@fitlab-ai/agent-infra 0.9.11 → 0.9.13

package/lib/task/verification-engine.ts

@@ -7,6 +7,8 @@ import { fileURLToPath } from "node:url";
 
 import {
   extractReviewBaseline,
+  extractReviewTargetHead,
+  extractReviewedHead,
   extractReviewDiffBase,
   extractReviewDiffFingerprint,
   extractReviewedSnapshotTree,
@@ -30,6 +32,9 @@ import { inspectDecisionDetailDuplicates } from "./decision-details.ts";
 import { loadVerificationConfig } from "./verification-config.ts";
 import { snapshotReview } from "../git/review-snapshot.ts";
 import { OrchestrationStateError, readRun } from "./orchestration.ts";
+import { resolveDeliveryTarget } from "./delivery-target.ts";
+import { readPrDeliveryFact } from "./pr-delivery-fact.ts";
+import { validateLocalArtifact } from "./local-artifact-finalization.ts";
 
 const TASK_ENUMS = {
   type: ["feature", "bugfix", "refactor", "docs", "chore"],
@@ -84,7 +89,7 @@ let repoRoot = path.resolve(path.dirname(scriptPath), "..", "..");
 
 const PLATFORM_ADAPTERS: Record<string, (context: any, shared: any) => any> = {
   "platform-sync": checkPlatformSync,
-  "platform-sync-preflight": (context: any, shared: any) => ({ ...checkPlatformSync(context, shared), type: "platform-sync-preflight" }),
+  "platform-sync-preflight": async (context: any, shared: any) => ({ ...await checkPlatformSync(context, shared), type: "platform-sync-preflight" }),
   "required-checks": checkRequiredChecks
 };
 const OPTIONAL_PLATFORM_CHECKS = new Set(["platform-sync"]);
@@ -103,7 +108,7 @@ const sharedUtils = {
   parsePrNumber
 };
 
-function runCheck(type: any, context: any, shared: any): any {
+async function runCheck(type: any, context: any, shared: any): Promise<any> {
   switch (type) {
     case "task-meta":
       return checkTaskMeta(context);
@@ -143,7 +148,7 @@ function runCheck(type: any, context: any, shared: any): any {
         return failResult(type, `Unsupported check type '${type}'.`);
       }
 
-      return adapter(context, shared);
+      return await adapter(context, shared);
     }
   }
 }
@@ -195,15 +200,14 @@ function validateCleanCompletionEvidence(run: any): string | null {
     || !shaPattern.test(evidence.headTree)
     || !shaPattern.test(evidence.worktreeTree)
     || !shaPattern.test(evidence.lastReviewedCommit)
-    || !Number.isInteger(evidence.prNumber)
-    || evidence.prNumber <= 0
-    || !shaPattern.test(evidence.prHead)
+    || !(evidence.prNumber === null || (Number.isInteger(evidence.prNumber) && evidence.prNumber > 0))
+    || !(evidence.prHead === null || shaPattern.test(evidence.prHead))
   ) {
     return 'Clean completion evidence has an invalid structure';
   }
   if (
     evidence.head !== evidence.lastReviewedCommit
-    || evidence.head !== evidence.prHead
+    || (evidence.prHead !== null && evidence.head !== evidence.prHead)
     || evidence.headTree !== evidence.worktreeTree
   ) {
     return 'Clean completion evidence does not bind matching commit and tree identities';
@@ -276,12 +280,8 @@ function checkOrchestrationEvidence({ taskDir }: any): any {
   if (run.completionEvidence != null) {
     const evidenceError = validateCleanCompletionEvidence(run);
     if (evidenceError) return failResult('orchestration-evidence', evidenceError);
-  } else if (run.status === 'completed' && (
-      run.receipts.length === 0
-      || run.receipts.at(-1)?.stage !== 'commit'
-      || run.receipts.at(-1)?.status !== 'consumed'
-    )) {
-      return failResult('orchestration-evidence', 'Completed run requires a final consumed commit receipt');
+  } else if (run.status === 'completed') {
+    return failResult('orchestration-evidence', 'Completed run requires reviewed-head-clean completion evidence');
   }
   if (run.pendingDelegation && !['prepared', 'activated', 'stage-completed'].includes(run.pendingDelegation.status)) {
     return failResult('orchestration-evidence', `Pending receipt has unsafe status '${run.pendingDelegation.status}'`);
@@ -489,7 +489,7 @@ function checkTaskMeta({ taskDir, config }: any): any {
   );
 }
 
