@fitlab-ai/agent-infra 0.9.13 → 0.9.14

package/lib/task/artifact-repair-intent.ts

@@ -0,0 +1,71 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+import type { ArtifactSchemaFamily } from './artifact-schema.ts';
+
+type ArtifactRepairIntent = Readonly<{
+  version: 1;
+  taskId: string;
+  family: ArtifactSchemaFamily;
+  artifact: string;
+  state: 'awaiting-repair' | 'passed' | 'consumed';
+  baselineSemanticDigest: string | null;
+  artifactSha256: string;
+  semanticDigest: string;
+}>;
+
+function intentRoot(repoRoot: string): string {
+  return path.join(repoRoot, '.agents', 'workspace', '.local-artifact-finalization-intents');
+}
+
+function intentPath(repoRoot: string, taskId: string, family: ArtifactSchemaFamily, artifact: string): string {
+  return path.join(intentRoot(repoRoot), `${taskId}-${family}-${artifact}.json`);
+}
+
+function isArtifactRepairIntent(value: unknown): value is ArtifactRepairIntent {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const intent = value as Record<string, unknown>;
+  return intent.version === 1
+    && typeof intent.taskId === 'string' && /^TASK-\d{8}-\d{6}$/.test(intent.taskId)
+    && typeof intent.family === 'string' && ['analysis', 'review-analysis', 'plan', 'review-plan', 'code', 'review-code'].includes(intent.family)
+    && typeof intent.artifact === 'string' && intent.artifact.length > 0
+    && ['awaiting-repair', 'passed', 'consumed'].includes(String(intent.state))
+    && (intent.baselineSemanticDigest === null || (typeof intent.baselineSemanticDigest === 'string' && /^[a-f0-9]{64}$/.test(intent.baselineSemanticDigest)))
+    && typeof intent.artifactSha256 === 'string' && /^[a-f0-9]{64}$/.test(intent.artifactSha256)
+    && typeof intent.semanticDigest === 'string' && /^[a-f0-9]{64}$/.test(intent.semanticDigest)
+    && (intent.state === 'awaiting-repair' ? intent.baselineSemanticDigest === intent.semanticDigest : true);
+}
+
+function readArtifactRepairIntent(
+  repoRoot: string,
+  taskId: string,
+  family: ArtifactSchemaFamily,
+  artifact: string
+): ArtifactRepairIntent | null {
+  const target = intentPath(repoRoot, taskId, family, artifact);
+  if (!fs.existsSync(target)) return null;
+  let value: unknown;
+  try { value = JSON.parse(fs.readFileSync(target, 'utf8')) as unknown; }
+  catch (error) { throw new Error(`ARTIFACT_REPAIR_INTENT_INVALID: ${String(error)}`); }
+  if (!isArtifactRepairIntent(value) || value.taskId !== taskId || value.family !== family || value.artifact !== artifact) {
+    throw new Error('ARTIFACT_REPAIR_INTENT_INVALID: repair provenance schema is invalid');
+  }
+  return value;
+}
+
+function writeArtifactRepairIntent(repoRoot: string, value: ArtifactRepairIntent): void {
+  if (!isArtifactRepairIntent(value)) throw new Error('ARTIFACT_REPAIR_INTENT_INVALID: repair provenance schema is invalid');
+  const directory = intentRoot(repoRoot);
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  const target = intentPath(repoRoot, value.taskId, value.family, value.artifact);
+  const temporary = `${target}.${process.pid}.${Date.now()}.tmp`;
+  fs.writeFileSync(temporary, `${JSON.stringify(value)}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+  try { fs.renameSync(temporary, target); }
+  catch (error) {
+    try { fs.unlinkSync(temporary); } catch { /* preserve primary error */ }
+    throw error;
+  }
+}
+
+export { readArtifactRepairIntent, writeArtifactRepairIntent };
+export type { ArtifactRepairIntent };

