@fitlab-ai/agent-infra 0.9.12 → 0.9.14

package/lib/task/rework-intent.ts

@@ -0,0 +1,165 @@
+const REWORK_INTENT_HEADINGS = ['返工意图', 'Rework Intent'] as const;
+const REWORK_INTENT_COLUMNS = [
+  'intent_id', 'finding_id', 'source_artifact', 'source_sha256', 'target',
+  'status', 'declared_at', 'consumed_at'
+] as const;
+type ReworkTarget = 'analysis' | 'plan' | 'code';
+type ReworkIntentStatus = 'pending' | 'consumed' | 'superseded';
+type ReworkIntent = {
+  intentId: string;
+  findingId: string;
+  sourceArtifact: string;
+  sourceSha256: string;
+  target: ReworkTarget;
+  status: ReworkIntentStatus;
+  declaredAt: string;
+  consumedAt: string;
+};
+type ReworkIntentParseResult =
+  | { ok: true; present: boolean; intents: readonly ReworkIntent[] }
+  | { ok: false; code: 'TASK_REWORK_INTENT_INVALID'; message: string };
+
+function cells(line: string): string[] | null {
+  const first = line.indexOf('|');
+  const last = line.lastIndexOf('|');
+  if (first < 0 || first === last || line.slice(0, first).trim() || line.slice(last + 1).trim()) return null;
+  const inner = line.slice(first + 1, last);
+  const result: string[] = [];
+  let start = 0;
+  let escaped = false;
+  for (let index = 0; index < inner.length; index += 1) {
+    const char = inner[index]!;
+    if (char === '|' && !escaped) {
+      result.push(inner.slice(start, index));
+      start = index + 1;
+    }
+    escaped = char === '\\' && !escaped;
+    if (char !== '\\') escaped = false;
+  }
+  result.push(inner.slice(start));
+  return result.map((cell) => cell.replace(/\\([\\|])/g, '$1').trim());
+}
+
+function sectionBody(content: string): string | null {
+  const heading = REWORK_INTENT_HEADINGS.map((value) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|');
+  const match = new RegExp(`^##\\s+(${heading})\\s*$`, 'm').exec(content);
+  if (!match) return null;
+  const start = (match.index ?? 0) + match[0].length;
+  const rest = content.slice(start);
+  const end = rest.search(/^##\s+/m);
+  return rest.slice(0, end < 0 ? rest.length : end);
+}
+
+function parseReworkIntentDocument(content: string): ReworkIntentParseResult {
+  const body = sectionBody(content);
+  if (body === null) return { ok: true, present: false, intents: [] };
+  const lines = body.split(/\r?\n/).filter((line) => line.trim());
+  const header = lines[0] ? cells(lines[0]) : null;
+  const separator = lines[1] ? cells(lines[1]) : null;
+  if (!header || !separator || header.length !== REWORK_INTENT_COLUMNS.length || !header.every((value, index) => value === REWORK_INTENT_COLUMNS[index]) || !separator.every((value) => /^:?-{3,}:?$/.test(value))) {
+    return { ok: false, code: 'TASK_REWORK_INTENT_INVALID', message: 'rework intent section must contain its canonical table' };
+  }
+  try {
+    const intents = lines.slice(2).map((line) => {
+      const values = cells(line);
+      if (!values || values.length !== REWORK_INTENT_COLUMNS.length) throw new Error('rework intent row has the wrong column count');
+      const row = Object.fromEntries(REWORK_INTENT_COLUMNS.map((column, index) => [column, values[index]!])) as Record<string, string>;
+      if (!/^RI-[1-9]\d*$/.test(row.intent_id!)) throw new Error(`invalid intent id '${row.intent_id}'`);
+      if (!/^(AN|PL|CD)-[1-9]\d*$/.test(row.finding_id!)) throw new Error(`invalid finding id '${row.finding_id}'`);
+      if (!['analysis', 'plan', 'code'].includes(row.target!)) throw new Error(`invalid rework target '${row.target}'`);
+      if (!['pending', 'consumed', 'superseded'].includes(row.status!)) throw new Error(`invalid rework status '${row.status}'`);
+      if (!/^[a-f0-9]{64}$/.test(row.source_sha256!)) throw new Error(`invalid source hash for '${row.intent_id}'`);
+      if (!row.source_artifact || !row.declared_at) throw new Error(`rework intent '${row.intent_id}' has invalid required fields`);
+      const terminal = row.status === 'consumed' || row.status === 'superseded';
