@fitlab-ai/agent-infra 0.12.0 → 0.12.2

package/lib/task/review-fingerprint.ts

@@ -3,13 +3,6 @@ import path from "node:path";
 
 import { inspectArtifactDirectory } from "./artifact-lifecycle.ts";
 
-type ReviewedGitTree = string & { readonly __reviewedGitTree: unique symbol };
-const REVIEWED_TREE_RE = /^[a-f0-9]{40,64}$/;
-
-export function parseReviewedGitTree(value: string): ReviewedGitTree | null {
-  return REVIEWED_TREE_RE.test(value) ? value as ReviewedGitTree : null;
-}
-
 // Paths excluded from the post-review coverage gate. Fail-closed: the gate
 // covers ALL tracked changes by default. This default denylist is EMPTY —
 // projects opt into exclusions explicitly via review.post_review_exclude_globs.
@@ -87,7 +80,6 @@ export function extractReviewedSnapshotTree(content: string): string {
   return match ? match[1]!.trim().replace(/`/g, "") : "";
 }
 
-export type { ReviewedGitTree };
 
 export function parseReviewVerdict(content: string): string {
   const match = String(content).match(/^[-*]?\s*\*\*(?:总体结论|Overall Verdict)\*\*[:：]\s*(.*?)\s*$/m);

package/lib/task/secure-fs.ts

@@ -3,7 +3,6 @@ import fs from 'node:fs';
 import path from 'node:path';
 
 const NO_FOLLOW = fs.constants.O_NOFOLLOW ?? 0;
-const DIRECTORY = fs.constants.O_DIRECTORY ?? 0;
 
 export class SecureFileError extends Error {
   readonly code: string;
@@ -40,10 +39,6 @@ function assertNoSymlinkAncestors(candidate: string): void {
   }
 }
 
-export async function readStableFile(candidate: string, options: Readonly<{ maxBytes: number; expectedSha256?: string }>): Promise<StableFile> {
-  return readStableFileSync(candidate, options);
-}
-
 export function readStableFileSync(candidate: string, options: Readonly<{ maxBytes: number; expectedSha256?: string }>): StableFile {
   if (!path.isAbsolute(candidate)) conflict('candidate path must be absolute and terminal');
   assertNoSymlinkAncestors(candidate);
@@ -74,40 +69,3 @@ export function readStableFileSync(candidate: string, options: Readonly<{ maxByt
     if (descriptor !== undefined) fs.closeSync(descriptor);
   }
 }
-
-export async function writeAtomicFile(target: string, bytes: Buffer, mode = 0o600, expectedSha256?: string): Promise<void> {
-  const parent = path.dirname(target);
-  let current = path.resolve(parent);
-  while (true) {
-    let stat: fs.Stats;
-    try { stat = await fs.promises.lstat(current); }
-    catch { throw new SecureFileError('TASK_ARTIFACT_WRITE_CONFLICT', 'authoritative parent directory is missing'); }
-    if (!stat.isDirectory() || stat.isSymbolicLink()) throw new SecureFileError('TASK_ARTIFACT_WRITE_CONFLICT', 'authoritative parent directory is not a real directory');
-    const next = path.dirname(current);
-    if (next === current) break;
-    current = next;
-  }
-  try {
-    const existing = await fs.promises.lstat(target);
-    if (existing.isSymbolicLink() || !existing.isFile()) throw new SecureFileError('TASK_ARTIFACT_WRITE_CONFLICT', 'authoritative target is not a regular file');
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
-  }
-  const temporary = path.join(parent, `.${path.basename(target)}.${process.pid}.${Date.now()}.tmp`);
-  let handle: fs.promises.FileHandle | undefined;
-  try {
-    handle = await fs.promises.open(temporary, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL, mode);
-    await handle.writeFile(bytes);
-    await handle.sync();
-    await handle.chmod(mode);
-    await handle.close();
-    handle = undefined;
-    if (expectedSha256 !== undefined) readStableFileSync(target, { maxBytes: 1024 * 1024, expectedSha256 });
-    fs.renameSync(temporary, target);
-    const directory = await fs.promises.open(parent, fs.constants.O_RDONLY | DIRECTORY);
-    try { await directory.sync(); } finally { await directory.close(); }
-  } finally {
-    await handle?.close().catch(() => undefined);
-    await fs.promises.rm(temporary, { force: true }).catch(() => undefined);
-  }
-}

package/lib/task/short-id.ts

@@ -447,15 +447,6 @@ function readRegistry(repoRoot: string): RegistrySchema | null {
   }
 }
 
