@fitlab-ai/agent-infra 0.9.15 → 0.11.0

package/dist/lib/task/events.js

@@ -16,13 +16,14 @@ import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-
 import { captureTaskWriteMetadata, writeTask } from './write.js';
 import { allowsManualOverride } from './guard-override.js';
 import { consumeLocalArtifactFinalizationIntent, readLocalArtifactFinalizationIntent, validateLocalArtifact } from './local-artifact-finalization.js';
-import { writeArtifactRepairIntent } from './artifact-repair-intent.js';
+import { writeArtifactRecoveryIntent, readArtifactRecoveryIntent } from './artifact-repair-intent.js';
+import { reconcileArtifactRecovery, recoveryContextFromIntent, sha256Content } from './artifact-recovery.js';
 import { buildLifecycleFacts, canStart } from './capabilities.js';
 import { createInvalidationOperation, invalidationMutation, parseInvalidationDocument, targetIdFor, upsertInvalidation } from './invalidation.js';
 import { consumeReworkIntents, parseReworkIntentDocument, reworkIntentMutation, supersedeReworkIntents } from './rework-intent.js';
 import { ARTIFACT_FAMILIES, expectedQualificationRelations, parseQualificationAudit, parseTaskQualification, upstreamArtifactDigest, validateQualificationAudit } from './qualification-audit.js';
 import { getArtifactSchema } from './artifact-schema.js';
-import { inspectArtifactContract } from './artifact-operations.js';
+import { canonicalSemanticDigest, inspectArtifactContract } from './artifact-operations.js';
 import { consumeLifecycleRecoveryAttestation, lifecycleRecoveryAttestationDigest, validateLifecycleRecoveryAttestation } from './control-authority.js';
 import { readManualValidationCompletion } from './manual-validation-completion.js';
 const eventCatalog = [
@@ -314,6 +315,59 @@ function openStartedIdentity(rows, family) {
 function reviewInputFamily(family) {
     return family === 'review-analysis' ? 'analysis' : family === 'review-plan' ? 'plan' : 'code';
 }
+function reconcileReviewCompletionReplay(repoRoot, taskDir, taskId, family, artifact, round) {
+    const stage = REVIEW_LEDGER_STAGES[family];
+    if (!stage)
+        return null;
+    const reviewFamily = family;
+    try {
+        let intent = readArtifactRecoveryIntent(repoRoot, taskId, reviewFamily, artifact);
+        if (!intent)
+            return null;
+        if (intent.state === 'commit-started') {
+            const reconciled = reconcileArtifactRecovery(recoveryContextFromIntent(repoRoot, taskDir, intent), { lockAlreadyHeld: true });
+            if (reconciled.status !== 'passed' && reconciled.status !== 'consumed') {
+                return {
+                    code: 'EVENT_ARTIFACT_CONFLICT',
+                    message: `review finalizer recovery remains ${reconciled.status} for ${artifact}`
+                };
+            }
+            intent = reconciled.intent;
+        }
+        if (!['passed', 'consumption-started', 'consumed'].includes(intent.state)) {
+            return {
+                code: 'EVENT_ARTIFACT_CONFLICT',
+                message: `review finalizer provenance is incomplete for ${artifact}`
+            };
+        }
+        const validated = validateCompletedArtifact(taskDir, FAMILY[family].artifact, artifact, round);
+        if (!validated.ok) {
+            return { code: 'EVENT_ARTIFACT_CONFLICT', message: validated.error.message };
+        }
+        const content = fs.readFileSync(validated.artifact.path, 'utf8');
+        const expectedRequestId = `review-finalize:${taskId}:${stage}:${round}`;
+        if (intent.round !== round
+            || intent.requestId !== expectedRequestId
+            || intent.finalArtifactSha256 !== sha256Content(content)
+            || intent.finalSemanticDigest !== canonicalSemanticDigest(content)) {
+            return {
+                code: 'EVENT_ARTIFACT_CONFLICT',
+                message: `review finalizer provenance does not match ${artifact}`
+            };
+        }
+        if (intent.state === 'passed' || intent.state === 'consumption-started') {
+            const consumed = { ...intent, state: 'consumed', updatedAt: Date.now() };
+            writeArtifactRecoveryIntent(repoRoot, consumed, { expected: intent });
+        }
+        return null;
+    }
+    catch (error) {