+      if (terminal !== Boolean(row.consumed_at)) throw new Error(`rework intent '${row.intent_id}' has invalid consumed_at`);
+      return {
+        intentId: row.intent_id!, findingId: row.finding_id!, sourceArtifact: row.source_artifact!,
+        sourceSha256: row.source_sha256!, target: row.target as ReworkTarget,
+        status: row.status as ReworkIntentStatus, declaredAt: row.declared_at!, consumedAt: row.consumed_at!
+      } satisfies ReworkIntent;
+    });
+    const ids = new Set<string>();
+    for (const intent of intents) {
+      if (ids.has(intent.intentId)) throw new Error(`duplicate intent '${intent.intentId}'`);
+      ids.add(intent.intentId);
+    }
+    return { ok: true, present: true, intents };
+  } catch (error) {
+    return { ok: false, code: 'TASK_REWORK_INTENT_INVALID', message: error instanceof Error ? error.message : String(error) };
+  }
+}
+
+function renderReworkIntents(intents: readonly ReworkIntent[]): string {
+  const escape = (value: string) => value.replace(/\\/g, '\\\\').replace(/\|/g, '\\|').replace(/[\r\n]/g, ' ');
+  return [
+    `| ${REWORK_INTENT_COLUMNS.join(' | ')} |`,
+    `| ${REWORK_INTENT_COLUMNS.map(() => '---').join(' | ')} |`,
+    ...intents.map((intent) => `| ${[
+      intent.intentId, intent.findingId, intent.sourceArtifact, intent.sourceSha256,
+      intent.target, intent.status, intent.declaredAt, intent.consumedAt
+    ].map(escape).join(' | ')} |`)
+  ].join('\n');
+}
+
+function upsertReworkIntent(intents: readonly ReworkIntent[], intent: ReworkIntent): { changed: boolean; intents: readonly ReworkIntent[] } {
+  const existing = intents.find((candidate) => candidate.intentId === intent.intentId);
+  if (!existing) return { changed: true, intents: [...intents, intent] };
+  const identity = (value: ReworkIntent) => [value.intentId, value.findingId, value.sourceArtifact, value.sourceSha256, value.target];
+  if (JSON.stringify(identity(existing)) !== JSON.stringify(identity(intent))) throw new Error(`intent '${intent.intentId}' identity conflicts with existing state`);
+  return { changed: false, intents };
+}
+
+function consumeReworkIntents(
+  intents: readonly ReworkIntent[],
+  target: ReworkTarget,
+  sourceHashes: Readonly<Record<string, string>>,
+  consumedAt: string
+): { changed: boolean; intents: readonly ReworkIntent[] } {
+  let changed = false;
+  const next = intents.map((intent) => {
+    if (
+      intent.status !== 'pending'
+      || intent.target !== target
+      || sourceHashes[intent.sourceArtifact] !== intent.sourceSha256
+    ) return intent;
+    changed = true;
+    return { ...intent, status: 'consumed' as const, consumedAt };
+  });
+  return { changed, intents: next };
+}
+
+function supersedeReworkIntents(
+  intents: readonly ReworkIntent[],
+  sourceArtifact: string,
+  sourceSha256: string,
+  supersededAt: string
+): { changed: boolean; intents: readonly ReworkIntent[] } {
+  let changed = false;
+  const next = intents.map((intent) => {
+    if (intent.status !== 'pending' || intent.sourceArtifact !== sourceArtifact || intent.sourceSha256 === sourceSha256) return intent;
+    changed = true;
+    return { ...intent, status: 'superseded' as const, consumedAt: supersededAt };
+  });
+  return { changed, intents: next };
+}
+
+function reworkIntentMutation(content: string, intents: readonly ReworkIntent[]) {
+  return {
+    kind: 'section' as const,
+    aliases: REWORK_INTENT_HEADINGS,
+    heading: /^##\s+Rework Intent\s*$/m.test(content) ? REWORK_INTENT_HEADINGS[1] : REWORK_INTENT_HEADINGS[0],
+    body: renderReworkIntents(intents)
+  };
+}
+
+export {
+  REWORK_INTENT_COLUMNS,
+  REWORK_INTENT_HEADINGS,
+  parseReworkIntentDocument,
+  renderReworkIntents,
+  reworkIntentMutation,
+  consumeReworkIntents,
+  supersedeReworkIntents,
+  upsertReworkIntent
+};
+export type { ReworkIntent, ReworkIntentParseResult, ReworkIntentStatus, ReworkTarget };