-function readBranchFromTaskMd(repoRoot: string, taskId: string): string | null {
-  const taskMdPath = path.join(resolveProjectTaskWorkspaceRoot(repoRoot), 'active', taskId, 'task.md');
-  if (!fs.existsSync(taskMdPath)) return null;
-  const content = fs.readFileSync(taskMdPath, 'utf8');
-  const m = content.match(/^branch:\s*(.+)$/m);
-  if (!m || !m[1]) return null;
-  return m[1].trim().replace(/^(["'])(.*)\1$/, '$2');
-}
-
 function loadShortIdByTaskId(repoRoot: string): Map<string, string> {
   const registry = readRegistry(repoRoot);
   const map = new Map<string, string>();
@@ -527,44 +518,10 @@ function inspectShortIdRegistry(
   }
 }
 
-/**
- * Resolve a branch to its active-task short id (`NN`), or `null` when no
- * active task is bound to that branch.
- *
- * Two-state semantics: this only consults the active registry
- * (`active/.short-ids.json`) plus each `active/{taskId}/task.md`. Tasks moved
- * to completed/blocked/cancelled/archive have already released their short id,
- * so their branches return `null` — in `ai sandbox ls` that surfaces as `-`,
- * meaning the sandbox is free to remove.
- */
-function lookupShortIdByBranch(
-  branch: string,
-  repoRoot: string,
-  _opts?: { shortIdLength?: number }
-): string | null {
-  const registry = readRegistry(repoRoot);
-  if (!registry) return null;
-  const matches: string[] = [];
-  for (const [key, taskId] of Object.entries(registry.ids)) {
-    const taskBranch = readBranchFromTaskMd(repoRoot, taskId);
-    if (taskBranch && taskBranch === branch) {
-      matches.push(key);
-    }
-  }
-  if (matches.length === 0) return null;
-  if (matches.length > 1) {
-    process.stderr.write(
-      `Warning: branch '${branch}' is bound to multiple active tasks: ${matches.join(', ')}; using ${matches[0]}\n`
-    );
-  }
-  return matches[0]!;
-}
-
 export {
   normalizeShortIdInput,
   isRemovedHashShortIdInput,
   resolveShortIdReadOnly,
-  lookupShortIdByBranch,
   loadShortIdByTaskId,
   inspectShortIdRegistry,
   configuredShortIdLength,

package/lib/task/skill-scope.ts

@@ -13,7 +13,6 @@ const TASK_SCOPE_SKILLS: ReadonlySet<string> = new Set([
   'review-code',
   'review-plan',
   'run-manual-validation',
-  'run-task',
   'watch-pr'
 ]);
 

package/lib/task/verification-engine.ts

@@ -1,7 +1,6 @@
 // frontmatter, ledger, Git snapshot and platform domains are imported below.
 import fs from "node:fs";
 import path from "node:path";
-import process from "node:process";
 import { execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 
@@ -29,10 +28,8 @@ import { inspectDecisionDetailDuplicates } from "./decision-details.ts";
 import { parseImplementationInputs, type ImplementationInput } from "./implementation-inputs.ts";
 import { scanVisibleMarkdown } from "./markdown.ts";
 import { loadVerificationConfig } from "./verification-config.ts";
-import { inspectActivityLog, pairEntries } from "./activity-log.ts";
+import { inspectActivityLog } from "./activity-log.ts";
 import { parseWorkflowWarnings } from "./workflow-warnings.ts";
-import { OrchestrationStateError, readRun } from "./orchestration.ts";
-import type { OrchestrationRun } from "./orchestration.ts";
 import { readPrDeliveryFact } from "./pr-delivery-fact.ts";
 import { validateLocalArtifact } from "./local-artifact-finalization.ts";
 import { getArtifactSchema } from "./artifact-schema.ts";
@@ -41,13 +38,12 @@ import type { VerificationShared } from "./verification-types.ts";
 import { normalizeVerificationRecord } from './gate-policy.ts';
 import { manualValidationFinalSummaryProjectionMatches } from "./manual-validation-receipt.ts";
 import { readManualValidationCompletion } from "./manual-validation-completion.ts";
-import { sha256File } from "./artifact-receipts.ts";
+import { parseArtifactReceipts, receiptForOutput, sha256File } from "./artifact-receipts.ts";
 import { inspectArtifactDirectory } from "./artifact-lifecycle.ts";
-import { getAgentClientAdapter } from "../agent-clients/registry.ts";
 import { parseArtifactName } from "./artifact-name.ts";
 import { summaryCommentState } from "../platform/pr-summary.ts";
 import { taskIssueIdentity } from "../platform/task-identities.ts";
-import { hasArtifactCompletionFact, hasArtifactCompletionLog, parseCompletionFacts } from './completion-facts.ts';
+import { hasValidArtifactCompletion } from './completion-facts.ts';
 import { inspectReviewIdentity } from './review-identity.ts';
 
