@fitlab-ai/agent-infra 0.9.12 → 0.9.13

package/lib/task/rework-intent.ts

@@ -0,0 +1,165 @@
+const REWORK_INTENT_HEADINGS = ['返工意图', 'Rework Intent'] as const;
+const REWORK_INTENT_COLUMNS = [
+  'intent_id', 'finding_id', 'source_artifact', 'source_sha256', 'target',
+  'status', 'declared_at', 'consumed_at'
+] as const;
+type ReworkTarget = 'analysis' | 'plan' | 'code';
+type ReworkIntentStatus = 'pending' | 'consumed' | 'superseded';
+type ReworkIntent = {
+  intentId: string;
+  findingId: string;
+  sourceArtifact: string;
+  sourceSha256: string;
+  target: ReworkTarget;
+  status: ReworkIntentStatus;
+  declaredAt: string;
+  consumedAt: string;
+};
+type ReworkIntentParseResult =
+  | { ok: true; present: boolean; intents: readonly ReworkIntent[] }
+  | { ok: false; code: 'TASK_REWORK_INTENT_INVALID'; message: string };
+
+function cells(line: string): string[] | null {
+  const first = line.indexOf('|');
+  const last = line.lastIndexOf('|');
+  if (first < 0 || first === last || line.slice(0, first).trim() || line.slice(last + 1).trim()) return null;
+  const inner = line.slice(first + 1, last);
+  const result: string[] = [];
+  let start = 0;
+  let escaped = false;
+  for (let index = 0; index < inner.length; index += 1) {
+    const char = inner[index]!;
+    if (char === '|' && !escaped) {
+      result.push(inner.slice(start, index));
+      start = index + 1;
+    }
+    escaped = char === '\\' && !escaped;
+    if (char !== '\\') escaped = false;
+  }
+  result.push(inner.slice(start));
+  return result.map((cell) => cell.replace(/\\([\\|])/g, '$1').trim());
+}
+
+function sectionBody(content: string): string | null {
+  const heading = REWORK_INTENT_HEADINGS.map((value) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|');
+  const match = new RegExp(`^##\\s+(${heading})\\s*$`, 'm').exec(content);
+  if (!match) return null;
+  const start = (match.index ?? 0) + match[0].length;
+  const rest = content.slice(start);
+  const end = rest.search(/^##\s+/m);
+  return rest.slice(0, end < 0 ? rest.length : end);
+}
+
+function parseReworkIntentDocument(content: string): ReworkIntentParseResult {
+  const body = sectionBody(content);
+  if (body === null) return { ok: true, present: false, intents: [] };
+  const lines = body.split(/\r?\n/).filter((line) => line.trim());
+  const header = lines[0] ? cells(lines[0]) : null;
+  const separator = lines[1] ? cells(lines[1]) : null;
+  if (!header || !separator || header.length !== REWORK_INTENT_COLUMNS.length || !header.every((value, index) => value === REWORK_INTENT_COLUMNS[index]) || !separator.every((value) => /^:?-{3,}:?$/.test(value))) {
+    return { ok: false, code: 'TASK_REWORK_INTENT_INVALID', message: 'rework intent section must contain its canonical table' };
+  }
+  try {
+    const intents = lines.slice(2).map((line) => {
+      const values = cells(line);
+      if (!values || values.length !== REWORK_INTENT_COLUMNS.length) throw new Error('rework intent row has the wrong column count');
+      const row = Object.fromEntries(REWORK_INTENT_COLUMNS.map((column, index) => [column, values[index]!])) as Record<string, string>;
+      if (!/^RI-[1-9]\d*$/.test(row.intent_id!)) throw new Error(`invalid intent id '${row.intent_id}'`);
+      if (!/^(AN|PL|CD)-[1-9]\d*$/.test(row.finding_id!)) throw new Error(`invalid finding id '${row.finding_id}'`);
+      if (!['analysis', 'plan', 'code'].includes(row.target!)) throw new Error(`invalid rework target '${row.target}'`);
+      if (!['pending', 'consumed', 'superseded'].includes(row.status!)) throw new Error(`invalid rework status '${row.status}'`);
+      if (!/^[a-f0-9]{64}$/.test(row.source_sha256!)) throw new Error(`invalid source hash for '${row.intent_id}'`);
+      if (!row.source_artifact || !row.declared_at) throw new Error(`rework intent '${row.intent_id}' has invalid required fields`);
+      const terminal = row.status === 'consumed' || row.status === 'superseded';
