@fitlab-ai/agent-infra 0.9.11 → 0.9.13

package/dist/lib/task/ledger-intents.js

@@ -1,10 +1,12 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { createHash } from 'node:crypto';
 import { declareImplementationInput, IMPLEMENTATION_INPUT_ALIASES, parseImplementationInputs, renderImplementationInputs } from './implementation-inputs.js';
 import { LEDGER_COLUMNS, LEDGER_HEADINGS, LEDGER_SECTION_MISSING_CODE, LEDGER_SECTION_MISSING_MESSAGE, nextHdId, parseLedgerDocument, validateLedgerRows } from './ledger.js';
 import { resolveTaskRef } from './resolve-ref.js';
 import { writeTask } from './write.js';
 import { allowsManualOverride } from './guard-override.js';
+import { parseReworkIntentDocument, reworkIntentMutation, upsertReworkIntent } from './rework-intent.js';
 const PREFIX = { analysis: 'AN', plan: 'PL', code: 'CD' };
 const RESPONSE = new Set(['accepted', 'adjusted', 'refuted', 'cannot-judge']);
 const DISPOSITION = new Set(['confirmed', 'closed', 'open', 'needs-human-decision']);
@@ -102,6 +104,41 @@ function applyLedgerIntent(intent, options = {}) {
     if (intent.kind === 'decision-next-id') {
         return { status: 'no-op', changed: false, intent: intent.kind, taskId: resolved.taskId, entityId: nextHdId(rows), before: null, after: null, operations: [], error: null };
     }
+    if (intent.kind === 'rework-intent-upsert') {
+        if (!/^RI-[1-9]\d*$/.test(intent.intentId) || !/^(AN|PL|CD)-[1-9]\d*$/.test(intent.findingId) || !['analysis', 'plan', 'code'].includes(intent.target) || !/^[a-f0-9]{64}$/.test(intent.sourceSha256)) {
+            return failed(intent, 'LEDGER_PAYLOAD_INVALID', 'rework intent identity, target, or source hash is invalid', resolved.taskId, intent.intentId);
+        }
+        const finding = rows.find((row) => row.id === intent.findingId);
+        if (!finding || finding.severity === 'decision')
+            return failed(intent, 'LEDGER_NOT_FOUND', `finding '${intent.findingId}' was not found`, resolved.taskId, intent.findingId);
+        const sourceFromEvidence = finding.evidence.split('#')[0];
+        if (sourceFromEvidence !== intent.sourceArtifact || !REVIEW_ARTIFACT[finding.stage]?.test(intent.sourceArtifact)) {
+            return failed(intent, 'LEDGER_IDENTITY_CONFLICT', 'rework intent source artifact does not match finding evidence', resolved.taskId, intent.intentId);
+        }
+        try {
+            const actualHash = createHash('sha256').update(fs.readFileSync(path.join(resolved.taskDir, intent.sourceArtifact))).digest('hex');
+            if (actualHash !== intent.sourceSha256)
+                return failed(intent, 'LEDGER_IDENTITY_CONFLICT', 'rework intent source artifact hash does not match', resolved.taskId, intent.intentId);
+            const parsed = parseReworkIntentDocument(content);
+            if (!parsed.ok)
+                return failed(intent, parsed.code, parsed.message, resolved.taskId, intent.intentId);
+            const nextIntent = {
+                intentId: intent.intentId, findingId: intent.findingId, sourceArtifact: intent.sourceArtifact,
+                sourceSha256: intent.sourceSha256, target: intent.target, status: 'pending',
+                declaredAt: new Date().toISOString(), consumedAt: ''
+            };
+            const next = upsertReworkIntent(parsed.intents, nextIntent);
+            if (!next.changed)
+                return { status: 'no-op', changed: false, intent: intent.kind, taskId: resolved.taskId, entityId: intent.intentId, before: null, after: null, operations: [], error: null };
+            const result = writeTask({ taskRef: intent.taskRef, expectedState: 'active', dryRun: intent.dryRun, mutations: [reworkIntentMutation(content, next.intents)] }, { ...options, taskLocation: { repoRoot: resolved.repoRoot, taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, state: resolved.state } });
+            if (result.status === 'failed')
