@fitlab-ai/agent-infra 0.9.3 → 0.9.4

package/lib/platform/pr-checks.ts

@@ -109,7 +109,7 @@ registerPlatformCapabilities('github', {
   inspectRequiredChecks({ client, repository, number, cwd }) {
     const github = (client as GitHubClient | undefined) || createGitHubClient();
     const inspected = github.json<unknown>([
-      'pr', 'checks', String(number), '--repo', repository, '--required',
+      'pr', 'checks', String(number), '--repo', repository,
       '--json', 'name,state,bucket,link,workflow,startedAt,completedAt'
     ], { cwd });
     return inspected.ok

package/lib/platform/pull-requests.ts

@@ -19,6 +19,8 @@ import { planPullRequestMetadata } from './pull-request-metadata.ts';
 import { platformResult } from './types.ts';
 import type { PlatformOperation, PlatformResult } from './types.ts';
 import { inspectCompletionArtifacts } from '../task/finalization-artifacts.ts';
+import { inspectCreatePrCommitGate } from '../task/commit-finalization.ts';
+import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.ts';
 
 type PullRequestSnapshot = PlatformChangeRequestSnapshot;
 
@@ -747,13 +749,23 @@ function resolveExternalPullRequest(taskRef: string, options: ResolveExternalOpt
   }), { mode: 'external', authorization: selected.source, candidates: selected.candidates, eligible: selected.eligible, selected: selected.selected });
 }
 
-function createPlatformPullRequest(taskRef: string, options: CreateOptions): PullRequestResult {
+function createPlatformPullRequestUnlocked(taskRef: string, options: CreateOptions): PullRequestResult {
   const base = resolvedContext(taskRef, options);
   if (!base.ok) return base.output;
   if (!options.base || !options.head || !options.title.trim() || !options.body.trim()) return result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
     error: { code: 'PR_PAYLOAD_INVALID', message: 'base, head, title and body are required', retryable: false }
   });
   if (base.prNumber) return inspectPlatformPullRequest(taskRef, options);
+  const gate = inspectCreatePrCommitGate(base.resolved.taskDir, base.resolved.repoRoot, base.resolved.taskId);
+  if (!gate.allowed) return result('blocked', base.resolved.taskId, base.issueNumber, null, {
+    platform: base.context.platform,
+    capabilities: base.context.capabilities,
+    error: {
+      code: gate.code!,
+      message: `${gate.message}; action=${gate.action}`,
+      retryable: gate.action === 'rerun-commit' || gate.action === 'rerun-review-code'
+    }
+  });
   const located = locatePullRequest(base, options.head, options.base);
   if (!located.ok && located.error.code === 'PR_IDENTITY_AMBIGUOUS') return result('failed', base.resolved.taskId, base.issueNumber, null, {
     platform: base.context.platform, capabilities: base.context.capabilities, error: located.error
@@ -811,6 +823,42 @@ function createPlatformPullRequest(taskRef: string, options: CreateOptions): Pul
   });
 }
 
+function createPlatformPullRequest(taskRef: string, options: CreateOptions): PullRequestResult {
+  const base = resolvedContext(taskRef, options);
+  if (!base.ok) return base.output;
+  if (!options.base || !options.head || !options.title.trim() || !options.body.trim()) {
+    return result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+      error: { code: 'PR_PAYLOAD_INVALID', message: 'base, head, title and body are required', retryable: false }
+    });
+  }
+  if (base.prNumber) return inspectPlatformPullRequest(taskRef, options);
+  try {
+    return withTaskExecutionLock(
+      base.resolved.repoRoot,
+      base.resolved.taskId,
+      'platform-pr.create',
+      () => createPlatformPullRequestUnlocked(taskRef, options)
+    );
+  } catch (error) {
+    if (error instanceof TaskExecutionLockError) {
+      return result('blocked', base.resolved.taskId, base.issueNumber, null, {
+        platform: base.context.platform,
+        capabilities: base.context.capabilities,
+        error: { code: error.code, message: error.message, retryable: true }
+      });
+    }
+    return result('failed', base.resolved.taskId, base.issueNumber, null, {
+      platform: base.context.platform,
+      capabilities: base.context.capabilities,
+      error: {
+        code: 'PR_CREATE_FAILED',
+        message: error instanceof Error ? error.message : String(error),
+        retryable: false
+      }
+    });
+  }
+}
+
 function syncPlatformPullRequest(taskRef: string, options: SyncOptions): PullRequestResult {
   const base = resolvedContext(taskRef, options);
   if (!base.ok) return base.output;