 const TASK_ENUMS = {
@@ -70,11 +66,9 @@ const DEFAULT_REQUIRED_FIELDS = [
 
 const DATE_TIME_PATTERN = /^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(?:[+-]\d{2}:\d{2})?$/;
 // Started rows do not represent completed lifecycle actions.
-const ACTIVITY_LOG_STARTED_RE = /\s*\[started\]\s*$/;
 const BRANCH_SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 
 // Review disagreement ledger (see .agents/rules/review-handshake.md).
-const LEDGER_SECTION_NAMES = ["审查分歧账本", "Review Disagreement Ledger"];
 const POST_REVIEW_COMMIT_STAGE = "post-review-commit";
 const SHA_PATTERN = /^[0-9a-f]{7,40}$/i;
 
@@ -126,10 +120,6 @@ async function runCheck(type: any, context: any, shared: any): Promise<any> {
       return checkPostReviewCommit(context);
     case "required-pr-delivery":
       return checkRequiredPrDelivery(context);
-    case "orchestration-state":
-      return checkOrchestrationState(context);
-    case "orchestration-evidence":
-      return checkOrchestrationEvidence(context);
     default: {
       const adapter = PLATFORM_ADAPTERS[type];
       if (!adapter) {
@@ -145,162 +135,6 @@ async function runCheck(type: any, context: any, shared: any): Promise<any> {
   }
 }
 
