@fitlab-ai/agent-infra 0.9.12 → 0.9.14

package/dist/lib/task/events.js

@@ -1,7 +1,8 @@
 import fs from 'node:fs';
+import path from 'node:path';
 import { appendActivityEntry, locateActivityLog, pairEntries, startedBackedRows } from './activity-log.js';
 import { buildArtifactLinkSection, artifactName, inspectArtifactDirectory, parseReviewedInputReference, parseCodePlanInputReference, parseArtifactName, resolveArtifactContext, validateCompletedArtifact } from './artifact-lifecycle.js';
-import { ArtifactReceiptError, sha256File, upsertArtifactReceipt } from './artifact-receipts.js';
+import { ArtifactReceiptError, parseArtifactReceipts, sha256File, upsertArtifactReceipt } from './artifact-receipts.js';
 import { parseTypedTaskFrontmatter } from './frontmatter.js';
 import { consumeImplementationInput, IMPLEMENTATION_INPUT_ALIASES, parseImplementationInputs, renderImplementationInputs } from './implementation-inputs.js';
 import { LEDGER_SECTION_MISSING_CODE, LEDGER_SECTION_MISSING_MESSAGE, parseLedgerDocument, summarizeLedgerStage, validateLedgerRows } from './ledger.js';
@@ -13,6 +14,13 @@ import { commitOrchestrationStageCompletion } from './orchestration.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.js';
 import { captureTaskWriteMetadata, writeTask } from './write.js';
 import { allowsManualOverride } from './guard-override.js';
+import { consumeLocalArtifactFinalizationIntent, readLocalArtifactFinalizationIntent, validateLocalArtifact } from './local-artifact-finalization.js';
+import { buildLifecycleFacts, canStart } from './capabilities.js';
+import { createInvalidationOperation, invalidationMutation, parseInvalidationDocument, targetIdFor, upsertInvalidation } from './invalidation.js';
+import { consumeReworkIntents, parseReworkIntentDocument, reworkIntentMutation, supersedeReworkIntents } from './rework-intent.js';
+import { ARTIFACT_FAMILIES, expectedQualificationRelations, parseQualificationAudit, parseTaskQualification, upstreamArtifactDigest, validateQualificationAudit } from './qualification-audit.js';
+import { getArtifactSchema } from './artifact-schema.js';
+import { inspectArtifactContract } from './artifact-operations.js';
 const eventCatalog = [
     'analyze.started', 'analyze.awaiting-input', 'analyze.completed',
     'review-analysis.started', 'review-analysis.completed',
@@ -23,19 +31,19 @@ const eventCatalog = [
     'manual-validation.started', 'manual-validation.completed',
     'validation-run.started', 'validation-run.completed'
 ];
-const BASE_FIELDS = new Set(['taskRef', 'event', 'agent', 'dryRun', 'overrideTicket', 'overrideTarget', 'overrideScope']);
+const BASE_FIELDS = new Set(['taskRef', 'event', 'agent', 'dryRun', 'overrideTicket', 'overrideTarget', 'overrideScope', 'initiator', 'requestId', 'reasonCode', 'sourceFinding', 'sourceArtifact', 'sourceSha256']);
 const SCHEMAS = {
     'analyze.started': { optional: ['round'] },
     'analyze.awaiting-input': { required: ['question'] },
-    'analyze.completed': { required: ['artifact'], optional: ['round', 'orchestrated'] },
+    'analyze.completed': { required: ['artifact', 'artifactSha256', 'semanticDigest'], optional: ['round', 'orchestrated'] },
     'review-analysis.started': { optional: ['round'] },
     'review-analysis.completed': { required: ['artifact', 'verdict', 'blockers', 'major', 'minor', 'manualValidation'], optional: ['round', 'orchestrated'] },
     'plan.started': { optional: ['round'] },
-    'plan.completed': { required: ['artifact'], optional: ['round', 'orchestrated'] },
+    'plan.completed': { required: ['artifact', 'artifactSha256', 'semanticDigest'], optional: ['round', 'orchestrated'] },
     'review-plan.started': { optional: ['round'] },
     'review-plan.completed': { required: ['artifact', 'verdict', 'blockers', 'major', 'minor', 'manualValidation'], optional: ['round', 'orchestrated'] },
     'code.started': { optional: ['round', 'fixFor', 'implementationInput'] },
-    'code.completed': { required: ['artifact'], optional: ['round', 'fixFor', 'implementationInput', 'filesModified', 'testsPassed', 'blockers', 'major', 'minor', 'manualValidation', 'orchestrated'] },
+    'code.completed': { required: ['artifact', 'artifactSha256', 'semanticDigest'], optional: ['round', 'fixFor', 'implementationInput', 'filesModified', 'testsPassed', 'blockers', 'major', 'minor', 'manualValidation', 'orchestrated'] },
     'review-code.started': { optional: ['round'] },
     'review-code.completed': { required: ['artifact', 'verdict', 'blockers', 'major', 'minor', 'manualValidation'], optional: ['round', 'orchestrated'] },
