@fitlab-ai/agent-infra 0.9.13 → 0.9.14

package/dist/lib/task/qualification-intents.js

@@ -0,0 +1,148 @@
+import fs from 'node:fs';
+import { CONSTRAINT_COLUMNS, CANDIDATE_COLUMNS, parseTaskQualification } from './qualification-audit.js';
+import { resolveTaskRef } from './resolve-ref.js';
+import { captureTaskWriteMetadata, writeTask } from './write.js';
+function failed(code, message, taskId = null) {
+    return { status: 'failed', changed: false, taskId, operations: [], error: { code, message } };
+}
+function validSingleLine(value) {
+    return typeof value === 'string' && Boolean(value.trim()) && !/[\r\n]/.test(value);
+}
+function assertProposalKeys(value, keys, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error(`${label} must be an object`);
+    const record = value;
+    const unexpected = Object.keys(record).find((key) => !keys.includes(key));
+    if (unexpected)
+        throw new Error(`${label} does not accept '${unexpected}'`);
+    return record;
+}
+function parseConstraintProposal(value) {
+    const row = assertProposalKeys(value, ['constraintId', 'statement', 'status', 'authority', 'source', 'evidence', 'derivedFrom', 'approvalEvidence'], 'constraint proposal');
+    for (const key of ['constraintId', 'statement', 'status', 'authority', 'source', 'evidence', 'approvalEvidence']) {
+        if (typeof row[key] !== 'string' || /[\r\n]/.test(row[key]))
+            throw new Error(`constraint proposal '${key}' must be a single-line string`);
+    }
+    if (!/^C-[1-9]\d*$/.test(row.constraintId))
+        throw new Error(`constraint proposal id '${row.constraintId}' is invalid`);
+    if (row.status === 'confirmed' || !['derived', 'assumption', 'open', 'conflicted', 'superseded'].includes(row.status))
+        throw new Error('proposal cannot write confirmed constraint status');
+    if (row.approvalEvidence !== '')
+        throw new Error('proposal cannot write approval_evidence');
+    if (!Array.isArray(row.derivedFrom) || row.derivedFrom.some((item) => typeof item !== 'string' || !/^C-[1-9]\d*$/.test(item)))
+        throw new Error('constraint proposal derivedFrom is invalid');
+    return {
+        constraintId: row.constraintId, statement: row.statement, status: row.status,
+        authority: row.authority, source: row.source, evidence: row.evidence,
+        derivedFrom: [...row.derivedFrom], approvalEvidence: ''
+    };
+}
+function parseCandidateProposal(value) {
+    const row = assertProposalKeys(value, ['candidateId', 'statement', 'status', 'constraintIds', 'impact', 'evidence'], 'candidate proposal');
+    for (const key of ['candidateId', 'statement', 'status', 'impact', 'evidence'])
+        if (!validSingleLine(row[key]))
+            throw new Error(`candidate proposal '${key}' must be a non-empty single-line string`);
+    if (!/^[A-Za-z][A-Za-z0-9_-]*$/.test(row.candidateId))
+        throw new Error(`candidate proposal id '${row.candidateId}' is invalid`);
+    if (row.status !== 'pending')
+        throw new Error('proposal can only write pending candidate status');
+    if (!Array.isArray(row.constraintIds) || row.constraintIds.some((item) => typeof item !== 'string' || !/^C-[1-9]\d*$/.test(item)))
+        throw new Error('candidate proposal constraintIds is invalid');
+    return row;
+}
+function proposalValues(request) {
+    if (!/^[a-f0-9]{64}$/i.test(request.expectedTaskInputDigest))
+        throw new Error('expectedTaskInputDigest must be a sha256 digest');
+    if (Object.keys(request).some((key) => !['taskRef', 'expectedTaskInputDigest', 'constraints', 'candidates', 'dryRun'].includes(key)))
+        throw new Error('proposal contains an unsupported field');
+    if (!Array.isArray(request.constraints) && request.constraints !== undefined)
+        throw new Error('constraints must be an array');
+    if (!Array.isArray(request.candidates) && request.candidates !== undefined)
+        throw new Error('candidates must be an array');
+    return {
+        constraints: (request.constraints ?? []).map(parseConstraintProposal),
+        candidates: (request.candidates ?? []).map(parseCandidateProposal)
+    };
+}
+function applyQualificationProposal(request, options = {}) {
+    if (!request || typeof request !== 'object' || !validSingleLine(request.taskRef))
+        return failed('QUALIFICATION_PROPOSAL_INVALID', 'taskRef is required');
+    let values;
+    try {
+        values = proposalValues(request);
+    }
+    catch (error) {
+        return failed('QUALIFICATION_PROPOSAL_INVALID', error instanceof Error ? error.message : String(error));
+    }
+    if (values.constraints.length === 0 && values.candidates.length === 0)
+        return failed('QUALIFICATION_PROPOSAL_INVALID', 'proposal must contain a constraint or candidate');
+    const resolved = resolveTaskRef(request.taskRef, { repoRoot: options.repoRoot });
+    if (!resolved.ok)
+        return failed(resolved.code, resolved.message, resolved.taskId);
+    if (resolved.state !== 'active')
+        return failed('TASK_STATE_MISMATCH', `task ${resolved.taskId} is ${resolved.state}, expected active`, resolved.taskId);