+                return failed(intent, result.error.code, result.error.message, result.taskId, intent.intentId);
+            return { status: result.status, changed: result.changed, intent: intent.kind, taskId: result.taskId, entityId: intent.intentId, before: null, after: null, operations: result.operations, error: null };
+        }
+        catch (error) {
+            return failed(intent, 'LEDGER_IDENTITY_CONFLICT', error instanceof Error ? error.message : String(error), resolved.taskId, intent.intentId);
+        }
+    }
     let before = null;
     let after;
     if (intent.kind === 'finding-upsert') {

package/dist/lib/task/lifecycle.js

@@ -14,6 +14,7 @@ const lifecycleIntentCatalog = [
 ];
 const lifecycleFailureCatalog = [
     'LIFECYCLE_DIRECTORY_RENAME_FAILED',
+    'LIFECYCLE_DIRECTORY_COPY_FAILED',
     'LIFECYCLE_DOCUMENT_INVALID',
     'LIFECYCLE_FINAL_STATE_INVALID',
     'LIFECYCLE_IDENTITY_CONFLICT',
@@ -295,6 +296,65 @@ function parseJournal(content) {
     }
     return value;
 }
+function directoryManifest(root) {
+    const entries = [];
+    const visit = (current, relative = '') => {
+        for (const entry of fs.readdirSync(current, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name))) {
+            const relativePath = relative ? path.join(relative, entry.name) : entry.name;
+            const absolute = path.join(current, entry.name);
+            const stat = fs.lstatSync(absolute);
+            if (stat.isSymbolicLink())
+                throw new Error(`symbolic link is not allowed in lifecycle directory: ${relativePath}`);
+            if (entry.isDirectory()) {
+                entries.push({ relativePath, kind: 'directory', size: 0, digest: '' });
+                visit(absolute, relativePath);
+            }
+            else if (entry.isFile()) {
+                const digest = createHash('sha256').update(fs.readFileSync(absolute)).digest('hex');
+                entries.push({ relativePath, kind: 'file', size: stat.size, digest });
+            }
+            else {
+                throw new Error(`unsupported lifecycle directory entry: ${relativePath}`);
+            }
+        }
+    };
+    visit(root);
+    return entries;
+}
+function copyDirectoryVerified(source, target) {
+    if (fs.existsSync(target))
+        throw new Error(`target directory already exists: ${target}`);
+    const copy = (currentSource, currentTarget) => {
+        fs.mkdirSync(currentTarget);
+        for (const entry of fs.readdirSync(currentSource, { withFileTypes: true })) {
+            const sourcePath = path.join(currentSource, entry.name);
+            const targetPath = path.join(currentTarget, entry.name);
+            const stat = fs.lstatSync(sourcePath);
+            if (stat.isSymbolicLink())
+                throw new Error(`symbolic link is not allowed in lifecycle directory: ${entry.name}`);
+            if (entry.isDirectory())
+                copy(sourcePath, targetPath);
+            else if (entry.isFile())
+                fs.copyFileSync(sourcePath, targetPath);
+            else
+                throw new Error(`unsupported lifecycle directory entry: ${entry.name}`);
+        }
+    };
+    copy(source, target);
+    const sourceManifest = directoryManifest(source);
+    const targetManifest = directoryManifest(target);
+    if (JSON.stringify(sourceManifest) !== JSON.stringify(targetManifest)) {
+        throw new Error('copied lifecycle directory failed manifest verification');
+    }
+}
+function removeCopiedSource(source, target) {
+    const sourceManifest = directoryManifest(source);
+    const targetManifest = directoryManifest(target);
+    if (JSON.stringify(sourceManifest) !== JSON.stringify(targetManifest)) {
+        throw new Error('lifecycle source and target diverged before source cleanup');
+    }
+    fs.rmSync(source, { recursive: true, force: false });
+}
 function applyTaskLifecycle(requestInput, options = {}) {
