@fitlab-ai/agent-infra 0.9.0 → 0.9.2

package/dist/lib/task/review-finalization.js

@@ -0,0 +1,166 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { locateActivityLog, pairEntries } from './activity-log.js';
+import { parseArtifactName, validateCompletedArtifact } from './artifact-lifecycle.js';
+import { parseLedger, summarizeLedgerStage, validateLedgerRows } from './ledger.js';
+import { finalizeReviewSummaryContent } from './review-artifacts.js';
+import { resolveTaskRef } from './resolve-ref.js';
+import { validateOrchestrationStage } from './orchestration.js';
+const STAGES = {
+    analysis: { family: 'review-analysis', action: 'Review Analysis' },
+    plan: { family: 'review-plan', action: 'Review Plan' },
+    code: { family: 'review-code', action: 'Review Code' }
+};
+const DEFAULT_FILE_SYSTEM = {
+    readFileSync: (file) => fs.readFileSync(file, 'utf8'),
+    statModeSync: (file) => fs.statSync(file).mode,
+    writeFileSync: (file, content, mode) => fs.writeFileSync(file, content, { encoding: 'utf8', flag: 'wx', mode }),
+    renameSync: (from, to) => fs.renameSync(from, to),
+    unlinkSync: (file) => fs.unlinkSync(file)
+};
+function failed(request, code, message, taskId = null, stageStatus = null) {
+    return {
+        status: 'failed',
+        changed: false,
+        intent: 'finalize-summary',
+        requestRef: request.taskRef,
+        taskId,
+        stage: request.stage,
+        artifact: request.artifact,
+        stageStatus,
+        operations: [],
+        error: { code, message }
+    };
+}
+function openReviewRound(content, action, round) {
+    const section = locateActivityLog(content);
+    if (!section)
+        return false;
+    const expected = `${action} (Round ${round})`;
+    return pairEntries(section.entries).filter((row) => (row.step === expected && Boolean(row.started) && !row.done)).length === 1;
+}
+function cleanupTemp(fileSystem, tempPath) {
+    try {
+        fileSystem.unlinkSync(tempPath);
+    }
+    catch {
+        // Best-effort cleanup preserves the primary failure.
+    }
+}
+function finalizeReviewSummary(request, options = {}) {
+    const stage = request.stage;
+    const spec = STAGES[stage];
+    if (!spec)
+        return failed(request, 'REVIEW_STAGE_INVALID', `unsupported review stage '${request.stage}'`);
+    if (!request.taskRef || !request.artifact) {
+        return failed(request, 'REVIEW_PAYLOAD_INVALID', 'taskRef, stage, and artifact are required');
+    }
+    const resolved = resolveTaskRef(request.taskRef, { repoRoot: options.repoRoot });
+    if (!resolved.ok)
+        return failed(request, resolved.code, resolved.message, resolved.taskId);
+    if (resolved.state !== 'active') {
+        return failed(request, 'TASK_STATE_MISMATCH', `task ${resolved.taskId} is ${resolved.state}, expected active`, resolved.taskId);
+    }
+    const parsedArtifact = parseArtifactName(request.artifact);
+    if (!parsedArtifact || parsedArtifact.family !== spec.family) {
+        return failed(request, 'REVIEW_ARTIFACT_IDENTITY_INVALID', `artifact '${request.artifact}' does not match ${spec.family}`, resolved.taskId);
+    }
+    const validated = validateCompletedArtifact(resolved.taskDir, spec.family, request.artifact, parsedArtifact.round);
+    if (!validated.ok) {
+        const code = validated.error.code === 'ARTIFACT_NOT_REGULAR'
+            ? 'REVIEW_ARTIFACT_NOT_REGULAR'
+            : 'REVIEW_ARTIFACT_IDENTITY_INVALID';
+        return failed(request, code, validated.error.message, resolved.taskId);
+    }
+    const fileSystem = { ...DEFAULT_FILE_SYSTEM, ...options.fileSystem };
+    let taskContent;
+    let artifactContent;
+    try {