+    let content;
+    try {
+        content = fs.readFileSync(resolved.taskMdPath, 'utf8');
+    }
+    catch (error) {
+        return failed('TASK_READ_FAILED', error instanceof Error ? error.message : String(error), resolved.taskId);
+    }
+    const parsed = parseTaskQualification(content);
+    if (!parsed.ok)
+        return failed(parsed.code, parsed.message, resolved.taskId);
+    if (!parsed.qualification.present)
+        return failed('QUALIFICATION_TASK_CONTRACT_MISSING', 'task qualification contract is missing', resolved.taskId);
+    const currentConstraintMap = new Map(parsed.qualification.constraints.map((row) => [row.constraintId, row]));
+    const currentCandidateMap = new Map(parsed.qualification.candidates.map((row) => [row.candidateId, row]));
+    const proposalAlreadyApplied = values.constraints.every((row) => {
+        const current = currentConstraintMap.get(row.constraintId);
+        return current && current.statement === row.statement && current.status === row.status && current.authority === row.authority
+            && current.source === row.source && current.evidence === row.evidence && current.derivedFrom.join(',') === row.derivedFrom.join(',') && current.approvalEvidence === '';
+    }) && values.candidates.every((row) => {
+        const current = currentCandidateMap.get(row.candidateId);
+        return current && current.statement === row.statement && current.status === row.status && current.constraintIds.join(',') === row.constraintIds.join(',')
+            && current.impact === row.impact && current.evidence === row.evidence;
+    });
+    if (parsed.qualification.taskInputDigest !== request.expectedTaskInputDigest) {
+        return proposalAlreadyApplied
+            ? { status: 'no-op', changed: false, taskId: resolved.taskId, operations: [], error: null }
+            : failed('QUALIFICATION_DIGEST_CONFLICT', 'task qualification input changed before proposal was applied', resolved.taskId);
+    }
+    for (const row of values.constraints) {
+        const current = currentConstraintMap.get(row.constraintId);
+        if (current?.status === 'confirmed')
+            return failed('QUALIFICATION_CONFIRMATION_REQUIRED', `confirmed constraint '${row.constraintId}' must be superseded or revoked through task-qualification`, resolved.taskId);
+    }
+    const knownConstraintIds = new Set([...parsed.qualification.constraints.map((row) => row.constraintId), ...values.constraints.map((row) => row.constraintId)]);
+    for (const row of values.constraints)
+        for (const parent of row.derivedFrom)
+            if (!knownConstraintIds.has(parent))
+                return failed('QUALIFICATION_CONSTRAINT_UNKNOWN', `constraint proposal '${row.constraintId}' references unknown '${parent}'`, resolved.taskId);
+    for (const row of values.candidates)
+        for (const id of row.constraintIds)
+            if (!knownConstraintIds.has(id))
+                return failed('QUALIFICATION_CONSTRAINT_UNKNOWN', `candidate proposal '${row.candidateId}' references unknown '${id}'`, resolved.taskId);
+    const mutations = [];
+    for (const row of values.constraints) {
+        mutations.push({ kind: 'table-row', action: 'upsert', sectionAliases: ['约束', 'Constraints'], columns: CONSTRAINT_COLUMNS, keyColumn: 'constraint_id', key: row.constraintId, values: { statement: row.statement, status: row.status, authority: row.authority, source: row.source, evidence: row.evidence, derived_from: row.derivedFrom.join(','), approval_evidence: '' } });
+    }
+    for (const row of values.candidates) {
+        mutations.push({ kind: 'table-row', action: 'upsert', sectionAliases: ['候选与否决方案', 'Candidate and Rejected Options', 'Candidates and Rejected Options', 'Candidates and Rejected Alternatives'], columns: CANDIDATE_COLUMNS, keyColumn: 'candidate_id', key: row.candidateId, values: { statement: row.statement, status: row.status, constraint_ids: row.constraintIds.join(','), impact: row.impact, evidence: row.evidence } });
+    }
+    // Only the submitted rows are mutated; no actor, confirmation, or QCR fields
+    // can be smuggled into this internal proposal operation.
+    let metadata;
+    try {
+        metadata = (options.metadataProvider ?? captureTaskWriteMetadata)();
+    }
+    catch (error) {
+        return failed('METADATA_CAPTURE_FAILED', error instanceof Error ? error.message : String(error), resolved.taskId);
+    }
+    const result = writeTask({ taskRef: resolved.taskId, expectedState: 'active', mutations, dryRun: request.dryRun }, { ...options, taskLocation: { repoRoot: resolved.repoRoot, taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, state: resolved.state }, metadataProvider: () => metadata });
+    if (result.status === 'failed')
+        return failed(result.error.code, result.error.message, result.taskId);
+    return { status: result.status, changed: result.changed, taskId: result.taskId, operations: result.operations, error: null };
+}
+export { applyQualificationProposal };
+//# sourceMappingURL=qualification-intents.js.map

