@fitlab-ai/agent-infra 0.9.13 → 0.9.15

package/lib/task/control-recovery.ts

@@ -0,0 +1,174 @@
+import { createHash } from 'node:crypto';
+import { isCompletionEvidence } from './orchestration.ts';
+import { TASK_WORKFLOW_OPERATIONS } from './workflow-command.ts';
+
+export type ControlRecoveryOutcome = 'not-executed' | 'in-progress' | 'success' | 'failure' | 'unknown' | 'rejected';
+
+/** Normalize the command result once at the control transport boundary. */
+export function parseControlOutput(output: string | null): Record<string, unknown> | null {
+  if (output === null) return null;
+  try {
+    const value = JSON.parse(output);
+    if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+    return value.result && typeof value.result === 'object' && !Array.isArray(value.result) ? value.result : value;
+  } catch { return null; }
+}
+
+export type ControlRecoveryOperation = Readonly<{
+  family: 'task-lifecycle' | 'task-finalization' | 'task-orchestration' | 'task-create' | 'codex-controller' | 'task-workflow';
+  intent: string;
+  class: string;
+}>;
+
+export type ControlRecoveryBinding = Readonly<{
+  requestId: string;
+  generation: string;
+  taskId: string | null;
+  intentDigest: string;
+}>;
+
+export type ControlRecoveryInput = Readonly<{
+  operation: ControlRecoveryOperation;
+  binding: ControlRecoveryBinding;
+  startedCommitted: boolean;
+  terminalResult?: Readonly<Record<string, unknown>> | null;
+  criticalPhases?: readonly string[];
+  domain?: Readonly<Record<string, unknown>> | null;
+  journal?: Readonly<{
+    exists: boolean;
+    completedSteps?: readonly string[];
+    failure?: string | null;
+  }> | null;
+  explicitRejection?: boolean;
+  evidenceConflict?: boolean;
+}>;
+
+export const SANDBOX_CONTROL_REQUIRED_COMPLETION_PHASES = Object.freeze([
+  'completed', 'evidence-written', 'publish-authorized'
+] as const);
+
+export type ControlRecoveryDecision = Readonly<{
+  outcome: ControlRecoveryOutcome;
+  responseReconstructable: boolean;
+  reasonCode: string;
+}>;
+
+const LIFECYCLE_INTENTS = ['block', 'activate', 'cancel', 'complete', 'close-codescan', 'close-dependabot', 'restore'] as const;
+const ORCHESTRATION_INTENTS = [
+  'begin-or-resume', 'route.read', 'route.clean-completion', 'status', 'prepare', 'dispatch',
+  'await-activation', 'recover-prepared', 'hook-start', 'hook-stop', 'advance', 'pause'
+] as const;
+
+export const SANDBOX_CONTROL_RECOVERY_OPERATIONS: readonly ControlRecoveryOperation[] = Object.freeze([
+  ...LIFECYCLE_INTENTS.map((intent) => ({ family: 'task-lifecycle' as const, intent, class: 'lifecycle-mutation' })),
+  { family: 'task-finalization', intent: 'complete', class: 'finalization' },
+  ...ORCHESTRATION_INTENTS.map((intent) => ({
+    family: 'task-orchestration' as const,
+    intent,
+    class: intent === 'route.clean-completion' ? 'route.clean-completion' : intent === 'route.read' || intent === 'status' ? 'read-only' : 'orchestration'
+  })),
+  { family: 'task-create', intent: 'create', class: 'task-create' },
+  ...TASK_WORKFLOW_OPERATIONS.map((intent) => ({ family: 'task-workflow' as const, intent, class: intent === 'artifact-inspect' || intent === 'decision-next-id' ? 'read-only' : 'workflow' })),
+  ...(['open', 'close', 'verify'] as const).map((intent) => ({ family: 'codex-controller' as const, intent, class: 'codex-controller' }))
+]);
+
+export function digestControlRecoveryIntent(family: string, intent: string): string {
+  return createHash('sha256').update(`${family}\0${intent}`, 'utf8').digest('hex');
+}
+
+export function findSandboxControlRecoveryOperation(family: ControlRecoveryOperation['family'], intent: string): ControlRecoveryOperation | null {
+  return SANDBOX_CONTROL_RECOVERY_OPERATIONS.find((operation) => operation.family === family && operation.intent === intent) ?? null;
+}
+
+function bindingMatchesResult(binding: ControlRecoveryBinding, result: Readonly<Record<string, unknown>>): boolean {
+  return result.requestId === binding.requestId
+    && result.generation === binding.generation
+    && (result.taskId === undefined || result.taskId === binding.taskId)
+    && (result.intentDigest === undefined || result.intentDigest === binding.intentDigest);
+}
+
+function domainEvidenceMatches(
