@fitlab-ai/agent-infra 0.9.15 → 0.11.0

package/lib/task/delegation-receipts.ts

@@ -186,7 +186,8 @@ function isDelegationHostEvidence(value: unknown): value is DelegationHostEviden
 function hasCurrentCodexEvidence(receipt: DelegationReceipt): boolean {
   const provenance = receipt.lifecycleProvenance;
   if (!provenance) return false;
-  const activated = ['activated', 'stage-completed', 'sealed', 'consumed'].includes(receipt.status);
+  const activated = ['activated', 'stage-completed', 'sealed', 'consumed'].includes(receipt.status)
+    || (receipt.status === 'aborted' && receipt.activatedAt !== null);
   if (!activated) return receipt.hostEvidence === null;
   const host = receipt.hostEvidence;
   if (
@@ -219,6 +220,12 @@ function hasCurrentCodexEvidence(receipt: DelegationReceipt): boolean {
       && host.consumer === receipt.id
       && exactText(host.consumedAt);
   }
+  if (receipt.status === 'aborted') {
+    return Number.isSafeInteger(host.stopRevision)
+      && (host.stopRevision as number) > host.startRevision
+      && host.consumer === `lifecycle-recovery:${receipt.taskId}:${receipt.id}`
+      && exactText(host.consumedAt);
+  }
   return host.stopRevision === null && host.consumer === null && host.consumedAt === null;
 }
 
@@ -244,7 +251,8 @@ function hasStatusBoundEvidence(receipt: DelegationReceipt): boolean {
   const dispatchComplete = dispatchFields.every((field) => field !== null);
   if (!dispatchEmpty && !dispatchComplete) return false;
 
-  const beforeActivation = ['prepared', 'aborted', 'expired'].includes(receipt.status);
+  const beforeActivation = ['prepared', 'expired'].includes(receipt.status)
+    || (receipt.status === 'aborted' && receipt.activatedAt === null);
   if (beforeActivation) {
     return receipt.parentId === null
       && receipt.childId === null
@@ -282,6 +290,21 @@ function hasStatusBoundEvidence(receipt: DelegationReceipt): boolean {
       && receipt.consumedAt === null;
   }
 
+  if (receipt.status === 'aborted') {
+    const host = receipt.hostEvidence;
+    return receipt.agent === null
+      && receipt.afterFingerprint === null
+      && receipt.changedPaths.length === 0
+      && receipt.sealedAt === null
+      && receipt.consumedAt === null
+      && host !== null
+      && host !== undefined
+      && Number.isSafeInteger(host.stopRevision)
+      && (host.stopRevision as number) > host.startRevision
+      && host.consumer === `lifecycle-recovery:${receipt.taskId}:${receipt.id}`
+      && exactText(host.consumedAt);
+  }
+
   if (
     !exactText(receipt.agent)
     || normalizeAgentToken(receipt.agent) !== normalizeAgentToken(receipt.client)
@@ -584,6 +607,53 @@ function abortPreparedDelegation(receipt: DelegationReceipt): ReceiptResult {
   };
 }
 
+function abortActivatedDelegation(
+  receipt: DelegationReceipt,
+  event: Readonly<{ childId: string; stopRevision: number; consumer: string; consumedAt: string }>
+): ReceiptResult {
+  if (receipt.status !== 'activated') {
+    return fail('DELEGATION_STATE_INVALID', `delegation ${receipt.id} is ${receipt.status}, expected activated`);
+  }
+  if (
+    receipt.client !== 'codex'
+    || !receipt.lifecycleProvenance
+    || receipt.hostEvidence?.kind !== 'codex-lifecycle-v2'
+    || typeof receipt.lifecycleProvenance.controllerInstanceDigest !== 'string'
+    || typeof receipt.lifecycleProvenance.controlGeneration !== 'string'
+    || typeof receipt.hostEvidence.controllerInstanceDigest !== 'string'
+    || typeof receipt.hostEvidence.controlGeneration !== 'string'
+  ) {
+    return fail('DELEGATION_RECOVERY_EVIDENCE_INVALID', 'activated delegation lacks the current Codex controller binding');
+  }
+  if (
+    event.childId !== receipt.childId
+    || !Number.isSafeInteger(event.stopRevision)
+    || event.stopRevision <= receipt.hostEvidence.startRevision
+    || event.consumer !== `lifecycle-recovery:${receipt.taskId}:${receipt.id}`
+    || !exactText(event.consumedAt)
+  ) {
+    return fail('DELEGATION_RECOVERY_EVIDENCE_INVALID', 'recovery stop evidence does not match the activated delegation');
+  }
+  return {
+    ok: true,
+    receipt: Object.freeze({
+      ...receipt,
+      status: 'aborted' as const,
+      agent: null,
+      afterFingerprint: null,
+      changedPaths: Object.freeze([]),
+      sealedAt: null,
+      consumedAt: null,
+      hostEvidence: Object.freeze({
+        ...receipt.hostEvidence,
+        stopRevision: event.stopRevision,
+        consumer: event.consumer,
+        consumedAt: event.consumedAt
+      })
+    })
+  };
+}
+
 function completeDelegationStage(
   receipt: DelegationReceipt,
   event: Readonly<{ stage: DelegationStage; round: number; artifact: string; agent: string }>
@@ -666,6 +736,7 @@ function consumeDelegation(receipt: DelegationReceipt, options: { now?: () => st
 
