@fitlab-ai/agent-infra 0.12.0 → 0.12.2

package/dist/lib/task/secure-fs.js

@@ -2,7 +2,6 @@ import { createHash } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 const NO_FOLLOW = fs.constants.O_NOFOLLOW ?? 0;
-const DIRECTORY = fs.constants.O_DIRECTORY ?? 0;
 export class SecureFileError extends Error {
     code;
     constructor(code, message) {
@@ -30,9 +29,6 @@ function assertNoSymlinkAncestors(candidate) {
         current = parent;
     }
 }
-export async function readStableFile(candidate, options) {
-    return readStableFileSync(candidate, options);
-}
 export function readStableFileSync(candidate, options) {
     if (!path.isAbsolute(candidate))
         conflict('candidate path must be absolute and terminal');
@@ -74,56 +70,4 @@ export function readStableFileSync(candidate, options) {
             fs.closeSync(descriptor);
     }
 }
-export async function writeAtomicFile(target, bytes, mode = 0o600, expectedSha256) {
-    const parent = path.dirname(target);
-    let current = path.resolve(parent);
-    while (true) {
-        let stat;
-        try {
-            stat = await fs.promises.lstat(current);
-        }
-        catch {
-            throw new SecureFileError('TASK_ARTIFACT_WRITE_CONFLICT', 'authoritative parent directory is missing');
-        }
-        if (!stat.isDirectory() || stat.isSymbolicLink())
-            throw new SecureFileError('TASK_ARTIFACT_WRITE_CONFLICT', 'authoritative parent directory is not a real directory');
-        const next = path.dirname(current);
-        if (next === current)
-            break;
-        current = next;
-    }
-    try {
-        const existing = await fs.promises.lstat(target);
-        if (existing.isSymbolicLink() || !existing.isFile())
-            throw new SecureFileError('TASK_ARTIFACT_WRITE_CONFLICT', 'authoritative target is not a regular file');
-    }
-    catch (error) {
-        if (error.code !== 'ENOENT')
-            throw error;
-    }
-    const temporary = path.join(parent, `.${path.basename(target)}.${process.pid}.${Date.now()}.tmp`);
-    let handle;
-    try {
-        handle = await fs.promises.open(temporary, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL, mode);
-        await handle.writeFile(bytes);
-        await handle.sync();
-        await handle.chmod(mode);
-        await handle.close();
-        handle = undefined;
-        if (expectedSha256 !== undefined)
-            readStableFileSync(target, { maxBytes: 1024 * 1024, expectedSha256 });
-        fs.renameSync(temporary, target);
-        const directory = await fs.promises.open(parent, fs.constants.O_RDONLY | DIRECTORY);
-        try {
-            await directory.sync();
-        }
-        finally {
-            await directory.close();
-        }
-    }
-    finally {
-        await handle?.close().catch(() => undefined);
-        await fs.promises.rm(temporary, { force: true }).catch(() => undefined);
-    }
-}
 //# sourceMappingURL=secure-fs.js.map

package/dist/lib/task/short-id.js

@@ -343,16 +343,6 @@ function readRegistry(repoRoot) {
         return null;
     }
 }
-function readBranchFromTaskMd(repoRoot, taskId) {
-    const taskMdPath = path.join(resolveProjectTaskWorkspaceRoot(repoRoot), 'active', taskId, 'task.md');
-    if (!fs.existsSync(taskMdPath))
-        return null;
-    const content = fs.readFileSync(taskMdPath, 'utf8');
-    const m = content.match(/^branch:\s*(.+)$/m);
-    if (!m || !m[1])
-        return null;
-    return m[1].trim().replace(/^(["'])(.*)\1$/, '$2');
-}
 function loadShortIdByTaskId(repoRoot) {
     const registry = readRegistry(repoRoot);
     const map = new Map();
@@ -421,33 +411,5 @@ function inspectShortIdRegistry(repoRoot, shortIdLength = configuredShortIdLengt
         };
     }
 }
-/**
- * Resolve a branch to its active-task short id (`NN`), or `null` when no
- * active task is bound to that branch.
- *
- * Two-state semantics: this only consults the active registry
- * (`active/.short-ids.json`) plus each `active/{taskId}/task.md`. Tasks moved
- * to completed/blocked/cancelled/archive have already released their short id,
- * so their branches return `null` — in `ai sandbox ls` that surfaces as `-`,
- * meaning the sandbox is free to remove.