     const normalized = normalizedRequest(requestInput);
     if ('code' in normalized)
@@ -356,7 +416,7 @@ function applyTaskLifecycle(requestInput, options = {}) {
     if (!spec.sources.includes(sourceState) && !existingJournal && !allowsManualOverride(options, 'LIFECYCLE_SOURCE_INVALID')) {
         return failed(request, { code: 'LIFECYCLE_SOURCE_INVALID', message: `${request.intent} is not allowed from ${sourceState}` }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
     }
-    if (sourcePath !== targetPath && fs.existsSync(targetPath)) {
+    if (sourcePath !== targetPath && fs.existsSync(targetPath) && !existingJournal) {
         return failed(request, { code: 'LIFECYCLE_TARGET_CONFLICT', message: `target directory already exists: ${targetPath}` }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
     }
     const content = io.readFileSync(currentTaskFile);
@@ -501,18 +561,55 @@ function applyTaskLifecycle(requestInput, options = {}) {
             (options.directoryRenameSync ?? io.renameSync)(sourcePath, targetPath);
         }
         catch (error) {
-            const failure = { code: 'LIFECYCLE_DIRECTORY_RENAME_FAILED', message: String(error) };
-            rememberJournalFailure(journalPath, journal, io, failure);
-            return failed(request, failure, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath, journalPath, task: { operations: taskOperations }, changed: true, completedSteps: [...completed], timestamp: journal.metadata.timestamp, agentInfraVersion: journal.metadata.agentInfraVersion });
+            if (error.code === 'EXDEV') {
+                try {
+                    copyDirectoryVerified(sourcePath, targetPath);
+                    completed.add('directory-moved');
+                    journal.completedSteps = [...completed];
+                    const copiedJournalPath = path.join(targetPath, '.task-lifecycle.json');
+                    writeJournal(initialJournalPath, journal, io);
+                    writeJournal(copiedJournalPath, journal, io);
+                    removeCopiedSource(sourcePath, targetPath);
+                    journalPath = copiedJournalPath;
+                }
+                catch (copyError) {
+                    if (fs.existsSync(targetPath))
+                        fs.rmSync(targetPath, { recursive: true, force: false });
+                    const failure = { code: 'LIFECYCLE_DIRECTORY_COPY_FAILED', message: String(copyError) };
+                    rememberJournalFailure(initialJournalPath, journal, io, failure);
+                    return failed(request, failure, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath, journalPath: initialJournalPath, task: { operations: taskOperations }, changed: true, completedSteps: [...completed], timestamp: journal.metadata.timestamp, agentInfraVersion: journal.metadata.agentInfraVersion });
+                }
+            }
+            else {
+                const failure = { code: 'LIFECYCLE_DIRECTORY_RENAME_FAILED', message: String(error) };
+                rememberJournalFailure(journalPath, journal, io, failure);
+                return failed(request, failure, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath, journalPath, task: { operations: taskOperations }, changed: true, completedSteps: [...completed], timestamp: journal.metadata.timestamp, agentInfraVersion: journal.metadata.agentInfraVersion });
+            }
         }
-        completed.add('directory-moved');
-        journal.completedSteps = [...completed];
-        journalPath = path.join(targetPath, '.task-lifecycle.json');
+        if (completed.has('directory-moved') && !fs.existsSync(sourcePath)) {
+            journalPath = path.join(targetPath, '.task-lifecycle.json');
+        }
+        else if (!completed.has('directory-moved')) {
+            completed.add('directory-moved');
+            journal.completedSteps = [...completed];
+            journalPath = path.join(targetPath, '.task-lifecycle.json');