package/dist/lib/task/review-artifacts.js

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { scanVisibleMarkdown } from './decision-details.js';
 const SUMMARY_HEADINGS = new Set(['审查摘要', 'Review Summary']);
 const PLACEHOLDERS = [
     '{unresolved-blockers}',
@@ -36,42 +37,40 @@ function normalizeVerdict(raw) {
     return '';
 }
 function extractSection(content, names) {
-    const lines = content.split(/\r?\n/);
     const nameSet = new Set(names);
-    const start = lines.findIndex((line) => {
-        const match = line.trim().match(/^##\s+(.+?)\s*$/);
-        return match ? nameSet.has(match[1]) : false;
-    });
-    if (start === -1)
+    const scanned = scanVisibleMarkdown(content);
+    const heading = scanned.headings.find((item) => item.level === 2 && nameSet.has(item.text));
+    if (!heading)
         return '';
-    const sectionLines = [];
-    for (let index = start + 1; index < lines.length; index += 1) {
-        if (/^##\s+/.test(lines[index]))
-            break;
-        sectionLines.push(lines[index]);
-    }
-    return sectionLines.join('\n');
+    const next = scanned.headings.find((item) => item.start > heading.start && item.level <= 2);
+    return content.slice(heading.end, next?.start ?? content.length);
 }
 function summaryBounds(content) {
-    const headings = [...content.matchAll(/^##\s+(.+?)\s*$/gm)]
-        .map((match) => ({ index: match.index, end: match.index + match[0].length, name: match[1] }));
-    const summaries = headings.filter((heading) => SUMMARY_HEADINGS.has(heading.name));
+    const scanned = scanVisibleMarkdown(content);
+    const summaries = scanned.headings.filter((heading) => heading.level === 2 && SUMMARY_HEADINGS.has(heading.text));
     if (summaries.length !== 1)
         return null;
     const summary = summaries[0];
-    const next = headings.find((heading) => heading.index > summary.index);
-    return { start: summary.end, end: next?.index ?? content.length };
+    const next = scanned.headings.find((heading) => heading.start > summary.start && heading.level <= 2);
+    return { start: summary.end, end: next?.start ?? content.length };
 }
 function uniqueLine(content, bounds, pattern) {
-    const section = content.slice(bounds.start, bounds.end);
-    const matches = [...section.matchAll(pattern)];
+    const matches = [];
+    for (const line of scanVisibleMarkdown(content).lines) {
+        if (line.start < bounds.start || line.start >= bounds.end)
+            continue;
+        pattern.lastIndex = 0;
+        const match = pattern.exec(line.text);
+        if (match)
+            matches.push({ value: match[1], index: line.start + match.index, length: match[0].length });
+    }
     if (matches.length !== 1)
         return null;
     const match = matches[0];
     return {
-        value: match[1],
-        start: bounds.start + match.index,
-        end: bounds.start + match.index + match[0].length
+        value: match.value,
+        start: match.index,
+        end: match.index + match.length
     };
 }
 function parseCounts(value) {