-function checkOrchestrationState({ taskDir }: any): any {
-  const file = path.join(taskDir, '.runtime', 'orchestration.json');
-  const stat = safeStat(file);
-  if (!stat?.isFile()) return failResult('orchestration-state', 'orchestration.json is missing');
-  let run: OrchestrationRun | null;
-  try {
-    run = readRun(taskDir);
-  } catch (error) {
-    const message = error instanceof OrchestrationStateError ? error.message : String(error);
-    return failResult('orchestration-state', `Invalid orchestration.json: ${message}`);
-  }
-  if (!run || !['paused', 'completed'].includes(run.status)) {
-    return failResult('orchestration-state', `Expected paused or completed run, received '${run?.status ?? 'missing'}'`);
-  }
-  const adapterEvidenceError = validateAdapterReceiptEvidence(run);
-  if (adapterEvidenceError) return failResult('orchestration-state', adapterEvidenceError);
-  if (run.status === 'paused' && (!run.pause?.code || !run.pause?.message)) {
-    return failResult('orchestration-state', 'Paused run requires a stable pause code and message');
-  }
-  if (run.status === 'completed') {
-    const evidenceError = validateCleanCompletionEvidence(run);
-    if (evidenceError) return failResult('orchestration-state', evidenceError);
-  } else if (run.completionEvidence != null) {
-    return failResult('orchestration-state', 'Clean completion evidence requires a completed run');
-  } else if (run.pendingDelegation?.status === 'sealed') {
-    return failResult('orchestration-state', 'Paused run has a sealed delegation that could still advance');
-  }
-  return passResult('orchestration-state', `Orchestration run is safely ${run.status}`);
-}
-
-function exactText(value: unknown): value is string {
-  return typeof value === 'string' && value.length > 0 && value.trim() === value;
-}
-
-function validateCleanCompletionEvidence(run: OrchestrationRun): string | null {
-  const evidence = run.completionEvidence;
-  const shaPattern = /^[0-9a-f]{40}$/i;
-  if (
-    !evidence
-    || Number.isNaN(Date.parse(evidence.observedAt))
-    || !shaPattern.test(evidence.head)
-    || !shaPattern.test(evidence.headTree)
-    || !shaPattern.test(evidence.worktreeTree)
-    || !shaPattern.test(evidence.lastReviewedCommit)
-    || !(evidence.prHead === null || shaPattern.test(evidence.prHead))
-  ) {
-    return 'Clean completion evidence has an invalid structure';
-  }
-  if (
-    evidence.head !== evidence.lastReviewedCommit
-    || (evidence.prHead !== null && evidence.head !== evidence.prHead)
-    || evidence.headTree !== evidence.worktreeTree
-  ) {
-    return 'Clean completion evidence does not bind matching commit and tree identities';
-  }
-  if (
-    run.status !== 'completed'
-    || run.pendingDelegation !== null
-    || run.receipts.some((receipt) => receipt.stage === 'commit')
-  ) {
-    return 'Clean completion evidence conflicts with pending delegation or commit receipt state';
-  }
-  return null;
-}
-
-function validateAdapterReceiptEvidence(run: OrchestrationRun): string | null {
-  const receipts = [...run.receipts, ...(run.pendingDelegation ? [run.pendingDelegation] : [])];
-  for (const receipt of receipts) {
-    const validate = getAgentClientAdapter(receipt.client).orchestrationAdapter?.validateReceiptEvidence;
-    if (validate && !validate(receipt)) {
-      return `Receipt '${receipt.id}' has invalid evidence from its agent adapter`;
-    }
-  }
-  return null;
-}
-
-function checkOrchestrationEvidence({ taskDir }: any): any {
-  const file = path.join(taskDir, '.runtime', 'orchestration.json');
-  const stat = safeStat(file);
-  if (!stat?.isFile()) return failResult('orchestration-evidence', 'orchestration.json is missing');
-  let run: OrchestrationRun | null;
-  try {
-    run = readRun(taskDir);
-  } catch (error) {
-    const message = error instanceof OrchestrationStateError ? error.message : String(error);
-    return failResult('orchestration-evidence', `Invalid orchestration.json: ${message}`);
-  }
-  if (!run) return failResult('orchestration-evidence', 'orchestration.json is missing');
-  const adapterEvidenceError = validateAdapterReceiptEvidence(run);
-  if (adapterEvidenceError) return failResult('orchestration-evidence', adapterEvidenceError);
-  // readRun validates the persisted schema, receipt identities and client provenance.
-  const policy = run.modelPolicy;
-  if (run.completionEvidence != null) {
-    const evidenceError = validateCleanCompletionEvidence(run);
-    if (evidenceError) return failResult('orchestration-evidence', evidenceError);
-  } else if (run.status === 'completed') {
-    return failResult('orchestration-evidence', 'Completed run requires reviewed-head-clean completion evidence');
-  }
-  if (run.pendingDelegation && !['prepared', 'activated', 'stage-completed'].includes(run.pendingDelegation.status)) {
-    return failResult('orchestration-evidence', `Pending receipt has unsafe status '${run.pendingDelegation.status}'`);
-  }
-  const receipts = [...run.receipts, ...(run.pendingDelegation ? [run.pendingDelegation] : [])];
-  for (const receipt of receipts) {
-    const expectedPolicy = policy[receipt.role];
-    if (!expectedPolicy || receipt.requestedModel !== expectedPolicy.model) {
-      return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' requested model does not match its role policy`);
-    }
-    if (receipt.requestedReasoningEffort !== expectedPolicy.reasoningEffort) {
-      return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' requested reasoning effort does not match its role policy`);
-    }
-    const activated = ['activated', 'stage-completed', 'sealed', 'consumed'].includes(receipt.status);
-    if (activated) {
-      const evidencePolicy = getAgentClientAdapter(receipt.client).delegationEvidence;
-      if (evidencePolicy.actualModelRequired !== false) {
-        if (!exactText(receipt.actualModel)) {
-          return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has no host-observed actual model`);
-        }
-      }
-      if (evidencePolicy.actualReasoningEffortRequired !== false) {
-        if (!exactText(receipt.actualReasoningEffort)) {
-          return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has no host-observed actual reasoning effort`);
-        }
-      }
-      if (evidencePolicy.spawnModeRequired !== false && receipt.spawnMode !== 'fresh') {
-        return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has invalid fresh delegation identity`);
-      }
-      if (receipt.actualModel != null && receipt.actualModel !== receipt.requestedModel) {
-        if (evidencePolicy.fallbackReasonRequired !== false && !exactText(receipt.modelFallbackReason)) {
-          return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' model fallback is not justified`);
-        }
-      }
-      if (
-        (receipt.actualModel == null || receipt.actualModel === receipt.requestedModel)
-        && receipt.modelFallbackReason !== null
-      ) {
-        return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has an unrelated model fallback reason`);
-      }
-      if (receipt.actualReasoningEffort != null && receipt.actualReasoningEffort !== receipt.requestedReasoningEffort) {
-        if (evidencePolicy.fallbackReasonRequired !== false && !exactText(receipt.reasoningEffortFallbackReason)) {
-          return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' reasoning-effort fallback is not justified`);
-        }
-      }
-      if (
-        (receipt.actualReasoningEffort == null || receipt.actualReasoningEffort === receipt.requestedReasoningEffort)
-        && receipt.reasoningEffortFallbackReason !== null
-      ) {
-        return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has an unrelated reasoning-effort fallback reason`);
-      }
-    }
-  }
-  if (run.receipts.some((receipt) => receipt.status !== 'consumed')) {
-    return failResult('orchestration-evidence', 'Historical receipts must be consumed');
-  }
-  return passResult('orchestration-evidence', 'Persisted orchestration model and delegation evidence is internally consistent');
-}
-
 // === Check Functions ===
 
