@fitlab-ai/agent-infra 0.9.14 → 0.10.0

package/lib/task/control-recovery.ts

@@ -0,0 +1,186 @@
+import { createHash } from 'node:crypto';
+import { isCompletionEvidence } from './orchestration.ts';
+import { TASK_WORKFLOW_OPERATIONS } from './workflow-command.ts';
+import { sameRecoveryWarning } from './recovery-warning.ts';
+
+export type ControlRecoveryOutcome = 'not-executed' | 'in-progress' | 'success' | 'failure' | 'unknown' | 'rejected';
+
+/** Normalize the command result once at the control transport boundary. */
+export function parseControlOutput(output: string | null): Record<string, unknown> | null {
+  if (output === null) return null;
+  try {
+    const value = JSON.parse(output);
+    if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+    return value.result && typeof value.result === 'object' && !Array.isArray(value.result) ? value.result : value;
+  } catch { return null; }
+}
+
+export type ControlRecoveryOperation = Readonly<{
+  family: 'task-lifecycle' | 'task-finalization' | 'task-orchestration' | 'task-create' | 'codex-controller' | 'task-workflow';
+  intent: string;
+  class: string;
+}>;
+
+export type ControlRecoveryBinding = Readonly<{
+  requestId: string;
+  generation: string;
+  taskId: string | null;
+  intentDigest: string;
+}>;
+
+export type ControlRecoveryInput = Readonly<{
+  operation: ControlRecoveryOperation;
+  binding: ControlRecoveryBinding;
+  startedCommitted: boolean;
+  terminalResult?: Readonly<Record<string, unknown>> | null;
+  criticalPhases?: readonly string[];
+  domain?: Readonly<Record<string, unknown>> | null;
+  journal?: Readonly<{
+    exists: boolean;
+    completedSteps?: readonly string[];
+    failure?: string | null;
+  }> | null;
+  explicitRejection?: boolean;
+  evidenceConflict?: boolean;
+}>;
+
+export const SANDBOX_CONTROL_REQUIRED_COMPLETION_PHASES = Object.freeze([
+  'completed', 'evidence-written', 'publish-authorized'
+] as const);
+
+export type ControlRecoveryDecision = Readonly<{
+  outcome: ControlRecoveryOutcome;
+  responseReconstructable: boolean;
+  reasonCode: string;
+}>;
+
+const LIFECYCLE_INTENTS = ['block', 'activate', 'cancel', 'complete', 'close-codescan', 'close-dependabot', 'restore', 'recover-started'] as const;
+const ORCHESTRATION_INTENTS = [
+  'begin-or-resume', 'route.read', 'route.clean-completion', 'status', 'prepare', 'dispatch',
+  'await-activation', 'recover-prepared', 'hook-start', 'hook-stop', 'advance', 'pause'
+] as const;
+
+export const SANDBOX_CONTROL_RECOVERY_OPERATIONS: readonly ControlRecoveryOperation[] = Object.freeze([
+  ...LIFECYCLE_INTENTS.map((intent) => ({ family: 'task-lifecycle' as const, intent, class: 'lifecycle-mutation' })),
+  { family: 'task-finalization', intent: 'complete', class: 'finalization' },
+  ...ORCHESTRATION_INTENTS.map((intent) => ({
+    family: 'task-orchestration' as const,
+    intent,
+    class: intent === 'route.clean-completion' ? 'route.clean-completion' : intent === 'route.read' || intent === 'status' ? 'read-only' : 'orchestration'
+  })),
+  { family: 'task-create', intent: 'create', class: 'task-create' },
+  ...TASK_WORKFLOW_OPERATIONS.map((intent) => ({ family: 'task-workflow' as const, intent, class: intent === 'artifact-inspect' || intent === 'decision-next-id' ? 'read-only' : 'workflow' })),
+  ...(['open', 'close', 'verify'] as const).map((intent) => ({ family: 'codex-controller' as const, intent, class: 'codex-controller' }))
+]);
+
+export function digestControlRecoveryIntent(family: string, intent: string): string {
+  return createHash('sha256').update(`${family}\0${intent}`, 'utf8').digest('hex');
+}
+
+export function findSandboxControlRecoveryOperation(family: ControlRecoveryOperation['family'], intent: string): ControlRecoveryOperation | null {
+  return SANDBOX_CONTROL_RECOVERY_OPERATIONS.find((operation) => operation.family === family && operation.intent === intent) ?? null;
+}
+
+function bindingMatchesResult(binding: ControlRecoveryBinding, result: Readonly<Record<string, unknown>>): boolean {
+  return result.requestId === binding.requestId
+    && result.generation === binding.generation
+    && (result.taskId === undefined || result.taskId === binding.taskId)
+    && (result.intentDigest === undefined || result.intentDigest === binding.intentDigest);
+}
+
+function domainEvidenceMatches(
+  operation: ControlRecoveryOperation,
+  result: Readonly<Record<string, unknown>>,
+  domain: Readonly<Record<string, unknown>> | null | undefined
+): boolean {
+  if (!domain) return false;
+  if (domain.consistent !== true) return false;
