@fitlab-ai/agent-infra 0.9.14 → 0.9.15

package/dist/lib/task/artifact-operations.js

@@ -1,43 +1,17 @@
 import fs from 'node:fs';
+import { parseArtifactName } from './artifact-name.js';
 import path from 'node:path';
 import { createHash } from 'node:crypto';
-import { scanVisibleMarkdown } from './decision-details.js';
-import { locateActivityLog, pairEntries, startedBackedRows } from './activity-log.js';
+import { readStableFileSync } from '../host-control/secure-fs.js';
+import { scanVisibleMarkdown } from './markdown.js';
+import { hasOpenArtifactRound } from './artifact-lifecycle.js';
 import { readArtifactRepairIntent } from './artifact-repair-intent.js';
+import { resolveTaskRef } from './resolve-ref.js';
 import { getArtifactSchema, renderArtifactSkeleton } from './artifact-schema.js';
 import { withTaskExecutionLock } from './task-execution-lock.js';
 function sha256Content(content) {
     return createHash('sha256').update(content, 'utf8').digest('hex');
 }
-function sourceLines(content) {
-    const lines = [];
-    let start = 0;
-    while (start < content.length) {
-        const newline = content.indexOf('\n', start);
-        const end = newline === -1 ? content.length : newline;
-        lines.push({ start, end, text: content.slice(start, end).replace(/\r$/, '') });
-        start = newline === -1 ? content.length : newline + 1;
-    }
-    if (content.length === 0)
-        lines.push({ start: 0, end: 0, text: '' });
-    return lines;
-}
-function hasUnclosedFence(content) {
-    let fence = null;
-    for (const line of sourceLines(content)) {
-        if (fence) {
-            const close = line.text.match(/^ {0,3}(`{3,}|~{3,})\s*$/);
-            if (close && close[1][0] === fence.character && close[1].length >= fence.length)
-                fence = null;
-            continue;
-        }
-        const open = line.text.match(/^ {0,3}(`{3,}|~{3,})(.*)$/);
-        if (open && !(open[1][0] === '`' && open[2].includes('`'))) {
-            fence = { character: open[1][0], length: open[1].length };
-        }
-    }
-    return fence !== null;
-}
 function lineNumber(content, offset) {
     return content.slice(0, offset).split('\n').length;
 }
@@ -47,9 +21,9 @@ function markerPattern(marker) {
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
-function markerEntries(content) {
+function markerEntries(content, scanned) {
     const entries = [];
-    for (const line of scanVisibleMarkdown(content).lines) {
+    for (const line of scanned.lines) {
         const match = line.text.match(/<!--\s*(artifact-section:[^\s>]+)\s*-->/g);
         if (!match)
             continue;
@@ -67,10 +41,9 @@ function markerEntries(content) {
     }
     return entries;
 }
-function sectionBodyBounds(content, heading) {
-    const next = scanVisibleMarkdown(content).headings.find((candidate) => (candidate.start > heading.start && candidate.level <= 2));
-    const headingEnd = scanVisibleMarkdown(content).headings.find((candidate) => candidate.start === heading.start)?.end ?? heading.start;
-    return { start: headingEnd, end: next?.start ?? content.length };
+function sectionBodyBounds(content, heading, scanned) {
+    const next = scanned.headings.find((candidate) => candidate.start > heading.start && candidate.level <= 2);
+    return { start: heading.end, end: next?.start ?? content.length };
 }
 function stripHtmlComments(content) {
     let result = '';
@@ -153,7 +126,7 @@ function inspectArtifactStructure(content, schema) {
     const repairCandidates = [];
     if (!content.trim())
         diagnostics.push(diagnostic('ARTIFACT_EMPTY', 'artifact is empty', null, null));
-    if (hasUnclosedFence(content))
+    if (scanned.hasUnclosedFence)
         diagnostics.push(diagnostic('ARTIFACT_UNCLOSED_FENCE', 'artifact contains an unclosed Markdown fence', null, null));
     const headingsBySection = new Map();
     for (const section of schema.sections) {
@@ -172,7 +145,7 @@ function inspectArtifactStructure(content, schema) {
             diagnostics.push(diagnostic('ARTIFACT_MISSING_SECTION', `required section '${aliases[0]}' is missing`, section.id, null));
         }
     }
-    const markers = markerEntries(content);
+    const markers = markerEntries(content, scanned);
     const englishHeadings = scanned.headings.filter((heading) => heading.level === 2 && schema.sections.some((section) => section.headings.en === heading.text)).length;