package/lib/platform/releases.ts

@@ -48,18 +48,30 @@ function reconcileReleaseMilestones(version: string, options: ReleaseOptions = {
   if (!listed.ok) return { ...platformResult(listed.error.retryable ? 'blocked' : 'failed'), changed: false, operations: [], error: listed.error };
   const milestones = flattenPages(listed.value).map((item) => ({ title: String(item.title || ''), number: Number(item.number), state: String(item.state || '') }));
   const major = Number(match[1]); const minor = Number(match[2]); const patch = Number(match[3]);
-  const ensure = [`${major}.${minor}.${patch + 1}`, `${major}.${minor}.x`];
-  if (patch === 0) ensure.push(`${major}.${minor + 1}.0`, `${major}.${minor + 1}.x`);
+  const nextPatch = `${major}.${minor}.${patch + 1}`;
+  const currentLine = `${major}.${minor}.x`;
+  const ensure = [
+    { title: nextPatch, description: `Issues that we want to release in v${nextPatch}.` },
+    { title: currentLine, description: `Issues that we want to resolve in ${major}.${minor} line.` }
+  ];
+  if (patch === 0) {
+    const nextMinor = `${major}.${minor + 1}.0`;
+    const nextLine = `${major}.${minor + 1}.x`;
+    ensure.push(
+      { title: nextMinor, description: `Issues that we want to release in v${nextMinor}.` },
+      { title: nextLine, description: `Issues that we want to resolve in ${major}.${minor + 1} line.` }
+    );
+  }
   const operations: Array<{ name: string; title: string; status: 'applied' | 'no-op' | 'failed' }> = [];
   const current = milestones.find((item) => item.title === version);
   if (current && current.state !== 'closed') {
     const closed = client.json(['api', '--method', 'PATCH', `repos/${context.platform.repository}/milestones/${current.number}`, '-f', 'state=closed'], { cwd: options.cwd });
     operations.push({ name: 'close-milestone', title: version, status: closed.ok ? 'applied' : 'failed' });
   } else operations.push({ name: 'close-milestone', title: version, status: 'no-op' });
-  for (const title of ensure) {
+  for (const { title, description } of ensure) {
     if (milestones.some((item) => item.title === title)) operations.push({ name: 'ensure-milestone', title, status: 'no-op' });
     else {
-      const created = client.json(['api', '--method', 'POST', `repos/${context.platform.repository}/milestones`, '-f', `title=${title}`], { cwd: options.cwd });
+      const created = client.json(['api', '--method', 'POST', `repos/${context.platform.repository}/milestones`, '-f', `title=${title}`, '-f', `description=${description}`], { cwd: options.cwd });
       operations.push({ name: 'ensure-milestone', title, status: created.ok ? 'applied' : 'failed' });
     }
   }

