
                     ok: false,
-                    error: { code: 'PR_REMOTE_HEAD_MISMATCH', message: `Remote head ${remote.value} does not match local HEAD ${localHead}`, retryable: false }
+                    error: { code: 'PR_REMOTE_HEAD_MISMATCH', message: `Remote head ${remote.value} does not match local HEAD ${localHead}` }
                 };
             return { ok: true, value: { sha: localHead } };
         },
@@ -904,7 +924,7 @@ function createGitHubOperations(client) {
                 const tag = resourceIdentityString(release) || '';
                 const result = module.publishGitHubReleaseNotes({ repository: repository(context), tag, title, notesFile }, { cwd: context.workingDirectory, client });
                 if (result.status === 'failed' || result.status === 'blocked')
-                    return { ok: false, error: result.error || { code: 'RELEASE_NOTES_PUBLISH_FAILED', message: 'Release notes publish failed', retryable: false } };
+                    return { ok: false, error: result.error ? providerError(result.error) : { code: 'RELEASE_NOTES_PUBLISH_FAILED', message: 'Release notes publish failed' } };
                 return { ok: true, value: { changed: result.changed, remoteId: tag } };
             }
             finally {
@@ -917,7 +937,7 @@ function createGitHubOperations(client) {
                 repository: repository(context), commitOids, branch, historyLimit, fromTime, toTime
             }, { cwd: context.workingDirectory, client });
             if (collected.status === 'failed' || collected.status === 'blocked' || !('pullRequests' in collected)) {
-                return { ok: false, error: collected.error || { code: 'RELEASE_NOTES_COLLECTION_FAILED', message: 'Release notes could not be collected', retryable: false } };
+                return { ok: false, error: collected.error ? providerError(collected.error) : { code: 'RELEASE_NOTES_COLLECTION_FAILED', message: 'Release notes could not be collected' } };
             }
             const mergedPullRequests = collected.pullRequests.map((item) => ({
                 id: String(item.number), identity: { kind: 'number', value: Number(item.number) }, number: Number(item.number),
@@ -1114,7 +1134,7 @@ function createGitHubOperations(client) {
     return { issues, comments, changeRequests, checks, reviews, releases, securityAlerts, repositoryMetadata, verification };
 }
 function createGitHubProvider(input, client = createGitHubClient()) {
-    return {
+    return publicProviderErrors({
         type: input.providerType,
         contractVersion: 2,
         identity: { issue: 'number', 'pull-request': 'number', comment: 'number', release: 'key' },
@@ -1124,7 +1144,7 @@ function createGitHubProvider(input, client = createGitHubClient()) {
                 return resolveContext(client, contextInput);
             }
         }
-    };
+    });
 }
 export { configuredGitRemotes, createGitHubProvider, defaultGitRemote, parseGitHubRemote, resolveGitHubChangeRequestGitEvidence };
 //# sourceMappingURL=github-provider.js.map

package/dist/lib/platform/github-release-notes.js

@@ -1,4 +1,5 @@
 import { createGitHubClient } from './github-client.js';
+import { providerErrorRetryable } from './provider-validation.js';
 function normalizeGitHubActor(actor) {
     const name = String(actor.name || '').trim();
     const email = actor.email ? String(actor.email).trim() : null;
@@ -26,12 +27,13 @@ function normalizePlatformAuthor(author) {
     };
 }
 function failure(error) {
+    const retryable = error.retryable ?? providerErrorRetryable(error.code);
     return {
-        status: error.retryable ? 'blocked' : 'failed',
+        status: retryable ? 'blocked' : 'failed',
         changed: false,
         operation: null,
         url: null,
-        error
+        error: { code: error.code, message: error.message }
     };
 }
 function publishGitHubReleaseNotes(input, options = {}) {