     const chineseHeadings = scanned.headings.filter((heading) => heading.level === 2 && schema.sections.some((section) => section.headings.zh === heading.text)).length;
     const locale = englishHeadings > chineseHeadings ? 'en' : 'zh-CN';
@@ -190,7 +163,7 @@ function inspectArtifactStructure(content, schema) {
             diagnostics.push(diagnostic('ARTIFACT_MARKER_MISMATCH', `section marker '${section.marker}' must occupy its own visible line`, section.id, marker.line));
         }
         if (marker && heading) {
-            const bounds = sectionBodyBounds(content, heading);
+            const bounds = sectionBodyBounds(content, heading, scanned);
             if (marker.start < bounds.start || marker.start >= bounds.end) {
                 diagnostics.push(diagnostic('ARTIFACT_MARKER_MISMATCH', `section marker '${section.marker}' is outside its section`, section.id, marker.line));
             }
@@ -302,30 +275,16 @@ function validateRepairContext(request, content) {
         return { ok: false, code: 'ARTIFACT_REPAIR_CONTEXT_INVALID', message: 'artifact context marker does not match the requested task, family, and round' };
     }
     let taskContent;
+    const resolved = resolveTaskRef(request.taskId, { repoRoot: request.repoRoot });
+    if (!resolved.ok)
+        return { ok: false, code: 'ARTIFACT_REPAIR_CONTEXT_INVALID', message: resolved.message };
     try {
-        taskContent = fs.readFileSync(path.join(request.taskDir, 'task.md'), 'utf8');
+        taskContent = fs.readFileSync(resolved.taskMdPath, 'utf8');
     }
     catch (error) {
         return { ok: false, code: 'ARTIFACT_REPAIR_CONTEXT_INVALID', message: `cannot read task lifecycle context: ${String(error)}` };
     }
-    const activity = locateActivityLog(taskContent);
-    if (!activity)
-        return { ok: false, code: 'ARTIFACT_REPAIR_CONTEXT_INVALID', message: 'task has no unique Activity Log section' };
-    const label = {
-        analysis: 'Analyze Task',
-        'review-analysis': 'Review Analysis',
-        plan: 'Plan Task',
-        'review-plan': 'Review Plan',
-        code: 'Code Task',
-        'review-code': 'Review Code'
-    };
-    const escaped = escapeRegExp(label[request.family]);
-    const qualifier = request.family === 'code'
-        ? '(?:, (?:fix for review-code(?:-r(?:[2-9]|[1-9]\\d+))?\\.md|decision II-[1-9]\\d+))?'
-        : '';
-    const expected = new RegExp(`^${escaped} \\(Round ${round}${qualifier}\\)$`);
-    const open = startedBackedRows(pairEntries(activity.entries)).filter((row) => expected.test(row.step) && !row.done);
-    if (open.length !== 1) {
+    if (!hasOpenArtifactRound(taskContent, request.family, round)) {
         return { ok: false, code: 'ARTIFACT_REPAIR_CONTEXT_INVALID', message: `artifact '${request.artifact}' does not have exactly one matching open started lifecycle event` };
     }
     let intent;
@@ -344,13 +303,8 @@ function validateRepairContext(request, content) {
     return { ok: true };
 }
 function artifactRound(family, artifact) {
-    if (artifact === `${family}.md`)
-        return 1;
-    const match = artifact.match(new RegExp(`^${escapeRegExp(family)}-r([2-9]|[1-9]\\d+)\\.md$`));
-    if (!match)
-        return null;
-    const round = Number(match[1]);
-    return Number.isSafeInteger(round) ? round : null;
+    const identity = parseArtifactName(artifact);
+    return identity?.family === family ? identity.round : null;
 }
 function validateTarget(taskDir, family, artifact) {
     if (path.basename(artifact) !== artifact || artifactRound(family, artifact) === null || !artifact.endsWith('.md'))
@@ -386,7 +340,7 @@ function applyRepairUnlocked(request) {
         return target;
     let content;
     try {
-        content = fs.readFileSync(target.path, 'utf8');
+        content = readStableFileSync(target.path, { maxBytes: 1024 * 1024 }).bytes.toString('utf8');
     }
     catch (error) {
         return resultFailure('ARTIFACT_REPAIR_TARGET_INVALID', String(error));
@@ -422,7 +376,7 @@ function applyRepairUnlocked(request) {
         mode = fs.statSync(target.path).mode & 0o777;
         fs.writeFileSync(tempPath, transformed, { encoding: 'utf8', mode, flag: 'wx' });
         const currentStat = fs.lstatSync(target.path);
-        if (currentStat.isSymbolicLink() || !currentStat.isFile() || sha256Content(fs.readFileSync(target.path, 'utf8')) !== actualSha256) {
+        if (currentStat.isSymbolicLink() || !currentStat.isFile() || readStableFileSync(target.path, { maxBytes: 1024 * 1024 }).sha256 !== actualSha256) {