+  operation: ControlRecoveryOperation,
+  result: Readonly<Record<string, unknown>>,
+  domain: Readonly<Record<string, unknown>> | null | undefined
+): boolean {
+  if (!domain) return false;
+  if (domain.consistent !== true) return false;
+  if (operation.class === 'route.clean-completion') {
+    const completion = domain.completionEvidence as Record<string, unknown> | undefined;
+    const snapshot = domain.snapshot as Record<string, unknown> | undefined;
+    const lastReviewedCommit = domain.lastReviewedCommit;
+    return result.status === 'completed'
+      && domain.status === 'completed'
+      && domain.pendingDelegation === null
+      && isCompletionEvidence(completion)
+      && snapshot?.head === completion.head
+      && snapshot.headTree === completion.headTree
+      && snapshot.worktreeTree === completion.worktreeTree
+      && lastReviewedCommit === completion.lastReviewedCommit;
+  }
+  if (operation.class === 'read-only') return result.changed === false && domain.snapshotValid === true;
+  return true;
+}
+
+export function classifySandboxControlRecovery(input: ControlRecoveryInput): ControlRecoveryDecision {
+  const result = input.terminalResult ?? null;
+  if (input.evidenceConflict) return { outcome: 'unknown', responseReconstructable: false, reasonCode: 'RECOVERY_EVIDENCE_CONFLICT' };
+  if (input.explicitRejection && !input.startedCommitted) {
+    return { outcome: 'not-executed', responseReconstructable: true, reasonCode: 'RECOVERY_EXPLICIT_REJECTION' };
+  }
+  if (!input.startedCommitted) {
+    return { outcome: 'not-executed', responseReconstructable: false, reasonCode: 'RECOVERY_NOT_STARTED' };
+  }
+  if (!result) return { outcome: 'unknown', responseReconstructable: false, reasonCode: 'RECOVERY_TERMINAL_RESULT_MISSING' };
+  if (!bindingMatchesResult(input.binding, result)) {
+    return { outcome: 'unknown', responseReconstructable: false, reasonCode: 'RECOVERY_RESULT_BINDING_MISMATCH' };
+  }
+  if (!SANDBOX_CONTROL_REQUIRED_COMPLETION_PHASES.every((phase) => input.criticalPhases?.includes(phase))) {
+    return { outcome: 'unknown', responseReconstructable: false, reasonCode: 'RECOVERY_CRITICAL_AUDIT_INCOMPLETE' };
+  }
+  const status = result.status;
+  const failed = status === 'failed' || result.error !== null && result.error !== undefined;
+  if (failed) {
+    if (input.domain && input.domain.consistent === false) {
+      return { outcome: 'failure', responseReconstructable: true, reasonCode: 'RECOVERY_TERMINAL_FAILURE' };
+    }
+    return { outcome: 'unknown', responseReconstructable: false, reasonCode: 'RECOVERY_FAILURE_EVIDENCE_INCOMPLETE' };
+  }
+  if (result.changed === null) {
+    return { outcome: 'unknown', responseReconstructable: false, reasonCode: 'RECOVERY_RESULT_CHANGE_FLAG_MISSING' };
+  }
+  if (!domainEvidenceMatches(input.operation, result, input.domain)) {
+    if (input.journal?.exists && (input.journal.completedSteps?.length ?? 0) > 0) {
+      return { outcome: 'in-progress', responseReconstructable: false, reasonCode: 'RECOVERY_DOMAIN_EVIDENCE_INCOMPLETE' };
+    }
+    return { outcome: 'unknown', responseReconstructable: false, reasonCode: 'RECOVERY_DOMAIN_EVIDENCE_MISSING' };
+  }
+  if (input.operation.family === 'task-lifecycle' && input.journal?.exists) {
+    if (input.journal.failure) {
+      return { outcome: 'failure', responseReconstructable: true, reasonCode: 'RECOVERY_LIFECYCLE_JOURNAL_FAILURE' };
+    }
+    return {
+      outcome: input.journal.completedSteps && input.journal.completedSteps.length > 0 ? 'in-progress' : 'unknown',
+      responseReconstructable: false,
+      reasonCode: 'RECOVERY_LIFECYCLE_JOURNAL_PRESENT'
+    };
+  }
+  return {
+    outcome: 'success',
+    responseReconstructable: true,
+    reasonCode: input.operation.class === 'route.clean-completion' && result.changed === false
+      ? 'RECOVERY_ROUTE_COMPLETION_NOOP'
+      : 'RECOVERY_TERMINAL_AND_DOMAIN_MATCH'
+  };
+}
+
+export function operationRecoveryBinding(
+  requestId: string,
+  generation: string,
+  taskId: string | null,
+  family: string,
+  intent: string
+): ControlRecoveryBinding {
+  return { requestId, generation, taskId, intentDigest: digestControlRecoveryIntent(family, intent) };
+}