+        return {
+            code: 'EVENT_ARTIFACT_CONFLICT',
+            message: `review finalizer recovery could not be reconciled for ${artifact}: ${error instanceof Error ? error.message : String(error)}`
+        };
+    }
+}
 function relationForStartedInput(family, input) {
     if (family.startsWith('review-')) {
         return input.family === reviewInputFamily(family) ? 'reviewed-input' : 'approval-context';
@@ -715,6 +769,8 @@ function applyTaskEventUnlocked(request, options = {}) {
     const row = manual ? openRows.at(-1) : matchingRows[0];
     let completedArtifact = null;
     let localFinalizationIntent = null;
+    let reviewFinalizationIntent = null;
+    let reviewContent = null;
     if (eventIdentity.phase === 'started' && row) {
         if (row.agent !== normalized.agent)
             return failed(normalized, { code: 'EVENT_LOG_CONFLICT', message: 'open started event has a different agent' }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath });
@@ -729,8 +785,14 @@ function applyTaskEventUnlocked(request, options = {}) {
     if (eventIdentity.phase === 'started' && !manual && completedRows.length > 0)
         return failed(normalized, { code: 'EVENT_ALREADY_COMPLETED', message: 'event identity is already completed' }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath });
     const done = completedRows.find((item) => item.note === eventIdentity.note);
-    if (eventIdentity.phase === 'completed' && done)
+    if (eventIdentity.phase === 'completed' && done) {
+        if (!normalized.dryRun && eventIdentity.family.startsWith('review-') && normalized.artifact && normalized.round) {
+            const recoveryError = reconcileReviewCompletionReplay(resolved.repoRoot, resolved.taskDir, resolved.taskId, eventIdentity.family, normalized.artifact, normalized.round);
+            if (recoveryError)
+                return failed(normalized, recoveryError, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+        }
         return successNoOp(normalized, resolved.taskId, resolved.taskMdPath, currentStep, eventIdentity, done.done, frontmatter, artifactContext);
+    }
     if (eventIdentity.phase === 'completed' && completedRows.length > 0 && openRows.length === 0)
         return failed(normalized, { code: 'EVENT_LOG_CONFLICT', message: 'event identity is already completed with a different payload' }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
     if (eventIdentity.phase === 'completed' && !row?.started && !allowsManualOverride(options.manualOverride, 'task-event', 'EVENT_START_MISSING'))
@@ -746,7 +808,6 @@ function applyTaskEventUnlocked(request, options = {}) {
                 return failed(normalized, validationError, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
         }
         if (eventIdentity.family.startsWith('review-')) {
-            let reviewContent;
             try {
                 reviewContent = fs.readFileSync(completedArtifact.path, 'utf8');
             }
@@ -775,6 +836,20 @@ function applyTaskEventUnlocked(request, options = {}) {
             const localFamily = eventIdentity.family === 'analyze'
                 ? 'analysis'
                 : eventIdentity.family === 'plan' ? 'plan' : 'code';
+            try {
+                localFinalizationIntent = readLocalArtifactFinalizationIntent(resolved.repoRoot, resolved.taskId, localFamily, completedArtifact.name);
+                if (localFinalizationIntent?.state === 'commit-started') {
+                    const reconciled = reconcileArtifactRecovery(recoveryContextFromIntent(resolved.repoRoot, resolved.taskDir, localFinalizationIntent), { lockAlreadyHeld: true });
+                    if (reconciled.status === 'passed' || reconciled.status === 'consumed')
+                        localFinalizationIntent = reconciled.intent;
+                }
+            }
+            catch (error) {
+                return failed(normalized, {
+                    code: 'EVENT_ARTIFACT_CONFLICT',
+                    message: `local finalizer recovery could not be reconciled for ${completedArtifact.name}: ${error instanceof Error ? error.message : String(error)}`
+                }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+            }
             let artifactContent;