 function checkTaskMeta({ taskDir, config, repositoryRoot, skillName, artifactFile }: any): any {
@@ -356,12 +190,9 @@ function checkTaskMeta({ taskDir, config, repositoryRoot, skillName, artifactFil
   if (expectedStep && metadata.current_step !== expectedStep) {
     let validLifecycleArtifact = false;
     if (currentTask) {
-      const { section, invalidEntries } = inspectActivityLog(task.content);
-      if (section && invalidEntries.length === 0) {
-        validLifecycleArtifact = checkArtifactLifecycleActivityLog(
-          taskDir, artifactFile, skillName, task, section.entries
-        )?.status === "pass";
-      }
+      validLifecycleArtifact = checkArtifactLifecycleActivityLog(
+        taskDir, artifactFile, skillName, task
+      )?.status === "pass";
     }
     if (!validLifecycleArtifact) {
       return failResult(
@@ -678,12 +509,6 @@ function checkImplementationInput({ taskDir, artifactFile }: any): any {
     return failResult("implementation-input", `Invalid Implementation Inputs: ${error instanceof Error ? error.message : String(error)}`);
   }
 
-  const doneActions = (inspectActivityLog(task.content).section?.entries ?? [])
-    .filter((entry) => !ACTIVITY_LOG_STARTED_RE.test(entry.step))
-    .map((entry) => entry.step)
-    .filter((step) => /^(?:Code Task|Code) \(Round \d+/.test(step));
-  const latestAction = doneActions.at(-1) || "";
-  const actionDecision = /(?:Code Task|Code) \(Round \d+, decision (II-[1-9]\d*)\)/.exec(latestAction)?.[1] || null;
   const report = fs.readFileSync(artifactPath, "utf8");
   const reportSection = getSectionContent(report, ["实现输入", "Implementation Input"]);
   if (!reportSection) return failResult("implementation-input", "Implementation Input report section not found");
@@ -696,37 +521,31 @@ function checkImplementationInput({ taskDir, artifactFile }: any): any {
   const reportLedger = field("账本 ID", "Ledger ID");
   const reportEvidence = field("裁决证据", "Decision Evidence");
 
-  if (!actionDecision) {
-    if (reportInput && reportInput !== "N/A") {
-      return failResult("implementation-input", "Non-decision code action must report Decision Input as N/A");
-    }
+  if (!reportInput || reportInput === "N/A") {
     return passResult("implementation-input", "Non-decision implementation input identity is consistent");
   }
-  if (reportInput !== actionDecision) {
-    return failResult("implementation-input", `Report decision input '${reportInput}' does not match Activity Log ${actionDecision}`);
-  }
-  const matches = rows.filter((row) => row.id === actionDecision);
-  if (matches.length !== 1) return failResult("implementation-input", `${actionDecision} is missing or duplicated in task table`);
+  const matches = rows.filter((row) => row.id === reportInput);
+  if (matches.length !== 1) return failResult("implementation-input", `${reportInput} is missing or duplicated in task table`);
   const row = matches[0]!;
   if (row.stage !== "code" || !row.needsImplementation || row.status !== "consumed" || row.consumedBy !== artifactFile || !row.decisionEvidence) {
-    return failResult("implementation-input", `${actionDecision} is not a consumed input for ${artifactFile}`);
+    return failResult("implementation-input", `${reportInput} is not a consumed input for ${artifactFile}`);
   }
   if (reportLedger !== row.ledgerId || reportEvidence !== row.decisionEvidence) {
-    return failResult("implementation-input", `${actionDecision} report identity does not match task table evidence`);
+    return failResult("implementation-input", `${reportInput} report identity does not match task table evidence`);
   }
-  return passResult("implementation-input", `${actionDecision} matches Activity Log, report, and task table`);
+  return passResult("implementation-input", `${reportInput} matches report and task table`);
 }
 