+        taskContent = fileSystem.readFileSync(resolved.taskMdPath);
+        artifactContent = fileSystem.readFileSync(validated.artifact.path);
+    }
+    catch (error) {
+        return failed(request, 'REVIEW_ARTIFACT_NOT_REGULAR', String(error), resolved.taskId);
+    }
+    if (!openReviewRound(taskContent, spec.action, parsedArtifact.round)) {
+        return failed(request, 'REVIEW_ARTIFACT_IDENTITY_INVALID', `${request.artifact} does not have one matching open started review event`, resolved.taskId);
+    }
+    const provenance = validateOrchestrationStage(request.taskRef, {
+        stage: spec.family,
+        round: parsedArtifact.round,
+        artifact: request.artifact,
+        role: 'reviewer'
+    }, { repoRoot: options.repoRoot });
+    if (provenance.status === 'failed' || provenance.status === 'paused') {
+        return failed(request, 'REVIEW_PROVENANCE_INVALID', provenance.error?.message ?? provenance.run?.pause?.message ?? 'orchestration provenance validation failed', resolved.taskId);
+    }
+    let rows;
+    try {
+        rows = parseLedger(taskContent);
+    }
+    catch (error) {
+        return failed(request, 'REVIEW_LEDGER_INVALID', String(error), resolved.taskId);
+    }
+    const ledgerError = validateLedgerRows(rows);
+    if (ledgerError) {
+        return failed(request, 'REVIEW_LEDGER_INVALID', `${ledgerError.code}: ${ledgerError.message}`, resolved.taskId);
+    }
+    const stageStatus = summarizeLedgerStage(rows, stage);
+    const transformed = finalizeReviewSummaryContent(artifactContent, stageStatus.unresolvedFindingCounts);
+    if (!transformed.ok) {
+        return failed(request, transformed.code, transformed.message, resolved.taskId, stageStatus);
+    }
+    if (!transformed.changed) {
+        return {
+            ...failed(request, 'REVIEW_ARTIFACT_CONFLICT', '', resolved.taskId, stageStatus),
+            status: 'no-op',
+            error: null
+        };
+    }
+    const operations = [{ kind: 'artifact', artifact: request.artifact, operation: 'update' }];
+    if (request.dryRun) {
+        return {
+            ...failed(request, 'REVIEW_ARTIFACT_CONFLICT', '', resolved.taskId, stageStatus),
+            status: 'planned',
+            changed: true,
+            operations,
+            error: null
+        };
+    }
+    const tempPath = path.join(resolved.taskDir, `.${request.artifact}.tmp-${process.pid}-${(options.randomSuffix ?? randomUUID)()}`);
+    let mode;
+    try {
+        mode = fileSystem.statModeSync(validated.artifact.path);
+        fileSystem.writeFileSync(tempPath, transformed.content, mode);
+    }
+    catch (error) {
+        cleanupTemp(fileSystem, tempPath);
+        return failed(request, 'REVIEW_TEMP_WRITE_FAILED', String(error), resolved.taskId, stageStatus);
+    }
+    try {
+        if (fileSystem.readFileSync(validated.artifact.path) !== artifactContent) {
+            cleanupTemp(fileSystem, tempPath);
+            return failed(request, 'REVIEW_ARTIFACT_CONFLICT', `${request.artifact} changed during finalization`, resolved.taskId, stageStatus);
+        }
+        fileSystem.renameSync(tempPath, validated.artifact.path);
+    }
+    catch (error) {
+        cleanupTemp(fileSystem, tempPath);
+        return failed(request, 'REVIEW_RENAME_FAILED', String(error), resolved.taskId, stageStatus);
+    }
+    return {
+        status: 'applied',
+        changed: true,
+        intent: 'finalize-summary',
+        requestRef: request.taskRef,
+        taskId: resolved.taskId,
+        stage,
+        artifact: request.artifact,
+        stageStatus,
+        operations,
+        error: null
+    };
+}
+export { finalizeReviewSummary };
+//# sourceMappingURL=review-finalization.js.map