             try {
                 artifactContent = fs.readFileSync(completedArtifact.path, 'utf8');
@@ -806,33 +881,23 @@ function applyTaskEventUnlocked(request, options = {}) {
                     message: `semantic digest does not match finalizer result for ${completedArtifact.name}`
                 }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
             }
-            try {
-                localFinalizationIntent = readLocalArtifactFinalizationIntent(resolved.repoRoot, resolved.taskId, localFamily, completedArtifact.name);
-            }
-            catch (error) {
-                return failed(normalized, {
-                    code: 'EVENT_ARTIFACT_CONFLICT',
-                    message: `cannot read local finalizer provenance for ${completedArtifact.name}: ${error instanceof Error ? error.message : String(error)}`
-                }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
-            }
-            if (!localFinalizationIntent || !['passed', 'consumed', 'finalize-ready', 'commit-started'].includes(localFinalizationIntent.state)) {
+            if (!localFinalizationIntent || !['passed', 'consumed'].includes(localFinalizationIntent.state)) {
                 return failed(normalized, {
                     code: 'EVENT_ARTIFACT_CONFLICT',
                     message: `local finalizer provenance is missing or incomplete for ${completedArtifact.name}`
                 }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
             }
-            if (localFinalizationIntent.artifactSha256 !== actualSha256 || localFinalizationIntent.semanticDigest !== local.semanticDigest) {
+            if (localFinalizationIntent.finalArtifactSha256 !== actualSha256 || localFinalizationIntent.finalSemanticDigest !== local.semanticDigest) {
                 return failed(normalized, {
                     code: 'EVENT_ARTIFACT_CONFLICT',
                     message: `local finalizer provenance does not match ${completedArtifact.name}`
                 }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
             }
-            if (localFinalizationIntent.recoveryOperationId !== null) {
+            if (localFinalizationIntent.authorityDigest !== null) {
                 if (!lifecycleAuthority
                     || localFinalizationIntent.recoveryOperationId !== lifecycleAuthority.operationId
                     || localFinalizationIntent.requestId !== lifecycleAuthority.lifecycleRequestId
-                    || (localFinalizationIntent.phase !== 'artifact.finalize-local'
-                        && localFinalizationIntent.authorityDigest !== lifecycleRecoveryAttestationDigest(lifecycleAuthority))) {
+                    || localFinalizationIntent.authorityDigest !== lifecycleRecoveryAttestationDigest(lifecycleAuthority)) {
                     return failed(normalized, {
                         code: 'EVENT_ARTIFACT_CONFLICT',
                         message: `local finalizer provenance does not match lifecycle completion authority for ${completedArtifact.name}`
@@ -862,6 +927,43 @@ function applyTaskEventUnlocked(request, options = {}) {
     const findingCountError = validateReviewFindingCounts(normalized, content, eventIdentity.family, completedArtifact?.path ?? null);
     if (findingCountError)
         return failed(normalized, findingCountError, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+    if (eventIdentity.phase === 'completed' && eventIdentity.family.startsWith('review-') && completedArtifact && reviewContent !== null) {
+        try {
+            reviewFinalizationIntent = readArtifactRecoveryIntent(resolved.repoRoot, resolved.taskId, eventIdentity.family, completedArtifact.name);
+            if (!normalized.dryRun && reviewFinalizationIntent?.state === 'commit-started') {
+                const reconciled = reconcileArtifactRecovery(recoveryContextFromIntent(resolved.repoRoot, resolved.taskDir, reviewFinalizationIntent), { lockAlreadyHeld: true });
+                if (reconciled.status === 'passed' || reconciled.status === 'consumed')
+                    reviewFinalizationIntent = reconciled.intent;
+            }
+            if (!reviewFinalizationIntent || !['passed', 'consumption-started', 'consumed'].includes(reviewFinalizationIntent.state)) {