package/lib/task/sections.ts

@@ -175,16 +175,18 @@ function matchingSections(content: string, aliases: readonly string[]) {
   const allowed = new Set(aliases);
   return linesOf(content)
     .map((line, index, lines) => {
-      const match = /^##\s+(.+?)\s*$/.exec(line.text);
-      if (!match?.[1] || !allowed.has(match[1])) return null;
+      const match = /^(#{2,3})\s+(.+?)\s*$/.exec(line.text);
+      if (!match?.[2] || !allowed.has(match[2])) return null;
+      const level = match[1]!.length;
       let end = content.length;
       for (let i = index + 1; i < lines.length; i += 1) {
-        if (/^##\s+/.test(lines[i]!.text)) {
+        const nextHeading = /^(#{2,3})\s+/.exec(lines[i]!.text);
+        if (nextHeading && nextHeading[1]!.length <= level) {
           end = lines[i]!.start;
           break;
         }
       }
-      return { heading: match[1], line, bodyStart: line.end, end };
+      return { heading: match[2]!, line, bodyStart: line.end, end };
     })
     .filter((match): match is NonNullable<typeof match> => match !== null);
 }

package/lib/task/skill-scope.ts

@@ -0,0 +1,24 @@
+const TASK_SCOPE_SKILLS: ReadonlySet<string> = new Set([
+  'analyze-task',
+  'block-task',
+  'cancel-task',
+  'check-task',
+  'code-task',
+  'commit',
+  'complete-manual-validation',
+  'complete-task',
+  'create-pr',
+  'plan-task',
+  'review-analysis',
+  'review-code',
+  'review-plan',
+  'run-manual-validation',
+  'run-task',
+  'watch-pr'
+]);
+
+function isTaskScopeSkill(skillName: string): boolean {
+  return TASK_SCOPE_SKILLS.has(skillName);
+}
+
+export { TASK_SCOPE_SKILLS, isTaskScopeSkill };

package/lib/task/task-execution-lock.ts

@@ -224,6 +224,22 @@ function withTaskExecutionLock<T>(
   };
   const serialized = `${JSON.stringify(owner)}\n`;
   let ownsFixed = false;
+  let deferRelease = false;
+  const release = (): void => {
+    try {
+      unlinkIfPresent(candidate);
+    } catch {
+      // Candidate cleanup is best-effort and must not replace the primary result.
+    }
+    if (ownsFixed) {
+      try {
+        const current = parseOwner(fs.readFileSync(fixed, 'utf8'), key);
+        if (current.token === token) unlinkIfPresent(fixed);
+      } catch {
+        // A missing or replaced fixed lock is not owned by this invocation.
+      }
+    }
+  };
   try {
     fs.mkdirSync(lockRoot, { recursive: true });
     cleanStaleCandidates(lockRoot, key, options.identityMatches ?? processIdentityMatches);
@@ -269,7 +285,12 @@ function withTaskExecutionLock<T>(
       );
     }
     unlinkIfPresent(candidate);
-    return callback();
+    const value = callback();
+    if (value && typeof (value as { then?: unknown }).then === 'function') {
+      deferRelease = true;
+      return (value as unknown as Promise<unknown>).finally(release) as T;
+    }
+    return value;
   } catch (error) {
     if (error instanceof TaskExecutionLockError) throw error;
     if (error instanceof Error && error.name === 'OrchestrationStateError') throw error;
@@ -279,19 +300,7 @@ function withTaskExecutionLock<T>(
       { operation: ownsFixed ? 'callback' : 'acquire', errno: errno(error), key }
     );
   } finally {
-    try {
-      unlinkIfPresent(candidate);
-    } catch {
-      // Candidate cleanup is best-effort and must not replace the primary result.
-    }
-    if (ownsFixed) {
-      try {
-        const current = parseOwner(fs.readFileSync(fixed, 'utf8'), key);
-        if (current.token === token) unlinkIfPresent(fixed);
-      } catch {
-        // A missing or replaced fixed lock is not owned by this invocation.
-      }
-    }
+    if (!deferRelease) release();
   }
 }
 

package/lib/task/verification-config.ts

@@ -1,6 +1,8 @@
 import fs from 'node:fs';
 import path from 'node:path';
 