-function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }: any): any {
+async function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }: any): Promise<any> {
   const task = loadTask(taskDir);
   if (!task.ok) return failResult('required-pr-delivery', task.message);
   let projectConfig: any = {};
@@ -500,23 +500,24 @@ function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }: any): any {
     return failResult('required-pr-delivery', 'Project configuration is invalid');
   }
   const flow = projectConfig.prFlow;
-  const status = String(task.metadata.pr_status || 'pending');
-  const prNumber = parsePrNumber(task.metadata.pr_number);
+  const factRead = readPrDeliveryFact(task.metadata);
+  if (factRead.status === 'invalid') return failResult('required-pr-delivery', factRead.error.message);
+  const fact = factRead.status === 'valid' ? factRead.fact : null;
+  const status = fact?.state || 'unbound';
+  const prIdentity = fact?.state === 'bound' ? fact.identity.resource : null;
+  const prNumber = prIdentity?.kind === 'number' ? prIdentity.value : null;
   if (flow === 'disabled') return passResult('required-pr-delivery', 'Pull request delivery is disabled by project policy');
-  if (flow === 'required' && (status !== 'created' || prNumber === null)) {
+  if (flow === 'required' && (status !== 'bound' || !prIdentity)) {
     return failResult('required-pr-delivery', 'Project policy requires a bound pull request before completion');
   }
-  if (flow !== 'required' && status === 'pending') {
+  if (flow !== 'required' && status === 'unbound') {
     return failResult('required-pr-delivery', 'Pull request delivery is pending; create a PR or explicitly skip it');
   }
-  if (status === 'created' && prNumber === null) {
-    return failResult('required-pr-delivery', 'Task claims a created pull request without a valid pr_number');
-  }
   if (flow === 'required') {
     if (mode === 'gate') {
       return passResult('required-pr-delivery', 'Bound pull request shape is valid; merged-state inspection is reserved for hard preflight');
     }
-    const inspected = inspectPlatformPullRequest(task.metadata.id, { cwd: repositoryRoot });
+    const inspected = await inspectPlatformPullRequest(task.metadata.id, { cwd: repositoryRoot });
     if (inspected.status === 'blocked') {
       return blockedResult(
         'required-pr-delivery',
@@ -527,7 +528,8 @@ function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }: any): any {
     const pullRequest = inspected.pullRequest;
     const repository = inspected.platform.repository?.toLowerCase() || '';
     const taskBranch = String(task.metadata.branch || '').trim();
-    if (inspected.status !== 'no-op' || !pullRequest || pullRequest.number !== prNumber) {
+    const deliveryBaseRef = String(task.metadata.delivery_base_ref || projectConfig.delivery?.baseRef || '').trim();
+    if (inspected.status !== 'no-op' || !pullRequest) {
       return failResult('required-pr-delivery', 'Bound pull request identity could not be verified');
     }
     if (
@@ -535,13 +537,14 @@ function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }: any): any {
       || pullRequest.repository.toLowerCase() !== repository
       || pullRequest.base.repository.toLowerCase() !== repository
       || (taskBranch && pullRequest.head.ref !== taskBranch)
+      || (deliveryBaseRef && pullRequest.base.ref !== deliveryBaseRef)
     ) {
       return failResult('required-pr-delivery', 'Bound pull request identity does not match the task');
     }
     if (pullRequest.state !== 'closed' || !pullRequest.mergedAt || !pullRequest.mergeCommitSha) {
       return failResult('required-pr-delivery', 'Project policy requires the bound pull request to be merged');
     }
-    return passResult('required-pr-delivery', `Pull request delivery policy satisfied (merged PR #${prNumber})`);
+    return passResult('required-pr-delivery', `Pull request delivery policy satisfied (merged PR ${prNumber === null ? 'identity' : `#${prNumber}`})`);
   }
   return passResult('required-pr-delivery', `Pull request delivery policy satisfied (${status})`);
 }
@@ -580,7 +583,7 @@ function loadProjectName(): any {
   }
 }
 
-function checkArtifact({ taskDir, config, artifactFile }: any): any {
+function checkArtifact({ taskDir, config, artifactFile, skillName }: any): any {
   const resolvedArtifact = resolveArtifactPath(taskDir, config.file_pattern, artifactFile);
   if (!resolvedArtifact.ok) {
     return failResult("artifact", resolvedArtifact.message);
@@ -598,6 +601,26 @@ function checkArtifact({ taskDir, config, artifactFile }: any): any {
 