+                return failed(normalized, {
+                    code: 'EVENT_ARTIFACT_CONFLICT',
+                    message: `review finalizer provenance is missing or incomplete for ${completedArtifact.name}`
+                }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+            }
+            const reviewStage = eventIdentity.family === 'review-analysis'
+                ? 'analysis'
+                : eventIdentity.family === 'review-plan' ? 'plan' : 'code';
+            const actualSha256 = sha256File(completedArtifact.path);
+            const actualSemanticDigest = canonicalSemanticDigest(reviewContent);
+            const expectedRequestId = `review-finalize:${resolved.taskId}:${reviewStage}:${normalized.round}`;
+            if (reviewFinalizationIntent.round !== normalized.round
+                || reviewFinalizationIntent.requestId !== expectedRequestId
+                || reviewFinalizationIntent.finalArtifactSha256 !== actualSha256
+                || reviewFinalizationIntent.finalSemanticDigest !== actualSemanticDigest) {
+                return failed(normalized, {
+                    code: 'EVENT_ARTIFACT_CONFLICT',
+                    message: `review finalizer provenance does not match ${completedArtifact.name}`
+                }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+            }
+        }
+        catch (error) {
+            return failed(normalized, {
+                code: 'EVENT_ARTIFACT_CONFLICT',
+                message: `review finalizer recovery could not be reconciled for ${completedArtifact.name}: ${error instanceof Error ? error.message : String(error)}`
+            }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+        }
+    }
     let orchestrationCompletion = null;
     if (eventIdentity.phase === 'completed' && eventIdentity.family !== 'manual-validation' && eventIdentity.family !== 'validation-run') {
         const orchestrationStage = eventIdentity.family === 'analyze' ? 'analysis' : eventIdentity.family;
@@ -1004,16 +1106,16 @@ function applyTaskEventUnlocked(request, options = {}) {
                 const expectedIntent = localFinalizationIntent;
                 localFinalizationIntent = {
                     ...localFinalizationIntent,
-                    state: 'commit-started',
+                    state: 'consumption-started',
                     phase: 'task-event.completed',
                     authorityDigest: lifecycleRecoveryAttestationDigest(lifecycleAuthority),
                     requestId: lifecycleAuthority.lifecycleRequestId,
                     updatedAt: Date.now()
                 };
-                writeArtifactRepairIntent(resolved.repoRoot, localFinalizationIntent, { expected: expectedIntent });
+                writeArtifactRecoveryIntent(resolved.repoRoot, localFinalizationIntent, { expected: expectedIntent });
             }
             else if (!lifecycleAuthority && localFinalizationIntent.state === 'passed') {
-                localFinalizationIntent = consumeLocalArtifactFinalizationIntent(resolved.repoRoot, localFinalizationIntent);
+                localFinalizationIntent = consumeLocalArtifactFinalizationIntent(resolved.repoRoot, localFinalizationIntent, { lockAlreadyHeld: options.lockAlreadyHeld });
             }
         }
         catch (error) {
@@ -1031,6 +1133,32 @@ function applyTaskEventUnlocked(request, options = {}) {
             });
         }
     }
+    if (!normalized.dryRun && reviewFinalizationIntent && completedArtifact && reviewFinalizationIntent.state === 'passed') {
+        try {
+            const expectedIntent = reviewFinalizationIntent;
+            reviewFinalizationIntent = {
+                ...reviewFinalizationIntent,
+                state: 'consumption-started',
+                phase: 'task-event.completed',
+                updatedAt: Date.now()
+            };
+            writeArtifactRecoveryIntent(resolved.repoRoot, reviewFinalizationIntent, { expected: expectedIntent });
+        }
+        catch (error) {
+            return failed(normalized, {
+                code: 'EVENT_ARTIFACT_CONFLICT',
+                message: `review finalizer provenance could not be advanced before task write for ${completedArtifact.name}: ${error instanceof Error ? error.message : String(error)}`