 export {
   activateDelegation,
+  abortActivatedDelegation,
   abortPreparedDelegation,
   completeDelegationStage,
   consumeDelegation,

package/lib/task/events.ts

@@ -38,7 +38,9 @@ import {
   readLocalArtifactFinalizationIntent,
   validateLocalArtifact
 } from './local-artifact-finalization.ts';
-import { writeArtifactRepairIntent } from './artifact-repair-intent.ts';
+import { writeArtifactRecoveryIntent, readArtifactRecoveryIntent } from './artifact-repair-intent.ts';
+import { reconcileArtifactRecovery, recoveryContextFromIntent, sha256Content } from './artifact-recovery.ts';
+import type { ArtifactRecoveryIntent } from './artifact-repair-intent.ts';
 import type { LocalArtifactFamily, LocalArtifactFinalizationIntent } from './local-artifact-finalization.ts';
 import { buildLifecycleFacts, canStart } from './capabilities.ts';
 import type { ExplicitTrigger, LifecycleAction, TriggerInitiator, TriggerReason } from './capabilities.ts';
@@ -48,7 +50,7 @@ import { consumeReworkIntents, parseReworkIntentDocument, reworkIntentMutation,
 import { ARTIFACT_FAMILIES, expectedQualificationRelations, parseQualificationAudit, parseTaskQualification, upstreamArtifactDigest, validateQualificationAudit } from './qualification-audit.ts';
 import type { QualificationAudit, UpstreamRelation } from './qualification-audit.ts';
 import { getArtifactSchema } from './artifact-schema.ts';
-import { inspectArtifactContract } from './artifact-operations.ts';
+import { canonicalSemanticDigest, inspectArtifactContract } from './artifact-operations.ts';
 import {
   consumeLifecycleRecoveryAttestation,
   lifecycleRecoveryAttestationDigest,
@@ -373,6 +375,67 @@ function reviewInputFamily(family: EventFamily): ArtifactFamily {
   return family === 'review-analysis' ? 'analysis' : family === 'review-plan' ? 'plan' : 'code';
 }
 