-const ARTIFACT_ACTIVITY_STAGES: Readonly<Record<string, { family: string; event: string; action: string }>> = {
-  "analyze-task": { family: "analysis", event: "analyze.completed", action: "Analyze Task" },
-  "plan-task": { family: "plan", event: "plan.completed", action: "Plan Task" },
-  "review-analysis": { family: "review-analysis", event: "review-analysis.completed", action: "Review Analysis" },
-  "review-plan": { family: "review-plan", event: "review-plan.completed", action: "Review Plan" },
-  "code-task": { family: "code", event: "code.completed", action: "Code Task" },
-  "review-code": { family: "review-code", event: "review-code.completed", action: "Review Code" }
+const ARTIFACT_ACTIVITY_STAGES: Readonly<Record<string, { family: string; event: string }>> = {
+  "analyze-task": { family: "analysis", event: "analyze.completed" },
+  "plan-task": { family: "plan", event: "plan.completed" },
+  "review-analysis": { family: "review-analysis", event: "review-analysis.completed" },
+  "review-plan": { family: "review-plan", event: "review-plan.completed" },
+  "code-task": { family: "code", event: "code.completed" },
+  "review-code": { family: "review-code", event: "review-code.completed" }
 };
 
-function checkArtifactLifecycleActivityLog(taskDir: string, artifactFile: string | undefined, skillName: string, task: any, entries: any[]): any {
+function checkArtifactLifecycleActivityLog(taskDir: string, artifactFile: string | undefined, skillName: string, task: any): any {
   const stage = ARTIFACT_ACTIVITY_STAGES[skillName];
   if (!stage) return null;
   const inventory = inspectArtifactDirectory(taskDir, stage.family as any);
@@ -741,38 +560,21 @@ function checkArtifactLifecycleActivityLog(taskDir: string, artifactFile: string
   if (!identity || identity.family !== stage.family) {
     return failResult("activity-log", `Artifact '${output}' does not belong to ${stage.family}`);
   }
-  if (!hasArtifactCompletionFact(task.content, path.join(taskDir, output), stage.event)) {
+  if (!hasValidArtifactCompletion(task.content, taskDir, output, stage.event)) {
     return failResult("activity-log", `Completion fact for '${output}' is missing or stale; rerun ${skillName} to record a current completion`);
   }
 
-  const frontmatter = parseTypedTaskFrontmatter(task.content);
-  const fact = parseCompletionFacts(frontmatter.completion_facts).find((item) => item.event === stage.event && item.output === output);
-  if (!fact) return failResult("activity-log", `Completion fact for '${output}' is missing; rerun ${skillName}`);
-  if (!Array.isArray(fact.lifecycleInputs)) {
-    return failResult("activity-log", `Completion fact for '${output}' has no input snapshot; rerun ${skillName}`);
-  }
-  for (const input of fact.lifecycleInputs) {
-    if (!input || typeof input.name !== "string" || !/^[a-f0-9]{64}$/u.test(input.sha256)) {
-      return failResult("activity-log", `Completion fact for '${output}' has an invalid input snapshot; rerun ${skillName}`);
-    }
-    const inputIdentity = parseArtifactName(input.name);
-    if (!inputIdentity) return failResult("activity-log", `Completion fact for '${output}' has invalid input '${input.name}'; rerun ${skillName}`);
+  const receipts = parseArtifactReceipts(task.content).rows.filter((receipt) => receipt.output === output);
+  for (const receipt of receipts) {
+    const inputIdentity = parseArtifactName(receipt.input);
+    if (!inputIdentity) return failResult("activity-log", `Completion receipt for '${output}' has invalid input '${receipt.input}'; rerun ${skillName}`);
     const inputInventory = inspectArtifactDirectory(taskDir, inputIdentity.family as any);
-    if (inputInventory.status !== "ready" || inputInventory.latest?.name !== input.name
-      || sha256File(path.join(taskDir, input.name)) !== input.sha256) {
-      return failResult("activity-log", `Input '${input.name}' changed or is no longer current; rerun ${skillName} to refresh '${output}'`);
+    if (inputInventory.status !== "ready" || inputInventory.latest?.name !== receipt.input
+      || sha256File(path.join(taskDir, receipt.input)) !== receipt.inputSha256) {
+      return failResult("activity-log", `Input '${receipt.input}' changed or is no longer current; rerun ${skillName} to refresh '${output}'`);
     }
   }
 