+      if (terminal !== Boolean(row.consumed_at)) throw new Error(`rework intent '${row.intent_id}' has invalid consumed_at`);
+      return {
+        intentId: row.intent_id!, findingId: row.finding_id!, sourceArtifact: row.source_artifact!,
+        sourceSha256: row.source_sha256!, target: row.target as ReworkTarget,
+        status: row.status as ReworkIntentStatus, declaredAt: row.declared_at!, consumedAt: row.consumed_at!
+      } satisfies ReworkIntent;
+    });
+    const ids = new Set<string>();
+    for (const intent of intents) {
+      if (ids.has(intent.intentId)) throw new Error(`duplicate intent '${intent.intentId}'`);
+      ids.add(intent.intentId);
+    }
+    return { ok: true, present: true, intents };
+  } catch (error) {
+    return { ok: false, code: 'TASK_REWORK_INTENT_INVALID', message: error instanceof Error ? error.message : String(error) };
+  }
+}
+
+function renderReworkIntents(intents: readonly ReworkIntent[]): string {
+  const escape = (value: string) => value.replace(/\\/g, '\\\\').replace(/\|/g, '\\|').replace(/[\r\n]/g, ' ');
+  return [
+    `| ${REWORK_INTENT_COLUMNS.join(' | ')} |`,
+    `| ${REWORK_INTENT_COLUMNS.map(() => '---').join(' | ')} |`,
+    ...intents.map((intent) => `| ${[
+      intent.intentId, intent.findingId, intent.sourceArtifact, intent.sourceSha256,
+      intent.target, intent.status, intent.declaredAt, intent.consumedAt
+    ].map(escape).join(' | ')} |`)
+  ].join('\n');
+}
+
+function upsertReworkIntent(intents: readonly ReworkIntent[], intent: ReworkIntent): { changed: boolean; intents: readonly ReworkIntent[] } {
+  const existing = intents.find((candidate) => candidate.intentId === intent.intentId);
+  if (!existing) return { changed: true, intents: [...intents, intent] };
+  const identity = (value: ReworkIntent) => [value.intentId, value.findingId, value.sourceArtifact, value.sourceSha256, value.target];
+  if (JSON.stringify(identity(existing)) !== JSON.stringify(identity(intent))) throw new Error(`intent '${intent.intentId}' identity conflicts with existing state`);
+  return { changed: false, intents };
+}
+
+function consumeReworkIntents(
+  intents: readonly ReworkIntent[],
+  target: ReworkTarget,
+  sourceHashes: Readonly<Record<string, string>>,
+  consumedAt: string
+): { changed: boolean; intents: readonly ReworkIntent[] } {
+  let changed = false;
+  const next = intents.map((intent) => {
+    if (
+      intent.status !== 'pending'
+      || intent.target !== target
+      || sourceHashes[intent.sourceArtifact] !== intent.sourceSha256
+    ) return intent;
+    changed = true;
+    return { ...intent, status: 'consumed' as const, consumedAt };
+  });
+  return { changed, intents: next };
+}
+
+function supersedeReworkIntents(
+  intents: readonly ReworkIntent[],
+  sourceArtifact: string,
+  sourceSha256: string,
+  supersededAt: string
+): { changed: boolean; intents: readonly ReworkIntent[] } {
+  let changed = false;
+  const next = intents.map((intent) => {
+    if (intent.status !== 'pending' || intent.sourceArtifact !== sourceArtifact || intent.sourceSha256 === sourceSha256) return intent;
+    changed = true;
+    return { ...intent, status: 'superseded' as const, consumedAt: supersededAt };
+  });
+  return { changed, intents: next };
+}
+
+function reworkIntentMutation(content: string, intents: readonly ReworkIntent[]) {
+  return {
+    kind: 'section' as const,
+    aliases: REWORK_INTENT_HEADINGS,
+    heading: /^##\s+Rework Intent\s*$/m.test(content) ? REWORK_INTENT_HEADINGS[1] : REWORK_INTENT_HEADINGS[0],
+    body: renderReworkIntents(intents)
+  };
+}
+
+export {
+  REWORK_INTENT_COLUMNS,
+  REWORK_INTENT_HEADINGS,
+  parseReworkIntentDocument,
+  renderReworkIntents,
+  reworkIntentMutation,
+  consumeReworkIntents,
+  supersedeReworkIntents,
+  upsertReworkIntent
+};
+export type { ReworkIntent, ReworkIntentParseResult, ReworkIntentStatus, ReworkTarget };