     'manual-validation.started': { optional: ['round'] },
@@ -65,6 +73,18 @@ function validateTaskEventRequest(request) {
     }
     if (request.verdict && !['approved', 'changes-requested', 'rejected'].includes(request.verdict))
         return { code: 'EVENT_PAYLOAD_INVALID', message: 'verdict is invalid' };
+    if (request.initiator && !['human', 'model', 'orchestrator'].includes(request.initiator))
+        return { code: 'EVENT_PAYLOAD_INVALID', message: 'initiator is invalid' };
+    if (request.requestId !== undefined && (!request.requestId.trim() || /[\r\n]/.test(request.requestId)))
+        return { code: 'EVENT_PAYLOAD_INVALID', message: 'requestId must be a non-empty single line' };
+    if (request.reasonCode && !['user-request', 'new-requirement', 'upstream-fact-doubt', 'review-finding', 'retry', 'validation-rerun'].includes(request.reasonCode))
+        return { code: 'EVENT_PAYLOAD_INVALID', message: 'reasonCode is invalid' };
+    for (const [name, value] of [['sourceFinding', request.sourceFinding], ['sourceArtifact', request.sourceArtifact], ['sourceSha256', request.sourceSha256]]) {
+        if (value !== undefined && (!value.trim() || /[\r\n]/.test(value)))
+            return { code: 'EVENT_PAYLOAD_INVALID', message: `${name} must be a non-empty single line` };
+    }
+    if (request.sourceSha256 !== undefined && !/^[a-f0-9]{64}$/.test(request.sourceSha256))
+        return { code: 'EVENT_PAYLOAD_INVALID', message: 'sourceSha256 must be a sha256 digest' };
     if (request.event === 'code.completed') {
         const fix = request.fixFor !== undefined || ['blockers', 'major', 'minor', 'manualValidation'].some((key) => request[key] !== undefined);
         const modeRequired = fix ? ['fixFor', 'blockers', 'major', 'minor', 'manualValidation'] : ['filesModified', 'testsPassed'];
@@ -76,21 +96,30 @@ function validateTaskEventRequest(request) {
         return { code: 'EVENT_PAYLOAD_INVALID', message: 'fixFor must reference a canonical review-code artifact' };
     if (request.implementationInput && !/^II-[1-9]\d*$/.test(request.implementationInput))
         return { code: 'EVENT_PAYLOAD_INVALID', message: 'implementationInput must be a canonical II-N id' };
+    if (request.artifactSha256 !== undefined && !/^[0-9a-f]{64}$/i.test(request.artifactSha256))
+        return { code: 'EVENT_PAYLOAD_INVALID', message: 'artifactSha256 must be a 64-character hexadecimal digest' };
+    if (request.semanticDigest !== undefined && !/^[0-9a-f]{64}$/i.test(request.semanticDigest))
+        return { code: 'EVENT_PAYLOAD_INVALID', message: 'semanticDigest must be a 64-character hexadecimal digest' };
     if (request.fixFor && request.implementationInput)
         return { code: 'EVENT_PAYLOAD_INVALID', message: 'fixFor and implementationInput are mutually exclusive' };
     if (request.summaryResult !== undefined && (!request.summaryResult.trim() || /[\r\n]/.test(request.summaryResult)))
         return { code: 'EVENT_PAYLOAD_INVALID', message: 'summaryResult must be a non-empty single line' };
+    if (request.event !== 'analyze.awaiting-input' && /\.(?:started|completed)$/.test(request.event)) {
+        if (!request.initiator || !request.requestId || !request.reasonCode) {
+            return { code: 'EVENT_TRIGGER_REQUIRED', message: `${request.event} requires --initiator, --request-id, and --reason-code` };
+        }
+    }
     return null;
 }
 const FAMILY = {
-    analyze: { artifact: 'analysis', started: ['requirement-analysis', 'requirement-analysis-review', 'code'], completed: ['requirement-analysis', 'requirement-analysis-review', 'code'], target: 'requirement-analysis', label: 'Analyze Task' },
-    'review-analysis': { artifact: 'review-analysis', started: ['requirement-analysis', 'requirement-analysis-review'], completed: ['requirement-analysis', 'requirement-analysis-review'], target: 'requirement-analysis-review', label: 'Review Analysis' },
-    plan: { artifact: 'plan', started: ['requirement-analysis-review', 'technical-design-review', 'commit'], completed: ['requirement-analysis-review', 'technical-design-review', 'commit'], target: 'technical-design', label: 'Plan Task' },
-    'review-plan': { artifact: 'review-plan', started: ['technical-design', 'technical-design-review'], completed: ['technical-design', 'technical-design-review'], target: 'technical-design-review', label: 'Review Plan' },
-    code: { artifact: 'code', started: ['technical-design-review', 'code-review'], completed: ['technical-design-review', 'code-review'], target: 'code', label: 'Code Task' },