+  if (operation.class === 'route.clean-completion') {
+    const completion = domain.completionEvidence as Record<string, unknown> | undefined;
+    const snapshot = domain.snapshot as Record<string, unknown> | undefined;
+    const lastReviewedCommit = domain.lastReviewedCommit;
+    return result.status === 'completed'
+      && domain.status === 'completed'
+      && domain.pendingDelegation === null
+      && isCompletionEvidence(completion)
+      && snapshot?.head === completion.head
+      && snapshot.headTree === completion.headTree
+      && snapshot.worktreeTree === completion.worktreeTree
+      && lastReviewedCommit === completion.lastReviewedCommit;
+  }
+  if (operation.family === 'task-lifecycle' && operation.intent === 'recover-started') {
+    const retryRequired = domain.recoveryState === 'retry-required'
+      && sameRecoveryWarning(domain.warning, result.warning);
+    return result.targetState === 'active'
+      && ['applied', 'no-op'].includes(String(result.status))
+      && domain.recovery === true
+      && domain.targetState === 'active'
+      && (domain.recoveryState === 'released' || retryRequired);
+  }
+  if (operation.class === 'read-only') return result.changed === false && domain.snapshotValid === true;
+  return true;
+}
+
+export function classifySandboxControlRecovery(input: ControlRecoveryInput): ControlRecoveryDecision {
+  const result = input.terminalResult ?? null;
+  if (input.evidenceConflict) return { outcome: 'unknown', responseReconstructable: false, reasonCode: 'RECOVERY_EVIDENCE_CONFLICT' };
+  if (input.explicitRejection && !input.startedCommitted) {
+    return { outcome: 'not-executed', responseReconstructable: true, reasonCode: 'RECOVERY_EXPLICIT_REJECTION' };
+  }
+  if (!input.startedCommitted) {
+    return { outcome: 'not-executed', responseReconstructable: false, reasonCode: 'RECOVERY_NOT_STARTED' };
+  }
+  if (!result) return { outcome: 'unknown', responseReconstructable: false, reasonCode: 'RECOVERY_TERMINAL_RESULT_MISSING' };
+  if (!bindingMatchesResult(input.binding, result)) {
+    return { outcome: 'unknown', responseReconstructable: false, reasonCode: 'RECOVERY_RESULT_BINDING_MISMATCH' };
+  }
+  if (!SANDBOX_CONTROL_REQUIRED_COMPLETION_PHASES.every((phase) => input.criticalPhases?.includes(phase))) {
+    return { outcome: 'unknown', responseReconstructable: false, reasonCode: 'RECOVERY_CRITICAL_AUDIT_INCOMPLETE' };
+  }
+  const status = result.status;
+  const failed = status === 'failed' || result.error !== null && result.error !== undefined;
+  if (failed) {
+    if (input.domain && input.domain.consistent === false) {
+      return { outcome: 'failure', responseReconstructable: true, reasonCode: 'RECOVERY_TERMINAL_FAILURE' };
+    }
+    return { outcome: 'unknown', responseReconstructable: false, reasonCode: 'RECOVERY_FAILURE_EVIDENCE_INCOMPLETE' };
+  }
+  if (result.changed === null) {
+    return { outcome: 'unknown', responseReconstructable: false, reasonCode: 'RECOVERY_RESULT_CHANGE_FLAG_MISSING' };
+  }
+  if (!domainEvidenceMatches(input.operation, result, input.domain)) {
+    if (input.journal?.exists && (input.journal.completedSteps?.length ?? 0) > 0) {
+      return { outcome: 'in-progress', responseReconstructable: false, reasonCode: 'RECOVERY_DOMAIN_EVIDENCE_INCOMPLETE' };
+    }
+    return { outcome: 'unknown', responseReconstructable: false, reasonCode: 'RECOVERY_DOMAIN_EVIDENCE_MISSING' };
+  }
+  if (input.operation.family === 'task-lifecycle' && input.journal?.exists) {
+    if (input.journal.failure) {
+      return { outcome: 'failure', responseReconstructable: true, reasonCode: 'RECOVERY_LIFECYCLE_JOURNAL_FAILURE' };
+    }
+    return {
+      outcome: input.journal.completedSteps && input.journal.completedSteps.length > 0 ? 'in-progress' : 'unknown',
+      responseReconstructable: false,
+      reasonCode: 'RECOVERY_LIFECYCLE_JOURNAL_PRESENT'
+    };
+  }
+  return {
+    outcome: 'success',
+    responseReconstructable: true,
+    reasonCode: input.operation.class === 'route.clean-completion' && result.changed === false
+      ? 'RECOVERY_ROUTE_COMPLETION_NOOP'
+      : input.operation.intent === 'recover-started' && input.domain?.recoveryState === 'retry-required'
+        ? 'RECOVERY_RELEASE_RETRY_REQUIRED'
+      : 'RECOVERY_TERMINAL_AND_DOMAIN_MATCH'
+  };
+}
+
+export function operationRecoveryBinding(
+  requestId: string,
+  generation: string,
+  taskId: string | null,
+  family: string,
+  intent: string
+): ControlRecoveryBinding {
+  return { requestId, generation, taskId, intentDigest: digestControlRecoveryIntent(family, intent) };
+}