-  const roundActionPattern = new RegExp(`^${stage.action} \\(Round ${identity.round}(?:, [^)]+)?\\)$`);
-  const roundAction = entries.find((entry) => {
-    return !ACTIVITY_LOG_STARTED_RE.test(entry.step)
-      && roundActionPattern.test(entry.step)
-      && entry.note.includes(`→ ${output}`);
-  });
-  if (!roundAction) {
-    return failResult("activity-log", `No completed Activity Log row records '${output}' for ${skillName} Round ${identity.round}`);
-  }
   return passResult("activity-log", `Current ${stage.family} completion '${output}' is valid for Round ${identity.round}`);
 }
 
@@ -782,22 +584,19 @@ function checkActivityLog({ taskDir, skillName, artifactFile }: any): any {
     return failResult("activity-log", task.message);
   }
 
-  const { section, invalidEntries } = inspectActivityLog(task.content);
-  if (!section) return failResult("activity-log", "Activity Log section not found or ambiguous");
-  if (invalidEntries.length) return failResult("activity-log", `Invalid Activity Log entry format: ${invalidEntries[0]}`);
-  const entries = section.entries;
-  if (entries.length === 0) return failResult("activity-log", "Activity Log has no entries");
+  const artifactLifecycleResult = checkArtifactLifecycleActivityLog(taskDir, artifactFile, skillName, task);
+  if (artifactLifecycleResult && artifactLifecycleResult.status !== "pass") return artifactLifecycleResult;
 
-  for (const entry of entries) {
-    if (!entry.note.trim()) return failResult("activity-log", "Activity Log entry note is required");
+  const { section, invalidEntries } = inspectActivityLog(task.content);
+  const warnings: string[] = [];
+  if (!section) warnings.push('Activity Log section is missing or ambiguous');
+  else {
+    if (invalidEntries.length) warnings.push('Activity Log contains malformed entries');
+    if (!section.entries.length) warnings.push('Activity Log has no entries');
+    if (section.entries.some((entry) => !entry.note.trim())) warnings.push('Activity Log entry note is empty');
   }
+  return passResult("activity-log", artifactLifecycleResult?.message ?? "Business checks are valid", warnings);
 
-  const artifactLifecycleResult = checkArtifactLifecycleActivityLog(
-    taskDir, artifactFile, skillName, task, entries
-  );
-  if (artifactLifecycleResult) return artifactLifecycleResult;
-
-  return passResult("activity-log", "Activity Log is valid");
 }
 
 function checkCompletionChecklist({ taskDir, config }: any): any {
@@ -837,18 +636,7 @@ function checkCompletionChecklist({ taskDir, config }: any): any {
   return passResult("completion-checklist", `Completion Checklist valid (${items.length} items checked)`);
 }
 