package/dist/lib/platform/in-label-sync.js

@@ -1,5 +1,6 @@
 import { computeInLabels } from './metadata-labels.js';
 import { createHash } from 'node:crypto';
+import { providerErrorRetryable } from './provider-validation.js';
 function inLabels(labels) {
     return [...new Set(labels.filter((label) => label.startsWith('in:')))].sort();
 }
@@ -96,7 +97,7 @@ function syncLabelDelta(client, repository, number, cwd, current, target, prefix
     const delta = labelDelta(current, target, prefix);
     let changed = false;
     const failure = (error) => {
-        if (changed || error.retryable) {
+        if (changed || error.retryable || providerErrorRetryable(error.code)) {
             return {
                 status: 'blocked',
                 changed,

package/dist/lib/platform/issue-comments.js

@@ -5,6 +5,7 @@ import { parseTaskFrontmatter } from '../task/frontmatter.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { coordinatePlatformWrite } from './operation-coordinator.js';
 import { resolvePlatformProviderContext } from './context.js';
+import { providerErrorRetryable } from './provider-validation.js';
 import { platformResult } from './types.js';
 import { providerError, providerOperationContext, providerStatus, providerResourceToken, unsupportedProviderOperation } from './provider-bridge.js';
 import { resourceIdentityNumber } from './resource-identity.js';
@@ -12,6 +13,9 @@ import { taskIssueIdentity, taskIssueIdentityError } from './task-identities.js'
 import { recordForArtifact, recordForCancel, recordForSummary, recordForTask, renderActivityRecoveryMetadata } from './activity-recovery.js';
 import { projectTaskComment } from './task-comment-projection.js';
 import { canonicalizeCommentBody, escapeHtmlText, fenceRanges, renderSafeCodeFence } from './comment-safety.js';
+function isRetryable(error) {
+    return error.retryable ?? providerErrorRetryable(error.code);
+}
 function providerCommentId(id, provider) {
     return provider.identity?.comment === 'number' && /^\d+$/.test(id) ? Number(id) : id;
 }
@@ -482,7 +486,7 @@ async function syncPlatformCommentImpl(taskRef, options) {
     const issue = resourceIdentityNumber(issueIdentityFromTask);
     const listed = await listedComments(loaded.value.provider, loaded.value, issueIdentityFromTask);
     if (!listed.ok) {
-        return platformResult(listed.error.retryable ? 'blocked' : 'failed', {
+        return platformResult(isRetryable(listed.error) ? 'blocked' : 'failed', {
             ...contextFields(context), resource: { kind: 'issue', number: issue }, error: listed.error
         });
     }
@@ -548,10 +552,10 @@ async function syncPlatformCommentImpl(taskRef, options) {
             })
             : unsupportedProviderOperation(loaded.value.provider, 'comments.write');
         if (!written.ok) {
-            if (!current && written.error.retryable) {
+            if (!current && isRetryable(written.error)) {
                 // A provider owns reconciliation because only it knows how to address the resource.
             }
-            return platformResult(written.error.retryable ? 'blocked' : 'failed', {
+            return platformResult(isRetryable(written.error) ? 'blocked' : 'failed', {
                 ...contextFields(context),
                 resource: { kind: 'issue', number: issue },
                 operations,
@@ -573,7 +577,7 @@ async function syncPlatformCommentImpl(taskRef, options) {
             })
             : unsupportedProviderOperation(loaded.value.provider, 'comments.delete');
         if (!deleted.ok) {
-            return platformResult(deleted.error.retryable ? 'blocked' : 'failed', {
+            return platformResult(isRetryable(deleted.error) ? 'blocked' : 'failed', {
                 ...contextFields(context),
                 resource: { kind: 'issue', number: issue },
                 operations,
@@ -585,7 +589,7 @@ async function syncPlatformCommentImpl(taskRef, options) {
     if (options.kind === 'summary') {
         const refreshed = await listedComments(loaded.value.provider, loaded.value, issueIdentityFromTask);
         if (!refreshed.ok) {
-            return platformResult(refreshed.error.retryable ? 'blocked' : 'failed', {
+            return platformResult(isRetryable(refreshed.error) ? 'blocked' : 'failed', {
                 ...contextFields(context), resource: { kind: 'issue', number: issue }, operations, error: refreshed.error
             });
         }
@@ -613,7 +617,7 @@ async function syncPlatformCommentImpl(taskRef, options) {
                 })
                 : unsupportedProviderOperation(loaded.value.provider, 'comments.delete');
             if (!deleted.ok) {
-                return platformResult(deleted.error.retryable ? 'blocked' : 'failed', {
+                return platformResult(isRetryable(deleted.error) ? 'blocked' : 'failed', {
                     ...contextFields(context), resource: { kind: 'issue', number: issue }, operations, error: deleted.error
                 });
             }
@@ -624,7 +628,7 @@ async function syncPlatformCommentImpl(taskRef, options) {
                 })
                 : unsupportedProviderOperation(loaded.value.provider, 'comments.write');
             if (!written.ok) {
-                return platformResult(written.error.retryable ? 'blocked' : 'failed', {
+                return platformResult(isRetryable(written.error) ? 'blocked' : 'failed', {
                     ...contextFields(context), resource: { kind: 'issue', number: issue }, operations, error: written.error
                 });
             }
@@ -635,7 +639,7 @@ async function syncPlatformCommentImpl(taskRef, options) {
                 const error = reconciled.ok
                     ? { code: 'SUMMARY_POSITION_UNVERIFIED', message: 'Summary comment is not provably last among task-managed comments', retryable: true }
                     : reconciled.error;
-                return platformResult(error.retryable ? 'blocked' : 'failed', {
+                return platformResult(isRetryable(error) ? 'blocked' : 'failed', {
                     ...contextFields(context), resource: { kind: 'issue', number: issue }, operations, error
                 });
             }
@@ -748,7 +752,7 @@ async function checkPlatformCommentOwner(taskRef, options = {}) {
             : response)
         : unsupportedProviderOperation(loaded.value.provider, 'comments.list');
     if (!listed.ok)
-        return platformResult(listed.error.retryable ? 'blocked' : 'failed', { ...contextFields(context), error: listed.error });
+        return platformResult(isRetryable(listed.error) ? 'blocked' : 'failed', { ...contextFields(context), error: listed.error });
     const matches = findMarkerComments(listed.value, MARKERS.task(resolved.taskId));
     if (matches.length > 1)
         return platformResult('failed', { ...contextFields(context), error: { code: 'COMMENT_MARKER_CONFLICT', message: 'Multiple task comments use the registered marker', retryable: false } });