-    'review-code': { artifact: 'review-code', started: ['code', 'code-review', 'commit'], completed: ['code', 'code-review', 'commit'], target: 'code-review', label: 'Review Code' },
-    'manual-validation': { artifact: 'manual-validation', started: ['code-review', 'commit'], completed: ['code-review', 'commit'], target: null, label: 'Complete Manual Validation' },
-    'validation-run': { artifact: 'validation-run', started: ['code-review', 'commit'], completed: ['code-review', 'commit'], target: null, label: 'Run Manual Validation' }
+    analyze: { artifact: 'analysis', target: 'requirement-analysis', label: 'Analyze Task' },
+    'review-analysis': { artifact: 'review-analysis', target: 'requirement-analysis-review', label: 'Review Analysis' },
+    plan: { artifact: 'plan', target: 'technical-design', label: 'Plan Task' },
+    'review-plan': { artifact: 'review-plan', target: 'technical-design-review', label: 'Review Plan' },
+    code: { artifact: 'code', target: 'code', label: 'Code Task' },
+    'review-code': { artifact: 'review-code', target: 'code-review', label: 'Review Code' },
+    'manual-validation': { artifact: 'manual-validation', target: null, label: 'Complete Manual Validation' },
+    'validation-run': { artifact: 'validation-run', target: null, label: 'Run Manual Validation' }
 };
 const REVIEW_LEDGER_STAGES = {
     'review-analysis': 'analysis',
@@ -248,6 +277,231 @@ function openStartedIdentity(rows, family) {
 function reviewInputFamily(family) {
     return family === 'review-analysis' ? 'analysis' : family === 'review-plan' ? 'plan' : 'code';
 }
+function relationForStartedInput(family, input) {
+    if (family.startsWith('review-')) {
+        return input.family === reviewInputFamily(family) ? 'reviewed-input' : 'approval-context';
+    }
+    const consumer = family === 'analyze' ? 'analysis' : family;
+    if ((consumer === 'plan' && input.family === 'analysis') || (consumer === 'code' && input.family === 'plan'))
+        return 'required-input';
+    return 'review-context';
+}
+function qualificationRelationsForStarted(family, inputs) {
+    return inputs.map((input) => ({
+        upstreamFamily: input.family,
+        upstreamArtifact: input.name,
+        upstreamRound: input.round,
+        upstreamSha256: sha256File(input.path),
+        relation: relationForStartedInput(family, input)
+    }));
+}
+function lifecycleAction(family) {
+    return family === 'analyze' ? 'analysis' : family;
+}
+function eventTrigger(request, family) {
+    return {
+        initiator: request.initiator ?? (request.orchestrated ? 'orchestrator' : request.agent === 'human' ? 'human' : 'model'),
+        requestId: request.requestId ?? `${request.taskRef}:${request.event}:${request.round ?? 1}`,
+        requestedAction: lifecycleAction(family),
+        reasonCode: request.reasonCode ?? (request.fixFor || request.implementationInput ? 'review-finding' : 'user-request'),
+        ...(request.sourceFinding ? { sourceFinding: request.sourceFinding } : {}),
+        ...(request.sourceArtifact ? { sourceArtifact: request.sourceArtifact } : {}),
+        ...(request.sourceSha256 ? { sourceSha256: request.sourceSha256 } : {}),
+        ...(request.implementationInput ? { implementationInput: request.implementationInput } : {}),
+        explicitRequest: request.requestId !== undefined || request.reasonCode !== undefined || request.initiator !== undefined || request.orchestrated === true
+    };
+}
+function invalidationMutationForCompletion(content, taskDir, family, artifact, timestamp) {
+    if (!['analyze', 'plan', 'code'].includes(family))
+        return { mutation: null };
+    const parsed = parseInvalidationDocument(content);
+    if (!parsed.ok)
+        return { error: parsed.message };
+    const downstream = {
+        analyze: ['review-analysis', 'plan', 'review-plan', 'code', 'review-code'],
+        plan: ['review-plan', 'code', 'review-code'],
+        code: ['review-code']
+    };
+    const sourceFamily = family;
+    const sourceArtifactFamily = sourceFamily === 'analyze' ? 'analysis' : sourceFamily;
+    let receipts = [];
+    try {
+        receipts = parseArtifactReceipts(content).rows;
+    }
+    catch (error) {
+        return { error: error instanceof Error ? error.message : String(error) };
+    }
+    const inventory = fs.readdirSync(taskDir).flatMap((name) => {
+        const identity = parseArtifactName(name);
+        if (!identity || !ARTIFACT_FAMILIES.includes(identity.family))
+            return [];
+        try {
+            const stat = fs.lstatSync(path.join(taskDir, name));