package/lib/process-data/index.ts

@@ -0,0 +1,224 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+
+import { detectRepoRoot } from '../task/resolve-ref.ts';
+import { normalizeObjects } from './normalize.ts';
+import { reconcileRecords } from './reconcile.ts';
+import { readAppliedOverlays, repairSnapshot } from './repair.ts';
+import { collectGitHubObjects, collectLocalObjects } from './sources.ts';
+import { canonicalJsonBytes, createObjectStore, publishSnapshot, verifySnapshot } from './store.ts';
+
+import type { CapturedObject, NormalizedRecord, RestCollectionEvidence } from './types.ts';
+
+const USAGE = `Usage: ai data <command> [options]
+
+Commands:
+  capture [--source all|local|github] [--root <dir>] [--include-excerpts]
+  verify <snapshot-id> [--root <dir>]
+  audit <snapshot-id> [--root <dir>] [--format json|text]
+  repair <snapshot-id> [--root <dir>] [--apply]
+  export <snapshot-id> [--root <dir>] [--repairs none|applied] [--output <file|->]
+`;
+
+type ParsedArgs = { positionals: string[]; options: Map<string, string | true> };
+
+function parseArgs(args: string[], valueOptions: Set<string>, booleanOptions: Set<string>): ParsedArgs {
+  const positionals: string[] = [];
+  const options = new Map<string, string | true>();
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index]!;
+    if (!arg.startsWith('--')) {
+      positionals.push(arg);
+      continue;
+    }
+    if (booleanOptions.has(arg)) {
+      if (options.has(arg)) throw new Error(`duplicate option: ${arg}`);
+      options.set(arg, true);
+      continue;
+    }
+    if (!valueOptions.has(arg)) throw new Error(`unknown option: ${arg}`);
+    const value = args[index + 1];
+    if (!value || value.startsWith('--')) throw new Error(`missing value for ${arg}`);
+    if (options.has(arg)) throw new Error(`duplicate option: ${arg}`);
+    options.set(arg, value);
+    index += 1;
+  }
+  return { positionals, options };
+}
+
+function dataRoot(repoRoot: string, requested?: string): string {
+  const workspace = path.resolve(repoRoot, '.agents', 'workspace');
+  const resolved = path.resolve(repoRoot, requested ?? path.join('.agents', 'workspace', 'process-data'));
+  const relative = path.relative(repoRoot, resolved);
+  if (!relative || relative.startsWith('..') || path.isAbsolute(relative)) throw new Error('data root must be inside the repository');
+  const taskRoots = ['active', 'blocked', 'completed', 'archive'].map((state) => path.join(workspace, state));
+  if (resolved === workspace || taskRoots.some((taskRoot) => resolved === taskRoot || resolved.startsWith(`${taskRoot}${path.sep}`))) {
+    throw new Error('data root cannot be the workspace root or a task directory');
+  }
+  let current = resolved;
+  while (current !== repoRoot) {
+    if (fs.existsSync(current) && fs.lstatSync(current).isSymbolicLink()) throw new Error('data root cannot traverse a symlink');
+    current = path.dirname(current);
+  }
+  return resolved;
+}
+
+function repositoryIdentity(repoRoot: string): string {
+  try {
+    return execFileSync('git', ['config', '--get', 'remote.origin.url'], { cwd: repoRoot, encoding: 'utf8' }).trim() || path.basename(repoRoot);
+  } catch {
+    return path.basename(repoRoot);
+  }
+}
+
+function writeJson(value: unknown): void {
+  process.stdout.write(`${JSON.stringify(value)}\n`);
+}
+
+function optionString(parsed: ParsedArgs, name: string): string | undefined {
+  const value = parsed.options.get(name);
+  return typeof value === 'string' ? value : undefined;
+}
+
+function capture(args: string[]): number {
+  const parsed = parseArgs(args, new Set(['--source', '--root']), new Set(['--include-excerpts']));
+  if (parsed.positionals.length > 0) throw new Error('capture does not accept positional arguments');
+  const scope = optionString(parsed, '--source') ?? 'all';
+  if (!['all', 'local', 'github'].includes(scope)) throw new Error('--source must be all, local, or github');
+  const repoRoot = detectRepoRoot();
+  const root = dataRoot(repoRoot, optionString(parsed, '--root'));
+  const observedFrom = new Date().toISOString();
+  const objects: CapturedObject[] = [];
+  const endpoints: RestCollectionEvidence[] = [];
+  let repository = repositoryIdentity(repoRoot);
+
+  if (scope === 'all' || scope === 'local') {
+    const local = collectLocalObjects(repoRoot, { includeExcerpts: parsed.options.has('--include-excerpts') });
+    if (!local.ok) { writeJson({ ok: false, error: local.error }); return 2; }
+    objects.push(...local.value);
+  }
+  if (scope === 'all' || scope === 'github') {
+    const github = collectGitHubObjects(repoRoot);
+    if (!github.ok) { writeJson({ ok: false, error: github.error }); return 2; }
+    objects.push(...github.value.objects);
+    endpoints.push(...github.value.endpoints);
+    repository = github.value.repository;
+  }
+
+  const store = createObjectStore(root);
+  for (const object of objects) {
+    if (object.content !== undefined && object.disposition?.state === 'included') {
+      const stored = store.put(Buffer.from(object.content, 'utf8'));
+      if (stored.sha256 !== object.sha256) throw new Error(`source hash mismatch: ${object.sourceIdentity}`);
+    }
+  }
+  const records = normalizeObjects(objects);
+  const reconciliation = reconcileRecords(records, scope as 'all' | 'local' | 'github');