package/lib/task/skill-scope.ts

@@ -0,0 +1,24 @@
+const TASK_SCOPE_SKILLS: ReadonlySet<string> = new Set([
+  'analyze-task',
+  'block-task',
+  'cancel-task',
+  'check-task',
+  'code-task',
+  'commit',
+  'complete-manual-validation',
+  'complete-task',
+  'create-pr',
+  'plan-task',
+  'review-analysis',
+  'review-code',
+  'review-plan',
+  'run-manual-validation',
+  'run-task',
+  'watch-pr'
+]);
+
+function isTaskScopeSkill(skillName: string): boolean {
+  return TASK_SCOPE_SKILLS.has(skillName);
+}
+
+export { TASK_SCOPE_SKILLS, isTaskScopeSkill };

package/lib/task/task-execution-lock.ts

@@ -224,6 +224,22 @@ function withTaskExecutionLock<T>(
   };
   const serialized = `${JSON.stringify(owner)}\n`;
   let ownsFixed = false;
+  let deferRelease = false;
+  const release = (): void => {
+    try {
+      unlinkIfPresent(candidate);
+    } catch {
+      // Candidate cleanup is best-effort and must not replace the primary result.
+    }
+    if (ownsFixed) {
+      try {
+        const current = parseOwner(fs.readFileSync(fixed, 'utf8'), key);
+        if (current.token === token) unlinkIfPresent(fixed);
+      } catch {
+        // A missing or replaced fixed lock is not owned by this invocation.
+      }
+    }
+  };
   try {
     fs.mkdirSync(lockRoot, { recursive: true });
     cleanStaleCandidates(lockRoot, key, options.identityMatches ?? processIdentityMatches);
@@ -269,7 +285,12 @@ function withTaskExecutionLock<T>(
       );
     }
     unlinkIfPresent(candidate);
-    return callback();
+    const value = callback();
+    if (value && typeof (value as { then?: unknown }).then === 'function') {
+      deferRelease = true;
+      return (value as unknown as Promise<unknown>).finally(release) as T;
+    }
+    return value;
   } catch (error) {
     if (error instanceof TaskExecutionLockError) throw error;
     if (error instanceof Error && error.name === 'OrchestrationStateError') throw error;
@@ -279,19 +300,7 @@ function withTaskExecutionLock<T>(
       { operation: ownsFixed ? 'callback' : 'acquire', errno: errno(error), key }
     );
   } finally {
-    try {
-      unlinkIfPresent(candidate);
-    } catch {
-      // Candidate cleanup is best-effort and must not replace the primary result.
-    }
-    if (ownsFixed) {
-      try {
-        const current = parseOwner(fs.readFileSync(fixed, 'utf8'), key);
-        if (current.token === token) unlinkIfPresent(fixed);
-      } catch {
-        // A missing or replaced fixed lock is not owned by this invocation.
-      }
-    }
+    if (!deferRelease) release();
   }
 }
 

package/lib/task/verification-engine.ts

@@ -34,6 +34,7 @@ import { snapshotReview } from "../git/review-snapshot.ts";
 import { OrchestrationStateError, readRun } from "./orchestration.ts";
 import { resolveDeliveryTarget } from "./delivery-target.ts";
 import { readPrDeliveryFact } from "./pr-delivery-fact.ts";
+import { validateLocalArtifact } from "./local-artifact-finalization.ts";
 
 const TASK_ENUMS = {
   type: ["feature", "bugfix", "refactor", "docs", "chore"],
@@ -88,7 +89,7 @@ let repoRoot = path.resolve(path.dirname(scriptPath), "..", "..");
 
 const PLATFORM_ADAPTERS: Record<string, (context: any, shared: any) => any> = {
   "platform-sync": checkPlatformSync,
-  "platform-sync-preflight": (context: any, shared: any) => ({ ...checkPlatformSync(context, shared), type: "platform-sync-preflight" }),
+  "platform-sync-preflight": async (context: any, shared: any) => ({ ...await checkPlatformSync(context, shared), type: "platform-sync-preflight" }),
   "required-checks": checkRequiredChecks
 };
 const OPTIONAL_PLATFORM_CHECKS = new Set(["platform-sync"]);
@@ -107,7 +108,7 @@ const sharedUtils = {
   parsePrNumber
 };
 
-function runCheck(type: any, context: any, shared: any): any {
+async function runCheck(type: any, context: any, shared: any): Promise<any> {
   switch (type) {
     case "task-meta":
       return checkTaskMeta(context);
@@ -147,7 +148,7 @@ function runCheck(type: any, context: any, shared: any): any {
         return failResult(type, `Unsupported check type '${type}'.`);
       }
 
-      return adapter(context, shared);
+      return await adapter(context, shared);
     }
   }
 }
@@ -488,7 +489,7 @@ function checkTaskMeta({ taskDir, config }: any): any {
   );
 }
 