package/lib/task/create-service.ts

@@ -12,6 +12,13 @@ import { verifyTaskEvent } from './verification.ts';
 type TaskCreateStatus = 'applied' | 'no-op' | 'degraded' | 'failed' | 'blocked';
 type TaskCreateOperation = { name: string; status: string; reasonCode: string | null };
 type TaskCreateWarning = { code: string; severity: string; action: string };
+type TaskCreateRecovery = 'none' | 'same-request-id' | 'new-request-id' | 'inspect-domain-state';
+type TaskCreateControl = Readonly<{
+  requestId: string | null;
+  accepted: boolean;
+  recovery: TaskCreateRecovery;
+}>;
+type TaskCreateError = { code: string; message: string; retryable: boolean };
 type TaskCreateResult = Readonly<{
   status: TaskCreateStatus;
   changed: boolean;
@@ -19,7 +26,8 @@ type TaskCreateResult = Readonly<{
   issue: { number: number; url: string } | null;
   operations: readonly TaskCreateOperation[];
   warnings: readonly TaskCreateWarning[];
-  error: { code: string; message: string; retryable: boolean } | null;
+  error: TaskCreateError | null;
+  control?: TaskCreateControl;
 }>;
 
 type CreateTaskOptions = Readonly<{
@@ -42,6 +50,116 @@ const DEFAULT_DEPENDENCIES: TaskCreateDependencies = {
   addWarning: applyWorkflowWarningIntent
 };
 