+  const observedTo = new Date().toISOString();
+  const published = publishSnapshot(root, {
+    scope: scope as 'all' | 'local' | 'github',
+    repository,
+    observedFrom,
+    observedTo,
+    objects: objects.map(({ content: _content, ...object }) => object),
+    endpoints,
+    excerptsEnabled: parsed.options.has('--include-excerpts'),
+    records,
+    quality: reconciliation.findings,
+    repairs: reconciliation.repairs
+  });
+  writeJson({ ok: true, snapshotId: published.snapshotId, scope, created: published.created, objects: objects.length, records: records.length });
+  return 0;
+}
+
+function verify(args: string[]): number {
+  const parsed = parseArgs(args, new Set(['--root']), new Set());
+  if (parsed.positionals.length !== 1) throw new Error('verify requires one snapshot id');
+  const repoRoot = detectRepoRoot();
+  const result = verifySnapshot(dataRoot(repoRoot, optionString(parsed, '--root')), parsed.positionals[0]!);
+  writeJson(result);
+  return result.ok ? 0 : 1;
+}
+
+function audit(args: string[]): number {
+  const parsed = parseArgs(args, new Set(['--root', '--format']), new Set());
+  if (parsed.positionals.length !== 1) throw new Error('audit requires one snapshot id');
+  const format = optionString(parsed, '--format') ?? 'text';
+  if (!['json', 'text'].includes(format)) throw new Error('--format must be json or text');
+  const repoRoot = detectRepoRoot();
+  const root = dataRoot(repoRoot, optionString(parsed, '--root'));
+  const verified = verifySnapshot(root, parsed.positionals[0]!);
+  if (!verified.ok || !verified.snapshotPath || !verified.manifest) { writeJson(verified); return 1; }
+  const quality = JSON.parse(fs.readFileSync(path.join(verified.snapshotPath, 'quality.json'), 'utf8')) as { findings: unknown[] };
+  const records = fs.readFileSync(path.join(verified.snapshotPath, 'normalized.jsonl'), 'utf8').split('\n').filter(Boolean).map((line) => {
+    const { schema: _schema, ...record } = JSON.parse(line) as { schema: string } & NormalizedRecord;
+    return record;
+  });
+  const recomputed = reconcileRecords(records, verified.manifest.scope);
+  if (!canonicalJsonBytes(recomputed.findings).equals(canonicalJsonBytes(quality.findings))) {
+    writeJson({ ok: false, error: { code: 'QUALITY_MISMATCH', message: 'stored quality baseline does not match recomputed findings' } });
+    return 1;
+  }
+  if (format === 'json') writeJson({ ok: true, snapshotId: parsed.positionals[0], findings: recomputed.findings });
+  else process.stdout.write(`Snapshot ${parsed.positionals[0]}: ${quality.findings.length} findings\n`);
+  return 0;
+}
+
+function repair(args: string[]): number {
+  const parsed = parseArgs(args, new Set(['--root']), new Set(['--apply']));
+  if (parsed.positionals.length !== 1) throw new Error('repair requires one snapshot id');
+  const repoRoot = detectRepoRoot();
+  const result = repairSnapshot(dataRoot(repoRoot, optionString(parsed, '--root')), parsed.positionals[0]!, parsed.options.has('--apply'));
+  writeJson({ ok: true, ...result });
+  return 0;
+}
+
+function exportSnapshot(args: string[]): number {
+  const parsed = parseArgs(args, new Set(['--root', '--repairs', '--output']), new Set());
+  if (parsed.positionals.length !== 1) throw new Error('export requires one snapshot id');
+  const repairMode = optionString(parsed, '--repairs') ?? 'none';
+  if (!['none', 'applied'].includes(repairMode)) throw new Error('--repairs must be none or applied');
+  const output = optionString(parsed, '--output') ?? '-';
+  const repoRoot = detectRepoRoot();
+  const root = dataRoot(repoRoot, optionString(parsed, '--root'));
+  const verified = verifySnapshot(root, parsed.positionals[0]!);
+  if (!verified.ok || !verified.snapshotPath) { writeJson(verified); return 1; }
+  let content = fs.readFileSync(path.join(verified.snapshotPath, 'normalized.jsonl'), 'utf8');
+  if (repairMode === 'applied') content += readAppliedOverlays(root, parsed.positionals[0]!);
+  if (output === '-') process.stdout.write(content);
+  else {
+    const destination = path.resolve(repoRoot, output);
+    const relative = path.relative(repoRoot, destination);
+    if (!relative || relative.startsWith('..') || path.isAbsolute(relative)) throw new Error('export output must be inside the repository');
+    fs.writeFileSync(destination, content, { flag: 'wx', mode: 0o600 });
+    writeJson({ ok: true, snapshotId: parsed.positionals[0], output: relative });
+  }
+  return 0;
+}
+
+async function cmdData(args: string[]): Promise<number> {
+  const [command, ...rest] = args;
+  if (!command || command === '--help' || command === '-h' || command === 'help') {
+    process.stdout.write(USAGE);
+    return command ? 0 : 1;
+  }
+  try {
+    switch (command) {
+      case 'capture': return capture(rest);
+      case 'verify': return verify(rest);
+      case 'audit': return audit(rest);
+      case 'repair': return repair(rest);
+      case 'export': return exportSnapshot(rest);
+      default:
+        process.stderr.write(`Unknown data command: ${command}\n`);
+        process.stdout.write(USAGE);
+        return 1;
+    }
+  } catch (error) {
+    writeJson({ ok: false, error: { code: 'DATA_COMMAND_FAILED', message: error instanceof Error ? error.message : String(error) } });
+    return 1;
+  }
+}
+
+export { cmdData, dataRoot };