-function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }: any): any {
+async function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }: any): Promise<any> {
   const task = loadTask(taskDir);
   if (!task.ok) return failResult('required-pr-delivery', task.message);
   let projectConfig: any = {};
@@ -503,9 +504,10 @@ function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }: any): any {
   if (factRead.status === 'invalid') return failResult('required-pr-delivery', factRead.error.message);
   const fact = factRead.status === 'valid' ? factRead.fact : null;
   const status = fact?.state || 'unbound';
-  const prNumber = fact?.state === 'bound' ? fact.identity.number : null;
+  const prIdentity = fact?.state === 'bound' ? fact.identity.resource : null;
+  const prNumber = prIdentity?.kind === 'number' ? prIdentity.value : null;
   if (flow === 'disabled') return passResult('required-pr-delivery', 'Pull request delivery is disabled by project policy');
-  if (flow === 'required' && (status !== 'bound' || prNumber === null)) {
+  if (flow === 'required' && (status !== 'bound' || !prIdentity)) {
     return failResult('required-pr-delivery', 'Project policy requires a bound pull request before completion');
   }
   if (flow !== 'required' && status === 'unbound') {
@@ -515,7 +517,7 @@ function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }: any): any {
     if (mode === 'gate') {
       return passResult('required-pr-delivery', 'Bound pull request shape is valid; merged-state inspection is reserved for hard preflight');
     }
-    const inspected = inspectPlatformPullRequest(task.metadata.id, { cwd: repositoryRoot });
+    const inspected = await inspectPlatformPullRequest(task.metadata.id, { cwd: repositoryRoot });
     if (inspected.status === 'blocked') {
       return blockedResult(
         'required-pr-delivery',
@@ -527,7 +529,7 @@ function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }: any): any {
     const repository = inspected.platform.repository?.toLowerCase() || '';
     const taskBranch = String(task.metadata.branch || '').trim();
     const deliveryBaseRef = String(task.metadata.delivery_base_ref || projectConfig.delivery?.baseRef || '').trim();
-    if (inspected.status !== 'no-op' || !pullRequest || pullRequest.number !== prNumber) {
+    if (inspected.status !== 'no-op' || !pullRequest) {
       return failResult('required-pr-delivery', 'Bound pull request identity could not be verified');
     }
     if (
@@ -542,7 +544,7 @@ function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }: any): any {
     if (pullRequest.state !== 'closed' || !pullRequest.mergedAt || !pullRequest.mergeCommitSha) {
       return failResult('required-pr-delivery', 'Project policy requires the bound pull request to be merged');
     }
-    return passResult('required-pr-delivery', `Pull request delivery policy satisfied (merged PR #${prNumber})`);
+    return passResult('required-pr-delivery', `Pull request delivery policy satisfied (merged PR ${prNumber === null ? 'identity' : `#${prNumber}`})`);
   }
   return passResult('required-pr-delivery', `Pull request delivery policy satisfied (${status})`);
 }
@@ -581,7 +583,7 @@ function loadProjectName(): any {
   }
 }
 
-function checkArtifact({ taskDir, config, artifactFile }: any): any {
+function checkArtifact({ taskDir, config, artifactFile, skillName }: any): any {
   const resolvedArtifact = resolveArtifactPath(taskDir, config.file_pattern, artifactFile);
   if (!resolvedArtifact.ok) {
     return failResult("artifact", resolvedArtifact.message);
@@ -599,6 +601,26 @@ function checkArtifact({ taskDir, config, artifactFile }: any): any {
 
   const content = fs.readFileSync(artifactPath, "utf8");
   const requiredSections = config.required_sections || [];
+  const localFamily = skillName === "analyze-task"
+    ? "analysis"
+    : skillName === "plan-task" ? "plan" : skillName === "code-task" ? "code" : null;
+  if (localFamily) {
+    const local = validateLocalArtifact(content, {
+      family: localFamily,
+      requiredSections: requiredSections.filter((section: unknown): section is string => typeof section === "string"),
+      requiredPatterns: (config.required_patterns || []).filter((pattern: unknown): pattern is string => typeof pattern === "string")
+    });
+    if (!local.ok) {
+      return failResult(
+        "artifact",
+        `${path.basename(artifactPath)} has local structural errors: ${local.diagnostics.map((item) => `${item.code}: ${item.message}`).join('; ')}`
+      );
+    }
+    return passResult(
+      "artifact",
+      `${path.basename(artifactPath)} passed (${requiredSections.length} sections)`
+    );
+  }
   const missingSections = requiredSections.filter(
     (section: any) => !new RegExp(`^##\\s+${escapeRegExp(section)}\\s*$`, "m").test(content)
   );
@@ -1031,6 +1053,7 @@ function checkManualValidation({ taskDir }: any): any {
   // 1. Latest review-code artifact; none -> pass (no review, check not applicable).
   const review = findAuthoritativeReviewCodeArtifact(taskDir);
   if (!review.ok) {
+    if (review.error) return failResult("manual-validation", `Review-code artifact is unavailable: ${review.error}`);
     return passResult("manual-validation", "No review-code artifact; manual validation not applicable");
   }
   // 2. Parse the numeric manual-validation count; unparseable/null -> fail closed
@@ -1096,9 +1119,10 @@ function checkManualValidation({ taskDir }: any): any {
   return passResult("manual-validation", `Manual validation completed → ${artifactName}`);
 }
 