   const content = fs.readFileSync(artifactPath, "utf8");
   const requiredSections = config.required_sections || [];
+  const localFamily = skillName === "analyze-task"
+    ? "analysis"
+    : skillName === "plan-task" ? "plan" : skillName === "code-task" ? "code" : null;
+  if (localFamily) {
+    const local = validateLocalArtifact(content, {
+      family: localFamily,
+      requiredSections: requiredSections.filter((section: unknown): section is string => typeof section === "string"),
+      requiredPatterns: (config.required_patterns || []).filter((pattern: unknown): pattern is string => typeof pattern === "string")
+    });
+    if (!local.ok) {
+      return failResult(
+        "artifact",
+        `${path.basename(artifactPath)} has local structural errors: ${local.diagnostics.map((item) => `${item.code}: ${item.message}`).join('; ')}`
+      );
+    }
+    return passResult(
+      "artifact",
+      `${path.basename(artifactPath)} passed (${requiredSections.length} sections)`
+    );
+  }
   const missingSections = requiredSections.filter(
     (section: any) => !new RegExp(`^##\\s+${escapeRegExp(section)}\\s*$`, "m").test(content)
   );
@@ -1030,6 +1053,7 @@ function checkManualValidation({ taskDir }: any): any {
   // 1. Latest review-code artifact; none -> pass (no review, check not applicable).
   const review = findAuthoritativeReviewCodeArtifact(taskDir);
   if (!review.ok) {
+    if (review.error) return failResult("manual-validation", `Review-code artifact is unavailable: ${review.error}`);
     return passResult("manual-validation", "No review-code artifact; manual validation not applicable");
   }
   // 2. Parse the numeric manual-validation count; unparseable/null -> fail closed
@@ -1095,9 +1119,10 @@ function checkManualValidation({ taskDir }: any): any {
   return passResult("manual-validation", `Manual validation completed → ${artifactName}`);
 }
 
-function checkPostReviewCommit({ taskDir, config }: any): any {
+async function checkPostReviewCommit({ taskDir, config }: any): Promise<any> {
   const reviewArtifact = findAuthoritativeReviewCodeArtifact(taskDir);
   if (!reviewArtifact.ok) {
+    if (reviewArtifact.error) return failResult("post-review-commit", `Review-code artifact is unavailable: ${reviewArtifact.error}`);
     return passResult("post-review-commit", "No review-code artifact; check inactive");
   }
 
@@ -1110,12 +1135,15 @@ function checkPostReviewCommit({ taskDir, config }: any): any {
 
   const task = loadTask(taskDir);
   if (!task.ok) return failResult("post-review-commit", task.message);
+  const factRead = readPrDeliveryFact(task.metadata);
+  if (factRead.status === 'invalid') return failResult("post-review-commit", factRead.error.message);
+  const fact = factRead.status === 'valid' ? factRead.fact : null;
   const lastReviewedCommit = task.ok ? (task.metadata.last_reviewed_commit || "").trim() : "";
   const globs = resolvePostReviewGlobs(config, loadPostReviewConfig(repoRoot));
-  const hasPullRequest = Number(task.metadata.pr_number) > 0;
-  let inspected: ReturnType<typeof inspectPlatformPullRequest> | null = null;
+  const hasPullRequest = fact?.state === 'bound';
+  let inspected: Awaited<ReturnType<typeof inspectPlatformPullRequest>> | null = null;
   if (hasPullRequest) {
-    inspected = inspectPlatformPullRequest(task.metadata.id, { cwd: gitRoot });
+    inspected = await inspectPlatformPullRequest(task.metadata.id, { cwd: gitRoot });
     if (!inspected.pullRequest) {
       const message = inspected.error?.message || "PR merge snapshot is unavailable";
       const code = inspected.error?.code || "PR_INSPECTION_INVALID";
@@ -1128,7 +1156,7 @@ function checkPostReviewCommit({ taskDir, config }: any): any {
       inspected.pullRequest.mergedAt &&
       inspected.pullRequest.mergeCommitSha
     ) {
-      const relation = resolveMaterializedReviewedHeadRelation({
+      const relation = await resolveMaterializedReviewedHeadRelation({
         cwd: gitRoot,
         platformType: inspected.platform.type,
         lastReviewedCommit,
@@ -1295,6 +1323,17 @@ function checkReviewFact({ taskDir, artifactFile }: any): any {
     return failResult("review-fact", resolvedArtifact.message);
   }
 
+  const authoritative = findAuthoritativeReviewCodeArtifact(taskDir);
+  if (!authoritative.ok) {
+    return failResult("review-fact", authoritative.error ?? "No active review-code artifact is available");
+  }
+  if (path.basename(resolvedArtifact.path) !== authoritative.fileName) {
+    return failResult(
+      "review-fact",
+      `review-code artifact ${path.basename(resolvedArtifact.path)} is not the current active artifact ${authoritative.fileName}; re-run review-code`
+    );
+  }
+
   const task = loadTask(taskDir);
   if (!task.ok) {
     return failResult("review-fact", task.message);
@@ -1302,7 +1341,8 @@ function checkReviewFact({ taskDir, artifactFile }: any): any {
 
   const content = fs.readFileSync(resolvedArtifact.path, "utf8");
   const verdict = parseReviewVerdict(content);
-  const reviewBaseline = extractReviewBaseline(content);
+  const reviewTargetHead = extractReviewTargetHead(content);
+  const reviewReviewedHead = extractReviewedHead(content);
   const reviewDiffBase = extractReviewDiffBase(content);
   const reviewedFingerprint = extractReviewDiffFingerprint(content);
   const reviewedTree = extractReviewedSnapshotTree(content);
@@ -1311,30 +1351,42 @@ function checkReviewFact({ taskDir, artifactFile }: any): any {
     return failResult("review-fact", `Unsupported review verdict '${verdict}'`);
   }
 