package/lib/task/create-service.ts

@@ -1,6 +1,3 @@
-import fs from 'node:fs';
-import path from 'node:path';
-
 import { syncPlatformComment } from '../platform/issue-comments.ts';
 import { createPlatformIssue, syncPlatformIssue } from '../platform/issues.ts';
 import type { PlatformResult } from '../platform/types.ts';
@@ -190,12 +187,6 @@ function platformOperations(prefix: string, operations: readonly { name: string;
   }));
 }
 
-function issueFromTask(repoRoot: string, taskId: string): { number: number; url: string } | null {
-  const content = fs.readFileSync(path.join(repoRoot, '.agents', 'workspace', 'active', taskId, 'task.md'), 'utf8');
-  const match = /^issue_number:\s*(\d+)\s*$/m.exec(content);
-  return match ? { number: Number(match[1]), url: '' } : null;
-}
-
 async function createTask(value: unknown, options: CreateTaskOptions): Promise<TaskCreateResult> {
   const dependencies = { ...DEFAULT_DEPENDENCIES, ...options.dependencies };
   let candidate: TaskCreateCandidateV1;
@@ -215,7 +206,7 @@ async function createTask(value: unknown, options: CreateTaskOptions): Promise<T
   const operations: TaskCreateOperation[] = [{
     name: 'task:local', status: local.status, reasonCode: null
   }];
-  let issue = issueFromTask(options.repoRoot, local.task.id);
+  let issue: TaskCreateResult['issue'] = null;
   const created = await dependencies.createIssue(local.task.id, { cwd: options.repoRoot, agent: candidate.agent });
   operations.push(...platformOperations('platform-create', created.operations));
   if (created.issue) issue = { number: created.issue.number, url: created.issue.url };

package/lib/task/create.ts

@@ -7,7 +7,7 @@ import { loadShortIdByTaskId, mutateShortIdRegistry } from './short-id.ts';
 import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.ts';
 import { readDeliveryDefaults, validateBaseRef, validateRemote } from './delivery-target.ts';
 import { buildUnboundFact, encodePrDeliveryFact } from './pr-delivery-fact.ts';
-import { CANDIDATE_COLUMNS, CONSTRAINT_COLUMNS } from './qualification-audit.ts';
+import { CANDIDATE_COLUMNS, CONSTRAINT_COLUMNS, parseTaskQualification } from './qualification-audit.ts';
 
 const AGENTS = ['claude', 'codex', 'antigravity', 'opencode', 'cursor'] as const;
 const TYPES = ['feature', 'bugfix', 'refactor', 'docs', 'chore'] as const;
@@ -191,11 +191,64 @@ function renderTable(columns: readonly string[], rows: readonly (readonly string
   ].join('\n');
 }
 