+import { getArtifactSchema } from './artifact-schema.ts';
+
 type VerificationConfig = {
   skill?: string;
   checks: Record<string, Record<string, unknown> | null>;
@@ -13,6 +15,16 @@ function loadVerificationConfig(repositoryRoot: string, skillName: string): Veri
   if (!parsed.checks || typeof parsed.checks !== 'object' || Array.isArray(parsed.checks)) {
     throw new Error(`config/verify.json has invalid checks for skill '${skillName}'`);
   }
+  const artifact = parsed.checks.artifact;
+  if (artifact && typeof artifact === 'object' && !Array.isArray(artifact)) {
+    const schema = artifact.schema;
+    if (schema !== undefined && (typeof schema !== 'string' || !getArtifactSchema(schema))) {
+      throw new Error(`config/verify.json has unknown artifact schema '${String(schema)}' for skill '${skillName}'`);
+    }
+    if (schema !== undefined && 'required_patterns' in artifact) {
+      throw new Error(`config/verify.json must not duplicate required_patterns for schema '${String(schema)}' in skill '${skillName}'`);
+    }
+  }
   return { ...(parsed.skill ? { skill: parsed.skill } : {}), checks: parsed.checks };
 }
 

package/lib/task/verification-engine.ts

@@ -34,6 +34,10 @@ import { snapshotReview } from "../git/review-snapshot.ts";
 import { OrchestrationStateError, readRun } from "./orchestration.ts";
 import { resolveDeliveryTarget } from "./delivery-target.ts";
 import { readPrDeliveryFact } from "./pr-delivery-fact.ts";
+import { validateLocalArtifact } from "./local-artifact-finalization.ts";
+import { validateQualificationAudit } from "./qualification-audit.ts";
+import { getArtifactSchema } from "./artifact-schema.ts";
+import { inspectArtifactContract } from "./artifact-operations.ts";
 
 const TASK_ENUMS = {
   type: ["feature", "bugfix", "refactor", "docs", "chore"],
@@ -88,7 +92,7 @@ let repoRoot = path.resolve(path.dirname(scriptPath), "..", "..");
 
 const PLATFORM_ADAPTERS: Record<string, (context: any, shared: any) => any> = {
   "platform-sync": checkPlatformSync,
-  "platform-sync-preflight": (context: any, shared: any) => ({ ...checkPlatformSync(context, shared), type: "platform-sync-preflight" }),
+  "platform-sync-preflight": async (context: any, shared: any) => ({ ...await checkPlatformSync(context, shared), type: "platform-sync-preflight" }),
   "required-checks": checkRequiredChecks
 };
 const OPTIONAL_PLATFORM_CHECKS = new Set(["platform-sync"]);
@@ -107,7 +111,7 @@ const sharedUtils = {
   parsePrNumber
 };
 
-function runCheck(type: any, context: any, shared: any): any {
+async function runCheck(type: any, context: any, shared: any): Promise<any> {
   switch (type) {
     case "task-meta":
       return checkTaskMeta(context);
@@ -147,7 +151,7 @@ function runCheck(type: any, context: any, shared: any): any {
         return failResult(type, `Unsupported check type '${type}'.`);
       }
 
-      return adapter(context, shared);
+      return await adapter(context, shared);
     }
   }
 }
@@ -488,7 +492,7 @@ function checkTaskMeta({ taskDir, config }: any): any {
   );
 }
 