-function checkPostReviewCommit({ taskDir, config }: any): any {
+async function checkPostReviewCommit({ taskDir, config }: any): Promise<any> {
   const reviewArtifact = findAuthoritativeReviewCodeArtifact(taskDir);
   if (!reviewArtifact.ok) {
+    if (reviewArtifact.error) return failResult("post-review-commit", `Review-code artifact is unavailable: ${reviewArtifact.error}`);
     return passResult("post-review-commit", "No review-code artifact; check inactive");
   }
 
@@ -1117,9 +1141,9 @@ function checkPostReviewCommit({ taskDir, config }: any): any {
   const lastReviewedCommit = task.ok ? (task.metadata.last_reviewed_commit || "").trim() : "";
   const globs = resolvePostReviewGlobs(config, loadPostReviewConfig(repoRoot));
   const hasPullRequest = fact?.state === 'bound';
-  let inspected: ReturnType<typeof inspectPlatformPullRequest> | null = null;
+  let inspected: Awaited<ReturnType<typeof inspectPlatformPullRequest>> | null = null;
   if (hasPullRequest) {
-    inspected = inspectPlatformPullRequest(task.metadata.id, { cwd: gitRoot });
+    inspected = await inspectPlatformPullRequest(task.metadata.id, { cwd: gitRoot });
     if (!inspected.pullRequest) {
       const message = inspected.error?.message || "PR merge snapshot is unavailable";
       const code = inspected.error?.code || "PR_INSPECTION_INVALID";
@@ -1132,7 +1156,7 @@ function checkPostReviewCommit({ taskDir, config }: any): any {
       inspected.pullRequest.mergedAt &&
       inspected.pullRequest.mergeCommitSha
     ) {
-      const relation = resolveMaterializedReviewedHeadRelation({
+      const relation = await resolveMaterializedReviewedHeadRelation({
         cwd: gitRoot,
         platformType: inspected.platform.type,
         lastReviewedCommit,
@@ -1299,6 +1323,17 @@ function checkReviewFact({ taskDir, artifactFile }: any): any {
     return failResult("review-fact", resolvedArtifact.message);
   }
 
+  const authoritative = findAuthoritativeReviewCodeArtifact(taskDir);
+  if (!authoritative.ok) {
+    return failResult("review-fact", authoritative.error ?? "No active review-code artifact is available");
+  }
+  if (path.basename(resolvedArtifact.path) !== authoritative.fileName) {
+    return failResult(
+      "review-fact",
+      `review-code artifact ${path.basename(resolvedArtifact.path)} is not the current active artifact ${authoritative.fileName}; re-run review-code`
+    );
+  }
+
   const task = loadTask(taskDir);
   if (!task.ok) {
     return failResult("review-fact", task.message);
@@ -1655,7 +1690,7 @@ function isBlank(value: any): any {
   return value === undefined || value === null || String(value).trim() === "";
 }
 
-function verifyInProcess({ mode, skillName, taskDir, artifactFile, checks: requestedChecks, repositoryRoot }: any): any {
+async function verifyInProcess({ mode, skillName, taskDir, artifactFile, checks: requestedChecks, repositoryRoot }: any): Promise<any> {
   if (repositoryRoot) repoRoot = path.resolve(repositoryRoot);
   else {
     let cursor = path.resolve(taskDir);
@@ -1668,7 +1703,7 @@ function verifyInProcess({ mode, skillName, taskDir, artifactFile, checks: reque
     const checks = [];
     for (const [type, checkConfig] of Object.entries(verifyConfig.checks || {})) {
       if (checkConfig === null) continue;
-      const result = runCheck(type, {
+      const result = await runCheck(type, {
         mode,
         skillName,
         taskDir: path.resolve(taskDir),
@@ -1688,7 +1723,7 @@ function verifyInProcess({ mode, skillName, taskDir, artifactFile, checks: reque
   if (config === null) return { skill: skillName, ...passResult(type, `Check '${type}' is disabled for skill '${skillName}'.`) };
   return {
     skill: skillName,
-    ...runCheck(type, {
+    ...await runCheck(type, {
       skillName,
       taskDir: path.resolve(taskDir),
       artifactFile,

package/lib/task/verification.ts

@@ -49,7 +49,7 @@ type TaskVerificationResult = {
 };
 type VerificationOptions = {
   repoRoot?: string;
-  engine?: typeof verifyInProcess;
+  engine?: (input: Parameters<typeof verifyInProcess>[0]) => Record<string, unknown> | Promise<Record<string, unknown>>;
   manualOverride?: ManualOverrideCapability;
 };
 