-function resolveReviewSetting(config: any, key: any, fallback: any, repoRoot: string): any {
-  if (config && config[key] !== undefined && config[key] !== null) {
-    return config[key];
-  }
-  const reviewConfig = loadPostReviewConfig(repoRoot);
-  if (reviewConfig[key] !== undefined && reviewConfig[key] !== null) {
-    return reviewConfig[key];
-  }
-  return fallback;
-}
-
-function checkReviewLedger({ taskDir, config, repositoryRoot }: any): any {
+function checkReviewLedger({ taskDir, config }: any): any {
   const task = loadTask(taskDir);
   if (!task.ok) {
     return failResult("review-ledger", task.message);
@@ -931,8 +719,7 @@ async function checkManualValidation({ taskDir, repositoryRoot }: any): Promise<
       `${parsed.summary.manualValidation} manual validation item(s) pending: run /complete-manual-validation`
     );
   }
-  // 5. The Activity Log must record the matching completion entry; the file name
-  //    is derived with path.basename (resolveArtifactPath does not return fileName).
+  // 5. Validate the committed receipt, transaction, and artifact.
   const artifactName = path.basename(resolved.path);
   const task = loadTask(taskDir);
   if (!task.ok) return failResult("manual-validation", task.message);
@@ -954,29 +741,21 @@ async function checkManualValidation({ taskDir, repositoryRoot }: any): Promise<
   if (sha256File(resolved.path) !== receipt.artifactSha256) {
     return failResult("manual-validation", `Manual validation artifact digest does not match the receipt for ${artifactName}`);
   }
-  // 6. Timing correlation (PL-3 fix, PL-4 corrected): the completion entry must
-  //    sit AFTER the latest review-code round's completion entry in the
-  //    append-only Activity Log. indexOf is a literal search, so the artifactName
-  //    must NOT be passed through escapeRegExp here (that escapes '.' to '\.',
-  //    which indexOf never matches). Not reusing completed.exec().index: exec
-  //    anchors to the first '**Complete Manual Validation**' heading, which can
-  //    belong to an earlier round's entry and misorder the standard path.
-  const inspectedLog = inspectActivityLog(task.content);
-  if (!inspectedLog.section) return failResult("manual-validation", "Activity Log is missing or invalid");
-  const reviewRow = pairEntries(inspectedLog.section.entries).find((row) =>
-    row.step === `Review Code (Round ${review.round})` && row.started !== '' && row.done !== ''
-  );
-  const reviewDoneIndex = reviewRow
-    ? inspectedLog.section.entries.findIndex((entry) => entry.step === reviewRow.step && entry.time === reviewRow.done)
-    : -1;
-  const completedIndex = inspectedLog.section.entries.findIndex((entry) => entry.step === "Complete Manual Validation"
-    && entry.note.includes(`Manual validation passed → ${artifactName};`)
-        && entry.note.includes(`transaction=${receipt.transactionId};`)
-        && entry.note.includes(`receipt=${receipt.receiptDigest};`)
-        && entry.note.includes(`head=${receipt.prHeadSha}`));
-  if (reviewDoneIndex === -1) return failResult("manual-validation", `Latest review-code (round ${review.round}) completion entry is missing from the Activity Log`);
-  if (completedIndex === -1) return failResult("manual-validation", `Committed manual validation completion is not recorded for ${artifactName}`);
-  if (completedIndex < reviewDoneIndex) return failResult("manual-validation", `Latest review-code (round ${review.round}) came after the manual validation completion recorded for ${artifactName}`);
+  // 6. Compare the review completion and committed manual-validation times.
+  let reviewReceipt;
+  try {
+    reviewReceipt = receiptForOutput(task.content, review.fileName!);
+  } catch (error) {
+    return failResult("manual-validation", `Review-code receipt is invalid: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (!reviewReceipt || reviewReceipt.event !== "review-code.completed") {
+    return failResult("manual-validation", `Review-code completion time is unavailable for ${review.fileName}`);
+  }
+  const reviewTime = Date.parse(reviewReceipt.completedAt.replace(' ', 'T'));
+  const validationTime = Date.parse(receipt.committedAt);
+  if (!Number.isFinite(reviewTime) || !Number.isFinite(validationTime) || validationTime <= reviewTime) {
+    return failResult("manual-validation", `Manual validation must be completed after review-code ${review.fileName}`);
+  }
 
   const fact = readPrDeliveryFact(task.metadata);
   if (fact.status === "invalid") return failResult("manual-validation", fact.error.message);
@@ -1212,12 +991,9 @@ function checkReviewFact({ taskDir, artifactFile, repositoryRoot }: any): any {
   }
 
   const content = fs.readFileSync(resolvedArtifact.path, "utf8");
-  if (!hasArtifactCompletionFact(task.content, resolvedArtifact.path, 'review-code.completed')) {
+  if (!hasValidArtifactCompletion(task.content, taskDir, path.basename(resolvedArtifact.path), 'review-code.completed')) {
     return failResult("review-fact", `Review Code completion fact does not match ${path.basename(resolvedArtifact.path)}`);
   }
-  if (!hasArtifactCompletionLog(task.content, path.basename(resolvedArtifact.path), 'review-code.completed')) {
-    return failResult("review-fact", `Review Code completion entry does not reference ${path.basename(resolvedArtifact.path)}`);
-  }
   const verdict = parseReviewVerdict(content);
   const reviewTargetHead = extractReviewTargetHead(content);
   const reviewReviewedHead = extractReviewedHead(content);
@@ -1368,13 +1144,6 @@ function normalizeContent(text: any): any {
     .trim();
 }
 
-function interpolate(template: any, taskDir: any, artifactFile: any): any {
-  const artifactStem = artifactFile ? path.basename(artifactFile, path.extname(artifactFile)) : "";
-  return template
-    .replace(/\{task-id\}/g, path.basename(taskDir))
-    .replace(/\{artifact-stem\}/g, artifactStem);
-}
-
 function summarizeGate(checks: any): any {
   if (checks.some((check: any) => check.effectiveStatus === "blocked")) {
     return "blocked";