             fs.unlinkSync(tempPath);
             return resultFailure('ARTIFACT_REPAIR_CONFLICT', 'artifact changed or was replaced during repair');
         }
@@ -469,7 +423,7 @@ function initializeArtifactSkeleton(request) {
                 const existing = fs.lstatSync(target);
                 if (existing.isSymbolicLink() || !existing.isFile())
                     return resultFailure('ARTIFACT_INIT_TARGET_INVALID', 'artifact target is not a regular file');
-                return resultNoOp(fs.readFileSync(target, 'utf8'));
+                return resultNoOp(readStableFileSync(target, { maxBytes: 1024 * 1024 }).bytes.toString('utf8'));
             }
             catch (error) {
                 if (error.code !== 'ENOENT')

package/dist/lib/task/artifact-receipts.js

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import { createHash } from 'node:crypto';
+import { parseArtifactName } from './artifact-name.js';
 import { extractSection, findSectionHeading, parseTable } from './sections.js';
 const RECEIPT_SECTION_ALIASES = ['产物生命周期收据', 'Artifact Lifecycle Receipts'];
 const RECEIPT_COLUMNS = ['event', 'output', 'input', 'input_sha256', 'completed_at'];
@@ -10,7 +11,6 @@ const RECEIPT_EVENTS = new Set([
     'code.completed'
 ]);
 const SHA256_RE = /^[a-f0-9]{64}$/;
-const ARTIFACT_NAME_RE = /^(analysis|review-analysis|plan|review-plan|code|review-code|manual-validation|validation-run|pr-review)(?:-r([2-9]|[1-9]\d+))?\.md$/;
 const RECEIPT_SHAPES = {
     'review-analysis.completed': { output: 'review-analysis', input: 'analysis' },
     'review-plan.completed': { output: 'review-plan', input: 'plan' },
@@ -30,21 +30,9 @@ function sha256Bytes(value) {
 function sha256File(filePath) {
     return sha256Bytes(fs.readFileSync(filePath));
 }
-function parseReceiptArtifactName(name) {
-    const match = ARTIFACT_NAME_RE.exec(name);
-    if (!match)
-        return null;
-    const roundText = match[2];
-    if (roundText !== undefined) {
-        const round = Number(roundText);
-        if (!Number.isSafeInteger(round) || String(round) !== roundText)
-            return null;
-    }
-    return { family: match[1] };
-}
 function validateReceiptShape(event, output, input) {
-    const outputIdentity = parseReceiptArtifactName(output);
-    const inputIdentity = parseReceiptArtifactName(input);
+    const outputIdentity = parseArtifactName(output);
+    const inputIdentity = parseArtifactName(input);
     if (!outputIdentity || !inputIdentity)
         throw new ArtifactReceiptError(`receipt artifact identity is invalid: ${output} -> ${input}`);
     const shape = RECEIPT_SHAPES[event];

package/dist/lib/task/artifact-repair-intent.js

@@ -1,23 +1,44 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
 function intentRoot(repoRoot) {
     return path.join(repoRoot, '.agents', 'workspace', '.local-artifact-finalization-intents');
 }
 function intentPath(repoRoot, taskId, family, artifact) {
     return path.join(intentRoot(repoRoot), `${taskId}-${family}-${artifact}.json`);
 }
-function isArtifactRepairIntent(value) {
+function validDigest(value) {
+    return typeof value === 'string' && /^[a-f0-9]{64}$/u.test(value);
+}
+function validTaskId(value) {
+    return typeof value === 'string' && /^TASK-\d{8}-\d{6}$/u.test(value);
+}
+function exactKeys(value, keys) {
+    return Object.keys(value).sort().join(',') === [...keys].sort().join(',');
+}
+export function isArtifactRepairIntent(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return false;
     const intent = value;
-    return intent.version === 1
-        && typeof intent.taskId === 'string' && /^TASK-\d{8}-\d{6}$/.test(intent.taskId)
-        && typeof intent.family === 'string' && ['analysis', 'review-analysis', 'plan', 'review-plan', 'code', 'review-code'].includes(intent.family)
+    return exactKeys(intent, [
+        'artifact', 'artifactSha256', 'authorityDigest', 'baselineSemanticDigest', 'createdAt',
+        'family', 'phase', 'recoveryOperationId', 'requestId', 'semanticDigest', 'state',
+        'taskId', 'updatedAt', 'version'
+    ])
+        && intent.version === 2
+        && validTaskId(intent.taskId)
+        && typeof intent.family === 'string'
+        && ['analysis', 'review-analysis', 'plan', 'review-plan', 'code', 'review-code'].includes(intent.family)
         && typeof intent.artifact === 'string' && intent.artifact.length > 0