- */
-function lookupShortIdByBranch(branch, repoRoot, _opts) {
-    const registry = readRegistry(repoRoot);
-    if (!registry)
-        return null;
-    const matches = [];
-    for (const [key, taskId] of Object.entries(registry.ids)) {
-        const taskBranch = readBranchFromTaskMd(repoRoot, taskId);
-        if (taskBranch && taskBranch === branch) {
-            matches.push(key);
-        }
-    }
-    if (matches.length === 0)
-        return null;
-    if (matches.length > 1) {
-        process.stderr.write(`Warning: branch '${branch}' is bound to multiple active tasks: ${matches.join(', ')}; using ${matches[0]}\n`);
-    }
-    return matches[0];
-}
-export { normalizeShortIdInput, isRemovedHashShortIdInput, resolveShortIdReadOnly, lookupShortIdByBranch, loadShortIdByTaskId, inspectShortIdRegistry, configuredShortIdLength, mutateShortIdRegistry, releaseStaleShortIdRegistry, executeShortIdCommand };
+export { normalizeShortIdInput, isRemovedHashShortIdInput, resolveShortIdReadOnly, loadShortIdByTaskId, inspectShortIdRegistry, configuredShortIdLength, mutateShortIdRegistry, releaseStaleShortIdRegistry, executeShortIdCommand };
 //# sourceMappingURL=short-id.js.map

package/dist/lib/task/skill-scope.js

@@ -13,7 +13,6 @@ const TASK_SCOPE_SKILLS = new Set([
     'review-code',
     'review-plan',
     'run-manual-validation',
-    'run-task',
     'watch-pr'
 ]);
 function isTaskScopeSkill(skillName) {

package/dist/lib/task/verification-engine.js

@@ -1,7 +1,6 @@
 // frontmatter, ledger, Git snapshot and platform domains are imported below.
 import fs from "node:fs";
 import path from "node:path";
-import process from "node:process";
 import { execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { extractReviewTargetHead, extractReviewedHead, extractReviewDiffBase, findAuthoritativeReviewCodeArtifact, loadPostReviewConfig, parseReviewVerdict, resolvePostReviewGlobs } from "./verification-review.js";
@@ -19,9 +18,8 @@ import { inspectDecisionDetailDuplicates } from "./decision-details.js";
 import { parseImplementationInputs } from "./implementation-inputs.js";
 import { scanVisibleMarkdown } from "./markdown.js";
 import { loadVerificationConfig } from "./verification-config.js";
-import { inspectActivityLog, pairEntries } from "./activity-log.js";
+import { inspectActivityLog } from "./activity-log.js";
 import { parseWorkflowWarnings } from "./workflow-warnings.js";
-import { OrchestrationStateError, readRun } from "./orchestration.js";
 import { readPrDeliveryFact } from "./pr-delivery-fact.js";
 import { validateLocalArtifact } from "./local-artifact-finalization.js";
 import { getArtifactSchema } from "./artifact-schema.js";
@@ -29,13 +27,12 @@ import { inspectArtifactContract } from "./artifact-operations.js";
 import { normalizeVerificationRecord } from './gate-policy.js';
 import { manualValidationFinalSummaryProjectionMatches } from "./manual-validation-receipt.js";
 import { readManualValidationCompletion } from "./manual-validation-completion.js";
-import { sha256File } from "./artifact-receipts.js";
+import { parseArtifactReceipts, receiptForOutput, sha256File } from "./artifact-receipts.js";
 import { inspectArtifactDirectory } from "./artifact-lifecycle.js";
-import { getAgentClientAdapter } from "../agent-clients/registry.js";
 import { parseArtifactName } from "./artifact-name.js";
 import { summaryCommentState } from "../platform/pr-summary.js";
 import { taskIssueIdentity } from "../platform/task-identities.js";
-import { hasArtifactCompletionFact, hasArtifactCompletionLog, parseCompletionFacts } from './completion-facts.js';
+import { hasValidArtifactCompletion } from './completion-facts.js';
 import { inspectReviewIdentity } from './review-identity.js';
 const TASK_ENUMS = {
     type: ["feature", "bugfix", "refactor", "docs", "chore"],
@@ -55,10 +52,8 @@ const DEFAULT_REQUIRED_FIELDS = [
 ];
 const DATE_TIME_PATTERN = /^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(?:[+-]\d{2}:\d{2})?$/;
 // Started rows do not represent completed lifecycle actions.
-const ACTIVITY_LOG_STARTED_RE = /\s*\[started\]\s*$/;
 const BRANCH_SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 // Review disagreement ledger (see .agents/rules/review-handshake.md).