+            }, {
+                taskId: resolved.taskId,
+                taskMdPath: resolved.taskMdPath,
+                fromStep: currentStep,
+                toStep: step,
+                action: eventIdentity.action,
+                phase: eventIdentity.phase,
+                artifactContext
+            });
+        }
+    }
     const sourceCompletion = eventIdentity.phase === 'completed'
         && ['analyze', 'plan', 'code'].includes(eventIdentity.family);
     const result = writeTask({ taskRef: normalized.taskRef, expectedState: stateOverride ? resolved.state : 'active', dryRun: normalized.dryRun, mutations }, { ...options, invalidationContext: sourceCompletion ? 'source-completion' : 'standard', metadataProvider: () => metadata });
@@ -1040,7 +1168,7 @@ function applyTaskEventUnlocked(request, options = {}) {
         try {
             if (!options.deferLifecycleRecoveryConsumption)
                 consumeLifecycleRecoveryAttestation(lifecycleAuthority);
-            writeArtifactRepairIntent(resolved.repoRoot, { ...localFinalizationIntent, state: 'consumed', updatedAt: Date.now() }, { expected: localFinalizationIntent });
+            writeArtifactRecoveryIntent(resolved.repoRoot, { ...localFinalizationIntent, state: 'consumed', updatedAt: Date.now() }, { expected: localFinalizationIntent });
         }
         catch (error) {
             return failed(normalized, {
@@ -1049,6 +1177,20 @@ function applyTaskEventUnlocked(request, options = {}) {
             }, { taskId: result.taskId, taskMdPath: result.taskMdPath, fromStep: currentStep, toStep: step, action: eventIdentity.action, phase: eventIdentity.phase, timestamp: result.timestamp, agentInfraVersion: result.agentInfraVersion, operations: result.operations, artifactContext });
         }
     }
+    if (!normalized.dryRun && reviewFinalizationIntent && completedArtifact) {
+        try {
+            if (reviewFinalizationIntent.state === 'consumption-started') {
+                const consumed = { ...reviewFinalizationIntent, state: 'consumed', updatedAt: Date.now() };
+                writeArtifactRecoveryIntent(resolved.repoRoot, consumed, { expected: reviewFinalizationIntent });
+            }
+        }
+        catch (error) {
+            return failed(normalized, {
+                code: 'EVENT_ARTIFACT_CONFLICT',
+                message: `review finalizer recovery consumption is incomplete: ${error instanceof Error ? error.message : String(error)}`
+            }, { taskId: result.taskId, taskMdPath: result.taskMdPath, fromStep: currentStep, toStep: step, action: eventIdentity.action, phase: eventIdentity.phase, timestamp: result.timestamp, agentInfraVersion: result.agentInfraVersion, operations: result.operations, artifactContext });
+        }
+    }
     if (!normalized.dryRun && orchestrationCompletion) {
         try {
             (options.commitOrchestrationCompletion ?? commitOrchestrationStageCompletion)(orchestrationCompletion);
@@ -1095,7 +1237,7 @@ function applyTaskEvent(request, options = {}) {
     if (!resolved.ok)
         return applyTaskEventUnlocked(request, options);
     try {
-        return withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-event.${request.event}`, () => applyTaskEventUnlocked(request, options));
+        return withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-event.${request.event}`, () => applyTaskEventUnlocked(request, { ...options, lockAlreadyHeld: true }));
     }
     catch (error) {
         if (!(error instanceof TaskExecutionLockError))

package/dist/lib/task/human-override.js

@@ -407,10 +407,7 @@ function resourceForSnapshot(policy, options, frontmatter) {
     if (policy.producerId === 'platform.issue') {
         const identity = options.probeIssueNumber !== undefined
             ? resourceIdentity(options.probeIssueNumber)
-            : taskIssueIdentity((frontmatter || {})) || (() => {
-                const number = toPositiveInteger(frontmatter?.issue_number);
-                return number === null ? null : resourceIdentity(number);
-            })();
+            : taskIssueIdentity((frontmatter || {}));
         return identity ? { kind: 'issue', identity, number: resourceIdentityNumber(identity) } : null;