+function reconcileReviewCompletionReplay(
+  repoRoot: string,
+  taskDir: string,
+  taskId: string,
+  family: EventFamily,
+  artifact: string,
+  round: number
+): TaskEventError | null {
+  const stage = REVIEW_LEDGER_STAGES[family];
+  if (!stage) return null;
+  const reviewFamily = family as 'review-analysis' | 'review-plan' | 'review-code';
+  try {
+    let intent = readArtifactRecoveryIntent(repoRoot, taskId, reviewFamily, artifact);
+    if (!intent) return null;
+    if (intent.state === 'commit-started') {
+      const reconciled = reconcileArtifactRecovery(
+        recoveryContextFromIntent(repoRoot, taskDir, intent),
+        { lockAlreadyHeld: true }
+      );
+      if (reconciled.status !== 'passed' && reconciled.status !== 'consumed') {
+        return {
+          code: 'EVENT_ARTIFACT_CONFLICT',
+          message: `review finalizer recovery remains ${reconciled.status} for ${artifact}`
+        };
+      }
+      intent = reconciled.intent;
+    }
+    if (!['passed', 'consumption-started', 'consumed'].includes(intent.state)) {
+      return {
+        code: 'EVENT_ARTIFACT_CONFLICT',
+        message: `review finalizer provenance is incomplete for ${artifact}`
+      };
+    }
+    const validated = validateCompletedArtifact(taskDir, FAMILY[family].artifact, artifact, round);
+    if (!validated.ok) {
+      return { code: 'EVENT_ARTIFACT_CONFLICT', message: validated.error.message };
+    }
+    const content = fs.readFileSync(validated.artifact.path, 'utf8');
+    const expectedRequestId = `review-finalize:${taskId}:${stage}:${round}`;
+    if (intent.round !== round
+      || intent.requestId !== expectedRequestId
+      || intent.finalArtifactSha256 !== sha256Content(content)
+      || intent.finalSemanticDigest !== canonicalSemanticDigest(content)) {
+      return {
+        code: 'EVENT_ARTIFACT_CONFLICT',
+        message: `review finalizer provenance does not match ${artifact}`
+      };
+    }
+    if (intent.state === 'passed' || intent.state === 'consumption-started') {
+      const consumed = { ...intent, state: 'consumed' as const, updatedAt: Date.now() };
+      writeArtifactRecoveryIntent(repoRoot, consumed, { expected: intent });
+    }
+    return null;
+  } catch (error) {
+    return {
+      code: 'EVENT_ARTIFACT_CONFLICT',
+      message: `review finalizer recovery could not be reconciled for ${artifact}: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+}
+
 function relationForStartedInput(family: EventFamily, input: ArtifactIdentity): UpstreamRelation['relation'] {
   if (family.startsWith('review-')) {
     return input.family === reviewInputFamily(family) ? 'reviewed-input' : 'approval-context';
@@ -720,6 +783,8 @@ function applyTaskEventUnlocked(request: TaskEventRequest, options: TaskEventOpt
   const row = manual ? openRows.at(-1) : matchingRows[0];
   let completedArtifact: ArtifactIdentity | null = null;
   let localFinalizationIntent: LocalArtifactFinalizationIntent | null = null;
+  let reviewFinalizationIntent: ArtifactRecoveryIntent | null = null;
+  let reviewContent: string | null = null;
   if (eventIdentity.phase === 'started' && row) {
     if (row.agent !== normalized.agent) return failed(normalized, { code: 'EVENT_LOG_CONFLICT', message: 'open started event has a different agent' }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath });
     if (manual && normalized.transactionId !== undefined) {
@@ -732,7 +797,20 @@ function applyTaskEventUnlocked(request: TaskEventRequest, options: TaskEventOpt
   }
   if (eventIdentity.phase === 'started' && !manual && completedRows.length > 0) return failed(normalized, { code: 'EVENT_ALREADY_COMPLETED', message: 'event identity is already completed' }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath });
   const done = completedRows.find((item) => item.note === eventIdentity.note);
-  if (eventIdentity.phase === 'completed' && done) return successNoOp(normalized, resolved.taskId, resolved.taskMdPath, currentStep, eventIdentity, done.done, frontmatter, artifactContext);
+  if (eventIdentity.phase === 'completed' && done) {
+    if (!normalized.dryRun && eventIdentity.family.startsWith('review-') && normalized.artifact && normalized.round) {
+      const recoveryError = reconcileReviewCompletionReplay(
+        resolved.repoRoot,
+        resolved.taskDir,
+        resolved.taskId,
+        eventIdentity.family,
+        normalized.artifact,
+        normalized.round
+      );
+      if (recoveryError) return failed(normalized, recoveryError, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+    }
+    return successNoOp(normalized, resolved.taskId, resolved.taskMdPath, currentStep, eventIdentity, done.done, frontmatter, artifactContext);
+  }
   if (eventIdentity.phase === 'completed' && completedRows.length > 0 && openRows.length === 0) return failed(normalized, { code: 'EVENT_LOG_CONFLICT', message: 'event identity is already completed with a different payload' }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
   if (eventIdentity.phase === 'completed' && !row?.started && !allowsManualOverride(options.manualOverride, 'task-event', 'EVENT_START_MISSING')) return failed(normalized, { code: 'EVENT_START_MISSING', message: 'completion requires one open matching started event' }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
   if (eventIdentity.phase === 'completed') {
@@ -749,7 +827,6 @@ function applyTaskEventUnlocked(request: TaskEventRequest, options: TaskEventOpt
       if (validationError) return failed(normalized, validationError, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
     }
     if (eventIdentity.family.startsWith('review-')) {
-      let reviewContent: string;
       try { reviewContent = fs.readFileSync(completedArtifact.path, 'utf8'); }
       catch (error) {
         return failed(normalized, { code: 'EVENT_ARTIFACT_CONFLICT', message: `cannot read qualification audit from ${completedArtifact.name}: ${error instanceof Error ? error.message : String(error)}` }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
@@ -776,6 +853,23 @@ function applyTaskEventUnlocked(request: TaskEventRequest, options: TaskEventOpt