-const LEDGER_SECTION_NAMES = ["审查分歧账本", "Review Disagreement Ledger"];
 const POST_REVIEW_COMMIT_STAGE = "post-review-commit";
 const SHA_PATTERN = /^[0-9a-f]{7,40}$/i;
 const scriptPath = fileURLToPath(import.meta.url);
@@ -106,10 +101,6 @@ async function runCheck(type, context, shared) {
             return checkPostReviewCommit(context);
         case "required-pr-delivery":
             return checkRequiredPrDelivery(context);
-        case "orchestration-state":
-            return checkOrchestrationState(context);
-        case "orchestration-evidence":
-            return checkOrchestrationEvidence(context);
         default: {
             const adapter = PLATFORM_ADAPTERS[type];
             if (!adapter) {
@@ -122,159 +113,6 @@ async function runCheck(type, context, shared) {
         }
     }
 }
-function checkOrchestrationState({ taskDir }) {
-    const file = path.join(taskDir, '.runtime', 'orchestration.json');
-    const stat = safeStat(file);
-    if (!stat?.isFile())
-        return failResult('orchestration-state', 'orchestration.json is missing');
-    let run;
-    try {
-        run = readRun(taskDir);
-    }
-    catch (error) {
-        const message = error instanceof OrchestrationStateError ? error.message : String(error);
-        return failResult('orchestration-state', `Invalid orchestration.json: ${message}`);
-    }
-    if (!run || !['paused', 'completed'].includes(run.status)) {
-        return failResult('orchestration-state', `Expected paused or completed run, received '${run?.status ?? 'missing'}'`);
-    }
-    const adapterEvidenceError = validateAdapterReceiptEvidence(run);
-    if (adapterEvidenceError)
-        return failResult('orchestration-state', adapterEvidenceError);
-    if (run.status === 'paused' && (!run.pause?.code || !run.pause?.message)) {
-        return failResult('orchestration-state', 'Paused run requires a stable pause code and message');
-    }
-    if (run.status === 'completed') {
-        const evidenceError = validateCleanCompletionEvidence(run);
-        if (evidenceError)
-            return failResult('orchestration-state', evidenceError);
-    }
-    else if (run.completionEvidence != null) {
-        return failResult('orchestration-state', 'Clean completion evidence requires a completed run');
-    }
-    else if (run.pendingDelegation?.status === 'sealed') {
-        return failResult('orchestration-state', 'Paused run has a sealed delegation that could still advance');
-    }
-    return passResult('orchestration-state', `Orchestration run is safely ${run.status}`);
-}
-function exactText(value) {
-    return typeof value === 'string' && value.length > 0 && value.trim() === value;
-}
-function validateCleanCompletionEvidence(run) {
-    const evidence = run.completionEvidence;
-    const shaPattern = /^[0-9a-f]{40}$/i;
-    if (!evidence
-        || Number.isNaN(Date.parse(evidence.observedAt))
-        || !shaPattern.test(evidence.head)
-        || !shaPattern.test(evidence.headTree)
-        || !shaPattern.test(evidence.worktreeTree)
-        || !shaPattern.test(evidence.lastReviewedCommit)
-        || !(evidence.prHead === null || shaPattern.test(evidence.prHead))) {
-        return 'Clean completion evidence has an invalid structure';
-    }
-    if (evidence.head !== evidence.lastReviewedCommit
-        || (evidence.prHead !== null && evidence.head !== evidence.prHead)
-        || evidence.headTree !== evidence.worktreeTree) {
-        return 'Clean completion evidence does not bind matching commit and tree identities';
-    }
-    if (run.status !== 'completed'
-        || run.pendingDelegation !== null
-        || run.receipts.some((receipt) => receipt.stage === 'commit')) {
-        return 'Clean completion evidence conflicts with pending delegation or commit receipt state';
-    }
-    return null;
-}
-function validateAdapterReceiptEvidence(run) {
-    const receipts = [...run.receipts, ...(run.pendingDelegation ? [run.pendingDelegation] : [])];
-    for (const receipt of receipts) {
-        const validate = getAgentClientAdapter(receipt.client).orchestrationAdapter?.validateReceiptEvidence;
-        if (validate && !validate(receipt)) {
-            return `Receipt '${receipt.id}' has invalid evidence from its agent adapter`;
-        }
-    }
-    return null;
-}
-function checkOrchestrationEvidence({ taskDir }) {
-    const file = path.join(taskDir, '.runtime', 'orchestration.json');
-    const stat = safeStat(file);
-    if (!stat?.isFile())
-        return failResult('orchestration-evidence', 'orchestration.json is missing');
-    let run;
-    try {
-        run = readRun(taskDir);
-    }
-    catch (error) {
-        const message = error instanceof OrchestrationStateError ? error.message : String(error);
-        return failResult('orchestration-evidence', `Invalid orchestration.json: ${message}`);
-    }
-    if (!run)
-        return failResult('orchestration-evidence', 'orchestration.json is missing');
-    const adapterEvidenceError = validateAdapterReceiptEvidence(run);
-    if (adapterEvidenceError)
-        return failResult('orchestration-evidence', adapterEvidenceError);
-    // readRun validates the persisted schema, receipt identities and client provenance.