-function appendCanonicalRows(content: string, columns: readonly string[], rows: readonly (readonly string[])[]): string {
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function candidateIdFor(index: number): string {
+  let value = index + 1;
+  let id = '';
+  while (value > 0) {
+    const remainder = (value - 1) % 26;
+    id = `${String.fromCharCode(65 + remainder)}${id}`;
+    value = Math.floor((value - 1) / 26);
+  }
+  return id;
+}
+
+function appendCanonicalRows(content: string, heading: string, columns: readonly string[], rows: readonly (readonly string[])[]): string {
   if (rows.length === 0) return content;
   const table = renderTable(columns, rows);
-  const separator = `| ${columns.map(() => '---').join(' | ')} |`;
-  return content.replace(separator, `${separator}\n${table.split('\n').slice(2).join('\n')}`);
+  const [header, separator, ...rowLines] = table.split('\n');
+  const eol = content.includes('\r\n') ? '\r\n' : '\n';
+  const lines = content.split(/\r?\n/);
+  const headingPattern = new RegExp(`^###\\s+${escapeRegExp(heading)}\\s*$`);
+  const sectionStart = lines.findIndex((line) => headingPattern.test(line));
+  if (sectionStart < 0) throw new Error(`TASK_CREATE_QUALIFICATION_INVALID: section '${heading}' is missing`);
+  let sectionEnd = lines.length;
+  for (let index = sectionStart + 1; index < lines.length; index += 1) {
+    if (/^#{2,3}\s+/.test(lines[index]!)) {
+      sectionEnd = index;
+      break;
+    }
+  }
+  const matches: number[] = [];
+  for (let index = sectionStart + 1; index + 1 < sectionEnd; index += 1) {
+    if (lines[index]!.trim() === header && lines[index + 1]!.trim() === separator) matches.push(index);
+  }
+  if (matches.length !== 1) {
+    throw new Error(`TASK_CREATE_QUALIFICATION_INVALID: section '${heading}' must contain exactly one canonical qualification table`);
+  }
+  lines.splice(matches[0]! + 2, 0, ...rowLines);
+  return lines.join(eol);
+}
+
+function validateRenderedQualification(content: string, candidate: TaskCreateCandidateV1): void {
+  const parsed = parseTaskQualification(content);
+  if (!parsed.ok) {
+    throw new Error(`TASK_CREATE_QUALIFICATION_INVALID: ${parsed.code}: ${parsed.message}`);
+  }
+  if (!parsed.qualification.present) {
+    throw new Error('TASK_CREATE_QUALIFICATION_INVALID: rendered task qualification contract is missing');
+  }
+  const expectedConstraintIds = candidate.taskInput.constraints.map((_, index) => `C-${index + 1}`);
+  const expectedCandidateIds = candidate.taskInput.alternatives.map((_, index) => candidateIdFor(index));
+  const actualConstraintIds = parsed.qualification.constraints.map((row) => row.constraintId);
+  const actualCandidateIds = parsed.qualification.candidates.map((row) => row.candidateId);
+  if (JSON.stringify(actualConstraintIds) !== JSON.stringify(expectedConstraintIds)
+    || JSON.stringify(actualCandidateIds) !== JSON.stringify(expectedCandidateIds)) {
+    throw new Error('TASK_CREATE_QUALIFICATION_INVALID: rendered task qualification rows do not match task input');
+  }
 }
 