package/dist/lib/task/review-finalization.js

@@ -10,6 +10,9 @@ import { resolveTaskRef } from './resolve-ref.js';
 import { validateLifecycleExecution } from './lifecycle-execution.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.js';
 import { allowsManualOverride } from './guard-override.js';
+import { getArtifactSchema } from './artifact-schema.js';
+import { canonicalSemanticDigest, inspectArtifactContract, sha256Content } from './artifact-operations.js';
+import { readArtifactRepairIntent, writeArtifactRepairIntent } from './artifact-repair-intent.js';
 const STAGES = {
     analysis: { family: 'review-analysis', action: 'Review Analysis' },
     plan: { family: 'review-plan', action: 'Review Plan' },
@@ -22,7 +25,7 @@ const DEFAULT_FILE_SYSTEM = {
     renameSync: (from, to) => fs.renameSync(from, to),
     unlinkSync: (file) => fs.unlinkSync(file)
 };
-function failed(request, code, message, taskId = null, stageStatus = null) {
+function failed(request, code, message, taskId = null, stageStatus = null, extra = {}) {
     return {
         status: 'failed',
         changed: false,
@@ -32,8 +35,13 @@ function failed(request, code, message, taskId = null, stageStatus = null) {
         stage: request.stage,
         artifact: request.artifact,
         stageStatus,
+        artifactSha256: null,
+        semanticDigest: null,
+        repairable: false,
+        operation: null,
         operations: [],
-        error: { code, message }
+        error: { code, message },
+        ...extra
     };
 }
 function openReviewRound(content, action, round) {
@@ -86,6 +94,73 @@ function finalizeReviewSummaryUnlocked(request, options = {}) {
     catch (error) {
         return failed(request, 'REVIEW_ARTIFACT_NOT_REGULAR', String(error), resolved.taskId);
     }
+    const schema = getArtifactSchema(spec.family);
+    const structure = schema ? inspectArtifactContract(artifactContent, schema) : null;
+    const artifactSha256 = sha256Content(artifactContent);
+    const artifactSemanticDigest = canonicalSemanticDigest(artifactContent);
+    let repairIntent;
+    try {
+        repairIntent = readArtifactRepairIntent(resolved.repoRoot, resolved.taskId, spec.family, request.artifact);
+    }
+    catch (error) {
+        return failed(request, 'REVIEW_PROVENANCE_INVALID', String(error), resolved.taskId, null, {
+            artifactSha256,
+            semanticDigest: artifactSemanticDigest
+        });
+    }
+    if (structure && !structure.ok) {
+        const repairable = structure.repair !== null && structure.diagnostics.length === 1 && structure.diagnostics[0]?.repairable === true;
+        if (repairable) {
+            if (repairIntent && (repairIntent.state !== 'awaiting-repair' ||
+                repairIntent.artifactSha256 !== artifactSha256 ||
+                repairIntent.semanticDigest !== structure.semanticDigest)) {
+                return failed(request, 'REVIEW_PROVENANCE_INVALID', 'a different review repair baseline is already recorded for this artifact', resolved.taskId, null, {
+                    artifactSha256,
+                    semanticDigest: structure.semanticDigest
+                });
+            }
+            try {
+                if (!repairIntent) {
+                    writeArtifactRepairIntent(resolved.repoRoot, {
+                        version: 1,
+                        taskId: resolved.taskId,
+                        family: spec.family,
+                        artifact: request.artifact,
+                        state: 'awaiting-repair',
+                        baselineSemanticDigest: structure.semanticDigest,
+                        artifactSha256,
+                        semanticDigest: structure.semanticDigest
+                    });
+                }
+            }
+            catch (error) {
+                return failed(request, 'REVIEW_PROVENANCE_INVALID', `cannot record repair provenance: ${String(error)}`, resolved.taskId, null, {
+                    artifactSha256,
+                    semanticDigest: structure.semanticDigest,
+                    operation: structure.repair
+                });
+            }
+        }
+        return failed(request, 'REVIEW_ARTIFACT_STRUCTURE_INVALID', structure.diagnostics.map((item) => `${item.code}: ${item.message}`).join('; '), resolved.taskId, null, {
+            artifactSha256,
+            semanticDigest: structure.semanticDigest,
+            repairable,
+            operation: structure.repair
+        });
+    }