package/lib/task/artifact-schema.ts

@@ -0,0 +1,192 @@
+type ArtifactFamily =
+  | 'analysis'
+  | 'review-analysis'
+  | 'plan'
+  | 'review-plan'
+  | 'code'
+  | 'review-code'
+  | 'manual-validation'
+  | 'validation-run'
+  | 'pr-review';
+
+type ArtifactSchemaFamily = Exclude<ArtifactFamily, 'manual-validation' | 'validation-run' | 'pr-review'>;
+type ArtifactLocale = 'zh-CN' | 'en';
+type ArtifactSection = Readonly<{
+  id: string;
+  order: number;
+  headings: Readonly<{ zh: string; en: string }>;
+  marker: string;
+}>;
+type ArtifactSchema = Readonly<{
+  family: ArtifactSchemaFamily;
+  title: Readonly<{ zh: string; en: string }>;
+  sections: readonly ArtifactSection[];
+  requiredPatterns: readonly string[];
+}>;
+type ArtifactSkeletonInput = Readonly<{
+  taskId: string;
+  family: ArtifactSchemaFamily;
+  artifact: string;
+  locale?: ArtifactLocale;
+}>;
+
+type ArtifactFamilySpec = Readonly<{
+  family: ArtifactFamily;
+  sectionAliases: readonly [string, string];
+  heading: string;
+  labels: readonly [string, string];
+}>;
+
+const ARTIFACT_FAMILY_CATALOG = [
+  { family: 'analysis', sectionAliases: ['分析', 'Analysis'], heading: '分析', labels: ['需求分析报告', 'Requirements Analysis'] },
+  { family: 'review-analysis', sectionAliases: ['审查反馈', 'Review Feedback'], heading: '审查反馈', labels: ['需求分析审查', 'Analysis Review'] },
+  { family: 'plan', sectionAliases: ['设计', 'Design'], heading: '设计', labels: ['技术方案', 'Technical Plan'] },
+  { family: 'review-plan', sectionAliases: ['审查反馈', 'Review Feedback'], heading: '审查反馈', labels: ['技术方案审查', 'Plan Review'] },
+  { family: 'code', sectionAliases: ['实现备注', 'Implementation Notes'], heading: '实现备注', labels: ['实现报告', 'Implementation Report'] },
+  { family: 'review-code', sectionAliases: ['审查反馈', 'Review Feedback'], heading: '审查反馈', labels: ['代码审查', 'Code Review'] },
+  { family: 'manual-validation', sectionAliases: ['实现备注', 'Implementation Notes'], heading: '实现备注', labels: ['人工验证', 'Manual Validation'] },
+  { family: 'validation-run', sectionAliases: ['实现备注', 'Implementation Notes'], heading: '实现备注', labels: ['验证运行证据', 'Validation Run Evidence'] },
+  { family: 'pr-review', sectionAliases: ['审查反馈', 'Review Feedback'], heading: '审查反馈', labels: ['PR 审查报告', 'PR Review Report'] }
+] as const satisfies readonly ArtifactFamilySpec[];
+
+const LOCAL_SECTIONS = {
+  analysis: [
+    ['source', '需求来源', 'Requirements Source'],
+    ['understanding', '需求理解', 'Requirements Understanding'],
+    ['files', '相关文件', 'Related Files'],
+    ['impact', '影响评估', 'Impact Assessment'],
+    ['risks', '技术风险', 'Technical Risks'],
+    ['effort', '工作量和复杂度评估', 'Effort and Complexity Assessment'],
+    ['state-check', '状态核对', 'State Check']
+  ],
+  plan: [
+    ['understanding', '问题理解', 'Problem Understanding'],
+    ['constraints', '约束条件', 'Constraints'],
+    ['options', '方案对比', 'Options Comparison'],
+    ['approach', '技术方法', 'Technical Approach'],
+    ['steps', '实施步骤', 'Implementation Steps'],
+    ['files', '文件清单', 'File List'],
+    ['verification', '验证策略', 'Verification Strategy'],
+    ['state-check', '状态核对', 'State Check']
+  ],
+  code: [
+    ['input', '实现输入', 'Implementation Input'],
+    ['files', '变更文件', 'Changed Files'],
+    ['key-code', '关键代码说明', 'Key Code Notes'],
+    ['tests', '测试结果', 'Test Results'],
+    ['deviations', '与方案的差异', 'Differences from Plan'],
+    ['review-focus', '供审查关注的内容', 'Review Focus'],
+    ['state-check', '状态核对', 'State Check'],
+    ['evidence', '证据原文', 'Raw Evidence']
+  ],
+  'review-analysis': [
+    ['summary', '审查摘要', 'Review Summary'],
+    ['coverage', '检视覆盖声明', 'Inspection Coverage'],
+    ['specialized-coverage', '需求分析专项覆盖', 'Requirements Analysis Coverage'],
+    ['traceability', '追踪矩阵', 'Traceability Matrix'],
+    ['issues', '问题清单', 'Findings'],
+    ['non-blocking', '非阻塞建议', 'Non-blocking Suggestions'],
+    ['manual-validation', '人工校验项', 'Manual Validation Items'],
+    ['conclusion', '结论与建议', 'Conclusion and Recommendation'],
+    ['state-check', '状态核对', 'State Check'],
+    ['evidence', '证据原文', 'Raw Evidence'],
+    ['self-critique', '自我质疑', 'Self-critique'],
+    ['ledger-writeback', '审查分歧账本回写', 'Review Disagreement Ledger Write-back']
+  ],
+  'review-plan': [
+    ['summary', '审查摘要', 'Review Summary'],
+    ['coverage', '检视覆盖声明', 'Inspection Coverage'],