+  const deliveryRemote = String(task.metadata.delivery_remote || "").trim();
+  const deliveryBaseRef = String(task.metadata.delivery_base_ref || "").trim();
+  if (!deliveryRemote || !deliveryBaseRef) {
+    return failResult("review-fact", "Task delivery target is not bound; re-run task branch preparation before review-code");
+  }
+  if (!reviewTargetHead || !reviewReviewedHead || !reviewDiffBase) {
+    return failResult("review-fact", "Review fact must record target head, reviewed head, and diff base");
+  }
+
   let gitRoot;
   let head;
   let baseline;
+  let targetHead;
   let diffBase;
   try {
     gitRoot = execFileSync("git", ["-C", taskDir, "rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
     head = execFileSync("git", ["-C", gitRoot, "rev-parse", "HEAD"], { encoding: "utf8" }).trim();
-    baseline = execFileSync("git", ["-C", gitRoot, "rev-parse", `${reviewBaseline}^{commit}`], { encoding: "utf8" }).trim();
-    diffBase = execFileSync(
-      "git",
-      ["-C", gitRoot, "rev-parse", `${reviewDiffBase || reviewBaseline}^{commit}`],
-      { encoding: "utf8" }
-    ).trim();
+    const target = resolveDeliveryTarget(gitRoot, { remote: deliveryRemote, baseRef: deliveryBaseRef });
+    if (!target.ok) throw new Error(target.message);
+    const reviewedRef = reviewReviewedHead;
+    baseline = execFileSync("git", ["-C", gitRoot, "rev-parse", `${reviewedRef}^{commit}`], { encoding: "utf8" }).trim();
+    targetHead = execFileSync("git", ["-C", gitRoot, "rev-parse", `${reviewTargetHead}^{commit}`], { encoding: "utf8" }).trim();
+    const computed = execFileSync("git", ["-C", gitRoot, "merge-base", baseline, targetHead], { encoding: "utf8" }).trim();
+    diffBase = execFileSync("git", ["-C", gitRoot, "rev-parse", `${reviewDiffBase}^{commit}`], { encoding: "utf8" }).trim();
+    if (diffBase !== computed) throw new Error('saved review diff base does not match merge-base(reviewed head, target head)');
   } catch {
     return blockedResult(
       "review-fact",
-      `Unable to resolve review baseline '${reviewBaseline}' in the task repository; re-run review-code`
+      `Unable to resolve saved review commits in the task repository; re-run review-code`
     );
   }
 
   if (baseline !== head) {
     return failResult(
       "review-fact",
-      `Review baseline ${baseline.slice(0, 8)} does not match current HEAD ${head.slice(0, 8)}; re-run review-code`
+      `Reviewed head ${baseline.slice(0, 8)} does not match current HEAD ${head.slice(0, 8)}; re-run review-code`
     );
   }
 
@@ -1378,7 +1430,7 @@ function checkReviewFact({ taskDir, artifactFile }: any): any {
     if (cleanSnapshot && lastReviewedCommit !== baseline) {
       return failResult(
         "review-fact",
-        `Approved clean review must set task last_reviewed_commit to baseline ${baseline.slice(0, 8)}`
+        `Approved clean review must set task last_reviewed_commit to reviewed head ${baseline.slice(0, 8)}`
       );
     }
     if (!cleanSnapshot && lastReviewedCommit) {
@@ -1638,7 +1690,7 @@ function isBlank(value: any): any {
   return value === undefined || value === null || String(value).trim() === "";
 }
 
-function verifyInProcess({ mode, skillName, taskDir, artifactFile, checks: requestedChecks, repositoryRoot }: any): any {
+async function verifyInProcess({ mode, skillName, taskDir, artifactFile, checks: requestedChecks, repositoryRoot }: any): Promise<any> {
   if (repositoryRoot) repoRoot = path.resolve(repositoryRoot);
   else {
     let cursor = path.resolve(taskDir);
@@ -1651,7 +1703,7 @@ function verifyInProcess({ mode, skillName, taskDir, artifactFile, checks: reque
     const checks = [];
     for (const [type, checkConfig] of Object.entries(verifyConfig.checks || {})) {
       if (checkConfig === null) continue;
-      const result = runCheck(type, {
+      const result = await runCheck(type, {
         mode,
         skillName,
         taskDir: path.resolve(taskDir),
@@ -1671,7 +1723,7 @@ function verifyInProcess({ mode, skillName, taskDir, artifactFile, checks: reque
   if (config === null) return { skill: skillName, ...passResult(type, `Check '${type}' is disabled for skill '${skillName}'.`) };
   return {
     skill: skillName,
-    ...runCheck(type, {
+    ...await runCheck(type, {
       skillName,
       taskDir: path.resolve(taskDir),
       artifactFile,

package/lib/task/verification-review.ts

@@ -1,5 +1,7 @@
 export {
   extractReviewBaseline,
+  extractReviewTargetHead,
+  extractReviewedHead,
   extractReviewDiffBase,
   extractReviewDiffFingerprint,
   extractReviewedSnapshotTree,

package/lib/task/verification.ts

@@ -49,7 +49,7 @@ type TaskVerificationResult = {
 };
 type VerificationOptions = {
   repoRoot?: string;
-  engine?: typeof verifyInProcess;
+  engine?: (input: Parameters<typeof verifyInProcess>[0]) => Record<string, unknown> | Promise<Record<string, unknown>>;
   manualOverride?: ManualOverrideCapability;
 };
 