package/dist/lib/task/review-fingerprint.js

@@ -5,6 +5,15 @@ import { artifactName, maxRound } from "./review-artifacts.js";
 // covers ALL tracked changes by default. This default denylist is EMPTY —
 // projects opt into exclusions explicitly via review.post_review_exclude_globs.
 export const DEFAULT_POST_REVIEW_EXCLUDES = [];
+export function loadPostReviewConfig(repoRoot) {
+    try {
+        const config = JSON.parse(fs.readFileSync(path.join(repoRoot, ".agents", ".airc.json"), "utf8"));
+        return config.review && typeof config.review === "object" ? config.review : {};
+    }
+    catch {
+        return {};
+    }
+}
 export function resolvePostReviewGlobs(config = {}, reviewConfig = {}) {
     const projectExcludes = [
         ...(Array.isArray(reviewConfig.post_review_exclude_globs) ? reviewConfig.post_review_exclude_globs : []),
@@ -31,6 +40,10 @@ export function extractReviewBaseline(content) {
     const match = String(content).match(/^[-*]?\s*\*\*(?:审查基线提交|Review Baseline Commit)\*\*[:：]\s*(.*?)\s*$/m);
     return match ? match[1].trim().replace(/`/g, "") : "";
 }
+export function extractReviewDiffBase(content) {
+    const match = String(content).match(/^[-*]?\s*\*\*(?:审查差异基线|Reviewed Diff Base)\*\*[:：]\s*(.*?)\s*$/m);
+    return match ? match[1].trim().replace(/`/g, "") : "";
+}
 export function extractReviewDiffFingerprint(content) {
     const match = String(content).match(/^[-*]?\s*\*\*(?:审查差异指纹|Reviewed Diff Fingerprint)\*\*[:：]\s*(.*?)\s*$/m);
     return match ? match[1].trim().replace(/`/g, "") : "";

package/dist/lib/task/verification-checks.js

@@ -1,5 +1,6 @@
 const LOCAL_VERIFICATION_CHECKS = [
-    'task-meta', 'artifact', 'implementation-input', 'activity-log', 'completion-checklist'
+    'task-meta', 'artifact', 'implementation-input', 'activity-log', 'completion-checklist',
+    'orchestration-state'
 ];
 function isLocalVerificationCheck(value) {
     return LOCAL_VERIFICATION_CHECKS.includes(value);