+            try {
+                writeJournal(journalPath, journal, io);
+            }
+            catch (error) {
+                return failed(request, { code: 'LIFECYCLE_JOURNAL_WRITE_FAILED', message: String(error) }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath, journalPath, task: { operations: taskOperations }, directory: { effect: 'move', changed: true }, changed: true, completedSteps: [...completed], timestamp: journal.metadata.timestamp, agentInfraVersion: journal.metadata.agentInfraVersion });
+            }
+        }
+    }
+    if (completed.has('directory-moved') && sourcePath !== targetPath && fs.existsSync(sourcePath) && fs.existsSync(targetPath)) {
         try {
-            writeJournal(journalPath, journal, io);
+            removeCopiedSource(sourcePath, targetPath);
+            journalPath = path.join(targetPath, '.task-lifecycle.json');
         }
         catch (error) {
-            return failed(request, { code: 'LIFECYCLE_JOURNAL_WRITE_FAILED', message: String(error) }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath, journalPath, task: { operations: taskOperations }, directory: { effect: 'move', changed: true }, changed: true, completedSteps: [...completed], timestamp: journal.metadata.timestamp, agentInfraVersion: journal.metadata.agentInfraVersion });
+            const failure = { code: 'LIFECYCLE_DIRECTORY_COPY_FAILED', message: String(error) };
+            rememberJournalFailure(journalPath, journal, io, failure);
+            return failed(request, failure, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath, journalPath, task: { operations: taskOperations }, changed: true, completedSteps: [...completed], timestamp: journal.metadata.timestamp, agentInfraVersion: journal.metadata.agentInfraVersion });
         }
     }
     let shortId = { effect: 'unchanged', shortId: null, changed: false };

package/dist/lib/task/local-artifact-finalization.js

@@ -0,0 +1,374 @@
+import fs from 'node:fs';
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+import { inspectDecisionDetailDuplicates, scanVisibleMarkdown } from './decision-details.js';
+import { parseArtifactName, validateCompletedArtifact } from './artifact-lifecycle.js';
+import { resolveTaskRef } from './resolve-ref.js';
+const LOCAL_ARTIFACT_REQUIRED_SECTIONS = {
+    analysis: [
+        '需求来源', '需求理解', '相关文件', '影响评估', '技术风险',
+        '工作量和复杂度评估', '状态核对'
+    ],
+    plan: [
+        '问题理解', '约束条件', '方案对比', '技术方法', '实施步骤',
+        '文件清单', '验证策略', '状态核对'
+    ],
+    code: [
+        '实现输入', '变更文件', '关键代码说明', '测试结果', '与方案的差异',
+        '供审查关注的内容', '状态核对', '证据原文'
+    ]
+};
+const LOCAL_ARTIFACT_REQUIRED_PATTERNS = ['^\\$ '];
+function finalizationIntentRoot(repoRoot) {
+    return path.join(repoRoot, '.agents', 'workspace', '.local-artifact-finalization-intents');
+}
+function finalizationIntentPath(repoRoot, taskId, family, artifact) {
+    return path.join(finalizationIntentRoot(repoRoot), `${taskId}-${family}-${artifact}.json`);
+}
+function isFinalizationIntent(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const intent = value;
+    return intent.version === 1
+        && typeof intent.taskId === 'string' && intent.taskId.length > 0
+        && (intent.family === 'analysis' || intent.family === 'plan' || intent.family === 'code')
+        && typeof intent.artifact === 'string' && intent.artifact.length > 0
+        && (intent.state === 'awaiting-repair' || intent.state === 'passed' || intent.state === 'consumed')
+        && (intent.baselineSemanticDigest === null || (typeof intent.baselineSemanticDigest === 'string' && /^[a-f0-9]{64}$/.test(intent.baselineSemanticDigest)))
+        && typeof intent.artifactSha256 === 'string' && /^[a-f0-9]{64}$/.test(intent.artifactSha256)
+        && typeof intent.semanticDigest === 'string' && /^[a-f0-9]{64}$/.test(intent.semanticDigest)
+        && (intent.state === 'awaiting-repair' ? intent.baselineSemanticDigest === intent.semanticDigest : true);