 function replaceEmptySubsection(content: string, heading: string, items: readonly string[]): string {
@@ -252,11 +305,11 @@ function renderTask(params: Readonly<{
   ];
   for (const [heading, key] of sections) content = replaceEmptySubsection(content, heading, candidate.taskInput[key]);
   const constraintIds = candidate.taskInput.constraints.map((_, index) => `C-${index + 1}`);
-  content = appendCanonicalRows(content, CONSTRAINT_COLUMNS, candidate.taskInput.constraints.map((statement, index) => [
+  content = appendCanonicalRows(content, '约束', CONSTRAINT_COLUMNS, candidate.taskInput.constraints.map((statement, index) => [
     constraintIds[index]!, statement, 'assumption', 'create-task', 'taskInput', 'create-task input', '', ''
   ]));
-  content = appendCanonicalRows(content, CANDIDATE_COLUMNS, candidate.taskInput.alternatives.map((statement, index) => [
-    String.fromCharCode(65 + index), statement, 'pending', constraintIds.join(','), 'requires qualification', 'create-task input'
+  content = appendCanonicalRows(content, '候选与否决方案', CANDIDATE_COLUMNS, candidate.taskInput.alternatives.map((statement, index) => [
+    candidateIdFor(index), statement, 'pending', constraintIds.join(','), 'requires qualification', 'create-task input'
   ]));
   content = content.replace('- **关联 Issue**：#XXX', '- **关联 Issue**：N/A');
   content = content.replace('- **关联 PR**：#XXX', '- **关联 PR**：N/A');
@@ -365,7 +418,6 @@ function createLocalTask(value: unknown, options: LocalTaskCreateOptions): Local
 
   return withCreateLock(repoRoot, workspaceRoot, () => {
     if (fs.existsSync(receipts)) assertRealDirectory(receipts, 'TASK_CREATE_RECEIPT_INVALID');
-    else fs.mkdirSync(receipts, { mode: 0o700 });
     const receiptPath = path.join(receipts, `${keyDigest}.json`);
     if (fs.existsSync(receiptPath)) {
       const stat = fs.lstatSync(receiptPath);
@@ -380,6 +432,7 @@ function createLocalTask(value: unknown, options: LocalTaskCreateOptions): Local
 
     const recovered = recoverPublishedTask(activeRoot, repoRoot, keyDigest, candidateDigest);
     if (recovered) {
+      ensureRealDirectory(receipts, 'TASK_CREATE_RECEIPT_INVALID');
       writeReceipt(receiptPath, {
         version: 1, candidateDigest, taskId: recovered.taskId, shortId: recovered.shortId, status: 'recovered'
       });
@@ -401,6 +454,8 @@ function createLocalTask(value: unknown, options: LocalTaskCreateOptions): Local
       template: fs.readFileSync(templatePath, 'utf8'), candidate, taskId, project: projectConfig.project, delivery: projectConfig.delivery, timestamp,
       agentInfraVersion, keyDigest, candidateDigest
     });
+    validateRenderedQualification(rendered, candidate);
+    ensureRealDirectory(receipts, 'TASK_CREATE_RECEIPT_INVALID');
     const temporary = path.join(workspaceRoot, `.task-create.tmp.${process.pid}.${randomUUID()}`);
     fs.mkdirSync(temporary, { mode: 0o700 });
     fs.writeFileSync(path.join(temporary, 'task.md'), rendered, { flag: 'wx', mode: 0o600 });

package/lib/task/decision-details.ts

@@ -1,23 +1,4 @@
-type SourceLine = {
-  start: number;
-  end: number;
-  text: string;
-};
-
-type VisibleHeading = SourceLine & {
-  level: number;
-  text: string;
-};
-
-type VisibleAnchor = SourceLine & {
-  id: string;
-};
-
-type VisibleMarkdown = {
-  lines: SourceLine[];
-  headings: VisibleHeading[];
-  anchors: VisibleAnchor[];
-};
+import { scanVisibleMarkdown, type SourceLine } from './markdown.ts';
 
 type DecisionDetailBlock = {
   id: string;
@@ -49,54 +30,9 @@ type DecisionDetailInspection =
     };
 
 const DECISION_ID = /^(AN|PL|CD|HD)-[1-9]\d*(?=$|[\s:：])/i;
-const HEADING = /^ {0,3}(#{1,6})[ \t]+(.+?)\s*$/;
-const FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})(.*)$/;
-const FENCE_CLOSE = /^ {0,3}(`{3,}|~{3,})\s*$/;
-const ANCHOR = /^\s*<a\s+id=(['"])([^'"]+)\1\s*><\/a>\s*$/;
 const FIELD = /^\s*[-*]\s+\*\*([^*]+)\*\*\s*[:：]\s*/;
 const OPTION_HEADING = /^(?:方案|Option)\s+[A-Z](?:\b|\s*[:：])/i;
 