+function invalidTaskCreateResult(): never {
+  throw new Error('TASK_CREATE_RESULT_INVALID');
+}
+
+function exactKeys(value: Record<string, unknown>, expected: readonly string[]): boolean {
+  return Object.keys(value).sort().join(',') === [...expected].sort().join(',');
+}
+
+function validTaskReference(value: unknown): boolean {
+  return value === null || (typeof value === 'string' && value.length > 0);
+}
+
+function validTaskCreateError(value: unknown): value is TaskCreateError {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const error = value as Record<string, unknown>;
+  return exactKeys(error, ['code', 'message', 'retryable'])
+    && typeof error.code === 'string' && /^[A-Z][A-Z0-9_]+$/u.test(error.code)
+    && typeof error.message === 'string'
+    && typeof error.retryable === 'boolean';
+}
+
+function validTaskCreateControl(value: unknown): value is TaskCreateControl {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const control = value as Record<string, unknown>;
+  return exactKeys(control, ['accepted', 'recovery', 'requestId'])
+    && validTaskReference(control.requestId)
+    && typeof control.accepted === 'boolean'
+    && ['none', 'same-request-id', 'new-request-id', 'inspect-domain-state'].includes(control.recovery as string);
+}
+
+export function parseTaskCreateResult(value: unknown): TaskCreateResult {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return invalidTaskCreateResult();
+  const result = value as Record<string, unknown>;
+  if (!exactKeys(result, ['changed', 'control', 'error', 'issue', 'operations', 'status', 'task', 'warnings'])
+    && !exactKeys(result, ['changed', 'error', 'issue', 'operations', 'status', 'task', 'warnings'])) {
+    return invalidTaskCreateResult();
+  }
+  if (!['applied', 'no-op', 'degraded', 'failed', 'blocked'].includes(result.status as string)
+    || typeof result.changed !== 'boolean'
+    || !result.task || typeof result.task !== 'object' || Array.isArray(result.task)
+    || !exactKeys(result.task as Record<string, unknown>, ['id', 'shortId'])
+    || !validTaskReference((result.task as { id?: unknown }).id)
+    || !validTaskReference((result.task as { shortId?: unknown }).shortId)
+    || !Array.isArray(result.operations)
+    || !result.operations.every((operation) => {
+      if (!operation || typeof operation !== 'object' || Array.isArray(operation)) return false;
+      const value = operation as Record<string, unknown>;
+      return exactKeys(value, ['name', 'reasonCode', 'status'])
+        && typeof value.name === 'string' && typeof value.status === 'string'
+        && (value.reasonCode === null || typeof value.reasonCode === 'string');
+    })
+    || !Array.isArray(result.warnings)
+    || !result.warnings.every((warning) => {
+      if (!warning || typeof warning !== 'object' || Array.isArray(warning)) return false;
+      const value = warning as Record<string, unknown>;
+      return exactKeys(value, ['action', 'code', 'severity'])
+        && typeof value.action === 'string' && typeof value.code === 'string' && typeof value.severity === 'string';
+    })
+    || (result.issue !== null && (
+      !result.issue || typeof result.issue !== 'object' || Array.isArray(result.issue)
+      || !exactKeys(result.issue as Record<string, unknown>, ['number', 'url'])
+      || !Number.isSafeInteger((result.issue as { number?: unknown }).number)
+      || ((result.issue as { number: number }).number) <= 0
+      || typeof (result.issue as { url?: unknown }).url !== 'string'
+    ))
+    || (result.error !== null && !validTaskCreateError(result.error))
+    || ('control' in result && !validTaskCreateControl(result.control))) {
+    return invalidTaskCreateResult();
+  }
+  if (result.status === 'blocked' && !(result.error as TaskCreateError | null)?.retryable) return invalidTaskCreateResult();
+  if (result.status === 'failed' && !(result.error as TaskCreateError | null)) return invalidTaskCreateResult();
+  return result as unknown as TaskCreateResult;
+}
+
+export function projectTaskCreateResult(result: TaskCreateResult, control: TaskCreateControl): TaskCreateResult {
+  return { ...result, control };
+}
+
+export function taskCreateExitCode(result: Pick<TaskCreateResult, 'status'>): number {
+  return result.status === 'blocked' ? 2 : result.status === 'failed' ? 1 : 0;
+}
+
+export function taskCreateFailure(
+  error: TaskCreateError,
+  control?: TaskCreateControl
+): TaskCreateResult {
+  return {
+    status: error.retryable ? 'blocked' : 'failed',
+    changed: false,
+    task: { id: null, shortId: null },
+    issue: null,
+    operations: [],
+    warnings: [],
+    error,
+    ...(control ? { control } : {})
+  };
+}
+
+export function taskCreateOutputUnavailableResult(requestId: string): TaskCreateResult {
+  return taskCreateFailure({
+    code: 'SANDBOX_CONTROL_OUTPUT_UNAVAILABLE',
+    message: 'SANDBOX_CONTROL_OUTPUT_UNAVAILABLE: task-create result output was not retained; inspect domain state before retrying',
+    retryable: false
+  }, {
+    requestId,
+    accepted: true,
+    recovery: 'inspect-domain-state'
+  });
+}
+
 async function verifyCreatedTask(repoRoot: string, taskId: string): Promise<{ operation: TaskCreateOperation; error: TaskCreateResult['error'] }> {
   const verification = await verifyTaskEvent(
     { taskRef: taskId, event: 'create-task.completed' },
@@ -91,10 +209,7 @@ async function createTask(value: unknown, options: CreateTaskOptions): Promise<T
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     const code = /^([A-Z][A-Z0-9_]+)/.exec(message)?.[1] ?? 'TASK_CREATE_FAILED';
-    return {
-      status: 'failed', changed: false, task: { id: null, shortId: null }, issue: null,
-      operations: [], warnings: [], error: { code, message, retryable: code === 'TASK_CREATE_LOCK_TIMEOUT' }
-    };
+    return taskCreateFailure({ code, message, retryable: code === 'TASK_CREATE_LOCK_TIMEOUT' });
   }
 