+}
+function readLocalArtifactFinalizationIntent(repoRoot, taskId, family, artifact) {
+    const target = finalizationIntentPath(repoRoot, taskId, family, artifact);
+    if (!fs.existsSync(target))
+        return null;
+    const value = JSON.parse(fs.readFileSync(target, 'utf8'));
+    if (!isFinalizationIntent(value) || value.taskId !== taskId || value.family !== family || value.artifact !== artifact) {
+        throw new Error('LOCAL_FINALIZATION_INTENT_INVALID: finalization provenance schema is invalid');
+    }
+    return value;
+}
+function writeLocalArtifactFinalizationIntent(repoRoot, value) {
+    if (!isFinalizationIntent(value))
+        throw new Error('LOCAL_FINALIZATION_INTENT_INVALID: finalization provenance schema is invalid');
+    const directory = finalizationIntentRoot(repoRoot);
+    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const target = finalizationIntentPath(repoRoot, value.taskId, value.family, value.artifact);
+    const temporary = `${target}.${process.pid}.${Date.now()}.tmp`;
+    fs.writeFileSync(temporary, `${JSON.stringify(value)}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+    try {
+        fs.renameSync(temporary, target);
+    }
+    catch (error) {
+        try {
+            fs.unlinkSync(temporary);
+        }
+        catch { /* preserve primary error */ }
+        throw error;
+    }
+}
+function consumeLocalArtifactFinalizationIntent(repoRoot, intent) {
+    if (intent.state === 'consumed')
+        return intent;
+    if (intent.state !== 'passed')
+        throw new Error('LOCAL_FINALIZATION_INTENT_INVALID: only passed provenance can be consumed');
+    const consumed = { ...intent, state: 'consumed' };
+    writeLocalArtifactFinalizationIntent(repoRoot, consumed);
+    return consumed;
+}
+function requiredSections(family) {
+    return LOCAL_ARTIFACT_REQUIRED_SECTIONS[family];
+}
+function lineNumber(content, offset) {
+    return content.slice(0, offset).split('\n').length;
+}
+function sectionBody(content, heading) {
+    const next = scanVisibleMarkdown(content).headings.find((candidate) => (candidate.start > heading.start && candidate.level <= 2));
+    return content.slice(heading.end, next?.start ?? content.length);
+}
+function semanticDigest(content, candidate) {
+    let normalized = content;
+    if (candidate) {
+        const raw = content.slice(candidate.start, candidate.end);
+        const marker = raw.match(/([:：])\s*$/);
+        if (marker?.index !== undefined) {
+            const canonical = raw.slice(0, marker.index) + raw.slice(marker.index + 1);
+            normalized = `${content.slice(0, candidate.start)}${canonical}${content.slice(candidate.end)}`;
+        }
+    }
+    return createHash('sha256').update(normalized, 'utf8').digest('hex');
+}
+function sha256Content(content) {
+    return createHash('sha256').update(content, 'utf8').digest('hex');
+}
+function visibleSectionHeadings(content, section) {
+    return scanVisibleMarkdown(content).headings.filter((heading) => (heading.level === 2 && heading.text === section));
+}
+function trailingPunctuationCandidates(content, section) {
+    return scanVisibleMarkdown(content).headings.filter((heading) => (heading.level === 2 && (heading.text === `${section}:` || heading.text === `${section}：`)));
+}
+function diagnostic(code, message, content, heading, extra = {}) {
+    return {
+        code, message, repairable: false,
+        line: heading ? lineNumber(content, heading.start) : null,
+        ...extra
+    };
+}
+function isStatusPattern(pattern) {
+    return pattern === '^\\$ ';
+}
+function validateLocalArtifact(content, options) {
+    const sections = options.requiredSections ?? requiredSections(options.family);
+    const patterns = options.requiredPatterns ?? LOCAL_ARTIFACT_REQUIRED_PATTERNS;
+    const diagnostics = [];
+    const candidates = [];
+    const scanned = scanVisibleMarkdown(content);