package/dist/lib/task/verification-engine.js

@@ -4,11 +4,16 @@ import path from "node:path";
 import process from "node:process";
 import { execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { extractReviewBaseline, extractReviewDiffFingerprint, extractReviewedSnapshotTree, findAuthoritativeReviewCodeArtifact, parseReviewVerdict, resolvePostReviewGlobs } from "./verification-review.js";
+import { extractReviewBaseline, extractReviewDiffBase, extractReviewDiffFingerprint, extractReviewedSnapshotTree, findAuthoritativeReviewCodeArtifact, loadPostReviewConfig, parseReviewVerdict, resolvePostReviewGlobs } from "./verification-review.js";
 import { check as checkPlatformSync } from "../platform/verification-sync.js";
 import { check as checkRequiredChecks } from "../platform/verification-required.js";
+import { inspectPlatformPullRequest } from "../platform/pull-requests.js";
+import { resolveMaterializedReviewedHeadRelation } from "../platform/change-request-git-evidence.js";
+import { resolveReviewedHeadRelation } from "../platform/merged-pr-equivalence.js";
+import { resolveLocalReviewedCommitRelation } from "../git/reviewed-commit-equivalence.js";
 import { parseTypedTaskFrontmatter } from "./frontmatter.js";
-import { parseLedger } from "./ledger.js";
+import { parseLedger, summarizeLedgerStage, validateLedgerRows } from "./ledger.js";
+import { equalCounts, parseReviewSummary } from "./review-artifacts.js";
 import { loadVerificationConfig } from "./verification-config.js";
 import { snapshotReview } from "../git/review-snapshot.js";
 const TASK_ENUMS = {
@@ -91,10 +96,14 @@ function runCheck(type, context, shared) {
             return checkCompletionChecklist(context);
         case "review-ledger":
             return checkReviewLedger(context);
+        case "review-summary":
+            return checkReviewSummary(context);
         case "review-fact":
             return checkReviewFact(context);
         case "post-review-commit":
             return checkPostReviewCommit(context);
+        case "orchestration-state":
+            return checkOrchestrationState(context);
         default: {
             const adapter = PLATFORM_ADAPTERS[type];
             if (!adapter) {
@@ -107,6 +116,34 @@ function runCheck(type, context, shared) {
         }
     }
 }
+function checkOrchestrationState({ taskDir }) {
+    const file = path.join(taskDir, 'orchestration.json');
+    const stat = safeStat(file);
+    if (!stat?.isFile())
+        return failResult('orchestration-state', 'orchestration.json is missing');
+    let run;
+    try {
+        run = JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch (error) {
+        return failResult('orchestration-state', `Invalid orchestration.json: ${String(error)}`);
+    }
+    if (run.schemaVersion !== 1 || !['paused', 'completed'].includes(run.status)) {
+        return failResult('orchestration-state', `Expected paused or completed run, received '${run.status}'`);
+    }
+    if (run.status === 'paused' && (!run.pause?.code || !run.pause?.message)) {
+        return failResult('orchestration-state', 'Paused run requires a stable pause code and message');
+    }
+    if (run.status === 'completed') {
+        if (run.pendingDelegation !== null || !run.commitAuthorization?.consumedAt) {
+            return failResult('orchestration-state', 'Completed run must consume commit authorization and clear pending delegation');
+        }
+    }
+    else if (run.pendingDelegation?.status === 'sealed') {
+        return failResult('orchestration-state', 'Paused run has a sealed delegation that could still advance');
+    }
+    return passResult('orchestration-state', `Orchestration run is safely ${run.status}`);
+}
 // === Check Functions ===
 function checkTaskMeta({ taskDir, config }) {
     const task = loadTask(taskDir);
@@ -210,19 +247,6 @@ function loadProjectName() {
         return "";
     }
 }
-function loadReviewConfig() {
-    const configPath = path.join(repoRoot, ".agents", ".airc.json");
-    if (!fs.existsSync(configPath)) {
-        return {};
-    }
-    try {
-        const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
-        return config.review && typeof config.review === "object" ? config.review : {};
-    }
-    catch {
-        return {};
-    }
-}
 function checkArtifact({ taskDir, config, artifactFile }) {
     const resolvedArtifact = resolveArtifactPath(taskDir, config.file_pattern, artifactFile);
     if (!resolvedArtifact.ok) {
@@ -250,6 +274,40 @@ function checkArtifact({ taskDir, config, artifactFile }) {
     }
     return passResult("artifact", `${path.basename(artifactPath)} passed (${requiredSections.length} sections)`);
 }
+function checkReviewSummary({ taskDir, config, artifactFile }) {
+    const stage = String(config.stage || "");
+    if (!["analysis", "plan", "code"].includes(stage)) {
+        return failResult("review-summary", `Invalid review stage '${stage}'`);
+    }
+    const resolvedArtifact = resolveArtifactPath(taskDir, "", artifactFile);