   const operations: TaskCreateOperation[] = [{
@@ -168,4 +283,14 @@ async function createTask(value: unknown, options: CreateTaskOptions): Promise<T
 }
 
 export { createTask };
-export type { CreateTaskOptions, TaskCreateDependencies, TaskCreateOperation, TaskCreateResult, TaskCreateStatus, TaskCreateWarning };
+export type {
+  CreateTaskOptions,
+  TaskCreateControl,
+  TaskCreateDependencies,
+  TaskCreateError,
+  TaskCreateOperation,
+  TaskCreateRecovery,
+  TaskCreateResult,
+  TaskCreateStatus,
+  TaskCreateWarning
+};

package/lib/task/create.ts

@@ -7,6 +7,7 @@ import { loadShortIdByTaskId, mutateShortIdRegistry } from './short-id.ts';
 import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.ts';
 import { readDeliveryDefaults, validateBaseRef, validateRemote } from './delivery-target.ts';
 import { buildUnboundFact, encodePrDeliveryFact } from './pr-delivery-fact.ts';
+import { CANDIDATE_COLUMNS, CONSTRAINT_COLUMNS, parseTaskQualification } from './qualification-audit.ts';
 
 const AGENTS = ['claude', 'codex', 'antigravity', 'opencode', 'cursor'] as const;
 const TYPES = ['feature', 'bugfix', 'refactor', 'docs', 'chore'] as const;
@@ -178,6 +179,78 @@ function renderList(items: readonly string[]): string {
   return items.map((item) => `- ${item}`).join('\n');
 }
 