-function sourceLines(content: string): SourceLine[] {
-  const lines: SourceLine[] = [];
-  let start = 0;
-  while (start < content.length) {
-    const newline = content.indexOf('\n', start);
-    const end = newline === -1 ? content.length : newline;
-    lines.push({ start, end, text: content.slice(start, end).replace(/\r$/, '') });
-    start = newline === -1 ? content.length : newline + 1;
-  }
-  return lines;
-}
-
-function scanVisibleMarkdown(content: string): VisibleMarkdown {
-  const lines = sourceLines(content);
-  const visible: SourceLine[] = [];
-  const headings: VisibleHeading[] = [];
-  const anchors: VisibleAnchor[] = [];
-  let fence: { character: '`' | '~'; length: number } | null = null;
-
-  for (const line of lines) {
-    if (fence) {
-      const close = line.text.match(FENCE_CLOSE);
-      if (close && close[1]![0] === fence.character && close[1]!.length >= fence.length) fence = null;
-      continue;
-    }
-    const open = line.text.match(FENCE_OPEN);
-    const marker = open?.[1];
-    const info = open?.[2] ?? '';
-    if (marker && !(marker[0] === '`' && info.includes('`'))) {
-      fence = { character: marker[0] as '`' | '~', length: marker.length };
-      continue;
-    }
-    visible.push(line);
-    const heading = line.text.match(HEADING);
-    if (heading) headings.push({ ...line, level: heading[1]!.length, text: heading[2]!.trim() });
-    const anchor = line.text.match(ANCHOR);
-    if (anchor) anchors.push({ ...line, id: anchor[2]! });
-  }
-  return { lines: visible, headings, anchors };
-}
-
 function parseDecisionDetailBlocks(content: string): DecisionDetailBlock[] {
   const scanned = scanVisibleMarkdown(content);
   const details = scanned.headings.filter((heading) => heading.level === 3 && DECISION_ID.test(heading.text));
@@ -270,15 +206,11 @@ export {
   normalizeDecisionDetailForDisplay,
   parseDecisionDetailBlocks,
   parseDecisionEvidence,
-  resolveDecisionDetail,
-  scanVisibleMarkdown
+  resolveDecisionDetail
 };
 export type {
   DecisionDetailBlock,
   DecisionDetailDuplicate,
   DecisionDetailInspection,
-  DecisionDetailResolution,
-  SourceLine,
-  VisibleHeading,
-  VisibleMarkdown
+  DecisionDetailResolution
 };

package/lib/task/delegation-receipts.ts

@@ -186,7 +186,8 @@ function isDelegationHostEvidence(value: unknown): value is DelegationHostEviden
 function hasCurrentCodexEvidence(receipt: DelegationReceipt): boolean {
   const provenance = receipt.lifecycleProvenance;
   if (!provenance) return false;
-  const activated = ['activated', 'stage-completed', 'sealed', 'consumed'].includes(receipt.status);
+  const activated = ['activated', 'stage-completed', 'sealed', 'consumed'].includes(receipt.status)
+    || (receipt.status === 'aborted' && receipt.activatedAt !== null);
   if (!activated) return receipt.hostEvidence === null;
   const host = receipt.hostEvidence;
   if (
@@ -219,6 +220,12 @@ function hasCurrentCodexEvidence(receipt: DelegationReceipt): boolean {
       && host.consumer === receipt.id
       && exactText(host.consumedAt);
   }
+  if (receipt.status === 'aborted') {
+    return Number.isSafeInteger(host.stopRevision)
+      && (host.stopRevision as number) > host.startRevision
+      && host.consumer === `lifecycle-recovery:${receipt.taskId}:${receipt.id}`
+      && exactText(host.consumedAt);
+  }
   return host.stopRevision === null && host.consumer === null && host.consumedAt === null;
 }
 