-    const policy = run.modelPolicy;
-    if (run.completionEvidence != null) {
-        const evidenceError = validateCleanCompletionEvidence(run);
-        if (evidenceError)
-            return failResult('orchestration-evidence', evidenceError);
-    }
-    else if (run.status === 'completed') {
-        return failResult('orchestration-evidence', 'Completed run requires reviewed-head-clean completion evidence');
-    }
-    if (run.pendingDelegation && !['prepared', 'activated', 'stage-completed'].includes(run.pendingDelegation.status)) {
-        return failResult('orchestration-evidence', `Pending receipt has unsafe status '${run.pendingDelegation.status}'`);
-    }
-    const receipts = [...run.receipts, ...(run.pendingDelegation ? [run.pendingDelegation] : [])];
-    for (const receipt of receipts) {
-        const expectedPolicy = policy[receipt.role];
-        if (!expectedPolicy || receipt.requestedModel !== expectedPolicy.model) {
-            return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' requested model does not match its role policy`);
-        }
-        if (receipt.requestedReasoningEffort !== expectedPolicy.reasoningEffort) {
-            return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' requested reasoning effort does not match its role policy`);
-        }
-        const activated = ['activated', 'stage-completed', 'sealed', 'consumed'].includes(receipt.status);
-        if (activated) {
-            const evidencePolicy = getAgentClientAdapter(receipt.client).delegationEvidence;
-            if (evidencePolicy.actualModelRequired !== false) {
-                if (!exactText(receipt.actualModel)) {
-                    return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has no host-observed actual model`);
-                }
-            }
-            if (evidencePolicy.actualReasoningEffortRequired !== false) {
-                if (!exactText(receipt.actualReasoningEffort)) {
-                    return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has no host-observed actual reasoning effort`);
-                }
-            }
-            if (evidencePolicy.spawnModeRequired !== false && receipt.spawnMode !== 'fresh') {
-                return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has invalid fresh delegation identity`);
-            }
-            if (receipt.actualModel != null && receipt.actualModel !== receipt.requestedModel) {
-                if (evidencePolicy.fallbackReasonRequired !== false && !exactText(receipt.modelFallbackReason)) {
-                    return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' model fallback is not justified`);
-                }
-            }
-            if ((receipt.actualModel == null || receipt.actualModel === receipt.requestedModel)
-                && receipt.modelFallbackReason !== null) {
-                return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has an unrelated model fallback reason`);
-            }
-            if (receipt.actualReasoningEffort != null && receipt.actualReasoningEffort !== receipt.requestedReasoningEffort) {
-                if (evidencePolicy.fallbackReasonRequired !== false && !exactText(receipt.reasoningEffortFallbackReason)) {
-                    return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' reasoning-effort fallback is not justified`);
-                }
-            }
-            if ((receipt.actualReasoningEffort == null || receipt.actualReasoningEffort === receipt.requestedReasoningEffort)
-                && receipt.reasoningEffortFallbackReason !== null) {
-                return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has an unrelated reasoning-effort fallback reason`);
-            }
-        }
-    }
-    if (run.receipts.some((receipt) => receipt.status !== 'consumed')) {
-        return failResult('orchestration-evidence', 'Historical receipts must be consumed');
-    }
-    return passResult('orchestration-evidence', 'Persisted orchestration model and delegation evidence is internally consistent');
-}
 // === Check Functions ===
 function checkTaskMeta({ taskDir, config, repositoryRoot, skillName, artifactFile }) {
     const task = loadTask(taskDir);
@@ -320,10 +158,7 @@ function checkTaskMeta({ taskDir, config, repositoryRoot, skillName, artifactFil
     if (expectedStep && metadata.current_step !== expectedStep) {
         let validLifecycleArtifact = false;
         if (currentTask) {
-            const { section, invalidEntries } = inspectActivityLog(task.content);
-            if (section && invalidEntries.length === 0) {