@@ -91,7 +91,7 @@ function failure(request: { taskRef: string; event: string; artifact?: string },
   };
 }
 
-function verifyTaskEvent(request: { taskRef: string; event: string; artifact?: string }, options: VerificationOptions = {}): TaskVerificationResult {
+async function verifyTaskEvent(request: { taskRef: string; event: string; artifact?: string }, options: VerificationOptions = {}): Promise<TaskVerificationResult> {
   const spec = VERIFICATION_CATALOG[request.event as VerificationEvent];
   if (!spec) return failure(request, 'VERIFY_EVENT_UNKNOWN', `unknown verification event '${request.event}'`);
   const resolved = resolveTaskRef(request.taskRef, { repoRoot: options.repoRoot });
@@ -113,7 +113,7 @@ function verifyTaskEvent(request: { taskRef: string; event: string; artifact?: s
   const invocations: VerificationInvocation[] = [];
   const engine = options.engine ?? verifyInProcess;
   if (spec.mode === 'gate') {
-    const payload = engine({ mode: 'gate', skillName: spec.skill, taskDir: resolved.taskDir, artifactFile: request.artifact, checks: [], repositoryRoot: resolved.repoRoot }) as Record<string, unknown>;
+    const payload = await engine({ mode: 'gate', skillName: spec.skill, taskDir: resolved.taskDir, artifactFile: request.artifact, checks: [], repositoryRoot: resolved.repoRoot });
     const status = payload.gate as 'pass' | 'fail' | 'blocked';
     if (status !== 'pass' && allowsManualOverride(options.manualOverride, 'verification-engine', status === 'blocked' ? 'CHECK_BLOCKED' : 'CHECK_FAILED')) {
       invocations.push({ status: 'pass', exitCode: 0, payload: { ...payload, gate: 'pass', humanOverride: 'human-approved', originalGate: status } });
@@ -125,7 +125,7 @@ function verifyTaskEvent(request: { taskRef: string; event: string; artifact?: s
     invocations.push({ status, exitCode: ({ pass: 0, fail: 1, blocked: 2 } as const)[status], payload });
   } else {
     for (const check of spec.checks ?? []) {
-      const payload = engine({ mode: 'checks', skillName: spec.skill, taskDir: resolved.taskDir, artifactFile: request.artifact, checks: [check], repositoryRoot: resolved.repoRoot }) as Record<string, unknown>;
+      const payload = await engine({ mode: 'checks', skillName: spec.skill, taskDir: resolved.taskDir, artifactFile: request.artifact, checks: [check], repositoryRoot: resolved.repoRoot });
       const status = payload.status as 'pass' | 'fail' | 'blocked';
       if (status !== 'pass' && allowsManualOverride(options.manualOverride, 'verification-engine', status === 'blocked' ? 'CHECK_BLOCKED' : 'CHECK_FAILED')) {
         invocations.push({ status: 'pass', exitCode: 0, payload: { ...payload, status: 'pass', humanOverride: 'human-approved', originalStatus: status } });

package/lib/task/workflow-warning-intents.ts

@@ -68,7 +68,7 @@ function sectionMutation(content: string): TaskMutation[] {
   const english = /^##\s+Activity Log\s*$/m.test(content);
   return [{
     kind: 'section', aliases: WORKFLOW_WARNING_HEADINGS, heading: english ? 'Workflow Warnings' : '工作流告警',
-    body: `| ${WORKFLOW_WARNING_COLUMNS.join(' | ')} |\n|----|------|------|----------|------|--------|--------|---------|--------|-------------|------------|`
+    body: `| ${WORKFLOW_WARNING_COLUMNS.join(' | ')} |\n|----|------|------|----------|------|--------|---------|--------|-------------|------------|------------|`
   }];
 }
 