+    if (!content.trim()) {
+        diagnostics.push(diagnostic('LOCAL_ARTIFACT_EMPTY', 'artifact is empty', content));
+    }
+    for (const section of sections) {
+        const exact = scanned.headings.filter((heading) => heading.level === 2 && heading.text === section);
+        const punctuated = trailingPunctuationCandidates(content, section);
+        if (exact.length > 1 || punctuated.length > 0 && exact.length > 0 || punctuated.length > 1) {
+            const first = exact[1] ?? punctuated[0] ?? exact[0];
+            diagnostics.push(diagnostic('LOCAL_ARTIFACT_DUPLICATE_SECTION', `required section '${section}' is duplicated or has an ambiguous punctuation variant`, content, first));
+        }
+        else if (exact.length === 0 && punctuated.length === 1) {
+            candidates.push(punctuated[0]);
+        }
+        else if (exact.length === 0) {
+            diagnostics.push(diagnostic('LOCAL_ARTIFACT_MISSING_SECTION', `required section '${section}' is missing`, content));
+        }
+    }
+    const statusSection = sections.find((section) => section === '状态核对' || section.toLowerCase() === 'state check');
+    if (statusSection) {
+        const statusHeading = visibleSectionHeadings(content, statusSection)[0]
+            ?? candidates.find((heading) => heading.text === `${statusSection}:` || heading.text === `${statusSection}：`);
+        if (statusHeading) {
+            const body = sectionBody(content, statusHeading);
+            for (const pattern of patterns.filter(isStatusPattern)) {
+                if (!new RegExp(pattern, 'm').test(body)) {
+                    diagnostics.push(diagnostic('LOCAL_STATUS_COMMAND_MISSING', `status section '${statusSection}' is missing required command output`, content, statusHeading));
+                }
+            }
+        }
+    }
+    for (const pattern of patterns.filter((item) => !isStatusPattern(item))) {
+        if (!new RegExp(pattern, 'm').test(content)) {
+            diagnostics.push(diagnostic('LOCAL_REQUIRED_PATTERN_MISSING', `artifact is missing required pattern '${pattern}'`, content));
+        }
+    }
+    const decisionDetails = inspectDecisionDetailDuplicates(content);
+    if (!decisionDetails.ok) {
+        diagnostics.push(diagnostic('LOCAL_DECISION_DETAIL_DUPLICATE', decisionDetails.message, content, decisionDetails.duplicates[0]?.blocks[0]
+            ? scanned.headings.find((heading) => heading.start === decisionDetails.duplicates[0].blocks[0].start)
+            : undefined));
+    }
+    if (candidates.length === 1 && diagnostics.length === 0) {
+        const candidate = candidates[0];
+        const section = candidate.text.slice(0, -1);
+        const repair = diagnostic('LOCAL_SECTION_HEADING_TRAILING_PUNCTUATION', `visible required H2 '${candidate.text}' may be normalized to '${section}'`, content, candidate, {
+            repairable: true,
+            from: candidate.text,
+            to: section,
+            operation: 'replace-line'
+        });
+        return {
+            ok: false,
+            family: options.family,
+            semanticDigest: semanticDigest(content, candidate),
+            repairable: true,
+            diagnostics: [repair]
+        };
+    }
+    if (candidates.length > 0) {
+        for (const candidate of candidates) {
+            const section = candidate.text.slice(0, -1);
+            diagnostics.push(diagnostic('LOCAL_ARTIFACT_MISSING_SECTION', `required section '${section}' is missing and cannot be repaired while other structural defects exist`, content, candidate));
+        }
+    }
+    return {
+        ok: diagnostics.length === 0,
+        family: options.family,
+        semanticDigest: semanticDigest(content),
+        repairable: false,
+        diagnostics
+    };
+}
+function failedFinalization(request, error, extra = {}) {
+    return {
+        status: 'failed', changed: false,
+        taskId: null, taskDir: null,