+    ['specialized-coverage', '技术方案架构覆盖', 'Technical Plan Architecture Coverage'],
+    ['traceability', '追踪矩阵', 'Traceability Matrix'],
+    ['issues', '问题清单', 'Findings'],
+    ['non-blocking', '非阻塞建议', 'Non-blocking Suggestions'],
+    ['manual-validation', '人工校验项', 'Manual Validation Items'],
+    ['conclusion', '结论与建议', 'Conclusion and Recommendation'],
+    ['state-check', '状态核对', 'State Check'],
+    ['evidence', '证据原文', 'Raw Evidence'],
+    ['self-critique', '自我质疑', 'Self-critique'],
+    ['ledger-writeback', '审查分歧账本回写', 'Review Disagreement Ledger Write-back']
+  ],
+  'review-code': [
+    ['summary', '审查摘要', 'Review Summary'],
+    ['coverage', '检视覆盖声明', 'Inspection Coverage'],
+    ['specialized-coverage', '代码实现专项覆盖', 'Code Implementation Coverage'],
+    ['traceability', '追踪矩阵', 'Traceability Matrix'],
+    ['issues', '问题清单', 'Findings'],
+    ['non-blocking', '非阻塞建议', 'Non-blocking Suggestions'],
+    ['manual-validation', '人工校验项', 'Manual Validation Items'],
+    ['conclusion', '结论与建议', 'Conclusion and Recommendation'],
+    ['state-check', '状态核对', 'State Check'],
+    ['evidence', '证据原文', 'Raw Evidence'],
+    ['self-critique', '自我质疑', 'Self-critique'],
+    ['ledger-writeback', '审查分歧账本回写', 'Review Disagreement Ledger Write-back']
+  ]
+} as const;
+
+function buildSections(family: ArtifactSchemaFamily): readonly ArtifactSection[] {
+  return LOCAL_SECTIONS[family].map(([id, zh, en], index) => ({
+    id,
+    order: index + 1,
+    headings: { zh, en },
+    marker: `artifact-section:${family}:${id}`
+  }));
+}
+
+const ARTIFACT_SCHEMAS: readonly ArtifactSchema[] = [
+  { family: 'analysis', title: { zh: '需求分析报告', en: 'Requirements Analysis' }, sections: buildSections('analysis'), requiredPatterns: ['^\\$ '] },
+  { family: 'review-analysis', title: { zh: '需求分析审查报告', en: 'Analysis Review Report' }, sections: buildSections('review-analysis'), requiredPatterns: ['^### (?:审查决定|Approval Decision)$', '^\\$ '] },
+  { family: 'plan', title: { zh: '技术方案', en: 'Technical Plan' }, sections: buildSections('plan'), requiredPatterns: ['^\\$ '] },
+  { family: 'review-plan', title: { zh: '技术方案审查报告', en: 'Plan Review Report' }, sections: buildSections('review-plan'), requiredPatterns: ['^### (?:审查决定|Approval Decision)$', '^\\$ '] },
+  { family: 'code', title: { zh: '实现报告', en: 'Implementation Report' }, sections: buildSections('code'), requiredPatterns: ['^\\$ '] },
+  { family: 'review-code', title: { zh: '代码审查报告', en: 'Code Review Report' }, sections: buildSections('review-code'), requiredPatterns: [
+    '^### (?:审查决定|Approval Decision)$',
+    '^\\$ ',
+    '^- \\*\\*(?:总体结论|Overall Verdict)\\*\\*[:：]\\s*(?:通过|需要修改|拒绝|Approved|Changes Requested|Rejected)\\s*$',
+    '^- \\*\\*(?:审查基线提交|Review Baseline Commit)\\*\\*[:：]\\s*\\S',
+    '^- \\*\\*(?:审查差异基线|Reviewed Diff Base)\\*\\*[:：]\\s*[0-9a-f]{40,64}\\s*$',
+    '^- \\*\\*(?:审查差异指纹|Reviewed Diff Fingerprint)\\*\\*[:：]\\s*sha256:[0-9a-f]{64}\\s*$',
+    '^- \\*\\*(?:审查快照树|Reviewed Snapshot Tree)\\*\\*[:：]\\s*[0-9a-f]{40,64}\\s*$'
+  ] }
+];
+
+function getArtifactSchema(family: string): ArtifactSchema | null {
+  return ARTIFACT_SCHEMAS.find((schema) => schema.family === family) ?? null;
+}
+
+function renderArtifactSkeleton(input: ArtifactSkeletonInput): string {
+  const schema = getArtifactSchema(input.family);
+  if (!schema) throw new Error(`unknown artifact schema family '${input.family}'`);
+  const locale = input.locale ?? 'zh-CN';
+  const roundMatch = input.artifact.match(/-r(\d+)\.md$/);
+  const round = roundMatch ? Number(roundMatch[1]) : 1;
+  const title = schema.title[locale === 'en' ? 'en' : 'zh'];
+  const headings = locale === 'en' ? 'en' : 'zh';
+  const lines = [
+    `<!-- artifact-context:${input.taskId}:${input.family}:${round} -->`,
+    `# ${title}`,
+    ''
+  ];
+  for (const section of schema.sections) {
+    lines.push(`## ${section.headings[headings]}`);
+    lines.push(`<!-- ${section.marker} -->`);
+    lines.push('<!-- artifact-slot:empty -->');
+    lines.push('');
+  }
+  return `${lines.join('\n').trimEnd()}\n`;
+}
+
+export {
+  ARTIFACT_FAMILY_CATALOG,
+  ARTIFACT_SCHEMAS,
+  getArtifactSchema,
+  renderArtifactSkeleton
+};
+export type {
+  ArtifactFamily,
+  ArtifactFamilySpec,
+  ArtifactLocale,
+  ArtifactSchema,
+  ArtifactSchemaFamily,
+  ArtifactSection,
+  ArtifactSkeletonInput
+};