+            if (!stat.isFile() || stat.isSymbolicLink())
+                return [];
+            return [{ family: identity.family, name, round: identity.round, sha256: sha256File(path.join(taskDir, name)) }];
+        }
+        catch (error) {
+            throw new Error(`cannot inspect invalidation artifact '${name}': ${error instanceof Error ? error.message : String(error)}`);
+        }
+    });
+    const taskQualification = parseTaskQualification(content);
+    if (!taskQualification.ok)
+        return { error: taskQualification.message };
+    const nodeMap = new Map(inventory.map((node) => [`${node.family}/${node.name}`, node]));
+    const audits = new Map();
+    let taskInputChanged = false;
+    let graphUsable = taskQualification.qualification.present;
+    if (graphUsable) {
+        for (const node of inventory) {
+            const artifactContent = fs.readFileSync(path.join(taskDir, node.name), 'utf8');
+            const parsedAudit = parseQualificationAudit(artifactContent);
+            if (!parsedAudit.ok || !parsedAudit.audit.present || !parsedAudit.audit.snapshot) {
+                graphUsable = false;
+                break;
+            }
+            audits.set(`${node.family}/${node.name}`, parsedAudit.audit);
+            if (parsedAudit.audit.snapshot.taskInputDigest !== taskQualification.qualification.taskInputDigest)
+                taskInputChanged = true;
+            if (parsedAudit.audit.snapshot.nonConstraintInputDigest !== taskQualification.qualification.nonConstraintInputDigest) {
+                graphUsable = false;
+                break;
+            }
+            if (parsedAudit.audit.snapshot.upstreamArtifactDigest !== upstreamArtifactDigest(parsedAudit.audit.upstreamRelations)) {
+                graphUsable = false;
+                break;
+            }
+            for (const relation of parsedAudit.audit.upstreamRelations) {
+                const upstream = nodeMap.get(`${relation.upstreamFamily}/${relation.upstreamArtifact}`);
+                if (!upstream || upstream.round !== relation.upstreamRound || upstream.sha256 !== relation.upstreamSha256) {
+                    graphUsable = false;
+                    break;
+                }
+            }
+            if (!graphUsable)
+                break;
+        }
+    }
+    const selected = new Set();
+    if (graphUsable) {
+        const changedConstraints = new Set();
+        for (const audit of audits.values()) {
+            for (const dependency of audit.constraintDependencies) {
+                const current = taskQualification.qualification.constraints.find((row) => row.constraintId === dependency.constraintId);
+                if (!current || current.digest !== dependency.constraintDigest)
+                    changedConstraints.add(dependency.constraintId);
+            }
+        }
+        const currentCandidates = new Map(taskQualification.qualification.candidates.map((candidate) => [candidate.candidateId, candidate]));
+        const candidateSnapshotMatches = [...audits.values()].every((audit) => audit.candidateQualifications.length === currentCandidates.size && audit.candidateQualifications.every((row) => {
+            const current = currentCandidates.get(row.candidateId);
+            return Boolean(current && current.status === row.status && current.impact === row.impact
+                && current.evidence === row.evidence && current.constraintIds.join(',') === row.constraintIds.join(','));
+        }));
+        // A task-input digest also covers candidates. A narrowed invalidation graph
+        // is safe only when the old audit rows show that the candidate projection
+        // stayed unchanged and the change is explained by at least one constraint.
+        if (taskInputChanged && (changedConstraints.size === 0 || !candidateSnapshotMatches))
+            graphUsable = false;
+        for (const node of inventory) {
+            const audit = audits.get(`${node.family}/${node.name}`);
+            if (audit.constraintDependencies.some((dependency) => changedConstraints.has(dependency.constraintId)))
+                selected.add(`${node.family}/${node.name}`);
+            if (audit.upstreamRelations.some((relation) => relation.upstreamFamily === sourceArtifactFamily))
+                selected.add(`${node.family}/${node.name}`);
+        }
+        // Relation rows point from a consumer to its actual upstream artifact. Walk
+        // that reverse edge so review-only seeds and multi-hop consumers receive the
+        // same derived targets as ordinary executor seeds.