-                validLifecycleArtifact = checkArtifactLifecycleActivityLog(taskDir, artifactFile, skillName, task, section.entries)?.status === "pass";
-            }
+            validLifecycleArtifact = checkArtifactLifecycleActivityLog(taskDir, artifactFile, skillName, task)?.status === "pass";
         }
         if (!validLifecycleArtifact) {
             return failResult("task-meta", `Expected current_step '${expectedStep}', got '${metadata.current_step || "(empty)"}'`);
@@ -586,12 +421,6 @@ function checkImplementationInput({ taskDir, artifactFile }) {
     catch (error) {
         return failResult("implementation-input", `Invalid Implementation Inputs: ${error instanceof Error ? error.message : String(error)}`);
     }
-    const doneActions = (inspectActivityLog(task.content).section?.entries ?? [])
-        .filter((entry) => !ACTIVITY_LOG_STARTED_RE.test(entry.step))
-        .map((entry) => entry.step)
-        .filter((step) => /^(?:Code Task|Code) \(Round \d+/.test(step));
-    const latestAction = doneActions.at(-1) || "";
-    const actionDecision = /(?:Code Task|Code) \(Round \d+, decision (II-[1-9]\d*)\)/.exec(latestAction)?.[1] || null;
     const report = fs.readFileSync(artifactPath, "utf8");
     const reportSection = getSectionContent(report, ["实现输入", "Implementation Input"]);
     if (!reportSection)
@@ -604,36 +433,30 @@ function checkImplementationInput({ taskDir, artifactFile }) {
     const reportInput = field("裁决输入", "Decision Input");
     const reportLedger = field("账本 ID", "Ledger ID");
     const reportEvidence = field("裁决证据", "Decision Evidence");
-    if (!actionDecision) {
-        if (reportInput && reportInput !== "N/A") {
-            return failResult("implementation-input", "Non-decision code action must report Decision Input as N/A");
-        }
+    if (!reportInput || reportInput === "N/A") {
         return passResult("implementation-input", "Non-decision implementation input identity is consistent");
     }
-    if (reportInput !== actionDecision) {
-        return failResult("implementation-input", `Report decision input '${reportInput}' does not match Activity Log ${actionDecision}`);
-    }
-    const matches = rows.filter((row) => row.id === actionDecision);
+    const matches = rows.filter((row) => row.id === reportInput);
     if (matches.length !== 1)
-        return failResult("implementation-input", `${actionDecision} is missing or duplicated in task table`);
+        return failResult("implementation-input", `${reportInput} is missing or duplicated in task table`);
     const row = matches[0];
     if (row.stage !== "code" || !row.needsImplementation || row.status !== "consumed" || row.consumedBy !== artifactFile || !row.decisionEvidence) {
-        return failResult("implementation-input", `${actionDecision} is not a consumed input for ${artifactFile}`);
+        return failResult("implementation-input", `${reportInput} is not a consumed input for ${artifactFile}`);
     }
     if (reportLedger !== row.ledgerId || reportEvidence !== row.decisionEvidence) {
-        return failResult("implementation-input", `${actionDecision} report identity does not match task table evidence`);
+        return failResult("implementation-input", `${reportInput} report identity does not match task table evidence`);
     }
-    return passResult("implementation-input", `${actionDecision} matches Activity Log, report, and task table`);
+    return passResult("implementation-input", `${reportInput} matches report and task table`);
 }
 const ARTIFACT_ACTIVITY_STAGES = {
-    "analyze-task": { family: "analysis", event: "analyze.completed", action: "Analyze Task" },
-    "plan-task": { family: "plan", event: "plan.completed", action: "Plan Task" },
-    "review-analysis": { family: "review-analysis", event: "review-analysis.completed", action: "Review Analysis" },
-    "review-plan": { family: "review-plan", event: "review-plan.completed", action: "Review Plan" },
-    "code-task": { family: "code", event: "code.completed", action: "Code Task" },
-    "review-code": { family: "review-code", event: "review-code.completed", action: "Review Code" }
+    "analyze-task": { family: "analysis", event: "analyze.completed" },
+    "plan-task": { family: "plan", event: "plan.completed" },
+    "review-analysis": { family: "review-analysis", event: "review-analysis.completed" },
+    "review-plan": { family: "review-plan", event: "review-plan.completed" },
+    "code-task": { family: "code", event: "code.completed" },
+    "review-code": { family: "review-code", event: "review-code.completed" }
 };
-function checkArtifactLifecycleActivityLog(taskDir, artifactFile, skillName, task, entries) {
+function checkArtifactLifecycleActivityLog(taskDir, artifactFile, skillName, task) {