package/lib/task/capabilities.ts

@@ -11,6 +11,10 @@ import { parseReworkIntentDocument } from './rework-intent.ts';
 import type { ReworkIntent } from './rework-intent.ts';
 import { sha256File } from './artifact-receipts.ts';
 import { hasOpenLifecycleExecution } from './activity-log.ts';
+import { parseQualificationAudit, parseTaskQualification } from './qualification-audit.ts';
+import type { QualificationAudit, TaskQualification } from './qualification-audit.ts';
+
+const ARTIFACT_AUDIT_FAMILIES = new Set(['analysis', 'review-analysis', 'plan', 'review-plan', 'code', 'review-code']);
 
 type LifecycleAction =
   | 'analysis' | 'review-analysis' | 'plan' | 'review-plan'
@@ -42,6 +46,8 @@ type LifecycleFacts = {
   unresolvedLedger: Record<'analysis' | 'plan' | 'code', number>;
   executionBusy: boolean;
   recommendedAction?: LifecycleAction | null;
+  qualificationStale?: boolean;
+  qualificationStaleArtifacts?: readonly string[];
 };
 type CapabilityResult = {
   allowed: boolean;
@@ -86,6 +92,9 @@ function canStart(action: LifecycleAction, facts: LifecycleFacts, trigger: Expli
   }
   if (facts.taskState !== 'active') return deny('TASK_NOT_ACTIVE', `state=${facts.taskState}`);
   if (invalidationBlocks(facts.invalidation)) return deny('INVALIDATION_INCOMPLETE');
+  if (facts.qualificationStale && facts.recommendedAction !== action) {
+    return deny('QUALIFICATION_STALE', ...(facts.qualificationStaleArtifacts ?? ['qualification audit is stale']));
+  }
   if (facts.executionBusy) return deny('EXECUTION_BUSY');
 
   const implicit = trigger.explicitRequest === false;
@@ -154,8 +163,42 @@ function reviewMatchesLatest(facts: LifecycleFacts, source: 'analysis' | 'plan'
   return Boolean(latestSource && facts.reviewedInputs?.[review] === latestSource);
 }
 