       const localFamily = eventIdentity.family === 'analyze'
         ? 'analysis'
         : eventIdentity.family === 'plan' ? 'plan' : 'code';
+      try {
+        localFinalizationIntent = readLocalArtifactFinalizationIntent(
+          resolved.repoRoot, resolved.taskId, localFamily, completedArtifact.name
+        );
+        if (localFinalizationIntent?.state === 'commit-started') {
+          const reconciled = reconcileArtifactRecovery(
+            recoveryContextFromIntent(resolved.repoRoot, resolved.taskDir, localFinalizationIntent),
+            { lockAlreadyHeld: true }
+          );
+          if (reconciled.status === 'passed' || reconciled.status === 'consumed') localFinalizationIntent = reconciled.intent;
+        }
+      } catch (error) {
+        return failed(normalized, {
+          code: 'EVENT_ARTIFACT_CONFLICT',
+          message: `local finalizer recovery could not be reconciled for ${completedArtifact.name}: ${error instanceof Error ? error.message : String(error)}`
+        }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+      }
       let artifactContent: string;
       try { artifactContent = fs.readFileSync(completedArtifact.path, 'utf8'); }
       catch (error) {
@@ -805,34 +899,23 @@ function applyTaskEventUnlocked(request: TaskEventRequest, options: TaskEventOpt
           message: `semantic digest does not match finalizer result for ${completedArtifact.name}`
         }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
       }
-      try {
-        localFinalizationIntent = readLocalArtifactFinalizationIntent(
-          resolved.repoRoot, resolved.taskId, localFamily, completedArtifact.name
-        );
-      } catch (error) {
-        return failed(normalized, {
-          code: 'EVENT_ARTIFACT_CONFLICT',
-          message: `cannot read local finalizer provenance for ${completedArtifact.name}: ${error instanceof Error ? error.message : String(error)}`
-        }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
-      }
-      if (!localFinalizationIntent || !['passed', 'consumed', 'finalize-ready', 'commit-started'].includes(localFinalizationIntent.state)) {
+      if (!localFinalizationIntent || !['passed', 'consumed'].includes(localFinalizationIntent.state)) {
         return failed(normalized, {
           code: 'EVENT_ARTIFACT_CONFLICT',
           message: `local finalizer provenance is missing or incomplete for ${completedArtifact.name}`
         }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
       }
-      if (localFinalizationIntent.artifactSha256 !== actualSha256 || localFinalizationIntent.semanticDigest !== local.semanticDigest) {
+      if (localFinalizationIntent.finalArtifactSha256 !== actualSha256 || localFinalizationIntent.finalSemanticDigest !== local.semanticDigest) {
         return failed(normalized, {
           code: 'EVENT_ARTIFACT_CONFLICT',
           message: `local finalizer provenance does not match ${completedArtifact.name}`
         }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
       }
-      if (localFinalizationIntent.recoveryOperationId !== null) {
+      if (localFinalizationIntent.authorityDigest !== null) {
         if (!lifecycleAuthority
           || localFinalizationIntent.recoveryOperationId !== lifecycleAuthority.operationId
           || localFinalizationIntent.requestId !== lifecycleAuthority.lifecycleRequestId
-          || (localFinalizationIntent.phase !== 'artifact.finalize-local'
-            && localFinalizationIntent.authorityDigest !== lifecycleRecoveryAttestationDigest(lifecycleAuthority))) {
+          || localFinalizationIntent.authorityDigest !== lifecycleRecoveryAttestationDigest(lifecycleAuthority)) {
           return failed(normalized, {
             code: 'EVENT_ARTIFACT_CONFLICT',
             message: `local finalizer provenance does not match lifecycle completion authority for ${completedArtifact.name}`
@@ -865,6 +948,49 @@ function applyTaskEventUnlocked(request: TaskEventRequest, options: TaskEventOpt
     completedArtifact?.path ?? null
   );
   if (findingCountError) return failed(normalized, findingCountError, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+  if (eventIdentity.phase === 'completed' && eventIdentity.family.startsWith('review-') && completedArtifact && reviewContent !== null) {
+    try {
+      reviewFinalizationIntent = readArtifactRecoveryIntent(
+        resolved.repoRoot,
+        resolved.taskId,
+        eventIdentity.family as 'review-analysis' | 'review-plan' | 'review-code',
+        completedArtifact.name
+      );
+      if (!normalized.dryRun && reviewFinalizationIntent?.state === 'commit-started') {
+        const reconciled = reconcileArtifactRecovery(
+          recoveryContextFromIntent(resolved.repoRoot, resolved.taskDir, reviewFinalizationIntent),
+          { lockAlreadyHeld: true }
+        );
+        if (reconciled.status === 'passed' || reconciled.status === 'consumed') reviewFinalizationIntent = reconciled.intent;
+      }
+      if (!reviewFinalizationIntent || !['passed', 'consumption-started', 'consumed'].includes(reviewFinalizationIntent.state)) {
+        return failed(normalized, {
+          code: 'EVENT_ARTIFACT_CONFLICT',
+          message: `review finalizer provenance is missing or incomplete for ${completedArtifact.name}`
+        }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+      }
+      const reviewStage = eventIdentity.family === 'review-analysis'
+        ? 'analysis'
+        : eventIdentity.family === 'review-plan' ? 'plan' : 'code';
+      const actualSha256 = sha256File(completedArtifact.path);
+      const actualSemanticDigest = canonicalSemanticDigest(reviewContent);
+      const expectedRequestId = `review-finalize:${resolved.taskId}:${reviewStage}:${normalized.round}`;
+      if (reviewFinalizationIntent.round !== normalized.round
+        || reviewFinalizationIntent.requestId !== expectedRequestId
+        || reviewFinalizationIntent.finalArtifactSha256 !== actualSha256
+        || reviewFinalizationIntent.finalSemanticDigest !== actualSemanticDigest) {
+        return failed(normalized, {
+          code: 'EVENT_ARTIFACT_CONFLICT',
+          message: `review finalizer provenance does not match ${completedArtifact.name}`