+    if (!resolvedArtifact.ok || !safeStat(resolvedArtifact.path)?.isFile()) {
+        return failResult("review-summary", resolvedArtifact.message || "Review artifact is missing");
+    }
+    const parsed = parseReviewSummary(fs.readFileSync(resolvedArtifact.path, "utf8"));
+    if (!parsed.ok)
+        return failResult("review-summary", `${parsed.code}: ${parsed.message}`);
+    if (!parsed.summary.counts) {
+        return failResult("review-summary", "Review summary finding counts are not finalized");
+    }
+    const task = loadTask(taskDir);
+    if (!task.ok)
+        return failResult("review-summary", task.message);
+    let rows;
+    try {
+        rows = parseLedger(task.content);
+    }
+    catch (error) {
+        return failResult("review-summary", `Invalid disagreement ledger: ${String(error)}`);
+    }
+    const invalid = validateLedgerRows(rows);
+    if (invalid)
+        return failResult("review-summary", `${invalid.code}: ${invalid.message}`);
+    const expected = summarizeLedgerStage(rows, stage).unresolvedFindingCounts;
+    if (!equalCounts(parsed.summary.counts, expected)) {
+        return failResult("review-summary", `Review summary counts ${JSON.stringify(parsed.summary.counts)} do not match ledger ${JSON.stringify(expected)}`);
+    }
+    return passResult("review-summary", `${path.basename(resolvedArtifact.path)} finding counts match the ${stage} ledger`);
+}
 function checkImplementationInput({ taskDir, artifactFile }) {
     const task = loadTask(taskDir);
     if (!task.ok)
@@ -495,7 +553,7 @@ function resolveReviewSetting(config, key, fallback) {
     if (config && config[key] !== undefined && config[key] !== null) {
         return config[key];
     }
-    const reviewConfig = loadReviewConfig();
+    const reviewConfig = loadPostReviewConfig(repoRoot);
     if (reviewConfig[key] !== undefined && reviewConfig[key] !== null) {
         return reviewConfig[key];
     }
@@ -579,8 +637,42 @@ function checkPostReviewCommit({ taskDir, config }) {
         return blockedResult("post-review-commit", "git unavailable or task directory is not inside a git repository");
     }
     const task = loadTask(taskDir);
-    const content = fs.readFileSync(reviewArtifact.path, "utf8");
+    if (!task.ok)
+        return failResult("post-review-commit", task.message);
     const lastReviewedCommit = task.ok ? (task.metadata.last_reviewed_commit || "").trim() : "";
+    const globs = resolvePostReviewGlobs(config, loadPostReviewConfig(repoRoot));
+    const hasPullRequest = Number(task.metadata.pr_number) > 0;
+    let inspected = null;
+    if (hasPullRequest) {
+        inspected = inspectPlatformPullRequest(task.metadata.id, { cwd: gitRoot });
+        if (!inspected.pullRequest) {
+            const message = inspected.error?.message || "PR merge snapshot is unavailable";
+            const code = inspected.error?.code || "PR_INSPECTION_INVALID";
+            return inspected.status === "blocked"
+                ? blockedResult("post-review-commit", message, code)
+                : failResult("post-review-commit", message, code);
+        }
+        if (inspected.pullRequest.state === "closed" &&
+            inspected.pullRequest.mergedAt &&
+            inspected.pullRequest.mergeCommitSha) {
+            const relation = resolveMaterializedReviewedHeadRelation({
+                cwd: gitRoot,
+                platformType: inspected.platform.type,
+                lastReviewedCommit,
+                pullRequest: inspected.pullRequest
+            });
+            if (relation.status === "merged-equivalent") {
+                return passResult("post-review-commit", `Reviewed PR head is content-equivalent to squash merge ${relation.mergeCommit.slice(0, 8)} on target ${relation.comparisonHead.slice(0, 8)}`);
+            }
+            if (relation.status === "blocked") {
+                return blockedResult("post-review-commit", relation.message, relation.code);
+            }
+            if (relation.status === "strict") {
+                return failResult("post-review-commit", "Merged PR evidence did not establish squash merge equivalence", "PR_MERGE_IDENTITY_INVALID");
+            }
+            return failResult("post-review-commit", relation.message, relation.code);
+        }
+    }
     const baselineSource = resolvePostReviewBaseline({
         gitRoot,
         lastReviewedCommit,
@@ -590,7 +682,6 @@ function checkPostReviewCommit({ taskDir, config }) {
         return baselineSource.result;
     }
     const sha = baselineSource.sha;
-    const globs = resolvePostReviewGlobs(config, loadReviewConfig());
     let commits;
     try {
         const out = execFileSync("git", ["-C", gitRoot, "rev-list", `${sha}..HEAD`, "--", ...globs], { encoding: "utf8" });
@@ -602,18 +693,63 @@ function checkPostReviewCommit({ taskDir, config }) {
     if (commits.length === 0) {
         return passResult("post-review-commit", `No post-review commits to code/rule paths since ${sha.slice(0, 8)}`);