+function qualificationCandidateSnapshotMatches(
+  audit: QualificationAudit,
+  qualification: TaskQualification
+): boolean {
+  const current = new Map(qualification.candidates.map((candidate) => [candidate.candidateId, candidate]));
+  return audit.candidateQualifications.length === current.size && audit.candidateQualifications.every((row) => {
+    const candidate = current.get(row.candidateId);
+    return Boolean(candidate && candidate.status === row.status && candidate.impact === row.impact
+      && candidate.evidence === row.evidence && candidate.constraintIds.join(',') === row.constraintIds.join(','));
+  });
+}
+
+const QUALIFICATION_RECOVERY_ORDER: ReadonlyArray<{ action: LifecycleAction; pattern: RegExp }> = [
+  { action: 'analysis', pattern: /^analysis(?:-r\d+)?\.md$/ },
+  { action: 'review-analysis', pattern: /^review-analysis(?:-r\d+)?\.md$/ },
+  { action: 'plan', pattern: /^plan(?:-r\d+)?\.md$/ },
+  { action: 'review-plan', pattern: /^review-plan(?:-r\d+)?\.md$/ },
+  { action: 'code', pattern: /^code(?:-r\d+)?\.md$/ },
+  { action: 'review-code', pattern: /^review-code(?:-r\d+)?\.md$/ }
+];
+
+function qualificationRecoveryAction(facts: LifecycleFacts): LifecycleAction | null {
+  const stale = facts.qualificationStaleArtifacts ?? [];
+  return QUALIFICATION_RECOVERY_ORDER.find(({ pattern }) => stale.some((name) => pattern.test(name)))?.action ?? null;
+}
+
 function recommendNext(facts: LifecycleFacts): LifecycleRecommendation {
   if (invalidationBlocks(facts.invalidation)) return { action: null, reasonCode: 'INVALIDATION_INCOMPLETE', evidence: ['reconcile task invalidation before routing'] };
+  if (facts.qualificationStale) {
+    const action = qualificationRecoveryAction(facts);
+    return {
+      action,
+      reasonCode: 'QUALIFICATION_RECOVERY_REQUIRED',
+      evidence: facts.qualificationStaleArtifacts ?? ['qualification audit is stale']
+    };
+  }
   const pendingIntent = (facts.reworkIntents ?? []).find((intent) => intent.status === 'pending');
   if (pendingIntent) return { action: pendingIntent.target, reasonCode: 'REWORK_INTENT_PENDING', evidence: [pendingIntent.intentId, pendingIntent.findingId] };
   if (!hasArtifact(facts, 'analysis')) return { action: 'analysis', reasonCode: 'ANALYSIS_ARTIFACT_MISSING', evidence: ['analysis artifact is absent'] };
@@ -226,6 +269,28 @@ function buildLifecycleFacts(taskDir: string, content: string, taskState = 'acti
         family, files.filter((name) => artifactFamilies[family].test(name) && isArtifactInvalidated(invalidation.document, family, name))
       ])
     ) as Partial<Record<LifecycleAction, readonly string[]>>;
+    const qualification = parseTaskQualification(content);
+    if (!qualification.ok) return { ok: false, code: 'TASK_CAPABILITY_FACTS_INVALID', message: qualification.message };
+    const qualificationStaleArtifacts: string[] = [];
+    if (qualification.qualification.present) {
+      const constraints = new Map(qualification.qualification.constraints.map((row) => [row.constraintId, row.digest]));
+      for (const family of Object.keys(artifactFamilies) as Array<keyof typeof artifactFamilies>) {
+        if (!ARTIFACT_AUDIT_FAMILIES.has(family)) continue;
+        const name = latestArtifact(artifacts[family] ?? []);
+        if (!name) continue;
+        let auditContent: string;
+        try { auditContent = fs.readFileSync(path.join(taskDir, name), 'utf8'); }
+        catch { qualificationStaleArtifacts.push(name); continue; }
+        const audit = parseQualificationAudit(auditContent);
+        if (!audit.ok || !audit.audit.present || !audit.audit.snapshot) { qualificationStaleArtifacts.push(name); continue; }
+        const constraintsChanged = audit.audit.constraintDependencies.some((dependency) => constraints.get(dependency.constraintId) !== dependency.constraintDigest);
+        const taskInputChanged = audit.audit.snapshot.taskInputDigest !== qualification.qualification.taskInputDigest;
+        if (audit.audit.snapshot.nonConstraintInputDigest !== qualification.qualification.nonConstraintInputDigest
+          || constraintsChanged
+          || (taskInputChanged && !constraintsChanged)
+          || (taskInputChanged && !qualificationCandidateSnapshotMatches(audit.audit, qualification.qualification))) qualificationStaleArtifacts.push(name);
+      }
+    }
     const reviews: LifecycleFacts['reviews'] = {};
     const reviewedInputs: NonNullable<LifecycleFacts['reviewedInputs']> = {};
     for (const family of ['review-analysis', 'review-plan', 'review-code'] as const) {
@@ -249,7 +314,11 @@ function buildLifecycleFacts(taskDir: string, content: string, taskState = 'acti
       taskState, currentStep: String(metadata.current_step ?? ''), artifacts, reviews,
       staleArtifacts, reviewedInputs, artifactHashes,
       invalidation: invalidation.document, reworkIntents: rework.intents,
-      unresolvedLedger, executionBusy: executionBusy || hasOpenLifecycleExecution(content), recommendedAction: null
+      unresolvedLedger,
+      executionBusy: executionBusy || hasOpenLifecycleExecution(content),
+      recommendedAction: null,
+      qualificationStale: qualificationStaleArtifacts.length > 0,
+      qualificationStaleArtifacts
     };
     facts.recommendedAction = recommendNext(facts).action;
     return { ok: true, facts };