+        let changed = true;
+        while (changed) {
+            changed = false;
+            for (const node of inventory) {
+                const key = `${node.family}/${node.name}`;
+                const audit = audits.get(key);
+                if (audit.upstreamRelations.some((relation) => selected.has(`${relation.upstreamFamily}/${relation.upstreamArtifact}`)) && !selected.has(key)) {
+                    selected.add(key);
+                    changed = true;
+                }
+            }
+        }
+        // A relation cycle cannot establish a safe downstream closure.
+        const visiting = new Set();
+        const visited = new Set();
+        const hasCycle = (key) => {
+            if (visiting.has(key))
+                return true;
+            if (visited.has(key))
+                return false;
+            visiting.add(key);
+            const cycle = audits.get(key)?.upstreamRelations.some((relation) => hasCycle(`${relation.upstreamFamily}/${relation.upstreamArtifact}`)) ?? false;
+            visiting.delete(key);
+            visited.add(key);
+            return cycle;
+        };
+        if ([...nodeMap.keys()].some(hasCycle))
+            graphUsable = false;
+    }
+    const reasonCode = graphUsable ? 'qualification-changed' : 'upstream-replaced';
+    const targetNodes = (graphUsable
+        ? inventory.filter((node) => selected.has(`${node.family}/${node.name}`))
+        : inventory.filter((node) => downstream[sourceFamily].includes(node.family)))
+        .filter((node) => !(node.family === FAMILY[family].artifact && node.name === artifact.name));
+    const targets = targetNodes.flatMap((node) => {
+        const shapes = [
+            { targetKind: 'artifact', targetFamily: node.family, targetArtifact: node.name, targetRound: node.round, targetSha256: node.sha256 }
+        ];
+        const receipt = receipts.find((candidate) => candidate.output === node.name);
+        if (receipt)
+            shapes.push({ targetKind: 'receipt', targetFamily: node.family, targetArtifact: node.name, targetRound: node.round, targetSha256: receipt.inputSha256 });
+        if (node.family.startsWith('review-'))
+            shapes.push({ targetKind: 'approval', targetFamily: node.family, targetArtifact: node.name, targetRound: node.round, targetSha256: node.sha256 });
+        if (node.family === 'review-code')
+            shapes.push({ targetKind: 'reviewed-snapshot', targetFamily: node.family, targetArtifact: node.name, targetRound: node.round, targetSha256: node.sha256 });
+        return shapes.map((targetShape) => ({ ...targetShape, targetId: targetIdFor('pending', targetShape), operationId: 'pending', status: 'pending', reasonCode, updatedAt: timestamp }));
+    });
+    if (targets.length === 0)
+        return { mutation: null };
+    const source = {
+        sourceFamily: lifecycleAction(family), sourceArtifact: artifact.name,
+        sourceRound: parseArtifactName(artifact.name)?.round ?? 1, sourceSha256: sha256File(artifact.path),
+        createdAt: timestamp, updatedAt: timestamp
+    };
+    const operation = createInvalidationOperation(source);
+    const normalizedTargets = targets.map((target) => ({
+        ...target, operationId: operation.operationId,
+        targetId: targetIdFor(operation.operationId, target)
+    }));
+    const operationWithTotal = createInvalidationOperation(source, normalizedTargets);
+    const next = upsertInvalidation(parsed.document, operationWithTotal, normalizedTargets);
+    if (!next.ok)
+        return { error: next.message };
+    return { mutation: next.changed ? invalidationMutation(content, next.document) : null };
+}
+function reworkIntentMutationForCompletion(content, taskDir, family, artifact, timestamp) {
+    const parsed = parseReworkIntentDocument(content);
+    if (!parsed.ok)
+        return { error: parsed.message };
+    const hash = sha256File(artifact.path);
+    let next = parsed.intents;
+    if (family === 'analyze' || family === 'plan' || family === 'code') {
+        const hashes = Object.fromEntries(fs.readdirSync(taskDir).flatMap((name) => {
+            if (!/^review-(?:analysis|plan|code)(?:-r\d+)?\.md$/.test(name))
+                return [];
+            try {
+                return [[name, sha256File(path.join(taskDir, name))]];
+            }
+            catch {
+                return [];
+            }
+        }));
+        next = consumeReworkIntents(next, family === 'analyze' ? 'analysis' : family, hashes, timestamp).intents;
+    }
+    if (family === 'review-analysis' || family === 'review-plan' || family === 'review-code') {
+        next = supersedeReworkIntents(next, artifact.name, hash, timestamp).intents;
+    }
+    return { mutation: JSON.stringify(next) === JSON.stringify(parsed.intents) ? null : reworkIntentMutation(content, next) };
+}
 function buildCompletionReceipt(taskDir, family, artifact, completedAt, frontmatter) {