@@ -244,7 +251,8 @@ function hasStatusBoundEvidence(receipt: DelegationReceipt): boolean {
   const dispatchComplete = dispatchFields.every((field) => field !== null);
   if (!dispatchEmpty && !dispatchComplete) return false;
 
-  const beforeActivation = ['prepared', 'aborted', 'expired'].includes(receipt.status);
+  const beforeActivation = ['prepared', 'expired'].includes(receipt.status)
+    || (receipt.status === 'aborted' && receipt.activatedAt === null);
   if (beforeActivation) {
     return receipt.parentId === null
       && receipt.childId === null
@@ -282,6 +290,21 @@ function hasStatusBoundEvidence(receipt: DelegationReceipt): boolean {
       && receipt.consumedAt === null;
   }
 
+  if (receipt.status === 'aborted') {
+    const host = receipt.hostEvidence;
+    return receipt.agent === null
+      && receipt.afterFingerprint === null
+      && receipt.changedPaths.length === 0
+      && receipt.sealedAt === null
+      && receipt.consumedAt === null
+      && host !== null
+      && host !== undefined
+      && Number.isSafeInteger(host.stopRevision)
+      && (host.stopRevision as number) > host.startRevision
+      && host.consumer === `lifecycle-recovery:${receipt.taskId}:${receipt.id}`
+      && exactText(host.consumedAt);
+  }
+
   if (
     !exactText(receipt.agent)
     || normalizeAgentToken(receipt.agent) !== normalizeAgentToken(receipt.client)
@@ -584,6 +607,53 @@ function abortPreparedDelegation(receipt: DelegationReceipt): ReceiptResult {
   };
 }
 
+function abortActivatedDelegation(
+  receipt: DelegationReceipt,
+  event: Readonly<{ childId: string; stopRevision: number; consumer: string; consumedAt: string }>
+): ReceiptResult {
+  if (receipt.status !== 'activated') {
+    return fail('DELEGATION_STATE_INVALID', `delegation ${receipt.id} is ${receipt.status}, expected activated`);
+  }
+  if (
+    receipt.client !== 'codex'
+    || !receipt.lifecycleProvenance
+    || receipt.hostEvidence?.kind !== 'codex-lifecycle-v2'
+    || typeof receipt.lifecycleProvenance.controllerInstanceDigest !== 'string'
+    || typeof receipt.lifecycleProvenance.controlGeneration !== 'string'
+    || typeof receipt.hostEvidence.controllerInstanceDigest !== 'string'
+    || typeof receipt.hostEvidence.controlGeneration !== 'string'
+  ) {
+    return fail('DELEGATION_RECOVERY_EVIDENCE_INVALID', 'activated delegation lacks the current Codex controller binding');
+  }
+  if (
+    event.childId !== receipt.childId
+    || !Number.isSafeInteger(event.stopRevision)
+    || event.stopRevision <= receipt.hostEvidence.startRevision
+    || event.consumer !== `lifecycle-recovery:${receipt.taskId}:${receipt.id}`
+    || !exactText(event.consumedAt)
+  ) {
+    return fail('DELEGATION_RECOVERY_EVIDENCE_INVALID', 'recovery stop evidence does not match the activated delegation');
+  }
+  return {
+    ok: true,
+    receipt: Object.freeze({
+      ...receipt,
+      status: 'aborted' as const,
+      agent: null,
+      afterFingerprint: null,
+      changedPaths: Object.freeze([]),
+      sealedAt: null,
+      consumedAt: null,
+      hostEvidence: Object.freeze({
+        ...receipt.hostEvidence,
+        stopRevision: event.stopRevision,
+        consumer: event.consumer,
+        consumedAt: event.consumedAt
+      })
+    })
+  };
+}
+
 function completeDelegationStage(
   receipt: DelegationReceipt,
   event: Readonly<{ stage: DelegationStage; round: number; artifact: string; agent: string }>
@@ -666,6 +736,7 @@ function consumeDelegation(receipt: DelegationReceipt, options: { now?: () => st
 
 export {
   activateDelegation,
+  abortActivatedDelegation,
   abortPreparedDelegation,
   completeDelegationStage,
   consumeDelegation,