package/lib/task/control-authority.ts

@@ -20,7 +20,11 @@ import {
   sealOrchestrationDelegation,
   statusOrchestration
 } from './orchestration.ts';
-import type { OrchestrationOptions, OrchestrationResult } from './orchestration.ts';
+import type {
+  OrchestrationDiagnosticLogger,
+  OrchestrationOptions,
+  OrchestrationResult
+} from './orchestration.ts';
 import { prepareCodexOrchestrationDelegation } from './codex-orchestration.ts';
 import {
   applyTaskFinalization,
@@ -60,6 +64,7 @@ export type TaskControlExecutionContext =
       generation: string;
       manifestPath: string;
       requestId: string;
+      diagnosticLog?: OrchestrationDiagnosticLogger;
       controllerBinding?: TaskControlControllerBinding | null;
     }>;
 
@@ -134,6 +139,7 @@ export function createSandboxExecutorExecutionContext(params: Readonly<{
   generation: string;
   manifestPath: string;
   requestId: string;
+  diagnosticLog?: OrchestrationDiagnosticLogger;
   controllerBinding?: TaskControlControllerBinding | null;
 }>): TaskControlExecutionContext {
   if (!/^TASK-\d{8}-\d{6}$/u.test(params.taskId) || !params.generation || !params.requestId) {
@@ -153,6 +159,7 @@ export function createSandboxExecutorExecutionContext(params: Readonly<{
     generation: params.generation,
     manifestPath: absolute('manifestPath', params.manifestPath),
     requestId: params.requestId,
+    ...(params.diagnosticLog === undefined ? {} : { diagnosticLog: params.diagnosticLog }),
     ...(params.controllerBinding === undefined ? {} : { controllerBinding: binding(params.controllerBinding) })
   };
 }
@@ -192,6 +199,9 @@ function domainOptions(
   return {
     ...options,
     repoRoot: context.repoRoot,
+    ...(context.source === 'sandbox-executor' && context.diagnosticLog !== undefined
+      ? { diagnosticLog: context.diagnosticLog }
+      : {}),
     ...(context.source === 'sandbox-executor' ? { gitWorktreeRoot: context.worktreeRoot } : {})
   };
 }

package/lib/task/create-service.ts

@@ -12,6 +12,13 @@ import { verifyTaskEvent } from './verification.ts';
 type TaskCreateStatus = 'applied' | 'no-op' | 'degraded' | 'failed' | 'blocked';
 type TaskCreateOperation = { name: string; status: string; reasonCode: string | null };
 type TaskCreateWarning = { code: string; severity: string; action: string };
+type TaskCreateRecovery = 'none' | 'same-request-id' | 'new-request-id' | 'inspect-domain-state';
+type TaskCreateControl = Readonly<{
+  requestId: string | null;
+  accepted: boolean;
+  recovery: TaskCreateRecovery;
+}>;
+type TaskCreateError = { code: string; message: string; retryable: boolean };
 type TaskCreateResult = Readonly<{
   status: TaskCreateStatus;
   changed: boolean;
@@ -19,7 +26,8 @@ type TaskCreateResult = Readonly<{
   issue: { number: number; url: string } | null;
   operations: readonly TaskCreateOperation[];
   warnings: readonly TaskCreateWarning[];
-  error: { code: string; message: string; retryable: boolean } | null;
+  error: TaskCreateError | null;
+  control?: TaskCreateControl;
 }>;
 
 type CreateTaskOptions = Readonly<{
@@ -42,6 +50,116 @@ const DEFAULT_DEPENDENCIES: TaskCreateDependencies = {
   addWarning: applyWorkflowWarningIntent
 };
 