@@ -91,7 +91,7 @@ function failure(request: { taskRef: string; event: string; artifact?: string },
   };
 }
 
-function verifyTaskEvent(request: { taskRef: string; event: string; artifact?: string }, options: VerificationOptions = {}): TaskVerificationResult {
+async function verifyTaskEvent(request: { taskRef: string; event: string; artifact?: string }, options: VerificationOptions = {}): Promise<TaskVerificationResult> {
   const spec = VERIFICATION_CATALOG[request.event as VerificationEvent];
   if (!spec) return failure(request, 'VERIFY_EVENT_UNKNOWN', `unknown verification event '${request.event}'`);
   const resolved = resolveTaskRef(request.taskRef, { repoRoot: options.repoRoot });
@@ -113,7 +113,7 @@ function verifyTaskEvent(request: { taskRef: string; event: string; artifact?: s
   const invocations: VerificationInvocation[] = [];
   const engine = options.engine ?? verifyInProcess;
   if (spec.mode === 'gate') {
-    const payload = engine({ mode: 'gate', skillName: spec.skill, taskDir: resolved.taskDir, artifactFile: request.artifact, checks: [], repositoryRoot: resolved.repoRoot }) as Record<string, unknown>;
+    const payload = await engine({ mode: 'gate', skillName: spec.skill, taskDir: resolved.taskDir, artifactFile: request.artifact, checks: [], repositoryRoot: resolved.repoRoot });
     const status = payload.gate as 'pass' | 'fail' | 'blocked';
     if (status !== 'pass' && allowsManualOverride(options.manualOverride, 'verification-engine', status === 'blocked' ? 'CHECK_BLOCKED' : 'CHECK_FAILED')) {
       invocations.push({ status: 'pass', exitCode: 0, payload: { ...payload, gate: 'pass', humanOverride: 'human-approved', originalGate: status } });
@@ -125,7 +125,7 @@ function verifyTaskEvent(request: { taskRef: string; event: string; artifact?: s
     invocations.push({ status, exitCode: ({ pass: 0, fail: 1, blocked: 2 } as const)[status], payload });
   } else {
     for (const check of spec.checks ?? []) {
-      const payload = engine({ mode: 'checks', skillName: spec.skill, taskDir: resolved.taskDir, artifactFile: request.artifact, checks: [check], repositoryRoot: resolved.repoRoot }) as Record<string, unknown>;
+      const payload = await engine({ mode: 'checks', skillName: spec.skill, taskDir: resolved.taskDir, artifactFile: request.artifact, checks: [check], repositoryRoot: resolved.repoRoot });
       const status = payload.status as 'pass' | 'fail' | 'blocked';
       if (status !== 'pass' && allowsManualOverride(options.manualOverride, 'verification-engine', status === 'blocked' ? 'CHECK_BLOCKED' : 'CHECK_FAILED')) {
         invocations.push({ status: 'pass', exitCode: 0, payload: { ...payload, status: 'pass', humanOverride: 'human-approved', originalStatus: status } });

package/lib/task/workflow-warning-intents.ts

@@ -68,7 +68,7 @@ function sectionMutation(content: string): TaskMutation[] {
   const english = /^##\s+Activity Log\s*$/m.test(content);
   return [{
     kind: 'section', aliases: WORKFLOW_WARNING_HEADINGS, heading: english ? 'Workflow Warnings' : '工作流告警',
-    body: `| ${WORKFLOW_WARNING_COLUMNS.join(' | ')} |\n|----|------|------|----------|------|--------|--------|---------|--------|-------------|------------|`
+    body: `| ${WORKFLOW_WARNING_COLUMNS.join(' | ')} |\n|----|------|------|----------|------|--------|---------|--------|-------------|------------|------------|`
   }];
 }
 