+        family: request.family, artifact: request.artifact,
+        artifactSha256: null, semanticDigest: null,
+        repairable: false, diagnostics: [], error, ...extra
+    };
+}
+function provenanceFailure(request, resolved, content, artifactSha256, semanticDigestValue, code, message) {
+    return failedFinalization(request, { code, message }, {
+        taskId: resolved.taskId,
+        taskDir: resolved.taskDir,
+        artifactSha256,
+        semanticDigest: semanticDigestValue,
+        diagnostics: [diagnostic(code, message, content)]
+    });
+}
+function finalizeLocalArtifact(request) {
+    const resolved = resolveTaskRef(request.taskRef, { repoRoot: request.repoRoot });
+    if (!resolved.ok)
+        return failedFinalization(request, { code: resolved.code, message: resolved.message });
+    const parsed = parseArtifactName(request.artifact);
+    if (!parsed || parsed.family !== request.family) {
+        return failedFinalization(request, {
+            code: 'ARTIFACT_IDENTITY_INVALID',
+            message: `artifact '${request.artifact}' does not match ${request.family}`
+        }, { taskId: resolved.taskId, taskDir: resolved.taskDir });
+    }
+    const validated = validateCompletedArtifact(resolved.taskDir, request.family, request.artifact, parsed.round);
+    if (!validated.ok) {
+        return failedFinalization(request, validated.error, { taskId: resolved.taskId, taskDir: resolved.taskDir });
+    }
+    let content;
+    try {
+        content = fs.readFileSync(validated.artifact.path, 'utf8');
+    }
+    catch (error) {
+        return failedFinalization(request, { code: 'ARTIFACT_NOT_READABLE', message: String(error) }, {
+            taskId: resolved.taskId, taskDir: resolved.taskDir
+        });
+    }
+    const result = validateLocalArtifact(content, {
+        family: request.family,
+        requiredSections: request.requiredSections,
+        requiredPatterns: request.requiredPatterns
+    });
+    const artifactSha256 = sha256Content(content);
+    let intent;
+    try {
+        intent = readLocalArtifactFinalizationIntent(resolved.repoRoot, resolved.taskId, request.family, request.artifact);
+    }
+    catch (error) {
+        return failedFinalization(request, {
+            code: 'LOCAL_FINALIZATION_INTENT_INVALID',
+            message: error instanceof Error ? error.message : String(error)
+        }, { taskId: resolved.taskId, taskDir: resolved.taskDir, artifactSha256, semanticDigest: result.semanticDigest });
+    }
+    if (result.repairable) {
+        if (intent && (intent.state !== 'awaiting-repair' || intent.baselineSemanticDigest !== result.semanticDigest)) {
+            return provenanceFailure(request, resolved, content, artifactSha256, result.semanticDigest, 'LOCAL_REPAIR_PROVENANCE_CONFLICT', 'a different local repair baseline is already recorded for this artifact');
+        }
+        if (!intent) {
+            try {
+                writeLocalArtifactFinalizationIntent(resolved.repoRoot, {
+                    version: 1,
+                    taskId: resolved.taskId,
+                    family: request.family,
+                    artifact: request.artifact,
+                    state: 'awaiting-repair',
+                    baselineSemanticDigest: result.semanticDigest,
+                    artifactSha256,
+                    semanticDigest: result.semanticDigest
+                });
+            }
+            catch (error) {
+                return failedFinalization(request, {
+                    code: 'LOCAL_FINALIZATION_INTENT_WRITE_FAILED',
+                    message: error instanceof Error ? error.message : String(error)
+                }, { taskId: resolved.taskId, taskDir: resolved.taskDir, artifactSha256, semanticDigest: result.semanticDigest });
+            }
+        }
+        return {
+            status: 'failed',
+            changed: false,
+            taskId: resolved.taskId,