     if (family === 'code') {
         let content;
@@ -399,6 +653,7 @@ function applyTaskEventUnlocked(request, options = {}) {
     const completedRows = matchingRows.filter((item) => item.done);
     const row = manual ? openRows.at(-1) : matchingRows[0];
     let completedArtifact = null;
+    let localFinalizationIntent = null;
     if (eventIdentity.phase === 'started' && row) {
         if (row.agent !== normalized.agent)
             return failed(normalized, { code: 'EVENT_LOG_CONFLICT', message: 'open started event has a different agent' }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath });
@@ -418,14 +673,108 @@ function applyTaskEventUnlocked(request, options = {}) {
         if (!validated.ok)
             return failed(normalized, validated.error, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
         completedArtifact = validated.artifact;
+        if (eventIdentity.family.startsWith('review-')) {
+            let reviewContent;
+            try {
+                reviewContent = fs.readFileSync(completedArtifact.path, 'utf8');
+            }
+            catch (error) {
+                return failed(normalized, { code: 'EVENT_ARTIFACT_CONFLICT', message: `cannot read qualification audit from ${completedArtifact.name}: ${error instanceof Error ? error.message : String(error)}` }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+            }
+            const schema = getArtifactSchema(eventIdentity.family);
+            const structure = schema ? inspectArtifactContract(reviewContent, schema) : null;
+            if (structure && !structure.ok) {
+                return failed(normalized, { code: 'EVENT_ARTIFACT_CONFLICT', message: `shared artifact structure invalid: ${structure.diagnostics.map((item) => `${item.code}: ${item.message}`).join('; ')}` }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+            }
+            const expected = expectedQualificationRelations(content, eventIdentity.family);
+            if (!expected.ok) {
+                return failed(normalized, { code: 'EVENT_ARTIFACT_CONFLICT', message: `${expected.code}: ${expected.message}` }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+            }
+            const qualification = validateQualificationAudit(content, reviewContent, {
+                family: eventIdentity.family,
+                artifact: completedArtifact.name,
+                expectedUpstreamRelations: expected.relations
+            });
+            if (!qualification.ok) {
+                return failed(normalized, { code: 'EVENT_ARTIFACT_CONFLICT', message: `${qualification.code}: ${qualification.message}` }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+            }
+        }
+        if (eventIdentity.family === 'analyze' || eventIdentity.family === 'plan' || eventIdentity.family === 'code') {
+            const localFamily = eventIdentity.family === 'analyze'
+                ? 'analysis'
+                : eventIdentity.family === 'plan' ? 'plan' : 'code';
+            let artifactContent;
+            try {
+                artifactContent = fs.readFileSync(completedArtifact.path, 'utf8');
+            }
+            catch (error) {
+                return failed(normalized, { code: 'EVENT_ARTIFACT_CONFLICT', message: `cannot read ${completedArtifact.name}: ${String(error)}` }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+            }
+            const local = validateLocalArtifact(artifactContent, {
+                family: localFamily,
+                taskContent: content,
+                artifact: completedArtifact.name
+            });
+            if (!local.ok) {
+                return failed(normalized, {
+                    code: 'EVENT_ARTIFACT_CONFLICT',
+                    message: `LOCAL_ARTIFACT_INVALID: ${local.diagnostics.map((item) => `${item.code}: ${item.message}`).join('; ')}`
+                }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+            }
+            const actualSha256 = sha256File(completedArtifact.path);
+            if (actualSha256 !== normalized.artifactSha256) {
+                return failed(normalized, {
+                    code: 'EVENT_ARTIFACT_CONFLICT',
+                    message: `artifact SHA-256 does not match finalizer result for ${completedArtifact.name}`
+                }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+            }
+            if (local.semanticDigest !== normalized.semanticDigest) {
+                return failed(normalized, {
+                    code: 'EVENT_ARTIFACT_CONFLICT',
+                    message: `semantic digest does not match finalizer result for ${completedArtifact.name}`
+                }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+            }
+            try {
+                localFinalizationIntent = readLocalArtifactFinalizationIntent(resolved.repoRoot, resolved.taskId, localFamily, completedArtifact.name);
+            }