package/lib/task/write.ts

@@ -16,6 +16,7 @@ import { allowsManualOverride } from './guard-override.ts';
 import type { ManualOverrideCapability } from './guard-override.ts';
 import { mutateTableRow, upsertSection } from './sections.ts';
 import { validateCurrentTaskContract } from './current-contract.ts';
+import { invalidationBlocks, parseInvalidationDocument } from './invalidation.ts';
 import type {
   TableRowDeleteMutation,
   TableRowUpsertMutation
@@ -86,6 +87,8 @@ type TaskWriteErrorCode =
   | ResolveTaskRefErrorCode
   | 'TASK_STATE_MISMATCH'
   | 'TASK_CURRENT_CONTRACT_INVALID'
+  | 'TASK_INVALIDATION_INVALID'
+  | 'TASK_INVALIDATION_BLOCKED'
   | 'TASK_READ_FAILED'
   | 'TASK_DOCUMENT_INVALID'
   | 'MUTATION_INVALID'
@@ -161,6 +164,7 @@ type TaskWriteOptions = {
   randomSuffix?: () => string;
   fileSystem?: Partial<TaskFileSystem>;
   manualOverride?: ManualOverrideCapability;
+  invalidationContext?: 'standard' | 'source-completion' | 'reconcile';
 };
 
 const DEFAULT_FILE_SYSTEM: TaskFileSystem = {
@@ -275,6 +279,21 @@ function writeTask(request: TaskWriteRequest, options: TaskWriteOptions = {}): T
     if (!contract.ok) {
       return failure(request, identity, contract.code, contract.message);
     }
+    if (
+      invalidationBlocks(contract.invalidation)
+      && options.invalidationContext !== 'source-completion'
+      && options.invalidationContext !== 'reconcile'
+    ) {
+      return failure(
+        request,
+        identity,
+        'TASK_INVALIDATION_BLOCKED',
+        'task has an incomplete artifact invalidation operation; reconcile it before writing downstream state'
+      );
+    }
+  } else {
+    const invalidation = parseInvalidationDocument(original);
+    if (!invalidation.ok) return failure(request, identity, 'TASK_INVALIDATION_INVALID', invalidation.message);
   }
 
   let candidate = original;

package/lib/update.ts

@@ -19,7 +19,7 @@ type UpdateConfig = {
   project: string;
   org: string;
   language: string;
-  platform?: { type?: string };
+  platform?: { type?: string; providers?: Record<string, unknown> };
   prFlow?: 'required' | 'disabled';
   sandbox?: Record<string, unknown>;
   task?: { shortIdLength: number };

package/lib/version.ts

@@ -1,4 +1,5 @@
 import { existsSync, readFileSync } from 'node:fs';
+import semver from 'semver';
 
 const packageJsonUrl = [
   new URL('../package.json', import.meta.url),
@@ -12,9 +13,22 @@ if (!packageJsonUrl) {
 const { version } = JSON.parse(readFileSync(packageJsonUrl, 'utf8'));
 const VERSION = `v${version}`;
 const AGENT_INFRA_VERSION_PATTERN = /^v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const LEGACY_COMPATIBILITY_CUTOFF_VERSION = '1.0.0';
 
 function isValidAgentInfraVersion(value: unknown): value is string {
   return typeof value === 'string' && AGENT_INFRA_VERSION_PATTERN.test(value);
 }
 
-export { VERSION, isValidAgentInfraVersion };
+function isLegacyCompatibilityEnabled(runtimeVersion = VERSION): boolean {
+  const normalized = runtimeVersion.startsWith('v') ? runtimeVersion.slice(1) : runtimeVersion;
+  const parsed = semver.valid(normalized);
+  return parsed !== null && semver.lt(parsed, LEGACY_COMPATIBILITY_CUTOFF_VERSION);
+}
+
+function legacyCompatibilityError(resource: string, runtimeVersion = VERSION): Error & { code: string } {
+  return Object.assign(new Error(
+    `PLATFORM_IDENTITY_LEGACY_UNSUPPORTED: ${resource} requires migration to the current schema before v${LEGACY_COMPATIBILITY_CUTOFF_VERSION} runtime ${runtimeVersion}`
+  ), { code: 'PLATFORM_IDENTITY_LEGACY_UNSUPPORTED' });
+}
+
+export { LEGACY_COMPATIBILITY_CUTOFF_VERSION, VERSION, isLegacyCompatibilityEnabled, isValidAgentInfraVersion, legacyCompatibilityError };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fitlab-ai/agent-infra",
-  "version": "0.9.12",
+  "version": "0.9.13",
   "description": "Bootstrap tool for AI multi-tool collaboration infrastructure — works with Claude Code, Codex, Antigravity CLI, and OpenCode",
   "license": "MIT",
   "type": "module",
@@ -17,6 +17,12 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
+  "exports": {
+    "./platform-provider": {
+      "types": "./dist/lib/platform/provider-contract.d.ts",
+      "import": "./dist/lib/platform/provider-contract.js"
+    }
+  },
   "bin": {
     "agent-infra": "./dist/bin/cli.js",
     "ai": "./dist/bin/cli.js",