package/lib/task/write.ts

@@ -16,6 +16,7 @@ import { allowsManualOverride } from './guard-override.ts';
 import type { ManualOverrideCapability } from './guard-override.ts';
 import { mutateTableRow, upsertSection } from './sections.ts';
 import { validateCurrentTaskContract } from './current-contract.ts';
+import { invalidationBlocks, parseInvalidationDocument } from './invalidation.ts';
 import type {
   TableRowDeleteMutation,
   TableRowUpsertMutation
@@ -86,6 +87,8 @@ type TaskWriteErrorCode =
   | ResolveTaskRefErrorCode
   | 'TASK_STATE_MISMATCH'
   | 'TASK_CURRENT_CONTRACT_INVALID'
+  | 'TASK_INVALIDATION_INVALID'
+  | 'TASK_INVALIDATION_BLOCKED'
   | 'TASK_READ_FAILED'
   | 'TASK_DOCUMENT_INVALID'
   | 'MUTATION_INVALID'
@@ -161,6 +164,7 @@ type TaskWriteOptions = {
   randomSuffix?: () => string;
   fileSystem?: Partial<TaskFileSystem>;
   manualOverride?: ManualOverrideCapability;
+  invalidationContext?: 'standard' | 'source-completion' | 'reconcile';
 };
 
 const DEFAULT_FILE_SYSTEM: TaskFileSystem = {
@@ -275,6 +279,21 @@ function writeTask(request: TaskWriteRequest, options: TaskWriteOptions = {}): T
     if (!contract.ok) {
       return failure(request, identity, contract.code, contract.message);
     }
+    if (
+      invalidationBlocks(contract.invalidation)
+      && options.invalidationContext !== 'source-completion'
+      && options.invalidationContext !== 'reconcile'
+    ) {
+      return failure(
+        request,
+        identity,
+        'TASK_INVALIDATION_BLOCKED',
+        'task has an incomplete artifact invalidation operation; reconcile it before writing downstream state'
+      );
+    }
+  } else {
+    const invalidation = parseInvalidationDocument(original);
+    if (!invalidation.ok) return failure(request, identity, 'TASK_INVALIDATION_INVALID', invalidation.message);
   }
 
   let candidate = original;

package/lib/update.ts

@@ -19,10 +19,11 @@ type UpdateConfig = {
   project: string;
   org: string;
   language: string;
-  platform?: { type?: string };
+  platform?: { type?: string; providers?: Record<string, unknown> };
   prFlow?: 'required' | 'disabled';
   sandbox?: Record<string, unknown>;
   task?: { shortIdLength: number };
+  delivery?: { remote?: string; baseRef?: string };
   labels?: Record<string, unknown>;
   files?: Partial<FileRegistry>;
   agentClients?: unknown;
@@ -33,6 +34,7 @@ type Defaults = {
   platform: { type: string };
   sandbox: Record<string, unknown>;
   task: { shortIdLength: number };
+  delivery: { remote: string; baseRef: string };
   labels: Record<string, unknown>;
   files: FileRegistry;
 };
@@ -83,10 +85,12 @@ async function cmdSync(): Promise<void> {
   const sandboxAdded = !config.sandbox;
   const taskAdded = !config.task;
   const labelsAdded = !config.labels;
+  const deliveryAdded = !config.delivery;
   if (platformAdded) config.platform = structuredClone(defaults.platform);
   if (sandboxAdded) config.sandbox = structuredClone(defaults.sandbox);
   if (taskAdded) config.task = structuredClone(defaults.task);
   if (labelsAdded) config.labels = structuredClone(defaults.labels);
+  if (deliveryAdded) config.delivery = structuredClone(defaults.delivery);
 
   const workflowPlan = planAgentClientReconciliation({
     config: config as unknown as Record<string, unknown>,
@@ -150,6 +154,9 @@ async function cmdSync(): Promise<void> {
       if (labelsAdded) {
         info(`Default labels.in config added to ${CONFIG_PATH}.`);
       }
+      if (deliveryAdded) {
+        info(`Default delivery target added to ${CONFIG_PATH}.`);
+      }
     } else {
       info(`File registry changed in ${CONFIG_PATH}.`);
     }
@@ -165,6 +172,9 @@ async function cmdSync(): Promise<void> {
     if (hasNewEntries && platformAdded) {
       info(`Default platform config added to ${CONFIG_PATH}.`);
     }
+    if (hasNewEntries && deliveryAdded) {
+      info(`Default delivery target added to ${CONFIG_PATH}.`);
+    }
     ok(`Updated ${CONFIG_PATH}`);
   }
 

package/lib/version.ts

@@ -1,4 +1,5 @@
 import { existsSync, readFileSync } from 'node:fs';
+import semver from 'semver';
 
 const packageJsonUrl = [
   new URL('../package.json', import.meta.url),
@@ -12,9 +13,22 @@ if (!packageJsonUrl) {
 const { version } = JSON.parse(readFileSync(packageJsonUrl, 'utf8'));
 const VERSION = `v${version}`;
 const AGENT_INFRA_VERSION_PATTERN = /^v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const LEGACY_COMPATIBILITY_CUTOFF_VERSION = '1.0.0';
 
 function isValidAgentInfraVersion(value: unknown): value is string {
   return typeof value === 'string' && AGENT_INFRA_VERSION_PATTERN.test(value);
 }
 