     const stage = ARTIFACT_ACTIVITY_STAGES[skillName];
     if (!stage)
         return null;
@@ -649,38 +472,20 @@ function checkArtifactLifecycleActivityLog(taskDir, artifactFile, skillName, tas
     if (!identity || identity.family !== stage.family) {
         return failResult("activity-log", `Artifact '${output}' does not belong to ${stage.family}`);
     }
-    if (!hasArtifactCompletionFact(task.content, path.join(taskDir, output), stage.event)) {
+    if (!hasValidArtifactCompletion(task.content, taskDir, output, stage.event)) {
         return failResult("activity-log", `Completion fact for '${output}' is missing or stale; rerun ${skillName} to record a current completion`);
     }
-    const frontmatter = parseTypedTaskFrontmatter(task.content);
-    const fact = parseCompletionFacts(frontmatter.completion_facts).find((item) => item.event === stage.event && item.output === output);
-    if (!fact)
-        return failResult("activity-log", `Completion fact for '${output}' is missing; rerun ${skillName}`);
-    if (!Array.isArray(fact.lifecycleInputs)) {
-        return failResult("activity-log", `Completion fact for '${output}' has no input snapshot; rerun ${skillName}`);
-    }
-    for (const input of fact.lifecycleInputs) {
-        if (!input || typeof input.name !== "string" || !/^[a-f0-9]{64}$/u.test(input.sha256)) {
-            return failResult("activity-log", `Completion fact for '${output}' has an invalid input snapshot; rerun ${skillName}`);
-        }
-        const inputIdentity = parseArtifactName(input.name);
+    const receipts = parseArtifactReceipts(task.content).rows.filter((receipt) => receipt.output === output);
+    for (const receipt of receipts) {
+        const inputIdentity = parseArtifactName(receipt.input);
         if (!inputIdentity)
-            return failResult("activity-log", `Completion fact for '${output}' has invalid input '${input.name}'; rerun ${skillName}`);
+            return failResult("activity-log", `Completion receipt for '${output}' has invalid input '${receipt.input}'; rerun ${skillName}`);
         const inputInventory = inspectArtifactDirectory(taskDir, inputIdentity.family);
-        if (inputInventory.status !== "ready" || inputInventory.latest?.name !== input.name
-            || sha256File(path.join(taskDir, input.name)) !== input.sha256) {
-            return failResult("activity-log", `Input '${input.name}' changed or is no longer current; rerun ${skillName} to refresh '${output}'`);
+        if (inputInventory.status !== "ready" || inputInventory.latest?.name !== receipt.input
+            || sha256File(path.join(taskDir, receipt.input)) !== receipt.inputSha256) {
+            return failResult("activity-log", `Input '${receipt.input}' changed or is no longer current; rerun ${skillName} to refresh '${output}'`);
         }
     }
-    const roundActionPattern = new RegExp(`^${stage.action} \\(Round ${identity.round}(?:, [^)]+)?\\)$`);
-    const roundAction = entries.find((entry) => {
-        return !ACTIVITY_LOG_STARTED_RE.test(entry.step)
-            && roundActionPattern.test(entry.step)
-            && entry.note.includes(`→ ${output}`);
-    });
-    if (!roundAction) {
-        return failResult("activity-log", `No completed Activity Log row records '${output}' for ${skillName} Round ${identity.round}`);
-    }
     return passResult("activity-log", `Current ${stage.family} completion '${output}' is valid for Round ${identity.round}`);
 }
 function checkActivityLog({ taskDir, skillName, artifactFile }) {
@@ -688,22 +493,22 @@ function checkActivityLog({ taskDir, skillName, artifactFile }) {
     if (!task.ok) {
         return failResult("activity-log", task.message);
     }
+    const artifactLifecycleResult = checkArtifactLifecycleActivityLog(taskDir, artifactFile, skillName, task);
+    if (artifactLifecycleResult && artifactLifecycleResult.status !== "pass")
+        return artifactLifecycleResult;
     const { section, invalidEntries } = inspectActivityLog(task.content);
+    const warnings = [];
     if (!section)
-        return failResult("activity-log", "Activity Log section not found or ambiguous");
-    if (invalidEntries.length)
-        return failResult("activity-log", `Invalid Activity Log entry format: ${invalidEntries[0]}`);
-    const entries = section.entries;
-    if (entries.length === 0)
-        return failResult("activity-log", "Activity Log has no entries");
-    for (const entry of entries) {
-        if (!entry.note.trim())
-            return failResult("activity-log", "Activity Log entry note is required");
-    }
-    const artifactLifecycleResult = checkArtifactLifecycleActivityLog(taskDir, artifactFile, skillName, task, entries);