+            taskDir: resolved.taskDir,
+            family: request.family,
+            artifact: request.artifact,
+            artifactSha256,
+            semanticDigest: result.semanticDigest,
+            repairable: true,
+            diagnostics: result.diagnostics,
+            error: {
+                code: 'LOCAL_ARTIFACT_INVALID',
+                message: result.diagnostics.map((item) => `${item.code}: ${item.message}`).join('; ')
+            }
+        };
+    }
+    if (!result.ok) {
+        return {
+            status: 'failed',
+            changed: false,
+            taskId: resolved.taskId,
+            taskDir: resolved.taskDir,
+            family: request.family,
+            artifact: request.artifact,
+            artifactSha256,
+            semanticDigest: result.semanticDigest,
+            repairable: false,
+            diagnostics: result.diagnostics,
+            error: {
+                code: 'LOCAL_ARTIFACT_INVALID',
+                message: result.diagnostics.map((item) => `${item.code}: ${item.message}`).join('; ')
+            }
+        };
+    }
+    if (intent?.state === 'awaiting-repair' && intent.baselineSemanticDigest !== result.semanticDigest) {
+        return provenanceFailure(request, resolved, content, artifactSha256, result.semanticDigest, 'LOCAL_REPAIR_BASELINE_MISMATCH', 'the repaired artifact semantic digest does not match the recorded repair baseline');
+    }
+    if ((intent?.state === 'passed' || intent?.state === 'consumed')
+        && (intent.artifactSha256 !== artifactSha256 || intent.semanticDigest !== result.semanticDigest)) {
+        return provenanceFailure(request, resolved, content, artifactSha256, result.semanticDigest, 'LOCAL_REPAIR_PROVENANCE_CONFLICT', 'the artifact changed after its finalization provenance was recorded');
+    }
+    if (intent?.state === 'consumed') {
+        return {
+            status: 'passed',
+            changed: false,
+            taskId: resolved.taskId,
+            taskDir: resolved.taskDir,
+            family: request.family,
+            artifact: request.artifact,
+            artifactSha256,
+            semanticDigest: result.semanticDigest,
+            repairable: false,
+            diagnostics: result.diagnostics,
+            error: null
+        };
+    }
+    try {
+        writeLocalArtifactFinalizationIntent(resolved.repoRoot, {
+            version: 1,
+            taskId: resolved.taskId,
+            family: request.family,
+            artifact: request.artifact,
+            state: 'passed',
+            baselineSemanticDigest: intent?.baselineSemanticDigest ?? null,
+            artifactSha256,
+            semanticDigest: result.semanticDigest
+        });
+    }
+    catch (error) {
+        return failedFinalization(request, {
+            code: 'LOCAL_FINALIZATION_INTENT_WRITE_FAILED',
+            message: error instanceof Error ? error.message : String(error)
+        }, { taskId: resolved.taskId, taskDir: resolved.taskDir, artifactSha256, semanticDigest: result.semanticDigest });
+    }
+    return {
+        status: result.ok ? 'passed' : 'failed',
+        changed: false,
+        taskId: resolved.taskId,
+        taskDir: resolved.taskDir,
+        family: request.family,
+        artifact: request.artifact,
+        artifactSha256,
+        semanticDigest: result.semanticDigest,
+        repairable: result.repairable,
+        diagnostics: result.diagnostics,
+        error: result.ok ? null : {
+            code: 'LOCAL_ARTIFACT_INVALID',
+            message: result.diagnostics.map((item) => `${item.code}: ${item.message}`).join('; ')
+        }
+    };
+}
+export { LOCAL_ARTIFACT_REQUIRED_PATTERNS, LOCAL_ARTIFACT_REQUIRED_SECTIONS, consumeLocalArtifactFinalizationIntent, finalizeLocalArtifact, readLocalArtifactFinalizationIntent, semanticDigest, sha256Content, validateLocalArtifact };
+//# sourceMappingURL=local-artifact-finalization.js.map