-export { VERSION, isValidAgentInfraVersion };
+function isLegacyCompatibilityEnabled(runtimeVersion = VERSION): boolean {
+  const normalized = runtimeVersion.startsWith('v') ? runtimeVersion.slice(1) : runtimeVersion;
+  const parsed = semver.valid(normalized);
+  return parsed !== null && semver.lt(parsed, LEGACY_COMPATIBILITY_CUTOFF_VERSION);
+}
+
+function legacyCompatibilityError(resource: string, runtimeVersion = VERSION): Error & { code: string } {
+  return Object.assign(new Error(
+    `PLATFORM_IDENTITY_LEGACY_UNSUPPORTED: ${resource} requires migration to the current schema before v${LEGACY_COMPATIBILITY_CUTOFF_VERSION} runtime ${runtimeVersion}`
+  ), { code: 'PLATFORM_IDENTITY_LEGACY_UNSUPPORTED' });
+}
+
+export { LEGACY_COMPATIBILITY_CUTOFF_VERSION, VERSION, isLegacyCompatibilityEnabled, isValidAgentInfraVersion, legacyCompatibilityError };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fitlab-ai/agent-infra",
-  "version": "0.9.11",
+  "version": "0.9.13",
   "description": "Bootstrap tool for AI multi-tool collaboration infrastructure — works with Claude Code, Codex, Antigravity CLI, and OpenCode",
   "license": "MIT",
   "type": "module",
@@ -17,6 +17,12 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
+  "exports": {
+    "./platform-provider": {
+      "types": "./dist/lib/platform/provider-contract.d.ts",
+      "import": "./dist/lib/platform/provider-contract.js"
+    }
+  },
   "bin": {
     "agent-infra": "./dist/bin/cli.js",
     "ai": "./dist/bin/cli.js",

package/templates/.agents/rules/README.en.md

@@ -13,6 +13,7 @@ so you can quickly find "which ones to read" without opening each file.
 - [`version-stamp.md`](version-stamp.md) — How and when to stamp `agent_infra_version`.
 - [`debugging-guide.md`](debugging-guide.md) — Structured debugging flow: gather evidence → form hypothesis → verify hypothesis → fix the root cause; no blind patch-and-retry.
 - [`compatibility-policy.md`](compatibility-policy.md) — Compatibility by exception: admission evidence, implementation boundaries, exit conditions, and lifecycle review requirements.
+- [`sync-content-generation.md`](sync-content-generation.md) — Producer-side Markdown constraints for task and lifecycle content synchronized to Issues.
 
 ## Issue / PR
 
@@ -29,11 +30,12 @@ so you can quickly find "which ones to read" without opening each file.
 - [`lifecycle-orchestration.md`](lifecycle-orchestration.md) — Fresh executor/reviewer, one-use receipt, pause/recovery, and safe endpoint rules for `run-task`.
 - [`review-handshake.md`](review-handshake.md) — Three-stage bidirectional review handshake: four-state disposition, symmetric evidence, disagreement ledger, convergence and post-review commit gate.
 - [`review-method.md`](review-method.md) — Shared three-stage review method: multi-pass review, risk lenses, traceability, and finding evidence.
+- [`local-artifact-repair.md`](local-artifact-repair.md) — Pre-completion local artifact validation for analysis/plan/code and model-per-case repair, safety gates, and convergence for failed review artifacts.
 - [`human-decision-context.md`](human-decision-context.md) — Self-contained context and canonical structure for new human-decision details.
 - [`task-short-id.md`](task-short-id.md) — Resolution, allocation and lifecycle of bare-number short ids.
 - [`milestone-inference.md`](milestone-inference.md) — Milestone inference for create-task / code-task / create-pr.
-- [`label-milestone-setup.md`](label-milestone-setup.md) — Platform commands to initialize labels / milestones.
-- [`security-alerts.md`](security-alerts.md) — Commands to import / close Dependabot and Code Scanning alerts.
+- [`label-milestone-setup.md`](label-milestone-setup.md) — Shared entry points to initialize labels / milestones.
+- [`security-alerts.md`](security-alerts.md) — Shared entry point to import / close dependency and code-scanning alerts.
 
 ## Commit & Release
 

package/templates/.agents/rules/README.zh-CN.md

@@ -12,6 +12,7 @@
 - [`version-stamp.md`](version-stamp.md) — `agent_infra_version` 版本戳的取值命令与写入时机。
 - [`debugging-guide.md`](debugging-guide.md) — 结构化调试流程：收集证据→形成假设→验证假设→修复根因，禁止盲目改代码重试。
 - [`compatibility-policy.md`](compatibility-policy.md) — 兼容性默认关闭：准入证据、实现边界、退出条件与生命周期审查要求。
+- [`sync-content-generation.md`](sync-content-generation.md) — 同步到 Issue 的任务和生命周期 Markdown 生成约束。
 