package/dist/lib/platform/operation-coordinator.js

@@ -25,7 +25,7 @@ async function coordinatePlatformWrite(input) {
             excludeId: operationId
         });
     if (drained.status !== 'applied' && drained.status !== 'no-op') {
-        return input.block(drained.error ?? {
+        return input.block(drained.error ? { ...drained.error, retryable: true } : {
             code: 'PLATFORM_OPERATION_QUEUE_BLOCKED',
             message: 'A previous platform operation is still unresolved; the current write remains queued',
             retryable: true

package/dist/lib/platform/pr-review.js

@@ -3,6 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { coordinatePlatformWrite } from './operation-coordinator.js';
 import { resolvePlatformProviderContext } from './context.js';
+import { providerErrorRetryable } from './provider-validation.js';
 import { platformResult } from './types.js';
 import { providerError, providerOperationContext, providerStatus, providerResourceToken, unsupportedProviderOperation } from './provider-bridge.js';
 import { isResourceIdentity, resourceIdentityEquals, resourceIdentityNumber, reviewMarker as resourceReviewMarker } from './resource-identity.js';
@@ -253,7 +254,7 @@ export async function publishPrReview(options) {
             })
             : unsupportedProviderOperation(loaded.value.provider, 'reviews.publish');
         if (!published.ok) {
-            if (published.error.retryable) {
+            if (published.error.retryable || providerErrorRetryable(published.error.code)) {
                 const reconciled = await listPrReviews(options.prNumber, { cwd: options.cwd, client: options.client });
                 const found = reconciled.reviews.find((review) => firstLine(review.body) === marker);
                 if (found)