-        && ['awaiting-repair', 'passed', 'consumed'].includes(String(intent.state))
-        && (intent.baselineSemanticDigest === null || (typeof intent.baselineSemanticDigest === 'string' && /^[a-f0-9]{64}$/.test(intent.baselineSemanticDigest)))
-        && typeof intent.artifactSha256 === 'string' && /^[a-f0-9]{64}$/.test(intent.artifactSha256)
-        && typeof intent.semanticDigest === 'string' && /^[a-f0-9]{64}$/.test(intent.semanticDigest)
+        && ['awaiting-repair', 'finalize-ready', 'commit-started', 'passed', 'consumed'].includes(String(intent.state))
+        && (intent.baselineSemanticDigest === null || validDigest(intent.baselineSemanticDigest))
+        && validDigest(intent.artifactSha256)
+        && validDigest(intent.semanticDigest)
+        && (intent.recoveryOperationId === null || (typeof intent.recoveryOperationId === 'string' && /^[a-f0-9-]{16,64}$/u.test(intent.recoveryOperationId)))
+        && (intent.phase === null || ['orchestration.prepare', 'artifact.finalize-local', 'task-event.completed'].includes(String(intent.phase)))
+        && (intent.authorityDigest === null || validDigest(intent.authorityDigest))
+        && typeof intent.requestId === 'string' && intent.requestId.length > 0 && !/[\r\n]/u.test(intent.requestId)
+        && Number.isSafeInteger(intent.createdAt) && Number.isSafeInteger(intent.updatedAt)
         && (intent.state === 'awaiting-repair' ? intent.baselineSemanticDigest === intent.semanticDigest : true);
 }
 function readArtifactRepairIntent(repoRoot, taskId, family, artifact) {
@@ -36,24 +57,74 @@ function readArtifactRepairIntent(repoRoot, taskId, family, artifact) {
     }
     return value;
 }
-function writeArtifactRepairIntent(repoRoot, value) {
+export function writeArtifactRepairIntent(repoRoot, value, options = {}) {
     if (!isArtifactRepairIntent(value))
         throw new Error('ARTIFACT_REPAIR_INTENT_INVALID: repair provenance schema is invalid');
     const directory = intentRoot(repoRoot);
     fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
     const target = intentPath(repoRoot, value.taskId, value.family, value.artifact);
-    const temporary = `${target}.${process.pid}.${Date.now()}.tmp`;
-    fs.writeFileSync(temporary, `${JSON.stringify(value)}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+    const lock = `${target}.lock`;
+    let descriptor;
     try {
-        fs.renameSync(temporary, target);
+        descriptor = fs.openSync(lock, 'wx', 0o600);
     }
     catch (error) {
-        try {
-            fs.unlinkSync(temporary);
+        if (error.code === 'EEXIST') {
+            throw new Error('ARTIFACT_REPAIR_INTENT_CONFLICT: another provenance writer owns the intent');
         }
-        catch { /* preserve primary error */ }
         throw error;
     }
+    try {
+        const current = fs.existsSync(target)
+            ? readArtifactRepairIntent(repoRoot, value.taskId, value.family, value.artifact)
+            : null;
+        if (!isDeepStrictEqual(current, options.expected ?? null)) {
+            throw new Error('ARTIFACT_REPAIR_INTENT_CONFLICT: repair provenance changed during finalization');
+        }
+        const temporary = `${target}.${process.pid}.${Date.now()}.tmp`;
+        fs.writeFileSync(temporary, `${JSON.stringify(value)}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+        try {
+            fs.renameSync(temporary, target);
+        }
+        catch (error) {
+            try {
+                fs.unlinkSync(temporary);
+            }
+            catch { /* preserve primary error */ }
+            throw error;
+        }
+    }
+    finally {
+        fs.closeSync(descriptor);
+        try {
+            fs.unlinkSync(lock);
+        }
+        catch { /* preserve the primary result */ }
+    }
+}
+export function findArtifactRepairIntentsByOperation(repoRoot, operationId) {
+    if (!operationId || /[\r\n]/u.test(operationId)) {
+        throw new Error('ARTIFACT_REPAIR_OPERATION_INVALID: recovery operation id is invalid');
+    }
+    const directory = intentRoot(repoRoot);
+    if (!fs.existsSync(directory))
+        return Object.freeze([]);
+    return Object.freeze(fs.readdirSync(directory)
+        .filter((name) => name.endsWith('.json'))
+        .map((name) => {
+        const target = path.join(directory, name);
+        let value;
+        try {
+            value = JSON.parse(fs.readFileSync(target, 'utf8'));
+        }
+        catch (error) {