-function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }: any): any {
+async function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }: any): Promise<any> {
   const task = loadTask(taskDir);
   if (!task.ok) return failResult('required-pr-delivery', task.message);
   let projectConfig: any = {};
@@ -503,9 +507,10 @@ function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }: any): any {
   if (factRead.status === 'invalid') return failResult('required-pr-delivery', factRead.error.message);
   const fact = factRead.status === 'valid' ? factRead.fact : null;
   const status = fact?.state || 'unbound';
-  const prNumber = fact?.state === 'bound' ? fact.identity.number : null;
+  const prIdentity = fact?.state === 'bound' ? fact.identity.resource : null;
+  const prNumber = prIdentity?.kind === 'number' ? prIdentity.value : null;
   if (flow === 'disabled') return passResult('required-pr-delivery', 'Pull request delivery is disabled by project policy');
-  if (flow === 'required' && (status !== 'bound' || prNumber === null)) {
+  if (flow === 'required' && (status !== 'bound' || !prIdentity)) {
     return failResult('required-pr-delivery', 'Project policy requires a bound pull request before completion');
   }
   if (flow !== 'required' && status === 'unbound') {
@@ -515,7 +520,7 @@ function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }: any): any {
     if (mode === 'gate') {
       return passResult('required-pr-delivery', 'Bound pull request shape is valid; merged-state inspection is reserved for hard preflight');
     }
-    const inspected = inspectPlatformPullRequest(task.metadata.id, { cwd: repositoryRoot });
+    const inspected = await inspectPlatformPullRequest(task.metadata.id, { cwd: repositoryRoot });
     if (inspected.status === 'blocked') {
       return blockedResult(
         'required-pr-delivery',
@@ -527,7 +532,7 @@ function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }: any): any {
     const repository = inspected.platform.repository?.toLowerCase() || '';
     const taskBranch = String(task.metadata.branch || '').trim();
     const deliveryBaseRef = String(task.metadata.delivery_base_ref || projectConfig.delivery?.baseRef || '').trim();
-    if (inspected.status !== 'no-op' || !pullRequest || pullRequest.number !== prNumber) {
+    if (inspected.status !== 'no-op' || !pullRequest) {
       return failResult('required-pr-delivery', 'Bound pull request identity could not be verified');
     }
     if (
@@ -542,7 +547,7 @@ function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }: any): any {
     if (pullRequest.state !== 'closed' || !pullRequest.mergedAt || !pullRequest.mergeCommitSha) {
       return failResult('required-pr-delivery', 'Project policy requires the bound pull request to be merged');
     }
-    return passResult('required-pr-delivery', `Pull request delivery policy satisfied (merged PR #${prNumber})`);
+    return passResult('required-pr-delivery', `Pull request delivery policy satisfied (merged PR ${prNumber === null ? 'identity' : `#${prNumber}`})`);
   }
   return passResult('required-pr-delivery', `Pull request delivery policy satisfied (${status})`);
 }
@@ -581,7 +586,7 @@ function loadProjectName(): any {
   }
 }
 
-function checkArtifact({ taskDir, config, artifactFile }: any): any {
+function checkArtifact({ taskDir, config, artifactFile, skillName }: any): any {
   const resolvedArtifact = resolveArtifactPath(taskDir, config.file_pattern, artifactFile);
   if (!resolvedArtifact.ok) {
     return failResult("artifact", resolvedArtifact.message);
@@ -598,6 +603,63 @@ function checkArtifact({ taskDir, config, artifactFile }: any): any {
   }
 
   const content = fs.readFileSync(artifactPath, "utf8");
+  let taskContent = "";
+  const taskPath = path.join(taskDir, "task.md");
+  if (fs.existsSync(taskPath)) {
+    try {
+      taskContent = fs.readFileSync(taskPath, "utf8");
+    } catch (error) {
+      return failResult("artifact", `Cannot read task qualification contract: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  if (taskContent && /^review-(?:analysis|plan|code)$/.test(skillName)) {
+    const qualification = validateQualificationAudit(taskContent, content, { artifact: path.basename(artifactPath) });
+    if (!qualification.ok) return failResult("artifact", `${path.basename(artifactPath)} has qualification audit errors: ${qualification.code}: ${qualification.message}`);
+  }
+  const schemaFamily = skillName === "analyze-task"
+    ? "analysis"
+    : skillName === "review-analysis"
+      ? "review-analysis"
+      : skillName === "plan-task"
+        ? "plan"
+        : skillName === "review-plan"
+          ? "review-plan"
+          : skillName === "code-task"
+            ? "code"
+            : skillName === "review-code" ? "review-code" : null;
+  const schema = schemaFamily ? getArtifactSchema(schemaFamily) : null;
+  const localFamily = skillName === "analyze-task"
+    ? "analysis"
+    : skillName === "plan-task" ? "plan" : skillName === "code-task" ? "code" : null;
+  if (schema) {
+    const structure = inspectArtifactContract(content, schema);
+    if (!structure.ok && !localFamily) {
+      return failResult("artifact", `${path.basename(artifactPath)} has shared structural errors: ${structure.diagnostics.map((item) => `${item.code}: ${item.message}`).join('; ')}`);
+    }
+  }
+  if (localFamily) {
+    const local = validateLocalArtifact(content, {
+      family: localFamily,
+      ...(taskContent ? { taskContent } : {}),
+      artifact: path.basename(artifactPath)
+    });
+    if (!local.ok) {
+      return failResult(
+        "artifact",
+        `${path.basename(artifactPath)} has local structural errors: ${local.diagnostics.map((item) => `${item.code}: ${item.message}`).join('; ')}`
+      );
+    }
+    return passResult(
+      "artifact",
+      `${path.basename(artifactPath)} passed (${schema?.sections.length ?? 0} sections)`
+    );
+  }
+  if (schema) {
+    return passResult(
+      "artifact",
+      `${path.basename(artifactPath)} passed (${schema.sections.length} sections)`
+    );
+  }
   const requiredSections = config.required_sections || [];
   const missingSections = requiredSections.filter(
     (section: any) => !new RegExp(`^##\\s+${escapeRegExp(section)}\\s*$`, "m").test(content)
@@ -764,6 +826,7 @@ function checkActivityLog({ taskDir, config }: any): any {
   let previousTimestamp = "";
   let latestAction = "";
   let latestTimestamp = "";
+  const doneActions: string[] = [];
 