+            catch (error) {
+                return failed(normalized, {
+                    code: 'EVENT_ARTIFACT_CONFLICT',
+                    message: `cannot read local finalizer provenance for ${completedArtifact.name}: ${error instanceof Error ? error.message : String(error)}`
+                }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+            }
+            if (!localFinalizationIntent || !['passed', 'consumed'].includes(localFinalizationIntent.state)) {
+                return failed(normalized, {
+                    code: 'EVENT_ARTIFACT_CONFLICT',
+                    message: `local finalizer provenance is missing or incomplete for ${completedArtifact.name}`
+                }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+            }
+            if (localFinalizationIntent.artifactSha256 !== actualSha256 || localFinalizationIntent.semanticDigest !== local.semanticDigest) {
+                return failed(normalized, {
+                    code: 'EVENT_ARTIFACT_CONFLICT',
+                    message: `local finalizer provenance does not match ${completedArtifact.name}`
+                }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+            }
+        }
     }
     if (eventIdentity.phase === 'waiting' && section.entries.some((entry) => entry.step === eventIdentity.action && entry.note === eventIdentity.note)) {
         const existing = section.entries.find((entry) => entry.step === eventIdentity.action && entry.note === eventIdentity.note);
         return successNoOp(normalized, resolved.taskId, resolved.taskMdPath, currentStep, eventIdentity, existing.time, frontmatter, artifactContext);
     }
-    const allowed = FAMILY[eventIdentity.family][eventIdentity.phase === 'started' ? 'started' : 'completed'];
-    if (!allowed.includes(currentStep) && !allowsManualOverride(options.manualOverride, 'task-event', 'EVENT_TRANSITION_INVALID'))
-        return failed(normalized, { code: 'EVENT_TRANSITION_INVALID', message: `${normalized.event} is not allowed from '${currentStep}'` }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+    if (eventIdentity.phase === 'started') {
+        const trigger = eventTrigger(normalized, eventIdentity.family);
+        const facts = buildLifecycleFacts(resolved.taskDir, content, resolved.state);
+        if (!facts.ok)
+            return failed(normalized, { code: 'EVENT_TRANSITION_INVALID', message: `${facts.code}: ${facts.message}` }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+        const capability = canStart(lifecycleAction(eventIdentity.family), facts.facts, trigger);
+        const capabilityOverride = capability.reasonCode === 'TASK_NOT_ACTIVE'
+            ? stateOverride
+            : allowsManualOverride(options.manualOverride, 'task-event', 'EVENT_TRANSITION_INVALID');
+        if (!capability.allowed && !capabilityOverride) {
+            const code = capability.reasonCode === 'INVALIDATION_INCOMPLETE' ? 'TASK_INVALIDATION_BLOCKED' : 'EVENT_TRANSITION_INVALID';
+            return failed(normalized, { code, message: `${capability.reasonCode}: ${capability.evidence.join(', ')}` }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+        }
+    }
     const findingCountError = validateReviewFindingCounts(normalized, content, eventIdentity.family, completedArtifact?.path ?? null);
     if (findingCountError)
         return failed(normalized, findingCountError, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
@@ -459,18 +808,41 @@ function applyTaskEventUnlocked(request, options = {}) {
         return failed(normalized, { code: 'METADATA_CAPTURE_FAILED', message: String(error) }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath });
     }
     let completionReceipt = null;
+    let completionInvalidation = null;
+    let completionRework = null;
     if (eventIdentity.phase === 'completed' && completedArtifact) {
         const receipt = buildCompletionReceipt(resolved.taskDir, eventIdentity.family, completedArtifact, metadata.timestamp, frontmatter);
         if (receipt && !receipt.ok) {
             return failed(normalized, { code: 'EVENT_ARTIFACT_CONFLICT', message: receipt.message }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
         }
         completionReceipt = receipt?.receipt ?? null;
+        try {
+            const invalidation = invalidationMutationForCompletion(content, resolved.taskDir, eventIdentity.family, completedArtifact, metadata.timestamp);
+            if ('error' in invalidation)
+                return failed(normalized, { code: 'EVENT_ARTIFACT_CONFLICT', message: invalidation.error }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+            completionInvalidation = invalidation.mutation;
+            const rework = reworkIntentMutationForCompletion(content, resolved.taskDir, eventIdentity.family, completedArtifact, metadata.timestamp);
+            if ('error' in rework)