     }
     if (policy.producerId === 'platform.pull-request') {
@@ -481,11 +478,11 @@ async function probePlatformFailure(taskRef, policy, resolved, options) {
     }
     const issueIdentity = options.probeIssueNumber !== undefined
         ? resourceIdentity(options.probeIssueNumber)
-        : taskIssueIdentity(frontmatter) || (() => {
-            const number = toPositiveInteger(frontmatter.issue_number);
-            return number === null ? null : resourceIdentity(number);
-        })();
+        : taskIssueIdentity(frontmatter);
     const fact = readPrDeliveryFact(frontmatter);
+    if (fact.status === 'invalid') {
+        return error(fact.error.code, fact.error.message);
+    }
     const pullRequestIdentity = options.probePullRequestNumber !== undefined
         ? resourceIdentity(options.probePullRequestNumber)
         : fact.status === 'valid' && fact.fact.state === 'bound' ? fact.fact.identity.resource : null;

package/dist/lib/task/intermediate-cleanup.js

@@ -7,11 +7,12 @@ import { checkpointCommitMatches } from './commit-identity.js';
 import { readCheckpointIntent } from './commit-intent.js';
 import { parseTaskFrontmatter } from './frontmatter.js';
 import { readTaskFinalizationReceipt } from './finalization.js';
-import { readLocalArtifactFinalizationIntent, semanticDigest, sha256Content } from './local-artifact-finalization.js';
+import { semanticDigest, sha256Content } from './local-artifact-finalization.js';
+import { artifactRecoveryRoot, readArtifactRecoveryIntent } from './artifact-repair-intent.js';
 import { parseArtifactName } from './artifact-name.js';
 import { enumerateAllTaskDirs } from './resolve-ref.js';
 const TASK_ID_RE = /^TASK-\d{8}-\d{6}$/;
-const LOCAL_INTENT_RE = /^(TASK-\d{8}-\d{6})-(analysis|plan|code)-(.+\.md)\.json$/;
+const LOCAL_INTENT_RE = /^(TASK-\d{8}-\d{6})-(analysis|review-analysis|plan|review-plan|code|review-code)-(.+\.md)\.json$/;
 const COMMIT_INTENT_RE = /^(TASK-\d{8}-\d{6})\.json$/;
 const AUXILIARY_ROOTS = [
     '.local-artifact-finalization-intents',
@@ -110,7 +111,7 @@ function localIntentCandidate(repoRoot, task, filePath, taskId, family, artifact
     }
     let intent;
     try {
-        intent = readLocalArtifactFinalizationIntent(repoRoot, taskId, family, artifact);
+        intent = readArtifactRecoveryIntent(repoRoot, taskId, family, artifact);
     }
     catch {
         return item('LFAI-CONSUMED', taskId, filePath, 'protected', 'LFAI_SCHEMA_INVALID', identity);
@@ -129,7 +130,7 @@ function localIntentCandidate(repoRoot, task, filePath, taskId, family, artifact
     catch {
         return item('LFAI-CONSUMED', taskId, filePath, 'protected', 'ARTIFACT_UNREADABLE', identity);
     }
-    if (intent.artifactSha256 !== sha256Content(content) || intent.semanticDigest !== semanticDigest(content)) {
+    if (intent.finalArtifactSha256 !== sha256Content(content) || intent.finalSemanticDigest !== semanticDigest(content)) {
         return item('LFAI-CONSUMED', taskId, filePath, 'protected', 'ARTIFACT_DIGEST_MISMATCH', identity);
     }
     const receiptReason = receiptGate(repoRoot, task, options);
@@ -254,7 +255,85 @@ function scanIntermediateCleanup(repoRoot, options = {}) {
     const candidates = scanInternal(repoRoot, options);
     return buildIntermediateCleanupReport(candidates, true);
 }
-function removeCandidate(candidate) {
+function cleanupConsumedRecoveryFiles(repoRoot, task, candidate) {
+    if (candidate.kind !== 'LFAI-CONSUMED' || !candidate.taskId)
+        return true;
+    if (!task)
+        return false;
+    const match = LOCAL_INTENT_RE.exec(path.basename(candidate.path));
+    if (!match)
+        return false;
+    let intent;
+    try {
+        intent = readArtifactRecoveryIntent(repoRoot, candidate.taskId, match[2], match[3]);
+    }
+    catch {
+        return false;
+    }
+    if (!intent || intent.state !== 'consumed')
+        return false;
+    const recovery = artifactRecoveryRoot(task.taskDir, intent.recoveryOperationId);
+    let stat = null;
+    try {
+        stat = fs.lstatSync(recovery);
+    }
+    catch (error) {
+        if (errorCode(error) === 'ENOENT')
+            return true;
+        return false;
+    }
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        return false;