   for (const entry of entries) {
     const match = entry.match(ACTIVITY_LOG_PATTERN);
@@ -783,6 +846,16 @@ function checkActivityLog({ taskDir, config }: any): any {
     if (!ACTIVITY_LOG_STARTED_RE.test(action)) {
       latestTimestamp = timestamp;
       latestAction = action;
+      doneActions.push(action);
+    }
+  }
+
+  if (config.expected_action_pattern && !new RegExp(config.expected_action_pattern).test(latestAction)) {
+    const expected = new RegExp(config.expected_action_pattern);
+    let index = doneActions.length - 1;
+    while (index >= 0 && doneActions[index] === 'Commit' && !expected.test(doneActions[index]!)) index -= 1;
+    if (index >= 0 && expected.test(doneActions[index]!)) {
+      latestAction = doneActions[index]!;
     }
   }
 
@@ -1031,6 +1104,7 @@ function checkManualValidation({ taskDir }: any): any {
   // 1. Latest review-code artifact; none -> pass (no review, check not applicable).
   const review = findAuthoritativeReviewCodeArtifact(taskDir);
   if (!review.ok) {
+    if (review.error) return failResult("manual-validation", `Review-code artifact is unavailable: ${review.error}`);
     return passResult("manual-validation", "No review-code artifact; manual validation not applicable");
   }
   // 2. Parse the numeric manual-validation count; unparseable/null -> fail closed
@@ -1096,9 +1170,10 @@ function checkManualValidation({ taskDir }: any): any {
   return passResult("manual-validation", `Manual validation completed → ${artifactName}`);
 }
 
-function checkPostReviewCommit({ taskDir, config }: any): any {
+async function checkPostReviewCommit({ taskDir, config }: any): Promise<any> {
   const reviewArtifact = findAuthoritativeReviewCodeArtifact(taskDir);
   if (!reviewArtifact.ok) {
+    if (reviewArtifact.error) return failResult("post-review-commit", `Review-code artifact is unavailable: ${reviewArtifact.error}`);
     return passResult("post-review-commit", "No review-code artifact; check inactive");
   }
 
@@ -1117,9 +1192,9 @@ function checkPostReviewCommit({ taskDir, config }: any): any {
   const lastReviewedCommit = task.ok ? (task.metadata.last_reviewed_commit || "").trim() : "";
   const globs = resolvePostReviewGlobs(config, loadPostReviewConfig(repoRoot));
   const hasPullRequest = fact?.state === 'bound';
-  let inspected: ReturnType<typeof inspectPlatformPullRequest> | null = null;
+  let inspected: Awaited<ReturnType<typeof inspectPlatformPullRequest>> | null = null;
   if (hasPullRequest) {
-    inspected = inspectPlatformPullRequest(task.metadata.id, { cwd: gitRoot });
+    inspected = await inspectPlatformPullRequest(task.metadata.id, { cwd: gitRoot });
     if (!inspected.pullRequest) {
       const message = inspected.error?.message || "PR merge snapshot is unavailable";
       const code = inspected.error?.code || "PR_INSPECTION_INVALID";
@@ -1132,7 +1207,7 @@ function checkPostReviewCommit({ taskDir, config }: any): any {
       inspected.pullRequest.mergedAt &&
       inspected.pullRequest.mergeCommitSha
     ) {
-      const relation = resolveMaterializedReviewedHeadRelation({
+      const relation = await resolveMaterializedReviewedHeadRelation({
         cwd: gitRoot,
         platformType: inspected.platform.type,
         lastReviewedCommit,
@@ -1299,6 +1374,17 @@ function checkReviewFact({ taskDir, artifactFile }: any): any {
     return failResult("review-fact", resolvedArtifact.message);
   }
 