package/dist/lib/platform/pr-summary.js

@@ -16,6 +16,7 @@ import { resourceIdentityEquals } from './resource-identity.js';
 import { buildPrChangeReport, CANONICAL_REPORT_PLACEHOLDER, readPrChangeReport, replaceCanonicalReportPlaceholder, runMechanicalChangeReport, taskIntentDigest, validateMechanicalReport, validatePrecheckCandidate, writePrChangeReportAtomic } from './pr-change-report.js';
 import { MANUAL_VALIDATION_RECEIPT_PLACEHOLDER, manualValidationFinalSummaryProjectionMatches } from '../task/manual-validation-receipt.js';
 import { readManualValidationCompletion } from '../task/manual-validation-completion.js';
+import { readManualValidationTransaction } from '../task/manual-validation-transaction.js';
 function summaryMarker(taskId) {
     return `<!-- sync-pr:${taskId}:summary -->`;
 }
@@ -119,6 +120,20 @@ async function inspectBoundPullRequest(context, repoRoot, prIdentity, loadedCont
         return { ok: false, status: inspectionError(error), error };
     }
     const remote = inspected.value;
+    if (!remote.identity) {
+        return {
+            ok: false,
+            status: 'failed',
+            error: { code: 'PR_IDENTITY_MISSING', message: 'Provider pull-request inspection did not return a canonical identity', retryable: false }
+        };
+    }
+    if (!resourceIdentityEquals(remote.identity, prIdentity)) {
+        return {
+            ok: false,
+            status: 'failed',
+            error: { code: 'PR_IDENTITY_MISMATCH', message: 'Provider returned a different pull request identity than requested', retryable: false }
+        };
+    }
     const number = remote.number ?? resourceIdentityNumber(remote.identity) ?? resourceIdentityNumber(prIdentity) ?? 0;
     const head = remote.head || { repository: context.platform.repository, ref: '', sha: remote.headSha || '' };
     const base = remote.base || { repository: context.platform.repository, ref: '', sha: remote.baseSha || '' };
@@ -127,7 +142,7 @@ async function inspectBoundPullRequest(context, repoRoot, prIdentity, loadedCont
         value: {
             repository: context.platform.repository,
             number,
-            identity: remote.identity ?? prIdentity,
+            identity: remote.identity,
             nodeId: remote.id,
             url: remote.displayUrl || '',
             state: remote.state === 'closed' ? 'closed' : 'open',
@@ -261,14 +276,18 @@ async function summaryContext(taskRef, options = {}) {
             artifacts: []
         };
     const prIdentity = fact.status === 'valid' && fact.fact.state === 'bound' ? fact.fact.identity.resource : null;
-    const prNumber = resourceIdentityNumber(prIdentity);
+    let prNumber = resourceIdentityNumber(prIdentity);
     const loaded = await resolvePlatformProviderContext({ cwd: resolved.repoRoot, client: options.client });
     const context = loaded.ok ? loaded.value.context : loaded.context;
     let pullRequest = null;
     if (loaded.ok && prIdentity && context.platform.repository && ['no-op', 'degraded'].includes(context.status)) {
         const inspected = await inspectBoundPullRequest(context, resolved.repoRoot, prIdentity, loaded.value);
-        if (inspected.ok)
+        if (inspected.ok) {
             pullRequest = inspected.value;
+            if (Number.isSafeInteger(inspected.value.number) && inspected.value.number > 0) {
+                prNumber = inspected.value.number;
+            }
+        }
     }
     const report = summaryReportStatus(reportPath, pullRequest, taskContent, resolved.repoRoot);
     return {
@@ -493,7 +512,7 @@ async function syncPullRequestSummary(taskRef, options) {
             const prIdentity = boundFact.identity.resource;
             const boundPrNumber = resourceIdentityNumber(prIdentity);
             knownPrNumber = boundPrNumber;
-            const prNumber = boundPrNumber;
+            let prNumber = boundPrNumber;
             const initial = await inspectBoundPullRequest(context, resolved.repoRoot, prIdentity, loaded.value);
             if (!initial.ok)
                 return fail(initial.status, context, initial.error);
@@ -505,9 +524,23 @@ async function syncPullRequestSummary(taskRef, options) {
             if (manual && (manual.phase === 'pending' ? hasFinalManualValidation : !hasFinalManualValidation))
                 return fail('failed', context, { code: 'MANUAL_VALIDATION_SUMMARY_PHASE_INVALID', message: 'manual-validation summary phase does not match the requested writer phase', retryable: false }, prNumber);
             if (manual) {
-                if (prNumber === null)
-                    return fail('failed', context, { code: 'MANUAL_VALIDATION_PR_NUMBER_REQUIRED', message: 'manual-validation summary requires a numeric pull-request identity', retryable: false }, prNumber);
-                if (manual.phase === 'final' && (!manual.transactionId || !manual.receiptDigest || !manual.prHeadSha || manual.prHeadSha !== initial.value.head.sha))
+                if (!Number.isSafeInteger(initial.value.number) || initial.value.number <= 0)
+                    return fail('failed', context, { code: 'MANUAL_VALIDATION_PR_NUMBER_REQUIRED', message: 'manual-validation summary requires a positive safe pull-request number from the authoritative snapshot', retryable: false }, prNumber);
+                prNumber = initial.value.number;
+                knownPrNumber = prNumber;
+                if (!manual.transactionId)
+                    return fail('failed', context, { code: 'MANUAL_VALIDATION_TRANSACTION_REQUIRED', message: 'manual-validation summary requires a transaction ID', retryable: false }, prNumber);
+                if (manual.phase === 'pending') {
+                    const transaction = readManualValidationTransaction(resolved.taskDir, {
+                        transactionId: manual.transactionId,
+                        taskId: resolved.taskId,
+                        prNumber,
+                        prHeadSha: initial.value.head.sha
+                    });
+                    if (!transaction.ok)
+                        return fail('failed', context, platformError(transaction.error), prNumber);
+                }
+                if (manual.phase === 'final' && (!manual.receiptDigest || !manual.prHeadSha || manual.prHeadSha !== initial.value.head.sha))
                     return fail('failed', context, { code: 'MANUAL_VALIDATION_TRANSACTION_REQUIRED', message: 'final manual-validation summary requires transaction, receipt, and current head identity', retryable: false }, prNumber);
                 if (manual.phase === 'final') {
                     if (manual.authority !== 'coordinator')
@@ -688,7 +721,11 @@ async function syncPullRequestSummary(taskRef, options) {
                 target: JSON.stringify(prIdentity),
                 expectedDigest: createHash('sha256').update(desired).digest('hex'),
                 dependency: 'deferred',
-                pullRequestSummary: { body: options.body, changeReportFile: options.changeReportFile }
+                pullRequestSummary: {
+                    body: options.body,
+                    changeReportFile: options.changeReportFile,
+                    ...(manual?.transactionId ? { manualValidation: { ...manual, transactionId: manual.transactionId } } : {})
+                }
             };
             if (options.skipQueue)
                 return publish();