+    if (repairIntent?.state === 'awaiting-repair' && repairIntent.baselineSemanticDigest !== artifactSemanticDigest) {
+        return failed(request, 'REVIEW_PROVENANCE_INVALID', 'the repaired review artifact semantic digest does not match the recorded repair baseline', resolved.taskId, null, {
+            artifactSha256,
+            semanticDigest: artifactSemanticDigest
+        });
+    }
+    if ((repairIntent?.state === 'passed' || repairIntent?.state === 'consumed')
+        && (repairIntent.artifactSha256 !== artifactSha256 || repairIntent.semanticDigest !== artifactSemanticDigest)) {
+        return failed(request, 'REVIEW_PROVENANCE_INVALID', 'the review artifact changed after its finalization provenance was recorded', resolved.taskId, null, {
+            artifactSha256,
+            semanticDigest: artifactSemanticDigest
+        });
+    }
     if (!openReviewRound(taskContent, spec.action, parsedArtifact.round)) {
         return failed(request, 'REVIEW_ARTIFACT_IDENTITY_INVALID', `${request.artifact} does not have one matching open started review event`, resolved.taskId);
     }
@@ -127,8 +202,27 @@ function finalizeReviewSummaryUnlocked(request, options = {}) {
         return failed(request, transformed.code, transformed.message, resolved.taskId, stageStatus);
     }
     if (!transformed.changed) {
+        if (repairIntent?.state === 'awaiting-repair') {
+            try {
+                writeArtifactRepairIntent(resolved.repoRoot, {
+                    ...repairIntent,
+                    state: 'passed',
+                    artifactSha256,
+                    semanticDigest: artifactSemanticDigest
+                });
+            }
+            catch (error) {
+                return failed(request, 'REVIEW_PROVENANCE_INVALID', `cannot record repaired review provenance: ${String(error)}`, resolved.taskId, stageStatus, {
+                    artifactSha256,
+                    semanticDigest: artifactSemanticDigest
+                });
+            }
+        }
         return {
-            ...failed(request, 'REVIEW_ARTIFACT_CONFLICT', '', resolved.taskId, stageStatus),
+            ...failed(request, 'REVIEW_ARTIFACT_CONFLICT', '', resolved.taskId, stageStatus, {
+                artifactSha256,
+                semanticDigest: artifactSemanticDigest
+            }),
             status: 'no-op',
             error: null
         };
@@ -136,7 +230,10 @@ function finalizeReviewSummaryUnlocked(request, options = {}) {
     const operations = [{ kind: 'artifact', artifact: request.artifact, operation: 'update' }];
     if (request.dryRun) {
         return {
-            ...failed(request, 'REVIEW_ARTIFACT_CONFLICT', '', resolved.taskId, stageStatus),
+            ...failed(request, 'REVIEW_ARTIFACT_CONFLICT', '', resolved.taskId, stageStatus, {
+                artifactSha256: sha256Content(transformed.content),
+                semanticDigest: canonicalSemanticDigest(transformed.content)
+            }),
             status: 'planned',
             changed: true,
             operations,
@@ -164,6 +261,22 @@ function finalizeReviewSummaryUnlocked(request, options = {}) {
         cleanupTemp(fileSystem, tempPath);
         return failed(request, 'REVIEW_RENAME_FAILED', String(error), resolved.taskId, stageStatus);
     }
+    if (repairIntent?.state === 'awaiting-repair') {
+        try {
+            writeArtifactRepairIntent(resolved.repoRoot, {
+                ...repairIntent,
+                state: 'passed',
+                artifactSha256: sha256Content(transformed.content),
+                semanticDigest: canonicalSemanticDigest(transformed.content)
+            });
+        }
+        catch (error) {
+            return failed(request, 'REVIEW_PROVENANCE_INVALID', `cannot record repaired review provenance: ${String(error)}`, resolved.taskId, stageStatus, {
+                artifactSha256: sha256Content(transformed.content),
+                semanticDigest: canonicalSemanticDigest(transformed.content)
+            });
+        }
+    }
     return {
         status: 'applied',
         changed: true,
@@ -173,6 +286,10 @@ function finalizeReviewSummaryUnlocked(request, options = {}) {
         stage,
         artifact: request.artifact,
         stageStatus,
+        artifactSha256: sha256Content(transformed.content),
+        semanticDigest: canonicalSemanticDigest(transformed.content),
+        repairable: false,
+        operation: null,
         operations,
         error: null
     };