+            throw new Error(`ARTIFACT_REPAIR_INTENT_INVALID: ${String(error)}`);
+        }
+        if (!isArtifactRepairIntent(value))
+            throw new Error('ARTIFACT_REPAIR_INTENT_INVALID: repair provenance schema is invalid');
+        return value;
+    })
+        .filter((value) => value.recoveryOperationId === operationId));
 }
-export { readArtifactRepairIntent, writeArtifactRepairIntent };
+export { readArtifactRepairIntent };
 //# sourceMappingURL=artifact-repair-intent.js.map

package/dist/lib/task/artifact-schema.js

@@ -1,14 +1,4 @@
-const ARTIFACT_FAMILY_CATALOG = [
-    { family: 'analysis', sectionAliases: ['分析', 'Analysis'], heading: '分析', labels: ['需求分析报告', 'Requirements Analysis'] },
-    { family: 'review-analysis', sectionAliases: ['审查反馈', 'Review Feedback'], heading: '审查反馈', labels: ['需求分析审查', 'Analysis Review'] },
-    { family: 'plan', sectionAliases: ['设计', 'Design'], heading: '设计', labels: ['技术方案', 'Technical Plan'] },
-    { family: 'review-plan', sectionAliases: ['审查反馈', 'Review Feedback'], heading: '审查反馈', labels: ['技术方案审查', 'Plan Review'] },
-    { family: 'code', sectionAliases: ['实现备注', 'Implementation Notes'], heading: '实现备注', labels: ['实现报告', 'Implementation Report'] },
-    { family: 'review-code', sectionAliases: ['审查反馈', 'Review Feedback'], heading: '审查反馈', labels: ['代码审查', 'Code Review'] },
-    { family: 'manual-validation', sectionAliases: ['实现备注', 'Implementation Notes'], heading: '实现备注', labels: ['人工验证', 'Manual Validation'] },
-    { family: 'validation-run', sectionAliases: ['实现备注', 'Implementation Notes'], heading: '实现备注', labels: ['验证运行证据', 'Validation Run Evidence'] },
-    { family: 'pr-review', sectionAliases: ['审查反馈', 'Review Feedback'], heading: '审查反馈', labels: ['PR 审查报告', 'PR Review Report'] }
-];
+import { parseArtifactName } from './artifact-name.js';
 const LOCAL_SECTIONS = {
     analysis: [
         ['source', '需求来源', 'Requirements Source'],
@@ -114,8 +104,10 @@ function renderArtifactSkeleton(input) {
     if (!schema)
         throw new Error(`unknown artifact schema family '${input.family}'`);
     const locale = input.locale ?? 'zh-CN';
-    const roundMatch = input.artifact.match(/-r(\d+)\.md$/);
-    const round = roundMatch ? Number(roundMatch[1]) : 1;
+    const identity = parseArtifactName(input.artifact);
+    if (identity?.family !== input.family)
+        throw new Error(`invalid artifact identity '${input.artifact}' for '${input.family}'`);
+    const round = identity.round;
     const title = schema.title[locale === 'en' ? 'en' : 'zh'];
     const headings = locale === 'en' ? 'en' : 'zh';
     const lines = [
@@ -131,5 +123,5 @@ function renderArtifactSkeleton(input) {
     }
     return `${lines.join('\n').trimEnd()}\n`;
 }
-export { ARTIFACT_FAMILY_CATALOG, ARTIFACT_SCHEMAS, getArtifactSchema, renderArtifactSkeleton };
+export { ARTIFACT_SCHEMAS, getArtifactSchema, renderArtifactSkeleton };
 //# sourceMappingURL=artifact-schema.js.map

package/dist/lib/task/capabilities.js

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { parseArtifactName } from './artifact-name.js';
 import { invalidationBlocks, isArtifactInvalidated, parseInvalidationDocument } from './invalidation.js';
 import { receiptForOutput } from './artifact-receipts.js';
 import { parseTypedTaskFrontmatter } from './frontmatter.js';
@@ -108,12 +109,9 @@ function canStart(action, facts, trigger) {
     }
     return deny('CAPABILITY_ACTION_UNKNOWN');
 }
-function artifactRound(name) {
-    const match = /-r(\d+)\.md$/.exec(name);
-    return match ? Number(match[1]) : 1;
-}
 function latestArtifact(names) {
-    return [...names].sort((left, right) => artifactRound(right) - artifactRound(left) || left.localeCompare(right))[0] ?? null;
+    return names.map(parseArtifactName).filter((identity) => identity !== null)
+        .sort((left, right) => right.round - left.round || left.name.localeCompare(right.name))[0]?.name ?? null;
 }
 function reviewedInputName(content, expectedFamily) {
     const header = content.split(/\r?\n/).findIndex((line) => /\*\*(?:审查输入|Review Input)\*\*[:：]/.test(line));
@@ -208,16 +206,11 @@ function buildLifecycleFacts(taskDir, content, taskState = 'active', executionBu
             const stat = fs.lstatSync(path.join(taskDir, name));
             return stat.isFile() && !stat.isSymbolicLink();
         });
-        const artifactFamilies = {
-            analysis: /^analysis(?:-r\d+)?\.md$/,
-            'review-analysis': /^review-analysis(?:-r\d+)?\.md$/,