package/lib/process-data/normalize.ts

@@ -0,0 +1,202 @@
+import { sha256 } from './store.ts';
+
+import type { CapturedObject, JsonValue, NormalizedKind, NormalizedRecord } from './types.ts';
+
+const TASK_ID_RE = /TASK-\d{8}-\d{6}/;
+const ACTIVITY_RE = /^- (\d{4}-\d{2}-\d{2} [^ ]+) — \*\*(.+?)\*\* by ([^ ]+) — (.+)$/gm;
+const LEDGER_RE = /^\|\s*((?:AN|PL|CD)-\d+)\s*\|\s*(analysis|plan|code)\s*\|\s*([^|]+?)\s*\|\s*([^|]+?)\s*\|\s*([^|]+?)\s*\|\s*([^|]+?)\s*\|$/gm;
+const RULING_RE = /^###\s+(HDR-\d+)\s*$([\s\S]*?)(?=^###\s+|^##\s+|(?![\s\S]))/gm;
+const CONFLICT_STATUSES = new Set(['open', 'accepted', 'adjusted', 'refuted', 'cannot-judge', 'needs-human-decision']);
+
+function recordId(kind: NormalizedKind, identity: string, suffix = ''): string {
+  return `${kind}:${sha256(`${identity}\0${suffix}`).slice(0, 24)}`;
+}
+
+function canonicalActor(raw: string): string | null {
+  const lowered = raw.toLowerCase();
+  const aliases: Record<string, string> = {
+    'claude-code': 'claude',
+    'antigravity-cli': 'antigravity',
+    'gemini-cli': 'gemini',
+    gemini: 'gemini'
+  };
+  if (['claude', 'codex', 'antigravity', 'opencode', 'cursor', 'human'].includes(lowered)) return lowered;
+  return aliases[lowered] ?? null;
+}
+
+function nextOccurrence(occurrences: Map<string, number>, identity: string): string {
+  const occurrence = (occurrences.get(identity) ?? 0) + 1;
+  occurrences.set(identity, occurrence);
+  return occurrence === 1 ? '' : `occurrence=${occurrence}`;
+}
+
+function normalizePlatformPage(object: CapturedObject): NormalizedRecord[] {
+  if (!object.content) return [];
+  try {
+    const page = JSON.parse(object.content) as unknown;
+    if (!Array.isArray(page)) return [];
+    return page.map((entry, index) => {
+      const value = entry as Record<string, unknown>;
+      const identity = String(value.id ?? value.node_id ?? value.sha ?? value.number ?? `${object.sourceIdentity}:${index}`);
+      const platformIdentity = /\/issues\?/.test(object.sourceIdentity) && typeof value.number === 'number'
+        ? `issue:${value.number}`
+        : /\/pulls\?/.test(object.sourceIdentity) && typeof value.number === 'number'
+          ? `pr:${value.number}`
+          : /\/issues\/\d+\/comments/.test(object.sourceIdentity)
+            ? `issue-comment:${identity}`
+            : /\/pulls\/\d+\/reviews/.test(object.sourceIdentity)
+              ? `review:${identity}`
+              : /\/pulls\/\d+\/commits/.test(object.sourceIdentity)
+                ? `commit:${identity}`
+                : `platform:${identity}`;
+      const binding = typeof value.body === 'string' ? value.body.match(TASK_ID_RE)?.[0] : undefined;
+      return {
+        recordId: recordId('platform-resource', object.sourceIdentity, identity),
+        kind: 'platform-resource',
+        sourceIdentity: platformIdentity,
+        sourceSha256: object.sha256,
+        ...(binding ? { binding } : {}),
+        data: entry as JsonValue
+      };
+    });
+  } catch {
+    return [];
+  }
+}
+
+function normalizeObjects(objects: CapturedObject[]): NormalizedRecord[] {
+  const records: NormalizedRecord[] = [];
+  for (const object of objects) {
+    if (object.disposition?.state && object.disposition.state !== 'included') {
+      records.push({
+        recordId: recordId('missing', object.sourceIdentity),
+        kind: 'missing',
+        sourceIdentity: object.sourceIdentity,
+        sourceSha256: object.sha256,
+        data: object.disposition.state === 'excluded-sensitive'
+          ? { reason: 'privacy-excluded', ruleId: object.disposition.ruleId }
+          : { reason: object.disposition.reason }
+      });
+      continue;
+    }
+    if (object.sourceKind === 'github-rest') {
+      records.push(...normalizePlatformPage(object));
+      continue;
+    }
+    if (object.sourceKind === 'operational-report') {
+      records.push({
+        recordId: recordId('operational-report', object.sourceIdentity),
+        kind: 'operational-report',
+        sourceIdentity: object.sourceIdentity,
+        sourceSha256: object.sha256
+      });
+      continue;
+    }
+    if (object.sourceKind === 'structured-telemetry') {