package/dist/lib/task/sections.js

@@ -99,17 +99,19 @@ function matchingSections(content, aliases) {
     const allowed = new Set(aliases);
     return linesOf(content)
         .map((line, index, lines) => {
-        const match = /^##\s+(.+?)\s*$/.exec(line.text);
-        if (!match?.[1] || !allowed.has(match[1]))
+        const match = /^(#{2,3})\s+(.+?)\s*$/.exec(line.text);
+        if (!match?.[2] || !allowed.has(match[2]))
             return null;
+        const level = match[1].length;
         let end = content.length;
         for (let i = index + 1; i < lines.length; i += 1) {
-            if (/^##\s+/.test(lines[i].text)) {
+            const nextHeading = /^(#{2,3})\s+/.exec(lines[i].text);
+            if (nextHeading && nextHeading[1].length <= level) {
                 end = lines[i].start;
                 break;
             }
         }
-        return { heading: match[1], line, bodyStart: line.end, end };
+        return { heading: match[2], line, bodyStart: line.end, end };
     })
         .filter((match) => match !== null);
 }

package/dist/lib/task/verification-config.js

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { getArtifactSchema } from './artifact-schema.js';
 function loadVerificationConfig(repositoryRoot, skillName) {
     const verifyPath = path.join(repositoryRoot, '.agents', 'skills', skillName, 'config', 'verify.json');
     if (!fs.existsSync(verifyPath))
@@ -8,6 +9,16 @@ function loadVerificationConfig(repositoryRoot, skillName) {
     if (!parsed.checks || typeof parsed.checks !== 'object' || Array.isArray(parsed.checks)) {
         throw new Error(`config/verify.json has invalid checks for skill '${skillName}'`);
     }
+    const artifact = parsed.checks.artifact;
+    if (artifact && typeof artifact === 'object' && !Array.isArray(artifact)) {
+        const schema = artifact.schema;
+        if (schema !== undefined && (typeof schema !== 'string' || !getArtifactSchema(schema))) {
+            throw new Error(`config/verify.json has unknown artifact schema '${String(schema)}' for skill '${skillName}'`);
+        }
+        if (schema !== undefined && 'required_patterns' in artifact) {
+            throw new Error(`config/verify.json must not duplicate required_patterns for schema '${String(schema)}' in skill '${skillName}'`);
+        }
+    }
     return { ...(parsed.skill ? { skill: parsed.skill } : {}), checks: parsed.checks };
 }
 export { loadVerificationConfig };