-            plan: /^plan(?:-r\d+)?\.md$/,
-            'review-plan': /^review-plan(?:-r\d+)?\.md$/,
-            code: /^code(?:-r\d+)?\.md$/,
-            'review-code': /^review-code(?:-r\d+)?\.md$/
+        const artifactFamilies = ['analysis', 'review-analysis', 'plan', 'review-plan', 'code', 'review-code'];
+        const familyFor = (name) => {
+            const family = parseArtifactName(name)?.family;
+            return artifactFamilies.find((candidate) => candidate === family) ?? null;
         };
-        const familyFor = (name) => Object.keys(artifactFamilies)
-            .find((family) => artifactFamilies[family].test(name)) ?? null;
         const activeFiles = files.filter((name) => {
             const family = familyFor(name);
             return !family || !isArtifactInvalidated(invalidation.document, family, name);
@@ -225,11 +218,11 @@ function buildLifecycleFacts(taskDir, content, taskState = 'active', executionBu
         const artifactHashes = {};
         for (const name of activeFiles)
             artifactHashes[name] = sha256File(path.join(taskDir, name));
-        const artifacts = Object.fromEntries(Object.keys(artifactFamilies).map((family) => [
-            family, activeFiles.filter((name) => artifactFamilies[family].test(name))
+        const artifacts = Object.fromEntries(artifactFamilies.map((family) => [
+            family, activeFiles.filter((name) => familyFor(name) === family)
         ]));
-        const staleArtifacts = Object.fromEntries(Object.keys(artifactFamilies).map((family) => [
-            family, files.filter((name) => artifactFamilies[family].test(name) && isArtifactInvalidated(invalidation.document, family, name))
+        const staleArtifacts = Object.fromEntries(artifactFamilies.map((family) => [
+            family, files.filter((name) => familyFor(name) === family && isArtifactInvalidated(invalidation.document, family, name))
         ]));
         const qualification = parseTaskQualification(content);
         if (!qualification.ok)
@@ -237,7 +230,7 @@ function buildLifecycleFacts(taskDir, content, taskState = 'active', executionBu
         const qualificationStaleArtifacts = [];
         if (qualification.qualification.present) {
             const constraints = new Map(qualification.qualification.constraints.map((row) => [row.constraintId, row.digest]));
-            for (const family of Object.keys(artifactFamilies)) {
+            for (const family of artifactFamilies) {
                 if (!ARTIFACT_AUDIT_FAMILIES.has(family))
                     continue;
                 const name = latestArtifact(artifacts[family] ?? []);

package/dist/lib/task/codex-orchestration.js

@@ -5,7 +5,12 @@ import { computeLifecycleBuildIdentity, verifyLifecycleBuildIdentity } from '../
 import { verifyCodexSandboxControllerContextWithWarnings as verifySandboxControllerWithWarnings } from '../agent-clients/adapters/codex-lifecycle/sandbox-controller.js';
 import { verifyCodexSandboxControllerContextWithWarnings as verifyControllerContextFileWithWarnings } from '../agent-clients/adapters/codex-lifecycle/controller-context.js';
 import { resolveTaskRef } from './resolve-ref.js';
-import { activateMatchingOrchestrationDelegation, hasActivatableOrchestrationDelegation, hasSealableOrchestrationDelegation, OrchestrationStateError, pauseMatchingOrchestrationDelegation, prepareOrchestrationDelegation, reconcileMatchingOrchestrationDelegation, sealMatchingOrchestrationDelegationWithHostEvidence } from './orchestration.js';
+import { activateMatchingOrchestrationDelegation, hasActivatableOrchestrationDelegation, hasSealableOrchestrationDelegation, OrchestrationStateError, pauseMatchingOrchestrationDelegation, prepareOrchestrationDelegation, routeOrchestration, reconcileMatchingOrchestrationDelegation, sealMatchingOrchestrationDelegationWithHostEvidence } from './orchestration.js';
+import { randomUUID, createHash } from 'node:crypto';
+import { consumeLifecycleRecoveryAttestation, issueLifecycleRecoveryAttestation, validateLifecycleRecoveryAttestation } from './control-authority.js';
+function buildIdentityDigest(value) {
+    return createHash('sha256').update(JSON.stringify(value), 'utf8').digest('hex');
+}
 function coreOptions(options) {
     return { ...options.orchestrationOptions, repoRoot: options.repoRoot ?? options.orchestrationOptions?.repoRoot };
 }
@@ -73,8 +78,9 @@ async function prepareCodexOrchestrationDelegation(taskRef, input, options = {})