+function invalidTaskCreateResult(): never {
+  throw new Error('TASK_CREATE_RESULT_INVALID');
+}
+
+function exactKeys(value: Record<string, unknown>, expected: readonly string[]): boolean {
+  return Object.keys(value).sort().join(',') === [...expected].sort().join(',');
+}
+
+function validTaskReference(value: unknown): boolean {
+  return value === null || (typeof value === 'string' && value.length > 0);
+}
+
+function validTaskCreateError(value: unknown): value is TaskCreateError {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const error = value as Record<string, unknown>;
+  return exactKeys(error, ['code', 'message', 'retryable'])
+    && typeof error.code === 'string' && /^[A-Z][A-Z0-9_]+$/u.test(error.code)
+    && typeof error.message === 'string'
+    && typeof error.retryable === 'boolean';
+}
+
+function validTaskCreateControl(value: unknown): value is TaskCreateControl {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const control = value as Record<string, unknown>;
+  return exactKeys(control, ['accepted', 'recovery', 'requestId'])
+    && validTaskReference(control.requestId)
+    && typeof control.accepted === 'boolean'
+    && ['none', 'same-request-id', 'new-request-id', 'inspect-domain-state'].includes(control.recovery as string);
+}
+
+export function parseTaskCreateResult(value: unknown): TaskCreateResult {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return invalidTaskCreateResult();
+  const result = value as Record<string, unknown>;
+  if (!exactKeys(result, ['changed', 'control', 'error', 'issue', 'operations', 'status', 'task', 'warnings'])
+    && !exactKeys(result, ['changed', 'error', 'issue', 'operations', 'status', 'task', 'warnings'])) {
+    return invalidTaskCreateResult();
+  }
+  if (!['applied', 'no-op', 'degraded', 'failed', 'blocked'].includes(result.status as string)
+    || typeof result.changed !== 'boolean'
+    || !result.task || typeof result.task !== 'object' || Array.isArray(result.task)
+    || !exactKeys(result.task as Record<string, unknown>, ['id', 'shortId'])
+    || !validTaskReference((result.task as { id?: unknown }).id)
+    || !validTaskReference((result.task as { shortId?: unknown }).shortId)
+    || !Array.isArray(result.operations)
+    || !result.operations.every((operation) => {
+      if (!operation || typeof operation !== 'object' || Array.isArray(operation)) return false;
+      const value = operation as Record<string, unknown>;
+      return exactKeys(value, ['name', 'reasonCode', 'status'])
+        && typeof value.name === 'string' && typeof value.status === 'string'
+        && (value.reasonCode === null || typeof value.reasonCode === 'string');
+    })
+    || !Array.isArray(result.warnings)
+    || !result.warnings.every((warning) => {
+      if (!warning || typeof warning !== 'object' || Array.isArray(warning)) return false;
+      const value = warning as Record<string, unknown>;
+      return exactKeys(value, ['action', 'code', 'severity'])
+        && typeof value.action === 'string' && typeof value.code === 'string' && typeof value.severity === 'string';
+    })
+    || (result.issue !== null && (
+      !result.issue || typeof result.issue !== 'object' || Array.isArray(result.issue)
+      || !exactKeys(result.issue as Record<string, unknown>, ['number', 'url'])
+      || !Number.isSafeInteger((result.issue as { number?: unknown }).number)
+      || ((result.issue as { number: number }).number) <= 0
+      || typeof (result.issue as { url?: unknown }).url !== 'string'
+    ))
+    || (result.error !== null && !validTaskCreateError(result.error))
+    || ('control' in result && !validTaskCreateControl(result.control))) {
+    return invalidTaskCreateResult();
+  }
+  if (result.status === 'blocked' && !(result.error as TaskCreateError | null)?.retryable) return invalidTaskCreateResult();
+  if (result.status === 'failed' && !(result.error as TaskCreateError | null)) return invalidTaskCreateResult();
+  return result as unknown as TaskCreateResult;
+}
+
+export function projectTaskCreateResult(result: TaskCreateResult, control: TaskCreateControl): TaskCreateResult {
+  return { ...result, control };
+}
+
+export function taskCreateExitCode(result: Pick<TaskCreateResult, 'status'>): number {
+  return result.status === 'blocked' ? 2 : result.status === 'failed' ? 1 : 0;
+}
+
+export function taskCreateFailure(
+  error: TaskCreateError,
+  control?: TaskCreateControl
+): TaskCreateResult {
+  return {
+    status: error.retryable ? 'blocked' : 'failed',
+    changed: false,
+    task: { id: null, shortId: null },
+    issue: null,
+    operations: [],
+    warnings: [],
+    error,
+    ...(control ? { control } : {})
+  };
+}
+
+export function taskCreateOutputUnavailableResult(requestId: string): TaskCreateResult {
+  return taskCreateFailure({
+    code: 'SANDBOX_CONTROL_OUTPUT_UNAVAILABLE',
+    message: 'SANDBOX_CONTROL_OUTPUT_UNAVAILABLE: task-create result output was not retained; inspect domain state before retrying',
+    retryable: false
+  }, {
+    requestId,
+    accepted: true,
+    recovery: 'inspect-domain-state'
+  });
+}
+
 async function verifyCreatedTask(repoRoot: string, taskId: string): Promise<{ operation: TaskCreateOperation; error: TaskCreateResult['error'] }> {
   const verification = await verifyTaskEvent(
     { taskRef: taskId, event: 'create-task.completed' },
@@ -91,10 +209,7 @@ async function createTask(value: unknown, options: CreateTaskOptions): Promise<T
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     const code = /^([A-Z][A-Z0-9_]+)/.exec(message)?.[1] ?? 'TASK_CREATE_FAILED';
-    return {
-      status: 'failed', changed: false, task: { id: null, shortId: null }, issue: null,
-      operations: [], warnings: [], error: { code, message, retryable: code === 'TASK_CREATE_LOCK_TIMEOUT' }
-    };
+    return taskCreateFailure({ code, message, retryable: code === 'TASK_CREATE_LOCK_TIMEOUT' });
   }
 