package/dist/lib/platform/provider-bridge.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { identityFromRemoteValue, parseResourceIdentity, parseResourceToken, resourceIdentityNumber } from './resource-identity.js';
+import { providerErrorRetryable } from './provider-validation.js';
 function providerOperationContext(loaded, workingDirectory = loaded.workingDirectory, scopeId = loaded.snapshot.scope.id) {
     return {
         repositoryRoot: loaded.repositoryRoot,
@@ -12,11 +13,11 @@ function providerError(error, fallbackCode) {
     return {
         code: error.code || fallbackCode,
         message: error.message || 'Platform provider operation failed',
-        retryable: error.retryable
+        retryable: 'retryable' in error ? error.retryable : providerErrorRetryable(error.code)
     };
 }
 function providerStatus(error) {
-    return error.retryable ? 'blocked' : 'failed';
+    return ('retryable' in error ? error.retryable : providerErrorRetryable(error.code)) ? 'blocked' : 'failed';
 }
 function unsupportedProviderOperation(provider, operation) {
     return {
@@ -24,9 +25,7 @@ function unsupportedProviderOperation(provider, operation) {
         error: {
             code: 'PLATFORM_CAPABILITY_UNSUPPORTED',
             message: `Platform '${provider.type}' does not provide ${operation}`,
-            retryable: false,
-            providerType: provider.type,
-            phase: 'operation'
+            retryable: false
         }
     };
 }