+      let data: JsonValue = { availability: 'unknown' };
+      try {
+        data = JSON.parse(object.content ?? '{}') as JsonValue;
+      } catch {
+        data = { availability: 'unavailable', reason: 'invalid receipt JSON' };
+      }
+      records.push({
+        recordId: recordId('telemetry', object.sourceIdentity),
+        kind: 'telemetry',
+        sourceIdentity: object.sourceIdentity,
+        sourceSha256: object.sha256,
+        data
+      });
+      continue;
+    }
+
+    const taskId = object.sourceIdentity.match(TASK_ID_RE)?.[0];
+    if (/\/task\.md$/.test(object.sourceIdentity) && taskId) {
+      const activityOccurrences = new Map<string, number>();
+      const findingOccurrences = new Map<string, number>();
+      const issueNumber = object.content?.match(/^issue_number:\s*(\d+)$/m)?.[1];
+      const agentInfraVersion = object.content?.match(/^agent_infra_version:\s*(\S+)$/m)?.[1];
+      records.push({
+        recordId: recordId('task', taskId),
+        kind: 'task',
+        sourceIdentity: taskId,
+        sourceSha256: object.sha256,
+        ...(issueNumber ? { binding: `issue:${issueNumber}` } : {}),
+        data: {
+          agentInfraVersion: agentInfraVersion
+            ? { state: 'known', value: agentInfraVersion }
+            : { state: 'unknown', reason: 'legacy-task-missing-agent-infra-version' }
+        }
+      });
+      for (const match of object.content?.matchAll(ACTIVITY_RE) ?? []) {
+        const rawActor = match[3]!;
+        const identity = `${match[1]}:${match[2]}`;
+        const occurrence = nextOccurrence(activityOccurrences, identity);
+        records.push({
+          recordId: recordId('lifecycle-event', taskId, occurrence ? `${identity}\0${occurrence}` : identity),
+          kind: 'lifecycle-event',
+          sourceIdentity: `${taskId}#activity=${match[1]}`,
+          sourceSha256: object.sha256,
+          data: {
+            timestamp: match[1]!,
+            action: match[2]!,
+            actorRaw: rawActor,
+            actorCanonical: canonicalActor(rawActor),
+            note: match[4]!
+          }
+        });
+      }
+      for (const match of object.content?.matchAll(LEDGER_RE) ?? []) {
+        const findingId = match[1]!.trim();
+        const stage = match[2]!.trim();
+        const round = match[3]!.trim();
+        const severity = match[4]!.trim();
+        const status = match[5]!.trim();
+        const evidence = match[6]!.trim();
+        const identity = `${taskId}#finding=${findingId}`;
+        const occurrence = nextOccurrence(findingOccurrences, identity);
+        const data = { findingId, stage, round, severity, status, evidence };
+        records.push({
+          recordId: recordId('review-finding', identity, occurrence),
+          kind: 'review-finding',
+          sourceIdentity: identity,
+          sourceSha256: object.sha256,
+          binding: taskId,
+          data
+        });
+        if (status && CONFLICT_STATUSES.has(status)) {
+          records.push({
+            recordId: recordId('conflict', identity, occurrence),
+            kind: 'conflict',
+            sourceIdentity: `${identity}#status=${status}`,
+            sourceSha256: object.sha256,
+            binding: taskId,
+            data
+          });
+        }
+      }
+      for (const match of object.content?.matchAll(RULING_RE) ?? []) {
+        const rulingId = match[1]!;
+        const identity = `${taskId}#ruling=${rulingId}`;
+        records.push({
+          recordId: recordId('human-ruling', identity),
+          kind: 'human-ruling',
+          sourceIdentity: identity,
+          sourceSha256: object.sha256,
+          binding: taskId,
+          data: { rulingId, evidence: match[2]!.trim() }
+        });
+      }
+      continue;
+    }
+    records.push({
+      recordId: recordId('artifact', object.sourceIdentity),
+      kind: 'artifact',
+      sourceIdentity: object.sourceIdentity,
+      sourceSha256: object.sha256,
+      ...(taskId ? { binding: taskId } : {})
+    });
+  }
+  return records.sort((left, right) => left.recordId.localeCompare(right.recordId));
+}
+
+export { normalizeObjects };