+  const authoritative = findAuthoritativeReviewCodeArtifact(taskDir);
+  if (!authoritative.ok) {
+    return failResult("review-fact", authoritative.error ?? "No active review-code artifact is available");
+  }
+  if (path.basename(resolvedArtifact.path) !== authoritative.fileName) {
+    return failResult(
+      "review-fact",
+      `review-code artifact ${path.basename(resolvedArtifact.path)} is not the current active artifact ${authoritative.fileName}; re-run review-code`
+    );
+  }
+
   const task = loadTask(taskDir);
   if (!task.ok) {
     return failResult("review-fact", task.message);
@@ -1655,7 +1741,7 @@ function isBlank(value: any): any {
   return value === undefined || value === null || String(value).trim() === "";
 }
 
-function verifyInProcess({ mode, skillName, taskDir, artifactFile, checks: requestedChecks, repositoryRoot }: any): any {
+async function verifyInProcess({ mode, skillName, taskDir, artifactFile, checks: requestedChecks, repositoryRoot }: any): Promise<any> {
   if (repositoryRoot) repoRoot = path.resolve(repositoryRoot);
   else {
     let cursor = path.resolve(taskDir);
@@ -1668,7 +1754,7 @@ function verifyInProcess({ mode, skillName, taskDir, artifactFile, checks: reque
     const checks = [];
     for (const [type, checkConfig] of Object.entries(verifyConfig.checks || {})) {
       if (checkConfig === null) continue;
-      const result = runCheck(type, {
+      const result = await runCheck(type, {
         mode,
         skillName,
         taskDir: path.resolve(taskDir),
@@ -1688,7 +1774,7 @@ function verifyInProcess({ mode, skillName, taskDir, artifactFile, checks: reque
   if (config === null) return { skill: skillName, ...passResult(type, `Check '${type}' is disabled for skill '${skillName}'.`) };
   return {
     skill: skillName,
-    ...runCheck(type, {
+    ...await runCheck(type, {
       skillName,
       taskDir: path.resolve(taskDir),
       artifactFile,

package/lib/task/verification.ts

@@ -49,7 +49,7 @@ type TaskVerificationResult = {
 };
 type VerificationOptions = {
   repoRoot?: string;
-  engine?: typeof verifyInProcess;
+  engine?: (input: Parameters<typeof verifyInProcess>[0]) => Record<string, unknown> | Promise<Record<string, unknown>>;
   manualOverride?: ManualOverrideCapability;
 };
 
@@ -91,7 +91,7 @@ function failure(request: { taskRef: string; event: string; artifact?: string },
   };
 }
 
-function verifyTaskEvent(request: { taskRef: string; event: string; artifact?: string }, options: VerificationOptions = {}): TaskVerificationResult {
+async function verifyTaskEvent(request: { taskRef: string; event: string; artifact?: string }, options: VerificationOptions = {}): Promise<TaskVerificationResult> {
   const spec = VERIFICATION_CATALOG[request.event as VerificationEvent];
   if (!spec) return failure(request, 'VERIFY_EVENT_UNKNOWN', `unknown verification event '${request.event}'`);
   const resolved = resolveTaskRef(request.taskRef, { repoRoot: options.repoRoot });
@@ -113,7 +113,7 @@ function verifyTaskEvent(request: { taskRef: string; event: string; artifact?: s
   const invocations: VerificationInvocation[] = [];
   const engine = options.engine ?? verifyInProcess;
   if (spec.mode === 'gate') {
-    const payload = engine({ mode: 'gate', skillName: spec.skill, taskDir: resolved.taskDir, artifactFile: request.artifact, checks: [], repositoryRoot: resolved.repoRoot }) as Record<string, unknown>;
+    const payload = await engine({ mode: 'gate', skillName: spec.skill, taskDir: resolved.taskDir, artifactFile: request.artifact, checks: [], repositoryRoot: resolved.repoRoot });
     const status = payload.gate as 'pass' | 'fail' | 'blocked';
     if (status !== 'pass' && allowsManualOverride(options.manualOverride, 'verification-engine', status === 'blocked' ? 'CHECK_BLOCKED' : 'CHECK_FAILED')) {
       invocations.push({ status: 'pass', exitCode: 0, payload: { ...payload, gate: 'pass', humanOverride: 'human-approved', originalGate: status } });
@@ -125,7 +125,7 @@ function verifyTaskEvent(request: { taskRef: string; event: string; artifact?: s
     invocations.push({ status, exitCode: ({ pass: 0, fail: 1, blocked: 2 } as const)[status], payload });
   } else {
     for (const check of spec.checks ?? []) {
-      const payload = engine({ mode: 'checks', skillName: spec.skill, taskDir: resolved.taskDir, artifactFile: request.artifact, checks: [check], repositoryRoot: resolved.repoRoot }) as Record<string, unknown>;
+      const payload = await engine({ mode: 'checks', skillName: spec.skill, taskDir: resolved.taskDir, artifactFile: request.artifact, checks: [check], repositoryRoot: resolved.repoRoot });
       const status = payload.status as 'pass' | 'fail' | 'blocked';
       if (status !== 'pass' && allowsManualOverride(options.manualOverride, 'verification-engine', status === 'blocked' ? 'CHECK_BLOCKED' : 'CHECK_FAILED')) {
         invocations.push({ status: 'pass', exitCode: 0, payload: { ...payload, status: 'pass', humanOverride: 'human-approved', originalStatus: status } });