-    if (artifactLifecycleResult)
-        return artifactLifecycleResult;
-    return passResult("activity-log", "Activity Log is valid");
+        warnings.push('Activity Log section is missing or ambiguous');
+    else {
+        if (invalidEntries.length)
+            warnings.push('Activity Log contains malformed entries');
+        if (!section.entries.length)
+            warnings.push('Activity Log has no entries');
+        if (section.entries.some((entry) => !entry.note.trim()))
+            warnings.push('Activity Log entry note is empty');
+    }
+    return passResult("activity-log", artifactLifecycleResult?.message ?? "Business checks are valid", warnings);
 }
 function checkCompletionChecklist({ taskDir, config }) {
     const task = loadTask(taskDir);
@@ -732,17 +537,7 @@ function checkCompletionChecklist({ taskDir, config }) {
     }
     return passResult("completion-checklist", `Completion Checklist valid (${items.length} items checked)`);
 }
-function resolveReviewSetting(config, key, fallback, repoRoot) {
-    if (config && config[key] !== undefined && config[key] !== null) {
-        return config[key];
-    }
-    const reviewConfig = loadPostReviewConfig(repoRoot);
-    if (reviewConfig[key] !== undefined && reviewConfig[key] !== null) {
-        return reviewConfig[key];
-    }
-    return fallback;
-}
-function checkReviewLedger({ taskDir, config, repositoryRoot }) {
+function checkReviewLedger({ taskDir, config }) {
     const task = loadTask(taskDir);
     if (!task.ok) {
         return failResult("review-ledger", task.message);
@@ -818,8 +613,7 @@ async function checkManualValidation({ taskDir, repositoryRoot }) {
     if (!resolved.ok) {
         return failResult("manual-validation", `${parsed.summary.manualValidation} manual validation item(s) pending: run /complete-manual-validation`);
     }
-    // 5. The Activity Log must record the matching completion entry; the file name
-    //    is derived with path.basename (resolveArtifactPath does not return fileName).
+    // 5. Validate the committed receipt, transaction, and artifact.
     const artifactName = path.basename(resolved.path);
     const task = loadTask(taskDir);
     if (!task.ok)
@@ -842,31 +636,22 @@ async function checkManualValidation({ taskDir, repositoryRoot }) {
     if (sha256File(resolved.path) !== receipt.artifactSha256) {
         return failResult("manual-validation", `Manual validation artifact digest does not match the receipt for ${artifactName}`);
     }
-    // 6. Timing correlation (PL-3 fix, PL-4 corrected): the completion entry must
-    //    sit AFTER the latest review-code round's completion entry in the
-    //    append-only Activity Log. indexOf is a literal search, so the artifactName
-    //    must NOT be passed through escapeRegExp here (that escapes '.' to '\.',
-    //    which indexOf never matches). Not reusing completed.exec().index: exec
-    //    anchors to the first '**Complete Manual Validation**' heading, which can
-    //    belong to an earlier round's entry and misorder the standard path.
-    const inspectedLog = inspectActivityLog(task.content);
-    if (!inspectedLog.section)
-        return failResult("manual-validation", "Activity Log is missing or invalid");
-    const reviewRow = pairEntries(inspectedLog.section.entries).find((row) => row.step === `Review Code (Round ${review.round})` && row.started !== '' && row.done !== '');
-    const reviewDoneIndex = reviewRow
-        ? inspectedLog.section.entries.findIndex((entry) => entry.step === reviewRow.step && entry.time === reviewRow.done)
-        : -1;
-    const completedIndex = inspectedLog.section.entries.findIndex((entry) => entry.step === "Complete Manual Validation"
-        && entry.note.includes(`Manual validation passed → ${artifactName};`)
-        && entry.note.includes(`transaction=${receipt.transactionId};`)
-        && entry.note.includes(`receipt=${receipt.receiptDigest};`)
-        && entry.note.includes(`head=${receipt.prHeadSha}`));
-    if (reviewDoneIndex === -1)
-        return failResult("manual-validation", `Latest review-code (round ${review.round}) completion entry is missing from the Activity Log`);
-    if (completedIndex === -1)
-        return failResult("manual-validation", `Committed manual validation completion is not recorded for ${artifactName}`);
-    if (completedIndex < reviewDoneIndex)
-        return failResult("manual-validation", `Latest review-code (round ${review.round}) came after the manual validation completion recorded for ${artifactName}`);
+    // 6. Compare the review completion and committed manual-validation times.