package/lib/process-data/privacy.ts

@@ -0,0 +1,41 @@
+import { sha256 } from './store.ts';
+
+import type { CapturedObject, PrivacyDisposition, SourceKind } from './types.ts';
+
+type ScannedDisposition =
+  | Extract<PrivacyDisposition, { state: 'included' }>
+  | Extract<PrivacyDisposition, { state: 'excluded-sensitive' }>;
+
+const RULES = [
+  { id: 'private-key', pattern: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/ },
+  { id: 'github-token', pattern: /\b(?:gh[opusr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/ },
+  { id: 'bearer-token', pattern: /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/i },
+  { id: 'aws-access-key', pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/ },
+  { id: 'slack-token', pattern: /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/ },
+  { id: 'slack-webhook', pattern: /https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9/_-]{20,}/i },
+  { id: 'credential-field', pattern: /(?:api[_-]?key|password|secret)\s*[:=]\s*["']?[^\s"']{8,}/i }
+] as const;
+
+function inspectPrivacy(content: string): ScannedDisposition {
+  for (const rule of RULES) {
+    if (rule.pattern.test(content)) return { state: 'excluded-sensitive', ruleId: rule.id };
+  }
+  return { state: 'included' };
+}
+
+function captureText(sourceKind: SourceKind, sourceIdentity: string, content: string): CapturedObject {
+  const bytes = Buffer.byteLength(content);
+  const digest = sha256(Buffer.from(content, 'utf8'));
+  const disposition = inspectPrivacy(content);
+  return disposition.state === 'included'
+    ? { sourceKind, sourceIdentity, sha256: digest, bytes, content, disposition }
+    : { sourceKind, sourceIdentity, sha256: digest, bytes, disposition };
+}
+
+function redactExcerpt(content: string, maxBytes = 4096): string | null {
+  if (inspectPrivacy(content).state !== 'included') return null;
+  const buffer = Buffer.from(content, 'utf8');
+  return buffer.subarray(0, maxBytes).toString('utf8').replace(/\b(token|password|secret)=\S+/gi, '$1=[REDACTED]');
+}
+
+export { captureText, inspectPrivacy, redactExcerpt };