+        }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+      }
+    } catch (error) {
+      return failed(normalized, {
+        code: 'EVENT_ARTIFACT_CONFLICT',
+        message: `review finalizer recovery could not be reconciled for ${completedArtifact.name}: ${error instanceof Error ? error.message : String(error)}`
+      }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+    }
+  }
   let orchestrationCompletion: OrchestrationStageCompletion | null = null;
   if (eventIdentity.phase === 'completed' && eventIdentity.family !== 'manual-validation' && eventIdentity.family !== 'validation-run') {
     const orchestrationStage = eventIdentity.family === 'analyze' ? 'analysis' : eventIdentity.family;
@@ -990,15 +1116,15 @@ function applyTaskEventUnlocked(request: TaskEventRequest, options: TaskEventOpt
         const expectedIntent = localFinalizationIntent;
         localFinalizationIntent = {
           ...localFinalizationIntent,
-          state: 'commit-started',
+          state: 'consumption-started',
           phase: 'task-event.completed',
           authorityDigest: lifecycleRecoveryAttestationDigest(lifecycleAuthority),
           requestId: lifecycleAuthority.lifecycleRequestId,
           updatedAt: Date.now()
         };
-        writeArtifactRepairIntent(resolved.repoRoot, localFinalizationIntent, { expected: expectedIntent });
+        writeArtifactRecoveryIntent(resolved.repoRoot, localFinalizationIntent, { expected: expectedIntent });
       } else if (!lifecycleAuthority && localFinalizationIntent.state === 'passed') {
-        localFinalizationIntent = consumeLocalArtifactFinalizationIntent(resolved.repoRoot, localFinalizationIntent);
+        localFinalizationIntent = consumeLocalArtifactFinalizationIntent(resolved.repoRoot, localFinalizationIntent, { lockAlreadyHeld: options.lockAlreadyHeld });
       }
     } catch (error) {
       return failed(normalized, {
@@ -1015,6 +1141,31 @@ function applyTaskEventUnlocked(request: TaskEventRequest, options: TaskEventOpt
       });
     }
   }
+  if (!normalized.dryRun && reviewFinalizationIntent && completedArtifact && reviewFinalizationIntent.state === 'passed') {
+    try {
+      const expectedIntent = reviewFinalizationIntent;
+      reviewFinalizationIntent = {
+        ...reviewFinalizationIntent,
+        state: 'consumption-started',
+        phase: 'task-event.completed',
+        updatedAt: Date.now()
+      };
+      writeArtifactRecoveryIntent(resolved.repoRoot, reviewFinalizationIntent, { expected: expectedIntent });
+    } catch (error) {
+      return failed(normalized, {
+        code: 'EVENT_ARTIFACT_CONFLICT',
+        message: `review finalizer provenance could not be advanced before task write for ${completedArtifact.name}: ${error instanceof Error ? error.message : String(error)}`
+      }, {
+        taskId: resolved.taskId,
+        taskMdPath: resolved.taskMdPath,
+        fromStep: currentStep,
+        toStep: step,
+        action: eventIdentity.action,
+        phase: eventIdentity.phase,
+        artifactContext
+      });
+    }
+  }
   const sourceCompletion = eventIdentity.phase === 'completed'
     && ['analyze', 'plan', 'code'].includes(eventIdentity.family);
   const result = writeTask({ taskRef: normalized.taskRef, expectedState: stateOverride ? resolved.state : 'active', dryRun: normalized.dryRun, mutations }, { ...options, invalidationContext: sourceCompletion ? 'source-completion' : 'standard', metadataProvider: () => metadata });
@@ -1022,7 +1173,7 @@ function applyTaskEventUnlocked(request: TaskEventRequest, options: TaskEventOpt
   if (!normalized.dryRun && lifecycleAuthority && localFinalizationIntent && completedArtifact) {
     try {
       if (!options.deferLifecycleRecoveryConsumption) consumeLifecycleRecoveryAttestation(lifecycleAuthority);
-      writeArtifactRepairIntent(resolved.repoRoot, { ...localFinalizationIntent, state: 'consumed', updatedAt: Date.now() }, { expected: localFinalizationIntent });
+      writeArtifactRecoveryIntent(resolved.repoRoot, { ...localFinalizationIntent, state: 'consumed', updatedAt: Date.now() }, { expected: localFinalizationIntent });
     } catch (error) {
       return failed(normalized, {
         code: 'EVENT_ARTIFACT_CONFLICT',
@@ -1030,6 +1181,19 @@ function applyTaskEventUnlocked(request: TaskEventRequest, options: TaskEventOpt
       }, { taskId: result.taskId, taskMdPath: result.taskMdPath, fromStep: currentStep, toStep: step, action: eventIdentity.action, phase: eventIdentity.phase, timestamp: result.timestamp, agentInfraVersion: result.agentInfraVersion, operations: result.operations, artifactContext });
     }
   }
+  if (!normalized.dryRun && reviewFinalizationIntent && completedArtifact) {
+    try {
+      if (reviewFinalizationIntent.state === 'consumption-started') {
+        const consumed = { ...reviewFinalizationIntent, state: 'consumed' as const, updatedAt: Date.now() };
+        writeArtifactRecoveryIntent(resolved.repoRoot, consumed, { expected: reviewFinalizationIntent });
+      }
+    } catch (error) {
+      return failed(normalized, {
+        code: 'EVENT_ARTIFACT_CONFLICT',
+        message: `review finalizer recovery consumption is incomplete: ${error instanceof Error ? error.message : String(error)}`
+      }, { taskId: result.taskId, taskMdPath: result.taskMdPath, fromStep: currentStep, toStep: step, action: eventIdentity.action, phase: eventIdentity.phase, timestamp: result.timestamp, agentInfraVersion: result.agentInfraVersion, operations: result.operations, artifactContext });
+    }
+  }
   if (!normalized.dryRun && orchestrationCompletion) {
     try {
       (options.commitOrchestrationCompletion ?? commitOrchestrationStageCompletion)(orchestrationCompletion);
@@ -1077,7 +1241,7 @@ function applyTaskEvent(request: TaskEventRequest, options: TaskEventOptions = {
       resolved.repoRoot,
       resolved.taskId,
       `task-event.${request.event}`,
-      () => applyTaskEventUnlocked(request, options)
+      () => applyTaskEventUnlocked(request, { ...options, lockAlreadyHeld: true })
     );
   } catch (error) {
     if (!(error instanceof TaskExecutionLockError)) throw error;