package/dist/lib/platform/provider-contract.d.ts

@@ -2,19 +2,16 @@ import type { ProviderIdentityDeclaration, ResourceIdentity } from './resource-i
 type JsonValue = string | number | boolean | null | JsonValue[] | {
     [key: string]: JsonValue;
 };
-type PlatformError = {
+type ProviderError = {
     code: string;
     message: string;
-    retryable: boolean;
-    providerType?: string;
-    phase?: string;
 };
 type ProviderResult<T> = {
     ok: true;
     value: T;
 } | {
     ok: false;
-    error: PlatformError;
+    error: ProviderError;
     value?: T;
 };
 type ProviderOperationContext = {
@@ -575,4 +572,4 @@ declare const PLATFORM_PROVIDER_CONTRACT_VERSION: 2;
 declare function isPlatformProviderFactory(value: unknown): value is PlatformProviderFactory;
 declare function validatePlatformProvider(value: unknown, providerType: string): ProviderResult<PlatformProvider>;
 export { PLATFORM_PROVIDER_CONTRACT_VERSION, isPlatformProviderFactory, validatePlatformProvider };
-export type { ChangeRequestSnapshot, CheckLogSnapshot, CheckRunSnapshot, GitEvidenceSnapshot, IssueSnapshot, JsonValue, MilestoneReconciliation, MilestoneDefinition, MilestoneInitialization, LabelDefinition, LabelReconciliation, MutationIdentity, MutationReceipt, PlatformCapabilities, PlatformContextSnapshot, PlatformError, PlatformProvider, PlatformProviderFactory, PlatformProviderFactoryInput, ProviderOperationContext, ProviderResult, ReleaseSnapshot, RemoteCommentSnapshot, RequiredCheckSnapshot, RepositoryMetadataSnapshot, ReleaseNotesFacts, ReleaseNoteAuthor, ReleaseNoteIssue, ReleaseNotePullRequest, ResourceIdentity, SecurityAlertKind, SecurityAlertSnapshot, ReviewSnapshot, VerificationRemoteFacts };
+export type { ChangeRequestSnapshot, CheckLogSnapshot, CheckRunSnapshot, GitEvidenceSnapshot, IssueSnapshot, JsonValue, MilestoneReconciliation, MilestoneDefinition, MilestoneInitialization, LabelDefinition, LabelReconciliation, MutationIdentity, MutationReceipt, PlatformCapabilities, PlatformContextSnapshot, ProviderError, PlatformProvider, PlatformProviderFactory, PlatformProviderFactoryInput, ProviderOperationContext, ProviderResult, ReleaseSnapshot, RemoteCommentSnapshot, RequiredCheckSnapshot, RepositoryMetadataSnapshot, ReleaseNotesFacts, ReleaseNoteAuthor, ReleaseNoteIssue, ReleaseNotePullRequest, ResourceIdentity, SecurityAlertKind, SecurityAlertSnapshot, ReviewSnapshot, VerificationRemoteFacts };