         if (!resolved.ok)
             return bridgeFailure(resolved.code, resolved.message);
         const preflight = await (options.preflight ?? preflightCodexLifecycleEvidence)(repoRoot);
-        if (!input.capabilityToken) {
-            return bridgeFailure('ORCHESTRATION_CODEX_CAPABILITY_REQUIRED', 'Codex prepare requires a current-session capability token');
+        const capabilityRef = input.capabilityRef;
+        if (!capabilityRef) {
+            return bridgeFailure('ORCHESTRATION_CODEX_CAPABILITY_REQUIRED', 'Codex prepare requires a current-session capability reference');
         }
         const buildIdentity = options.buildIdentity ?? computeLifecycleBuildIdentity(repoRoot);
         const brokerController = options.controllerBinding ?? brokerControllerBinding();
@@ -99,7 +105,7 @@ async function prepareCodexOrchestrationDelegation(taskRef, input, options = {})
             controlGeneration: localController.controlGeneration
         } : null);
         const capabilityStore = options.capabilityStore ?? createCodexCapabilityStore();
-        const attested = capabilityStore.inspect(input.capabilityToken);
+        const attested = capabilityStore.inspectReference(capabilityRef);
         const capabilityIdentity = verifyLifecycleBuildIdentity(attested.buildIdentity, buildIdentity);
         if (!capabilityIdentity.ok) {
             return bridgeFailure(capabilityIdentity.code, capabilityIdentity.message);
@@ -124,14 +130,57 @@ async function prepareCodexOrchestrationDelegation(taskRef, input, options = {})
                     controlGeneration: controller.controlGeneration
                 } } : {})
         };
+        if (input.lifecycleRecoveryAttestation) {
+            try {
+                validateLifecycleRecoveryAttestation(input.lifecycleRecoveryAttestation);
+            }
+            catch (error) {
+                return bridgeFailure('LIFECYCLE_AUTHORITY_ATTESTATION_INVALID', error instanceof Error ? error.message : String(error));
+            }
+        }
+        let lifecycleRecoveryAttestation = input.lifecycleRecoveryAttestation ?? null;
+        const routed = input.capabilityRef && !lifecycleRecoveryAttestation
+            ? routeOrchestration(taskRef, coreOptions(options))
+            : null;
+        if (routed && !routed.next)
+            return routed;
+        if (routed?.next && ['analysis', 'plan', 'code'].includes(routed.next.stage)) {
+            const recoveryRequest = {
+                version: 1,
+                requestId: randomUUID(),
+                operationId: randomUUID(),
+                phase: 'orchestration.prepare',
+                taskId: resolved.taskId,
+                family: routed.next.stage === 'analysis' ? 'analysis'
+                    : routed.next.stage === 'plan' ? 'plan' : 'code',
+                artifact: routed.next.artifact,
+                round: routed.next.round,
+                lifecycleRequestId: randomUUID(),
+                authorityRef: capabilityRef,
+                expectedControlGeneration: controller?.controlGeneration ?? '',
+                expectedControllerInstanceDigest: controller?.instanceDigest ?? '0'.repeat(64),
+                expectedBuildIdentityDigest: buildIdentityDigest(buildIdentity),
+                expectedHookDefinitionHash: preflight.hookDefinitionHash
+            };
+            const authority = issueLifecycleRecoveryAttestation(recoveryRequest, {
+                capabilityStore,
+                ...(controller ? { controllerBinding: controller } : {}),
+                buildIdentity
+            });
+            if (authority.status === 'rejected' || !authority.attestation) {
+                return bridgeFailure(authority.error?.code ?? 'LIFECYCLE_AUTHORITY_REJECTED', authority.error?.message ?? 'lifecycle authority was rejected');
+            }
+            lifecycleRecoveryAttestation = authority.attestation;
+        }
         const prepared = prepareOrchestrationDelegation(taskRef, {
             ...input,
-            lifecycleProvenance
+            lifecycleProvenance,
+            lifecycleRecoveryAttestation
         }, {
             ...coreOptions(options),
             validateLifecycleCapability: () => {
                 try {
-                    const validated = capabilityStore.validate(input.capabilityToken, capabilityExpected);
+                    const validated = capabilityStore.validateReference(capabilityRef, capabilityExpected);