     }
-    let exempt = false;
+    let localHead = "";
     try {
-        exempt = task.ok && parseLedger(task.content).some((row) => row.stage === POST_REVIEW_COMMIT_STAGE && row.status === "human-decided");
+        localHead = execFileSync("git", ["-C", gitRoot, "rev-parse", "HEAD"], { encoding: "utf8" }).trim();
     }
     catch {
-        return failResult("post-review-commit", "Invalid disagreement ledger");
+        return blockedResult("post-review-commit", "Unable to resolve the local HEAD");
+    }
+    if (hasPullRequest) {
+        if (inspected?.pullRequest) {
+            const relation = resolveReviewedHeadRelation({
+                gitRoot,
+                comparisonHead: localHead,
+                lastReviewedCommit: sha,
+                pullRequest: inspected.pullRequest
+            });
+            if (relation.status === "merged-equivalent") {
+                return passResult("post-review-commit", `Reviewed PR head is content-equivalent to squash merge ${relation.mergeCommit.slice(0, 8)}`);
+            }
+            if (relation.status === "blocked") {
+                return blockedResult("post-review-commit", relation.message, relation.code);
+            }
+        }
+    }
+    else if (commits.length === 1) {
+        const relation = resolveLocalReviewedCommitRelation({
+            gitRoot,
+            localHead,
+            lastReviewedCommit: sha,
+            rewrittenCommit: commits[0],
+            pathspecs: globs
+        });
+        if (relation.status === "local-equivalent") {
+            return passResult("post-review-commit", `Reviewed commit is content-equivalent to local rewrite ${relation.rewrittenCommit.slice(0, 8)}`);
+        }
+        if (relation.status === "blocked") {
+            return blockedResult("post-review-commit", relation.message);
+        }
     }
-    if (exempt) {
+    const exemption = resolvePostReviewExemption(task.content);
+    if (!exemption.ok)
+        return failResult("post-review-commit", exemption.message);
+    if (exemption.exempt) {
         return passResult("post-review-commit", `${commits.length} post-review commit(s) covered by a human-decided exemption`);
     }
     return failResult("post-review-commit", `${commits.length} commit(s) to code/rule paths after reviewed commit ${sha.slice(0, 8)}; re-run review-code or record a human-decided exemption`);
 }
+function resolvePostReviewExemption(content) {
+    try {
+        return {
+            ok: true,
+            exempt: parseLedger(content).some((row) => row.stage === POST_REVIEW_COMMIT_STAGE && row.status === "human-decided")
+        };
+    }
+    catch {
+        return { ok: false, message: "Invalid disagreement ledger" };
+    }
+}
 function checkReviewFact({ taskDir, artifactFile }) {
     const resolvedArtifact = resolveArtifactPath(taskDir, "review-code.md|review-code-r{N}.md", artifactFile);
     if (!resolvedArtifact.ok) {
@@ -626,6 +762,7 @@ function checkReviewFact({ taskDir, artifactFile }) {
     const content = fs.readFileSync(resolvedArtifact.path, "utf8");
     const verdict = parseReviewVerdict(content);
     const reviewBaseline = extractReviewBaseline(content);
+    const reviewDiffBase = extractReviewDiffBase(content);
     const reviewedFingerprint = extractReviewDiffFingerprint(content);
     const reviewedTree = extractReviewedSnapshotTree(content);
     if (!["通过", "需要修改", "拒绝", "Approved", "Changes Requested", "Rejected"].includes(verdict)) {
@@ -634,10 +771,12 @@ function checkReviewFact({ taskDir, artifactFile }) {
     let gitRoot;
     let head;
     let baseline;
+    let diffBase;
     try {
         gitRoot = execFileSync("git", ["-C", taskDir, "rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
         head = execFileSync("git", ["-C", gitRoot, "rev-parse", "HEAD"], { encoding: "utf8" }).trim();
         baseline = execFileSync("git", ["-C", gitRoot, "rev-parse", `${reviewBaseline}^{commit}`], { encoding: "utf8" }).trim();
+        diffBase = execFileSync("git", ["-C", gitRoot, "rev-parse", `${reviewDiffBase || reviewBaseline}^{commit}`], { encoding: "utf8" }).trim();
     }
     catch {
         return blockedResult("review-fact", `Unable to resolve review baseline '${reviewBaseline}' in the task repository; re-run review-code`);
@@ -647,7 +786,13 @@ function checkReviewFact({ taskDir, artifactFile }) {
     }
     let actualSnapshot;
     try {
-        actualSnapshot = snapshotReview({ cwd: gitRoot, mode: "worktree", baseline, globs: resolvePostReviewGlobs({}, loadReviewConfig()) });
+        actualSnapshot = snapshotReview({
+            cwd: gitRoot,
+            mode: "worktree",
+            baseline,
+            diffBase,
+            globs: resolvePostReviewGlobs({}, loadPostReviewConfig(repoRoot))
+        });
     }
     catch {
         return blockedResult("review-fact", `Unable to recompute reviewed diff fingerprint from baseline ${baseline.slice(0, 8)}; re-run review-code`);