   const operations: TaskCreateOperation[] = [{
@@ -168,4 +283,14 @@ async function createTask(value: unknown, options: CreateTaskOptions): Promise<T
 }
 
 export { createTask };
-export type { CreateTaskOptions, TaskCreateDependencies, TaskCreateOperation, TaskCreateResult, TaskCreateStatus, TaskCreateWarning };
+export type {
+  CreateTaskOptions,
+  TaskCreateControl,
+  TaskCreateDependencies,
+  TaskCreateError,
+  TaskCreateOperation,
+  TaskCreateRecovery,
+  TaskCreateResult,
+  TaskCreateStatus,
+  TaskCreateWarning
+};

package/lib/task/create.ts

@@ -7,6 +7,7 @@ import { loadShortIdByTaskId, mutateShortIdRegistry } from './short-id.ts';
 import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.ts';
 import { readDeliveryDefaults, validateBaseRef, validateRemote } from './delivery-target.ts';
 import { buildUnboundFact, encodePrDeliveryFact } from './pr-delivery-fact.ts';
+import { CANDIDATE_COLUMNS, CONSTRAINT_COLUMNS } from './qualification-audit.ts';
 
 const AGENTS = ['claude', 'codex', 'antigravity', 'opencode', 'cursor'] as const;
 const TYPES = ['feature', 'bugfix', 'refactor', 'docs', 'chore'] as const;
@@ -178,6 +179,25 @@ function renderList(items: readonly string[]): string {
   return items.map((item) => `- ${item}`).join('\n');
 }
 
+function tableCell(value: string): string {
+  return value.replace(/\\/g, '\\\\').replace(/\|/g, '\\|').replace(/[\r\n]/g, ' ');
+}
+
+function renderTable(columns: readonly string[], rows: readonly (readonly string[])[]): string {
+  return [
+    `| ${columns.join(' | ')} |`,
+    `| ${columns.map(() => '---').join(' | ')} |`,
+    ...rows.map((row) => `| ${row.map(tableCell).join(' | ')} |`)
+  ].join('\n');
+}
+
+function appendCanonicalRows(content: string, columns: readonly string[], rows: readonly (readonly string[])[]): string {
+  if (rows.length === 0) return content;
+  const table = renderTable(columns, rows);
+  const separator = `| ${columns.map(() => '---').join(' | ')} |`;
+  return content.replace(separator, `${separator}\n${table.split('\n').slice(2).join('\n')}`);
+}
+
 function replaceEmptySubsection(content: string, heading: string, items: readonly string[]): string {
   if (items.length === 0) return content;
   return content.replace(`${heading}\n`, `${heading}\n\n${renderList(items)}\n`);
@@ -231,6 +251,13 @@ function renderTask(params: Readonly<{
     ['### 验收标准', 'acceptanceCriteria'], ['### 未决事项', 'openQuestions']
   ];
   for (const [heading, key] of sections) content = replaceEmptySubsection(content, heading, candidate.taskInput[key]);
+  const constraintIds = candidate.taskInput.constraints.map((_, index) => `C-${index + 1}`);
+  content = appendCanonicalRows(content, CONSTRAINT_COLUMNS, candidate.taskInput.constraints.map((statement, index) => [
+    constraintIds[index]!, statement, 'assumption', 'create-task', 'taskInput', 'create-task input', '', ''
+  ]));
+  content = appendCanonicalRows(content, CANDIDATE_COLUMNS, candidate.taskInput.alternatives.map((statement, index) => [
+    String.fromCharCode(65 + index), statement, 'pending', constraintIds.join(','), 'requires qualification', 'create-task input'
+  ]));
   content = content.replace('- **关联 Issue**：#XXX', '- **关联 Issue**：N/A');
   content = content.replace('- **关联 PR**：#XXX', '- **关联 PR**：N/A');
   content = content.replace('- **分支**：`feature/xxx`', `- **分支**：\`${branch}\``);