package/lib/task/human-override.ts

@@ -617,10 +617,7 @@ function resourceForSnapshot(
   if (policy.producerId === 'platform.issue') {
     const identity = options.probeIssueNumber !== undefined
       ? resourceIdentity(options.probeIssueNumber)
-      : taskIssueIdentity((frontmatter || {}) as Record<string, string | number | boolean | null>) || (() => {
-        const number = toPositiveInteger(frontmatter?.issue_number);
-        return number === null ? null : resourceIdentity(number);
-      })();
+      : taskIssueIdentity((frontmatter || {}) as Record<string, string | number | boolean | null>);
     return identity ? { kind: 'issue', identity, number: resourceIdentityNumber(identity) } : null;
   }
   if (policy.producerId === 'platform.pull-request') {
@@ -719,11 +716,11 @@ async function probePlatformFailure(
   }
   const issueIdentity = options.probeIssueNumber !== undefined
     ? resourceIdentity(options.probeIssueNumber)
-    : taskIssueIdentity(frontmatter) || (() => {
-      const number = toPositiveInteger(frontmatter.issue_number);
-      return number === null ? null : resourceIdentity(number);
-    })();
+    : taskIssueIdentity(frontmatter);
   const fact = readPrDeliveryFact(frontmatter);
+  if (fact.status === 'invalid') {
+    return error(fact.error.code, fact.error.message);
+  }
   const pullRequestIdentity = options.probePullRequestNumber !== undefined
     ? resourceIdentity(options.probePullRequestNumber)
     : fact.status === 'valid' && fact.fact.state === 'bound' ? fact.fact.identity.resource : null;