package/lib/task/workflow-warning-intents.ts

@@ -68,7 +68,7 @@ function sectionMutation(content: string): TaskMutation[] {
   const english = /^##\s+Activity Log\s*$/m.test(content);
   return [{
     kind: 'section', aliases: WORKFLOW_WARNING_HEADINGS, heading: english ? 'Workflow Warnings' : '工作流告警',
-    body: `| ${WORKFLOW_WARNING_COLUMNS.join(' | ')} |\n|----|------|------|----------|------|--------|--------|---------|--------|-------------|------------|`
+    body: `| ${WORKFLOW_WARNING_COLUMNS.join(' | ')} |\n|----|------|------|----------|------|--------|---------|--------|-------------|------------|------------|`
   }];
 }
 

package/lib/task/write.ts

@@ -16,6 +16,7 @@ import { allowsManualOverride } from './guard-override.ts';
 import type { ManualOverrideCapability } from './guard-override.ts';
 import { mutateTableRow, upsertSection } from './sections.ts';
 import { validateCurrentTaskContract } from './current-contract.ts';
+import { invalidationBlocks, parseInvalidationDocument } from './invalidation.ts';
 import type {
   TableRowDeleteMutation,
   TableRowUpsertMutation
@@ -86,6 +87,8 @@ type TaskWriteErrorCode =
   | ResolveTaskRefErrorCode
   | 'TASK_STATE_MISMATCH'
   | 'TASK_CURRENT_CONTRACT_INVALID'
+  | 'TASK_INVALIDATION_INVALID'
+  | 'TASK_INVALIDATION_BLOCKED'
   | 'TASK_READ_FAILED'
   | 'TASK_DOCUMENT_INVALID'
   | 'MUTATION_INVALID'
@@ -161,6 +164,7 @@ type TaskWriteOptions = {
   randomSuffix?: () => string;
   fileSystem?: Partial<TaskFileSystem>;
   manualOverride?: ManualOverrideCapability;
+  invalidationContext?: 'standard' | 'source-completion' | 'reconcile';
 };
 
 const DEFAULT_FILE_SYSTEM: TaskFileSystem = {
@@ -275,6 +279,21 @@ function writeTask(request: TaskWriteRequest, options: TaskWriteOptions = {}): T
     if (!contract.ok) {
       return failure(request, identity, contract.code, contract.message);
     }
+    if (
+      invalidationBlocks(contract.invalidation)
+      && options.invalidationContext !== 'source-completion'
+      && options.invalidationContext !== 'reconcile'
+    ) {
+      return failure(
+        request,
+        identity,
+        'TASK_INVALIDATION_BLOCKED',
+        'task has an incomplete artifact invalidation operation; reconcile it before writing downstream state'
+      );
+    }
+  } else {
+    const invalidation = parseInvalidationDocument(original);
+    if (!invalidation.ok) return failure(request, identity, 'TASK_INVALIDATION_INVALID', invalidation.message);
   }
 
   let candidate = original;

package/lib/update.ts

@@ -19,7 +19,7 @@ type UpdateConfig = {
   project: string;
   org: string;
   language: string;
-  platform?: { type?: string };
+  platform?: { type?: string; providers?: Record<string, unknown> };
   prFlow?: 'required' | 'disabled';
   sandbox?: Record<string, unknown>;
   task?: { shortIdLength: number };