+                return failed(normalized, { code: 'EVENT_ARTIFACT_CONFLICT', message: rework.error }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+            completionRework = rework.mutation;
+        }
+        catch (error) {
+            return failed(normalized, { code: 'EVENT_ARTIFACT_CONFLICT', message: error instanceof Error ? error.message : String(error) }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+        }
     }
     const step = eventIdentity.phase === 'started' || eventIdentity.target === null ? currentStep : eventIdentity.target;
     const logStep = eventIdentity.phase === 'started' ? `${eventIdentity.action} [started]` : eventIdentity.action;
     const body = appendActivityEntry(section, { time: metadata.timestamp, step: logStep, agent: normalized.agent, note: eventIdentity.note });
     const frontmatterSet = { current_step: step, assigned_to: normalized.agent };
     let frontmatterRemove;
+    if (eventIdentity.phase === 'started' && artifactContext) {
+        try {
+            frontmatterSet.qualification_input_relations = JSON.stringify(qualificationRelationsForStarted(eventIdentity.family, artifactContext.inputs));
+        }
+        catch (error) {
+            return failed(normalized, { code: 'EVENT_ARTIFACT_CONFLICT', message: `cannot capture qualification input relations: ${error instanceof Error ? error.message : String(error)}` }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: step, action: eventIdentity.action, phase: eventIdentity.phase, artifactContext });
+        }
+    }
     if (eventIdentity.phase === 'started' && eventIdentity.family === 'code') {
         const planInput = artifactContext?.inputs.find((input) => input.family === 'plan');
         if (!planInput)
@@ -502,6 +874,8 @@ function applyTaskEventUnlocked(request, options = {}) {
     else if (eventIdentity.phase === 'completed' && eventIdentity.family.startsWith('review-')) {
         frontmatterRemove = ['review_input_artifact', 'review_input_sha256'];
     }
+    if (eventIdentity.phase === 'completed')
+        frontmatterRemove = [...(frontmatterRemove ?? []), 'qualification_input_relations'];
     if (eventIdentity.phase === 'started' && normalized.implementationInput)
         frontmatterSet.last_reviewed_commit = '';
     const mutations = [
@@ -521,6 +895,10 @@ function applyTaskEventUnlocked(request, options = {}) {
             return failed(normalized, { code: 'EVENT_ARTIFACT_CONFLICT', message }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
         }
     }
+    if (completionInvalidation)
+        mutations.push(completionInvalidation);
+    if (completionRework)
+        mutations.push(completionRework);
     if (eventIdentity.phase === 'completed' && normalized.implementationInput) {
         let implementationRows;
         try {
@@ -536,7 +914,28 @@ function applyTaskEventUnlocked(request, options = {}) {
         });
     }
     mutations.push({ kind: 'section', aliases: ['活动日志', 'Activity Log'], heading: section.heading, body });
-    const result = writeTask({ taskRef: normalized.taskRef, expectedState: stateOverride ? resolved.state : 'active', dryRun: normalized.dryRun, mutations }, { ...options, metadataProvider: () => metadata });
+    if (!normalized.dryRun && localFinalizationIntent && completedArtifact && localFinalizationIntent.state === 'passed') {
+        try {
+            localFinalizationIntent = consumeLocalArtifactFinalizationIntent(resolved.repoRoot, localFinalizationIntent);
+        }
+        catch (error) {
+            return failed(normalized, {
+                code: 'EVENT_ARTIFACT_CONFLICT',
+                message: `local finalizer provenance could not be consumed before task write for ${completedArtifact.name}: ${error instanceof Error ? error.message : String(error)}`
+            }, {
+                taskId: resolved.taskId,
+                taskMdPath: resolved.taskMdPath,
+                fromStep: currentStep,
+                toStep: step,
+                action: eventIdentity.action,
+                phase: eventIdentity.phase,
+                artifactContext
+            });
+        }
+    }
+    const sourceCompletion = eventIdentity.phase === 'completed'
+        && ['analyze', 'plan', 'code'].includes(eventIdentity.family);
+    const result = writeTask({ taskRef: normalized.taskRef, expectedState: stateOverride ? resolved.state : 'active', dryRun: normalized.dryRun, mutations }, { ...options, invalidationContext: sourceCompletion ? 'source-completion' : 'standard', metadataProvider: () => metadata });
     if (result.status === 'failed')
         return failed(normalized, result.error, { taskId: result.taskId, taskMdPath: result.taskMdPath, fromStep: currentStep, toStep: step, action: eventIdentity.action, phase: eventIdentity.phase, timestamp: result.timestamp, agentInfraVersion: result.agentInfraVersion, operations: result.operations, artifactContext });
     if (!normalized.dryRun && orchestrationCompletion) {