 ## Issue / PR
 
@@ -28,11 +29,12 @@
 - [`lifecycle-orchestration.md`](lifecycle-orchestration.md) — `run-task` 的 fresh executor/reviewer、一次性 receipt、暂停恢复与安全终点规则。
 - [`review-handshake.md`](review-handshake.md) — 三阶段双向审查握手协议：四态处置、对称证据、分歧账本、收敛与 post-review commit 门禁。
 - [`review-method.md`](review-method.md) — 三阶段共享检视方法：多遍检视、风险镜头、追踪与 finding 证据契约。
+- [`local-artifact-repair.md`](local-artifact-repair.md) — analysis/plan/code completed 前的本地产物校验、review artifact 失败后的模型逐例修复、机械安全门与收敛契约。
 - [`human-decision-context.md`](human-decision-context.md) — 新建人工裁决详情的自足上下文与规范结构。
 - [`task-short-id.md`](task-short-id.md) — 裸数字任务短号的解析、分配与生命周期。
 - [`milestone-inference.md`](milestone-inference.md) — create-task / code-task / create-pr 的 milestone 推断。
-- [`label-milestone-setup.md`](label-milestone-setup.md) — 初始化 label / milestone 的平台命令集。
-- [`security-alerts.md`](security-alerts.md) — 导入 / 关闭 Dependabot 与 Code Scanning 告警的命令集。
+- [`label-milestone-setup.md`](label-milestone-setup.md) — 初始化 label / milestone 的共享入口。
+- [`security-alerts.md`](security-alerts.md) — 导入 / 关闭依赖与代码扫描告警的共享入口。
 
 ## 提交与发布
 

package/templates/.agents/rules/create-issue.en.md

@@ -1,5 +1,14 @@
 # Issue Creation
 
-This code platform does not provide an Issue adapter. `platform-issue create` returns a structured no-op/degraded result.
+> `--agent` values are defined in `.agents/rules/task-management.md` under “Collaborator Token Specification”.
 
-`create-task` skips the cascade Issue creation step on this platform; the local `task.md` remains a valid artifact. If you later want to bind the task to an Issue, manually write `issue_number` into `task.md` and the subsequent skills (`commit` / `code-task` / `complete-task`, etc.) will pick up Issue metadata syncing through the existing cascade rules.
+After `create-task` writes task.md, create and initialize the Issue through declarative internal intents:
+
+```bash
+agent-infra-internal platform-issue create {task-id} --agent {standard-agent-token}
+agent-infra-internal platform-issue sync {task-id} --agent {standard-agent-token} --status waiting-for-triage --assignees current --milestone initial --issue-type --fields
+```
+
+The core reads only persisted task identity, title, type, description, and requirements, and reuses deterministic `ai task issue-body` rendering. It owns template selection, upstream/capabilities, duplicate prevention, POST outcome boundaries, response validation, and atomic `issue_number` binding.
+
+`planned|applied|no-op|degraded` exit 0, `failed` exits 1, and `blocked` exits 2. Callers must not fall back to direct platform CLI or GraphQL orchestration.

package/templates/.agents/rules/create-issue.zh-CN.md

@@ -1,5 +1,27 @@
 # Issue 创建
 
-当前代码平台未提供 Issue 适配器；`platform-issue create` 返回结构化 no-op/degraded 结果。
+> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」。
 
-`create-task` 在本平台上会跳过级联创建 Issue 步骤；本地 `task.md` 仍然是有效产物。如果将来需要把任务绑定到一个 Issue，可手动在 `task.md` 中写入 `issue_number`，后续技能（`commit` / `code-task` / `complete-task` 等）会按既有的级联同步规则自动接管 Issue 元数据更新。
+当 `create-task` 完成本地 `task.md` 落盘后，通过声明式内部命令创建 Issue：
+
+```bash
+agent-infra-internal platform-issue create {task-id} --agent {standard-agent-token}
+```
+
+命令只从已落盘 task.md 读取身份、标题、类型、描述与需求，并复用 `ai task issue-body` 的确定性正文渲染。它负责模板选择、upstream/capability、已有绑定检查、非幂等 POST 边界、响应身份校验及通过任务写入内核回写 `issue_number`。
+
+创建后的初始元数据使用同一适配层同步：
+
+```bash
+agent-infra-internal platform-issue sync {task-id} --agent {standard-agent-token} \
+  --status waiting-for-triage --assignees current --milestone initial --issue-type --fields
+```
+
+## 结果处理
+
+- `planned|applied|no-op|degraded`：exit 0；调用方按 operations 继续评论同步。
+- `failed`：exit 1；调用方登记 `ISSUE_CREATE_FAILED` warning，不伪造绑定。
+- `blocked`：exit 2；认证、网络或创建 outcome 不确定，调用方保留远端 identity 证据并停止盲目重试。
+- 已绑定有效 Issue 时只验证绑定并返回 no-op，绝不重复创建。
+
+自定义或空平台返回 no-op/degraded；调用方不得回退到直接平台 CLI 或 GraphQL 编排。