+function tableCell(value: string): string {
+  return value.replace(/\\/g, '\\\\').replace(/\|/g, '\\|').replace(/[\r\n]/g, ' ');
+}
+
+function renderTable(columns: readonly string[], rows: readonly (readonly string[])[]): string {
+  return [
+    `| ${columns.join(' | ')} |`,
+    `| ${columns.map(() => '---').join(' | ')} |`,
+    ...rows.map((row) => `| ${row.map(tableCell).join(' | ')} |`)
+  ].join('\n');
+}
+
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function candidateIdFor(index: number): string {
+  let value = index + 1;
+  let id = '';
+  while (value > 0) {
+    const remainder = (value - 1) % 26;
+    id = `${String.fromCharCode(65 + remainder)}${id}`;
+    value = Math.floor((value - 1) / 26);
+  }
+  return id;
+}
+
+function appendCanonicalRows(content: string, heading: string, columns: readonly string[], rows: readonly (readonly string[])[]): string {
+  if (rows.length === 0) return content;
+  const table = renderTable(columns, rows);
+  const [header, separator, ...rowLines] = table.split('\n');
+  const eol = content.includes('\r\n') ? '\r\n' : '\n';
+  const lines = content.split(/\r?\n/);
+  const headingPattern = new RegExp(`^###\\s+${escapeRegExp(heading)}\\s*$`);
+  const sectionStart = lines.findIndex((line) => headingPattern.test(line));
+  if (sectionStart < 0) throw new Error(`TASK_CREATE_QUALIFICATION_INVALID: section '${heading}' is missing`);
+  let sectionEnd = lines.length;
+  for (let index = sectionStart + 1; index < lines.length; index += 1) {
+    if (/^#{2,3}\s+/.test(lines[index]!)) {
+      sectionEnd = index;
+      break;
+    }
+  }
+  const matches: number[] = [];
+  for (let index = sectionStart + 1; index + 1 < sectionEnd; index += 1) {
+    if (lines[index]!.trim() === header && lines[index + 1]!.trim() === separator) matches.push(index);
+  }
+  if (matches.length !== 1) {
+    throw new Error(`TASK_CREATE_QUALIFICATION_INVALID: section '${heading}' must contain exactly one canonical qualification table`);
+  }
+  lines.splice(matches[0]! + 2, 0, ...rowLines);
+  return lines.join(eol);
+}
+
+function validateRenderedQualification(content: string, candidate: TaskCreateCandidateV1): void {
+  const parsed = parseTaskQualification(content);
+  if (!parsed.ok) {
+    throw new Error(`TASK_CREATE_QUALIFICATION_INVALID: ${parsed.code}: ${parsed.message}`);
+  }
+  if (!parsed.qualification.present) {
+    throw new Error('TASK_CREATE_QUALIFICATION_INVALID: rendered task qualification contract is missing');
+  }
+  const expectedConstraintIds = candidate.taskInput.constraints.map((_, index) => `C-${index + 1}`);
+  const expectedCandidateIds = candidate.taskInput.alternatives.map((_, index) => candidateIdFor(index));
+  const actualConstraintIds = parsed.qualification.constraints.map((row) => row.constraintId);
+  const actualCandidateIds = parsed.qualification.candidates.map((row) => row.candidateId);
+  if (JSON.stringify(actualConstraintIds) !== JSON.stringify(expectedConstraintIds)
+    || JSON.stringify(actualCandidateIds) !== JSON.stringify(expectedCandidateIds)) {
+    throw new Error('TASK_CREATE_QUALIFICATION_INVALID: rendered task qualification rows do not match task input');
+  }
+}
+
 function replaceEmptySubsection(content: string, heading: string, items: readonly string[]): string {
   if (items.length === 0) return content;
   return content.replace(`${heading}\n`, `${heading}\n\n${renderList(items)}\n`);
@@ -231,6 +304,13 @@ function renderTask(params: Readonly<{
     ['### 验收标准', 'acceptanceCriteria'], ['### 未决事项', 'openQuestions']
   ];
   for (const [heading, key] of sections) content = replaceEmptySubsection(content, heading, candidate.taskInput[key]);
+  const constraintIds = candidate.taskInput.constraints.map((_, index) => `C-${index + 1}`);
+  content = appendCanonicalRows(content, '约束', CONSTRAINT_COLUMNS, candidate.taskInput.constraints.map((statement, index) => [
+    constraintIds[index]!, statement, 'assumption', 'create-task', 'taskInput', 'create-task input', '', ''
+  ]));
+  content = appendCanonicalRows(content, '候选与否决方案', CANDIDATE_COLUMNS, candidate.taskInput.alternatives.map((statement, index) => [
+    candidateIdFor(index), statement, 'pending', constraintIds.join(','), 'requires qualification', 'create-task input'
+  ]));
   content = content.replace('- **关联 Issue**：#XXX', '- **关联 Issue**：N/A');
   content = content.replace('- **关联 PR**：#XXX', '- **关联 PR**：N/A');
   content = content.replace('- **分支**：`feature/xxx`', `- **分支**：\`${branch}\``);
@@ -338,7 +418,6 @@ function createLocalTask(value: unknown, options: LocalTaskCreateOptions): Local
 
   return withCreateLock(repoRoot, workspaceRoot, () => {
     if (fs.existsSync(receipts)) assertRealDirectory(receipts, 'TASK_CREATE_RECEIPT_INVALID');
-    else fs.mkdirSync(receipts, { mode: 0o700 });
     const receiptPath = path.join(receipts, `${keyDigest}.json`);
     if (fs.existsSync(receiptPath)) {
       const stat = fs.lstatSync(receiptPath);
@@ -353,6 +432,7 @@ function createLocalTask(value: unknown, options: LocalTaskCreateOptions): Local
 
     const recovered = recoverPublishedTask(activeRoot, repoRoot, keyDigest, candidateDigest);
     if (recovered) {
+      ensureRealDirectory(receipts, 'TASK_CREATE_RECEIPT_INVALID');
       writeReceipt(receiptPath, {
         version: 1, candidateDigest, taskId: recovered.taskId, shortId: recovered.shortId, status: 'recovered'
       });
@@ -374,6 +454,8 @@ function createLocalTask(value: unknown, options: LocalTaskCreateOptions): Local
       template: fs.readFileSync(templatePath, 'utf8'), candidate, taskId, project: projectConfig.project, delivery: projectConfig.delivery, timestamp,
       agentInfraVersion, keyDigest, candidateDigest
     });
+    validateRenderedQualification(rendered, candidate);
+    ensureRealDirectory(receipts, 'TASK_CREATE_RECEIPT_INVALID');
     const temporary = path.join(workspaceRoot, `.task-create.tmp.${process.pid}.${randomUUID()}`);
     fs.mkdirSync(temporary, { mode: 0o700 });
     fs.writeFileSync(path.join(temporary, 'task.md'), rendered, { flag: 'wx', mode: 0o600 });