package/templates/.agents/rules/README.en.md

@@ -30,7 +30,7 @@ so you can quickly find "which ones to read" without opening each file.
 - [`lifecycle-orchestration.md`](lifecycle-orchestration.md) — Fresh executor/reviewer, one-use receipt, pause/recovery, and safe endpoint rules for `run-task`.
 - [`review-handshake.md`](review-handshake.md) — Three-stage bidirectional review handshake: four-state disposition, symmetric evidence, disagreement ledger, convergence and post-review commit gate.
 - [`review-method.md`](review-method.md) — Shared three-stage review method: multi-pass review, risk lenses, traceability, and finding evidence.
-- [`local-artifact-repair.md`](local-artifact-repair.md) — Model-per-case repair, mechanical safety gates, dynamic convergence, and result-output contract for failed review artifacts.
+- [`local-artifact-repair.md`](local-artifact-repair.md) — Pre-completion local artifact validation for analysis/plan/code and model-per-case repair, safety gates, and convergence for failed review artifacts.
 - [`human-decision-context.md`](human-decision-context.md) — Self-contained context and canonical structure for new human-decision details.
 - [`task-short-id.md`](task-short-id.md) — Resolution, allocation and lifecycle of bare-number short ids.
 - [`milestone-inference.md`](milestone-inference.md) — Milestone inference for create-task / code-task / create-pr.

package/templates/.agents/rules/README.zh-CN.md

@@ -29,7 +29,7 @@
 - [`lifecycle-orchestration.md`](lifecycle-orchestration.md) — `run-task` 的 fresh executor/reviewer、一次性 receipt、暂停恢复与安全终点规则。
 - [`review-handshake.md`](review-handshake.md) — 三阶段双向审查握手协议：四态处置、对称证据、分歧账本、收敛与 post-review commit 门禁。
 - [`review-method.md`](review-method.md) — 三阶段共享检视方法：多遍检视、风险镜头、追踪与 finding 证据契约。
-- [`local-artifact-repair.md`](local-artifact-repair.md) — review artifact 失败后的模型逐例修复、机械安全门、动态收敛与结果输出契约。
+- [`local-artifact-repair.md`](local-artifact-repair.md) — analysis/plan/code completed 前的本地产物校验、review artifact 失败后的模型逐例修复、机械安全门与收敛契约。
 - [`human-decision-context.md`](human-decision-context.md) — 新建人工裁决详情的自足上下文与规范结构。
 - [`task-short-id.md`](task-short-id.md) — 裸数字任务短号的解析、分配与生命周期。
 - [`milestone-inference.md`](milestone-inference.md) — create-task / code-task / create-pr 的 milestone 推断。

package/templates/.agents/rules/issue-pr-commands.en.md

@@ -29,6 +29,6 @@ agent-infra-internal platform-pr sync {task-id} \
   --agent {standard-agent-token} --metadata --closing-issue
 ```
 
-Conflicting bindings do not change `task.md`. Metadata comes from the linked Issue, permission-bound items degrade independently, and an already-created PR is never rolled back.
+Conflicting bindings do not change `task.md`. The shared core computes one `in:` target from task-bound diff/PR files and the repository mapping. A unique closing Issue is converged before the PR; other metadata comes from the linked Issue. Zero or multiple closing Issues update only the PR and return `degraded`; `in:` labels are never copied back from the Issue or removed from unrelated resources. Permission-bound items degrade independently, partial side effects return `blocked` with `IN_LABEL_SYNC_PARTIAL`, and an already-created PR is never rolled back.
 
 Statuses `planned|applied|no-op|degraded` exit 0, `failed` exits 1, and `blocked` exits 2.

package/templates/.agents/rules/issue-pr-commands.zh-CN.md

@@ -39,7 +39,7 @@ agent-infra-internal platform-pr sync {task-id} \
   --agent {standard-agent-token} --metadata --closing-issue
 ```
 
-core 从关联 Issue 复制 type / `in:` labels、assignee、具体 milestone，并确保 closing association。权限不足返回逐项 `skipped` 和顶层 `degraded`；不得反向修改 Issue。
+core 根据 task-bound diff/PR files 与仓库映射计算唯一 `in:` target；唯一 closing Issue 按 Issue→PR 顺序收敛，其他 metadata 从关联 Issue 复制。零或多个 closing Issue 只更新 PR 并返回 `degraded`；不得从 Issue 反向复制 `in:`，也不清除非 `in:` labels。权限不足逐项返回 `skipped`，部分副作用返回 `blocked` 与 `IN_LABEL_SYNC_PARTIAL`。
 
 ## 状态语义