package/lib/task/intermediate-cleanup.ts

@@ -15,17 +15,18 @@ import {
   type TaskFinalizationReceipt
 } from './finalization.ts';
 import {
-  readLocalArtifactFinalizationIntent,
   semanticDigest,
-  sha256Content,
-  type LocalArtifactFinalizationIntent
+  sha256Content
 } from './local-artifact-finalization.ts';
+import { artifactRecoveryRoot, readArtifactRecoveryIntent } from './artifact-repair-intent.ts';
+import type { ArtifactRecoveryIntent } from './artifact-repair-intent.ts';
 import { parseArtifactName } from './artifact-name.ts';
+import type { ArtifactSchemaFamily } from './artifact-schema.ts';
 import { enumerateAllTaskDirs, type TaskWorkspaceState } from './resolve-ref.ts';
 import type { TaskControlBindingEvidence } from './finalization-state.ts';
 
 const TASK_ID_RE = /^TASK-\d{8}-\d{6}$/;
-const LOCAL_INTENT_RE = /^(TASK-\d{8}-\d{6})-(analysis|plan|code)-(.+\.md)\.json$/;
+const LOCAL_INTENT_RE = /^(TASK-\d{8}-\d{6})-(analysis|review-analysis|plan|review-plan|code|review-code)-(.+\.md)\.json$/;
 const COMMIT_INTENT_RE = /^(TASK-\d{8}-\d{6})\.json$/;
 const AUXILIARY_ROOTS = [
   '.local-artifact-finalization-intents',
@@ -161,7 +162,7 @@ function localIntentCandidate(
   task: TaskRecord | undefined,
   filePath: string,
   taskId: string,
-  family: 'analysis' | 'plan' | 'code',
+  family: ArtifactSchemaFamily,
   artifact: string,
   identity: FileIdentity,
   options: ScanOptions
@@ -172,8 +173,8 @@ function localIntentCandidate(
     || !parseArtifactName(artifact)?.family || parseArtifactName(artifact)!.family !== family) {
     return item('LFAI-CONSUMED', taskId, filePath, 'protected', 'PATH_IDENTITY_MISMATCH', identity);
   }
-  let intent: LocalArtifactFinalizationIntent | null;
-  try { intent = readLocalArtifactFinalizationIntent(repoRoot, taskId, family, artifact); }
+  let intent: ArtifactRecoveryIntent | null;
+  try { intent = readArtifactRecoveryIntent(repoRoot, taskId, family, artifact); }
   catch { return item('LFAI-CONSUMED', taskId, filePath, 'protected', 'LFAI_SCHEMA_INVALID', identity); }
   if (!intent || intent.state !== 'consumed') {
     return item('LFAI-CONSUMED', taskId, filePath, 'protected', 'LFAI_STATE_PROTECTED', identity);
@@ -185,7 +186,7 @@ function localIntentCandidate(
   let content: string;
   try { content = fs.readFileSync(artifactPath, 'utf8'); }
   catch { return item('LFAI-CONSUMED', taskId, filePath, 'protected', 'ARTIFACT_UNREADABLE', identity); }
-  if (intent.artifactSha256 !== sha256Content(content) || intent.semanticDigest !== semanticDigest(content)) {
+  if (intent.finalArtifactSha256 !== sha256Content(content) || intent.finalSemanticDigest !== semanticDigest(content)) {
     return item('LFAI-CONSUMED', taskId, filePath, 'protected', 'ARTIFACT_DIGEST_MISMATCH', identity);
   }
   const receiptReason = receiptGate(repoRoot, task!, options);
@@ -306,7 +307,56 @@ function scanIntermediateCleanup(repoRoot: string, options: ScanOptions = {}): I
   return buildIntermediateCleanupReport(candidates, true);
 }
 