package/dist/lib/task/verification-review.js

@@ -1,3 +1,3 @@
-export { extractReviewBaseline, extractReviewDiffFingerprint, extractReviewedSnapshotTree, findAuthoritativeReviewCodeArtifact, parseReviewVerdict, resolvePostReviewGlobs } from './review-fingerprint.js';
+export { extractReviewBaseline, extractReviewDiffBase, extractReviewDiffFingerprint, extractReviewedSnapshotTree, findAuthoritativeReviewCodeArtifact, loadPostReviewConfig, parseReviewVerdict, resolvePostReviewGlobs } from './review-fingerprint.js';
 export { parseLedger, summarizeLedgerStage, validateLedgerRows } from './ledger.js';
 //# sourceMappingURL=verification-review.js.map

package/dist/lib/task/verification.js

@@ -19,14 +19,16 @@ const VERIFICATION_CATALOG = {
     'block-task.completed': gate('block-task', 'blocked'),
     'cancel-task.completed': gate('cancel-task', 'completed'),
     'commit.completed': gate('commit', 'active'),
-    'complete-task.preflight': { skill: 'complete-task', expectedState: 'active', mode: 'checks', checks: ['review-ledger', 'post-review-commit', 'required-checks', 'platform-sync-preflight'] },
+    'complete-task.preflight': { skill: 'complete-task', expectedState: 'active', mode: 'checks', checks: ['review-ledger', 'post-review-commit', 'platform-sync-preflight'] },
     'complete-task.completed': gate('complete-task', 'completed'),
     'create-pr.completed': gate('create-pr', 'active'),
     'create-task.completed': gate('create-task', 'active'),
     'import-codescan.completed': gate('import-codescan', 'active'),
     'import-dependabot.completed': gate('import-dependabot', 'active'),
     'import-issue.completed': gate('import-issue', 'active'),
-    'watch-pr.completed': gate('watch-pr', 'active')
+    'watch-pr.completed': gate('watch-pr', 'active'),
+    'run-task.paused': { skill: 'run-task', expectedState: 'active', mode: 'checks', checks: ['orchestration-state'] },
+    'run-task.completed': { skill: 'run-task', expectedState: 'active', mode: 'checks', checks: ['orchestration-state'] }
 };
 function failure(request, code, message, extra = {}) {
     return {

package/dist/lib/task/workspace-snapshot.js

@@ -0,0 +1,34 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+function git(repoRoot, indexFile, args) {
+    const env = indexFile ? { ...process.env, GIT_INDEX_FILE: indexFile } : process.env;
+    const result = spawnSync('git', args, { cwd: repoRoot, env, encoding: 'utf8' });
+    if (result.status !== 0) {
+        throw new Error(String(result.stderr || result.stdout || `git ${args[0]} failed`).trim());
+    }
+    return result.stdout;
+}
+function captureWorkspaceSnapshot(repoRoot) {
+    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agent-infra-orchestration-index-'));
+    const indexFile = path.join(tempDir, 'index');
+    try {
+        git(repoRoot, indexFile, ['read-tree', 'HEAD']);
+        git(repoRoot, indexFile, ['add', '-A', '--', ':/']);
+        const workspace = path.join(repoRoot, '.agents', 'workspace', 'active');
+        if (fs.existsSync(workspace)) {
+            git(repoRoot, indexFile, ['add', '-f', '--', '.agents/workspace/active']);
+        }
+        return git(repoRoot, indexFile, ['write-tree']).trim();
+    }
+    finally {
+        fs.rmSync(tempDir, { recursive: true, force: true });
+    }
+}
+function diffWorkspaceSnapshots(repoRoot, before, after) {
+    const output = git(repoRoot, null, ['diff', '--name-only', '-z', before, after]);
+    return output.split('\0').filter(Boolean);
+}
+export { captureWorkspaceSnapshot, diffWorkspaceSnapshots };
+//# sourceMappingURL=workspace-snapshot.js.map