                     if (validated.sessionId !== attested.sessionId
                         || validated.turnId !== attested.turnId
                         || validated.toolUseId !== attested.toolUseId) {
@@ -146,24 +195,16 @@ async function prepareCodexOrchestrationDelegation(taskRef, input, options = {})
                     return capabilityFailure(error);
                 }
             },
-            consumeLifecycleCapability: () => {
-                try {
-                    const consumed = capabilityStore.consume(input.capabilityToken, capabilityExpected);
-                    if (consumed.sessionId !== attested.sessionId
-                        || consumed.turnId !== attested.turnId
-                        || consumed.toolUseId !== attested.toolUseId) {
-                        return {
-                            code: 'CODEX_CAPABILITY_IDENTITY_CHANGED',
-                            message: 'capability identity changed during consumption'
-                        };
-                    }
-                    return null;
-                }
-                catch (error) {
-                    return capabilityFailure(error);
-                }
-            }
+            consumeLifecycleCapability: () => null
         });
+        if (lifecycleRecoveryAttestation && !options.deferLifecycleRecoveryConsumption && prepared.status !== 'failed') {
+            try {
+                consumeLifecycleRecoveryAttestation(lifecycleRecoveryAttestation);
+            }
+            catch (error) {
+                return bridgeFailure(error instanceof Error ? error.name : 'LIFECYCLE_AUTHORITY_CONSUME_FAILED', error instanceof Error ? error.message : String(error));
+            }
+        }
         return identityWarnings.length > 0 && prepared.status !== 'failed'
             ? { ...prepared, warnings: Object.freeze(identityWarnings) }
             : prepared;
@@ -211,7 +252,12 @@ async function activateCodexOrchestrationDelegation(childThreadId, options = {})
         const contextVerification = contextPath
             ? verifySandboxControllerWithWarnings(contextPath, { repoRoot })
             : null;
-        const controller = contextVerification?.context ?? null;
+        const controller = options.controllerBinding
+            ?? brokerControllerBinding()
+            ?? (contextVerification?.context ? {
+                instanceDigest: contextVerification.context.controllerInstanceDigest,
+                controlGeneration: contextVerification.context.controlGeneration
+            } : null);
         const activated = activateMatchingOrchestrationDelegation('codex', {
             nativeAgent: evidence.nativeAgent,
             childId: evidence.childThreadId,
@@ -233,7 +279,7 @@ async function activateCodexOrchestrationDelegation(childThreadId, options = {})
                 capabilityTurnId: evidence.parentTurnId,
                 spawnToolUseId: evidence.spawnToolUseId,
                 spawnObservedAt: record.spawnObservedAt ?? undefined,
-                controllerInstanceDigest: controller?.controllerInstanceDigest ?? null,
+                controllerInstanceDigest: controller?.instanceDigest ?? null,
                 controlGeneration: controller?.controlGeneration ?? null
             }
         }, coreOptions(options));

package/dist/lib/task/commit-identity.js

@@ -0,0 +1,28 @@
+import { execFileSync } from 'node:child_process';
+function gitText(repoRoot, args) {
+    return execFileSync('git', [...args], {
+        cwd: repoRoot,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe']
+    }).trim();
+}
+function checkpointCommitMatches(repoRoot, intent, head) {
+    try {
+        const parent = gitText(repoRoot, ['rev-parse', `${head}^`]);
+        const tree = gitText(repoRoot, ['rev-parse', `${head}^{tree}`]);
+        const message = gitText(repoRoot, ['show', '-s', '--format=%s', head]);
+        const changed = gitText(repoRoot, ['diff-tree', '--no-commit-id', '--name-only', '-r', head])
+            .split('\n')
+            .filter(Boolean)
+            .sort();
+        return parent === intent.expectedHead
+            && tree === intent.expectedTree
+            && message === intent.message
+            && JSON.stringify(changed) === JSON.stringify([...intent.paths].sort());
+    }
+    catch {
+        return false;
+    }
+}
+export { checkpointCommitMatches };
+//# sourceMappingURL=commit-identity.js.map