package/dist/lib/task/verification-engine.js

@@ -22,6 +22,9 @@ import { OrchestrationStateError, readRun } from "./orchestration.js";
 import { resolveDeliveryTarget } from "./delivery-target.js";
 import { readPrDeliveryFact } from "./pr-delivery-fact.js";
 import { validateLocalArtifact } from "./local-artifact-finalization.js";
+import { validateQualificationAudit } from "./qualification-audit.js";
+import { getArtifactSchema } from "./artifact-schema.js";
+import { inspectArtifactContract } from "./artifact-operations.js";
 const TASK_ENUMS = {
     type: ["feature", "bugfix", "refactor", "docs", "chore"],
     workflow: ["feature-development", "bug-fix", "refactoring"],
@@ -520,21 +523,57 @@ function checkArtifact({ taskDir, config, artifactFile, skillName }) {
         return failResult("artifact", `Artifact is empty: ${path.basename(artifactPath)}`);
     }
     const content = fs.readFileSync(artifactPath, "utf8");
-    const requiredSections = config.required_sections || [];
+    let taskContent = "";
+    const taskPath = path.join(taskDir, "task.md");
+    if (fs.existsSync(taskPath)) {
+        try {
+            taskContent = fs.readFileSync(taskPath, "utf8");
+        }
+        catch (error) {
+            return failResult("artifact", `Cannot read task qualification contract: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    if (taskContent && /^review-(?:analysis|plan|code)$/.test(skillName)) {
+        const qualification = validateQualificationAudit(taskContent, content, { artifact: path.basename(artifactPath) });
+        if (!qualification.ok)
+            return failResult("artifact", `${path.basename(artifactPath)} has qualification audit errors: ${qualification.code}: ${qualification.message}`);
+    }
+    const schemaFamily = skillName === "analyze-task"
+        ? "analysis"
+        : skillName === "review-analysis"
+            ? "review-analysis"
+            : skillName === "plan-task"
+                ? "plan"
+                : skillName === "review-plan"
+                    ? "review-plan"
+                    : skillName === "code-task"
+                        ? "code"
+                        : skillName === "review-code" ? "review-code" : null;
+    const schema = schemaFamily ? getArtifactSchema(schemaFamily) : null;
     const localFamily = skillName === "analyze-task"
         ? "analysis"
         : skillName === "plan-task" ? "plan" : skillName === "code-task" ? "code" : null;
+    if (schema) {
+        const structure = inspectArtifactContract(content, schema);
+        if (!structure.ok && !localFamily) {
+            return failResult("artifact", `${path.basename(artifactPath)} has shared structural errors: ${structure.diagnostics.map((item) => `${item.code}: ${item.message}`).join('; ')}`);
+        }
+    }
     if (localFamily) {
         const local = validateLocalArtifact(content, {
             family: localFamily,
-            requiredSections: requiredSections.filter((section) => typeof section === "string"),
-            requiredPatterns: (config.required_patterns || []).filter((pattern) => typeof pattern === "string")
+            ...(taskContent ? { taskContent } : {}),
+            artifact: path.basename(artifactPath)
         });
         if (!local.ok) {
             return failResult("artifact", `${path.basename(artifactPath)} has local structural errors: ${local.diagnostics.map((item) => `${item.code}: ${item.message}`).join('; ')}`);
         }
-        return passResult("artifact", `${path.basename(artifactPath)} passed (${requiredSections.length} sections)`);
+        return passResult("artifact", `${path.basename(artifactPath)} passed (${schema?.sections.length ?? 0} sections)`);
     }
+    if (schema) {
+        return passResult("artifact", `${path.basename(artifactPath)} passed (${schema.sections.length} sections)`);
+    }
+    const requiredSections = config.required_sections || [];
     const missingSections = requiredSections.filter((section) => !new RegExp(`^##\\s+${escapeRegExp(section)}\\s*$`, "m").test(content));
     if (missingSections.length > 0) {
         return failResult("artifact", `${path.basename(artifactPath)} is missing sections: ${missingSections.join(", ")}`);
@@ -686,6 +725,7 @@ function checkActivityLog({ taskDir, config }) {
     let previousTimestamp = "";
     let latestAction = "";
     let latestTimestamp = "";
+    const doneActions = [];
     for (const entry of entries) {
         const match = entry.match(ACTIVITY_LOG_PATTERN);
         if (!match) {
@@ -702,6 +742,16 @@ function checkActivityLog({ taskDir, config }) {
         if (!ACTIVITY_LOG_STARTED_RE.test(action)) {
             latestTimestamp = timestamp;
             latestAction = action;
+            doneActions.push(action);
+        }
+    }
+    if (config.expected_action_pattern && !new RegExp(config.expected_action_pattern).test(latestAction)) {
+        const expected = new RegExp(config.expected_action_pattern);
+        let index = doneActions.length - 1;
+        while (index >= 0 && doneActions[index] === 'Commit' && !expected.test(doneActions[index]))
+            index -= 1;
+        if (index >= 0 && expected.test(doneActions[index])) {
+            latestAction = doneActions[index];
         }
     }
     if (config.expected_action_pattern && !new RegExp(config.expected_action_pattern).test(latestAction)) {