+    let entries;
+    try {
+        entries = fs.readdirSync(recovery, { withFileTypes: true });
+    }
+    catch {
+        return false;
+    }
+    for (const entry of entries) {
+        if (entry.isSymbolicLink())
+            return false;
+        if (entry.isFile()) {
+            if (!['baseline.md', 'candidate.md', 'final.md', 'publish.md'].includes(entry.name))
+                return false;
+            continue;
+        }
+        if (!entry.isDirectory() || entry.name !== 'generations')
+            return false;
+        let generations;
+        try {
+            generations = fs.readdirSync(path.join(recovery, entry.name), { withFileTypes: true });
+        }
+        catch {
+            return false;
+        }
+        if (generations.some((generation) => generation.isSymbolicLink()
+            || !generation.isFile() || !/^[a-f0-9]{64}\.md$/u.test(generation.name)))
+            return false;
+    }
+    try {
+        for (const entry of entries) {
+            const target = path.join(recovery, entry.name);
+            if (entry.isFile())
+                fs.unlinkSync(target);
+            else {
+                for (const generation of fs.readdirSync(target, { withFileTypes: true }))
+                    fs.unlinkSync(path.join(target, generation.name));
+                fs.rmdirSync(target);
+            }
+        }
+        fs.rmdirSync(recovery);
+        const recoveryRoot = path.dirname(recovery);
+        if (fs.readdirSync(recoveryRoot).length === 0)
+            fs.rmdirSync(recoveryRoot);
+        return true;
+    }
+    catch (error) {
+        return errorCode(error) === 'ENOENT';
+    }
+}
+function removeCandidate(repoRoot, candidate, task) {
     if (candidate.disposition !== 'planned')
         return candidate;
     const root = candidate.kind === 'EMPTY-AUX-PARENT'
@@ -279,6 +358,9 @@ function removeCandidate(candidate) {
         return { ...candidate, disposition: 'protected', reason: 'PATH_IDENTITY_CHANGED' };
     if (!sameFileIdentity(expected, actual))
         return { ...candidate, disposition: 'protected', reason: 'PATH_IDENTITY_CHANGED' };
+    if (!cleanupConsumedRecoveryFiles(repoRoot, task, candidate)) {
+        return { ...candidate, disposition: 'protected', reason: 'RECOVERY_STAGING_NOT_SAFE_TO_REMOVE' };
+    }
     try {
         if (candidate.kind === 'EMPTY-AUX-PARENT') {
             if (fs.readdirSync(candidate.path).length !== 0)
@@ -317,6 +399,7 @@ function cleanupIntermediateUnderRemovalCoordinator(repoRoot, options = {}) {
         indexes.push(index);
         byTask.set(candidate.taskId, indexes);
     }
+    const tasks = inspectTaskRecords(repoRoot, new Set(byTask.keys()));
     for (const taskId of [...byTask.keys()].sort()) {
         const execute = () => {
             const refreshed = scanIntermediateCleanup(repoRoot, {
@@ -330,7 +413,7 @@ function cleanupIntermediateUnderRemovalCoordinator(repoRoot, options = {}) {
                     continue;
                 const current = refreshedByKey.get(intermediateCleanupKey(initialCandidate));
                 items[index] = current
-                    ? removeCandidate(current)
+                    ? removeCandidate(repoRoot, current, tasks.get(taskId))
                     : { ...initialCandidate, disposition: 'protected', reason: 'CANDIDATE_NO_LONGER_ELIGIBLE' };
             }
         };
@@ -351,14 +434,14 @@ function cleanupIntermediateUnderRemovalCoordinator(repoRoot, options = {}) {
     for (const [index, candidate] of items.entries()) {
         if (candidate.taskId || candidate.disposition !== 'planned')
             continue;
-        items[index] = removeCandidate(candidate);
+        items[index] = removeCandidate(repoRoot, candidate);
     }
     const knownPaths = new Set(items.map((candidate) => intermediateCleanupKey(candidate)));
     for (const candidate of scanIntermediateCleanup(repoRoot, scanOptions).items) {
         if (candidate.kind !== 'EMPTY-AUX-PARENT' || candidate.disposition !== 'planned'
             || knownPaths.has(intermediateCleanupKey(candidate)))
             continue;
-        items.push(removeCandidate(candidate));
+        items.push(removeCandidate(repoRoot, candidate));
     }
     return buildIntermediateCleanupReport(items);
 }