-function removeCandidate(candidate: IntermediateCleanupItem): IntermediateCleanupItem {
+function cleanupConsumedRecoveryFiles(repoRoot: string, task: TaskRecord | undefined, candidate: IntermediateCleanupItem): boolean {
+  if (candidate.kind !== 'LFAI-CONSUMED' || !candidate.taskId) return true;
+  if (!task) return false;
+  const match = LOCAL_INTENT_RE.exec(path.basename(candidate.path));
+  if (!match) return false;
+  let intent: ReturnType<typeof readArtifactRecoveryIntent>;
+  try { intent = readArtifactRecoveryIntent(repoRoot, candidate.taskId, match[2] as ArtifactSchemaFamily, match[3]!); }
+  catch { return false; }
+  if (!intent || intent.state !== 'consumed') return false;
+
+  const recovery = artifactRecoveryRoot(task.taskDir, intent.recoveryOperationId);
+  let stat: fs.Stats | null = null;
+  try { stat = fs.lstatSync(recovery); } catch (error) {
+    if (errorCode(error) === 'ENOENT') return true;
+    return false;
+  }
+  if (!stat.isDirectory() || stat.isSymbolicLink()) return false;
+  let entries: fs.Dirent[];
+  try { entries = fs.readdirSync(recovery, { withFileTypes: true }); } catch { return false; }
+  for (const entry of entries) {
+    if (entry.isSymbolicLink()) return false;
+    if (entry.isFile()) {
+      if (!['baseline.md', 'candidate.md', 'final.md', 'publish.md'].includes(entry.name)) return false;
+      continue;
+    }
+    if (!entry.isDirectory() || entry.name !== 'generations') return false;
+    let generations: fs.Dirent[];
+    try { generations = fs.readdirSync(path.join(recovery, entry.name), { withFileTypes: true }); } catch { return false; }
+    if (generations.some((generation) => generation.isSymbolicLink()
+      || !generation.isFile() || !/^[a-f0-9]{64}\.md$/u.test(generation.name))) return false;
+  }
+  try {
+    for (const entry of entries) {
+      const target = path.join(recovery, entry.name);
+      if (entry.isFile()) fs.unlinkSync(target);
+      else {
+        for (const generation of fs.readdirSync(target, { withFileTypes: true })) fs.unlinkSync(path.join(target, generation.name));
+        fs.rmdirSync(target);
+      }
+    }
+    fs.rmdirSync(recovery);
+    const recoveryRoot = path.dirname(recovery);
+    if (fs.readdirSync(recoveryRoot).length === 0) fs.rmdirSync(recoveryRoot);
+    return true;
+  } catch (error) {
+    return errorCode(error) === 'ENOENT';
+  }
+}
+
+function removeCandidate(repoRoot: string, candidate: IntermediateCleanupItem, task?: TaskRecord): IntermediateCleanupItem {
   if (candidate.disposition !== 'planned') return candidate;
   const root = candidate.kind === 'EMPTY-AUX-PARENT'
     ? path.dirname(path.dirname(candidate.path))
@@ -323,6 +373,9 @@ function removeCandidate(candidate: IntermediateCleanupItem): IntermediateCleanu
   const actual = safeLstat(root, candidate.path, candidate.kind === 'EMPTY-AUX-PARENT' ? 'directory' : 'file');
   if (!actual) return { ...candidate, disposition: 'protected', reason: 'PATH_IDENTITY_CHANGED' };
   if (!sameFileIdentity(expected, actual)) return { ...candidate, disposition: 'protected', reason: 'PATH_IDENTITY_CHANGED' };
+  if (!cleanupConsumedRecoveryFiles(repoRoot, task, candidate)) {
+    return { ...candidate, disposition: 'protected', reason: 'RECOVERY_STAGING_NOT_SAFE_TO_REMOVE' };
+  }
   try {
     if (candidate.kind === 'EMPTY-AUX-PARENT') {
       if (fs.readdirSync(candidate.path).length !== 0) return { ...candidate, disposition: 'protected', reason: 'AUXILIARY_ROOT_NOT_EMPTY' };
@@ -367,6 +420,7 @@ function cleanupIntermediateUnderRemovalCoordinator(
     indexes.push(index);
     byTask.set(candidate.taskId, indexes);
   }
+  const tasks = inspectTaskRecords(repoRoot, new Set(byTask.keys()));
 
   for (const taskId of [...byTask.keys()].sort()) {
     const execute = (): void => {
@@ -380,7 +434,7 @@ function cleanupIntermediateUnderRemovalCoordinator(
         if (initialCandidate.disposition !== 'planned') continue;
         const current = refreshedByKey.get(intermediateCleanupKey(initialCandidate));
         items[index] = current
-          ? removeCandidate(current)
+          ? removeCandidate(repoRoot, current, tasks.get(taskId))
           : { ...initialCandidate, disposition: 'protected', reason: 'CANDIDATE_NO_LONGER_ELIGIBLE' };
       }
     };
@@ -397,14 +451,14 @@ function cleanupIntermediateUnderRemovalCoordinator(
 
   for (const [index, candidate] of items.entries()) {
     if (candidate.taskId || candidate.disposition !== 'planned') continue;
-    items[index] = removeCandidate(candidate);
+    items[index] = removeCandidate(repoRoot, candidate);
   }
 
   const knownPaths = new Set(items.map((candidate) => intermediateCleanupKey(candidate)));
   for (const candidate of scanIntermediateCleanup(repoRoot, scanOptions).items) {
     if (candidate.kind !== 'EMPTY-AUX-PARENT' || candidate.disposition !== 'planned'
       || knownPaths.has(intermediateCleanupKey(candidate))) continue;
-    items.push(removeCandidate(candidate));
+    items.push(removeCandidate(repoRoot, candidate));
   }
 
   return buildIntermediateCleanupReport(items);