package/dist/lifecycle-build-manifest.json

@@ -1,6 +1,6 @@
 {
   "protocolVersion": 3,
-  "packageVersion": "0.9.13",
-  "sourceInputHash": "5e4d3ad1c1e7e3c909489ef59ff318ea9cffe5f538ae37d83923773946357afe",
-  "internalExecutableBuildHash": "c8cabf5c6bc776cdcb9621f712172ebda95ff9b12fb6f67213e18bc0159516fd"
+  "packageVersion": "0.9.14",
+  "sourceInputHash": "a3cf306ad6576904e6ef7d962e51245c6684540bd41358beaebf8209c00f3cfc",
+  "internalExecutableBuildHash": "14773c26aea5022af695f2e3ca4a39bed3c87c1eab04347aeded028745d8ded1"
 }

package/lib/agent-client.ts

@@ -11,6 +11,9 @@ import { AGENT_CLIENT_IDS, isAgentClientId } from './agent-clients/types.ts';
 import type { AgentClientState } from './agent-clients/types.ts';
 import { closePrompt, multiSelect } from './prompt.ts';
 import { resolveTemplateDir } from './paths.ts';
+import { PUBLIC_CLI_ROUTE_SELECTORS } from './internal/cli-route-inventory.ts';
+
+const AGENT_CLIENT_OPERATIONS = PUBLIC_CLI_ROUTE_SELECTORS['agent-client'];
 
 const USAGE = `Usage: ai agent-client <operation>
 
@@ -107,6 +110,12 @@ async function cmdAgentClient(args: string[]): Promise<number> {
     process.stdout.write(USAGE);
     return 0;
   }
+  if (!AGENT_CLIENT_OPERATIONS.includes(operation as typeof AGENT_CLIENT_OPERATIONS[number])) {
+    throw new AgentClientCommandError(
+      'AGENT_CLIENT_OPERATION_INVALID',
+      `Unknown operation '${operation}'`
+    );
+  }
 
   if (operation === 'list') {
     if (args.length !== 1) {

package/lib/internal/agent-client.ts

@@ -9,6 +9,7 @@ import { normalizeCustomTUIs } from '../agent-clients/custom-tuis.ts';
 import { renderNextStepCommands } from '../agent-clients/next-steps.ts';
 import { getAgentClientModelSelection } from '../agent-clients/registry.ts';
 import { isAgentClientId } from '../agent-clients/types.ts';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.ts';
 
 const USAGE = 'Usage: agent-infra-internal agent-client <next-steps|model-selection> [options]\n';
 
@@ -35,7 +36,7 @@ function parseArgs(args: string[]): ParsedArgs | null {
     process.stdout.write(USAGE);
     return null;
   }
-  if (args[0] !== 'next-steps') {
+  if (!internalHandlerRoute('agent-client', 'next-steps', args[0] ?? '')) {
     failure('AGENT_CLIENT_PAYLOAD_INVALID', "operation must be 'next-steps'");
     return null;
   }
@@ -84,7 +85,8 @@ function parseArgs(args: string[]): ParsedArgs | null {
 }
 
 function agentClient(args: string[] = []): void {
-  if (args[0] === 'model-selection') {
+  if (!ensureInternalHandlerRoute('agent-client', args)) return;
+  if (internalHandlerRoute('agent-client', 'model-selection', args[0] ?? '')) {
     const values: Record<string, string> = {};
     const seen = new Set<string>();
     for (let index = 1; index < args.length; index += 1) {