+    let reviewReceipt;
+    try {
+        reviewReceipt = receiptForOutput(task.content, review.fileName);
+    }
+    catch (error) {
+        return failResult("manual-validation", `Review-code receipt is invalid: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!reviewReceipt || reviewReceipt.event !== "review-code.completed") {
+        return failResult("manual-validation", `Review-code completion time is unavailable for ${review.fileName}`);
+    }
+    const reviewTime = Date.parse(reviewReceipt.completedAt.replace(' ', 'T'));
+    const validationTime = Date.parse(receipt.committedAt);
+    if (!Number.isFinite(reviewTime) || !Number.isFinite(validationTime) || validationTime <= reviewTime) {
+        return failResult("manual-validation", `Manual validation must be completed after review-code ${review.fileName}`);
+    }
     const fact = readPrDeliveryFact(task.metadata);
     if (fact.status === "invalid")
         return failResult("manual-validation", fact.error.message);
@@ -1069,12 +854,9 @@ function checkReviewFact({ taskDir, artifactFile, repositoryRoot }) {
         return failResult("review-fact", task.message);
     }
     const content = fs.readFileSync(resolvedArtifact.path, "utf8");
-    if (!hasArtifactCompletionFact(task.content, resolvedArtifact.path, 'review-code.completed')) {
+    if (!hasValidArtifactCompletion(task.content, taskDir, path.basename(resolvedArtifact.path), 'review-code.completed')) {
         return failResult("review-fact", `Review Code completion fact does not match ${path.basename(resolvedArtifact.path)}`);
     }
-    if (!hasArtifactCompletionLog(task.content, path.basename(resolvedArtifact.path), 'review-code.completed')) {
-        return failResult("review-fact", `Review Code completion entry does not reference ${path.basename(resolvedArtifact.path)}`);
-    }
     const verdict = parseReviewVerdict(content);
     const reviewTargetHead = extractReviewTargetHead(content);
     const reviewReviewedHead = extractReviewedHead(content);
@@ -1194,12 +976,6 @@ function normalizeContent(text) {
         .replace(/\n{3,}/g, "\n\n")
         .trim();
 }
-function interpolate(template, taskDir, artifactFile) {
-    const artifactStem = artifactFile ? path.basename(artifactFile, path.extname(artifactFile)) : "";
-    return template
-        .replace(/\{task-id\}/g, path.basename(taskDir))
-        .replace(/\{artifact-stem\}/g, artifactStem);
-}
 function summarizeGate(checks) {
     if (checks.some((check) => check.effectiveStatus === "blocked")) {
         return "blocked";

package/dist/lib/task/verification.js

@@ -29,9 +29,7 @@ const VERIFICATION_CATALOG = {
     'import-dependabot.completed': gate('import-dependabot', 'active'),
     'import-issue.completed': gate('import-issue', 'active'),
     'watch-pr.completed': gate('watch-pr', 'active'),
-    'review-pr.completed': gate('review-pr', 'active', 'pr-review'),
-    'run-task.paused': { skill: 'run-task', expectedState: 'active', mode: 'checks', checks: ['orchestration-state', 'orchestration-evidence'] },
-    'run-task.completed': { skill: 'run-task', expectedState: 'active', mode: 'checks', checks: ['orchestration-state', 'orchestration-evidence'] }
+    'review-pr.completed': gate('review-pr', 'active', 'pr-review')
 };
 function failure(request, code, message, extra = {}) {
     return {
@@ -117,6 +115,11 @@ function renderTaskVerification(result) {
             && typeof message === 'string'
             && /\bhuman-decided (?:post-review )?exemption\b/i.test(message)
             && /\bPRC-\d+\s*:/.test(message);
+        if (Array.isArray(check.warnings)) {
+            for (const warning of check.warnings)
+                if (typeof warning === 'string')
+                    lines.push(`Warning: ${id} - ${warning}`);
+        }
         if (effectiveStatus === 'pass' && !isSoftWarning && !isHumanExemptionNotice)
             continue;
         lines.push(isSoftWarning