package/lib/task/decision-details.ts

@@ -1,23 +1,4 @@
-type SourceLine = {
-  start: number;
-  end: number;
-  text: string;
-};
-
-type VisibleHeading = SourceLine & {
-  level: number;
-  text: string;
-};
-
-type VisibleAnchor = SourceLine & {
-  id: string;
-};
-
-type VisibleMarkdown = {
-  lines: SourceLine[];
-  headings: VisibleHeading[];
-  anchors: VisibleAnchor[];
-};
+import { scanVisibleMarkdown, type SourceLine } from './markdown.ts';
 
 type DecisionDetailBlock = {
   id: string;
@@ -49,54 +30,9 @@ type DecisionDetailInspection =
     };
 
 const DECISION_ID = /^(AN|PL|CD|HD)-[1-9]\d*(?=$|[\s:：])/i;
-const HEADING = /^ {0,3}(#{1,6})[ \t]+(.+?)\s*$/;
-const FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})(.*)$/;
-const FENCE_CLOSE = /^ {0,3}(`{3,}|~{3,})\s*$/;
-const ANCHOR = /^\s*<a\s+id=(['"])([^'"]+)\1\s*><\/a>\s*$/;
 const FIELD = /^\s*[-*]\s+\*\*([^*]+)\*\*\s*[:：]\s*/;
 const OPTION_HEADING = /^(?:方案|Option)\s+[A-Z](?:\b|\s*[:：])/i;
 
-function sourceLines(content: string): SourceLine[] {
-  const lines: SourceLine[] = [];
-  let start = 0;
-  while (start < content.length) {
-    const newline = content.indexOf('\n', start);
-    const end = newline === -1 ? content.length : newline;
-    lines.push({ start, end, text: content.slice(start, end).replace(/\r$/, '') });
-    start = newline === -1 ? content.length : newline + 1;
-  }
-  return lines;
-}
-
-function scanVisibleMarkdown(content: string): VisibleMarkdown {
-  const lines = sourceLines(content);
-  const visible: SourceLine[] = [];
-  const headings: VisibleHeading[] = [];
-  const anchors: VisibleAnchor[] = [];
-  let fence: { character: '`' | '~'; length: number } | null = null;
-
-  for (const line of lines) {
-    if (fence) {
-      const close = line.text.match(FENCE_CLOSE);
-      if (close && close[1]![0] === fence.character && close[1]!.length >= fence.length) fence = null;
-      continue;
-    }
-    const open = line.text.match(FENCE_OPEN);
-    const marker = open?.[1];
-    const info = open?.[2] ?? '';
-    if (marker && !(marker[0] === '`' && info.includes('`'))) {
-      fence = { character: marker[0] as '`' | '~', length: marker.length };
-      continue;
-    }
-    visible.push(line);
-    const heading = line.text.match(HEADING);
-    if (heading) headings.push({ ...line, level: heading[1]!.length, text: heading[2]!.trim() });
-    const anchor = line.text.match(ANCHOR);
-    if (anchor) anchors.push({ ...line, id: anchor[2]! });
-  }
-  return { lines: visible, headings, anchors };
-}
-
 function parseDecisionDetailBlocks(content: string): DecisionDetailBlock[] {
   const scanned = scanVisibleMarkdown(content);
   const details = scanned.headings.filter((heading) => heading.level === 3 && DECISION_ID.test(heading.text));
@@ -270,15 +206,11 @@ export {
   normalizeDecisionDetailForDisplay,
   parseDecisionDetailBlocks,
   parseDecisionEvidence,
-  resolveDecisionDetail,
-  scanVisibleMarkdown
+  resolveDecisionDetail
 };
 export type {
   DecisionDetailBlock,
   DecisionDetailDuplicate,
   DecisionDetailInspection,
-  DecisionDetailResolution,
-  SourceLine,
-  VisibleHeading,
-  VisibleMarkdown
+  DecisionDetailResolution
 };