@fitlab-ai/agent-infra 0.9.5 → 0.9.6

package/dist/lib/task/commands/validate.js

@@ -0,0 +1,289 @@
+import { execFileSync, spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { loadConfig } from '../../sandbox/config.js';
+import { detectEngine } from '../../sandbox/engine.js';
+import { runEngine } from '../../sandbox/shell.js';
+import { sandboxBranchLabel, sandboxLabel } from '../../sandbox/constants.js';
+import { fetchSandboxRows, selectSandboxContainer } from '../../sandbox/commands/list-running.js';
+import { containerNameCandidates } from '../../sandbox/constants.js';
+import { resolveSandboxTarget } from '../../sandbox/workspace-identity.js';
+import { sandboxControlPaths } from '../../sandbox/workspace-view.js';
+import { appendSandboxControlAudit, readActiveLease, readSandboxControlStatus } from '../../sandbox/control/state.js';
+import { SANDBOX_CONTROL_FUTURE_SKEW_MS, SANDBOX_CONTROL_STATUS_STALE_MS } from '../../sandbox/control/protocol.js';
+import { getProcessStartTime } from '../../server/process-state.js';
+import { assertGitWorktreeBinding } from '../../git/worktree-identity.js';
+const USAGE = `Usage: ai task validate <branch | TASK-id | N> [--scope snapshot|inplace] [--timeout <ms>] [--format text|json] -- <command> [args...]`;
+const MAX_TIMEOUT_MS = 60 * 60 * 1000;
+const RECOVERY_GRACE_MS = 30_000;
+export function parseValidateArgs(args) {
+    if (args.includes('--help') || args.includes('-h')) {
+        return { target: '', scope: 'snapshot', timeoutMs: 300_000, format: 'text', command: [], help: true };
+    }
+    const separator = args.indexOf('--');
+    if (separator < 0)
+        throw new Error(`${USAGE}\nA literal -- must separate validation options from the command.`);
+    const optionArgs = args.slice(0, separator);
+    const command = args.slice(separator + 1);
+    let scope = 'snapshot';
+    let timeoutMs = 300_000;
+    let format = 'text';
+    const positionals = [];
+    for (let index = 0; index < optionArgs.length; index += 1) {
+        const arg = optionArgs[index];
+        if (arg === '--scope') {
+            const value = optionArgs[++index];
+            if (value !== 'snapshot' && value !== 'inplace')
+                throw new Error('validate --scope must be snapshot or inplace');
+            scope = value;
+        }
+        else if (arg === '--timeout') {
+            const value = Number(optionArgs[++index]);
+            if (!Number.isSafeInteger(value) || value <= 0 || value > MAX_TIMEOUT_MS)
+                throw new Error(`validate --timeout must be 1..${MAX_TIMEOUT_MS}`);
+            timeoutMs = value;
+        }
+        else if (arg === '--format') {
+            const value = optionArgs[++index];
+            if (value !== 'text' && value !== 'json')
+                throw new Error('validate --format must be text or json');
+            format = value;
+        }
+        else if (arg.startsWith('-')) {
+            throw new Error(`Unknown option: ${arg}`);
+        }
+        else {
+            positionals.push(arg);
+        }
+    }
+    if (positionals.length !== 1 || command.length === 0)
+        throw new Error(USAGE);
+    return { target: positionals[0], scope, timeoutMs, format, command, help: false };
+}
+function runValidationCommand(command, cwd, scope, timeoutMs, json) {
+    const [file, ...args] = command;
+    const result = spawnSync(file, args, {
+        cwd,
+        env: { ...process.env, AGENT_INFRA_VALIDATION_SCOPE: scope },
+        encoding: 'utf8',
+        timeout: timeoutMs,
+        stdio: ['inherit', 'pipe', 'pipe'],
+        shell: process.platform === 'win32' && /\.(?:bat|cmd)$/i.test(file)
+    });
+    if (json) {
+        if (result.stdout)
+            process.stderr.write(result.stdout);
+        if (result.stderr)
+            process.stderr.write(result.stderr);
+    }
+    else {
+        if (result.stdout)
+            process.stdout.write(result.stdout);
+        if (result.stderr)
+            process.stderr.write(result.stderr);
+    }
+    return { exitCode: result.status ?? 1, signal: result.signal ?? null };
+}
+function git(root, args) {
+    return execFileSync('git', args, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+}
+function waitForState(statusDir, predicate, timeoutMs = 5_000) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        try {
+            const status = readSandboxControlStatus(statusDir);
+            if (predicate(status))
+                return;
+        }
+        catch {
+            // Atomic status publication may be between renames.
+        }
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
+    }
+    throw new Error('SANDBOX_VALIDATION_BROKER_STATE_TIMEOUT');
+}
+function snapshotValidation(repoRoot, commit, options) {
+    const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'agent-infra-validation-'));
+    const worktree = path.join(tempRoot, 'worktree');
+    let cleanup = 'not-created';
+    try {
+        git(repoRoot, ['worktree', 'add', '--detach', worktree, commit]);
+        cleanup = 'pending';
+        return { ...runValidationCommand(options.command, worktree, 'snapshot', options.timeoutMs, options.format === 'json'), cleanup: () => cleanup };
+    }
+    finally {
+        let cleanupError = null;
+        if (fs.existsSync(worktree)) {
+            try {
+                git(repoRoot, ['worktree', 'remove', '--force', worktree]);
+                cleanup = 'completed';
+            }
+            catch (error) {
+                cleanupError = error;
+            }
+        }
+        try {
+            git(repoRoot, ['worktree', 'prune']);
+        }
+        catch (error) {
+            cleanupError ??= error;
+        }
+        try {
+            fs.rmSync(tempRoot, { recursive: true, force: true });
+        }
+        catch (error) {
+            cleanupError ??= error;
+        }
+        if (cleanupError)
+            throw cleanupError;
+    }
+}
+function inplaceValidation(config, target, options) {
+    const engine = detectEngine(config);
+    const { running, nonRunning } = fetchSandboxRows(engine, sandboxLabel(config), sandboxBranchLabel(config));
+    const row = selectSandboxContainer([...running, ...nonRunning], containerNameCandidates(config, target.branch));
+    if (!row)
+        throw new Error('SANDBOX_VALIDATION_CONTAINER_NOT_FOUND');
+    const control = sandboxControlPaths({
+        base: config.controlBase, project: config.project,
+        container: row.name, identity: target.workspace
+    });
+    const manifest = JSON.parse(fs.readFileSync(control.manifestPath, 'utf8'));
+    const initial = readSandboxControlStatus(control.statusDir);
+    const now = Date.now();
+    if (initial.generation !== manifest.generation
+        || now - initial.updatedAt > SANDBOX_CONTROL_STATUS_STALE_MS
+        || initial.updatedAt > now + SANDBOX_CONTROL_FUTURE_SKEW_MS) {
+        throw new Error('SANDBOX_VALIDATION_BROKER_STATUS_STALE');
+    }
+    if (initial.state !== 'healthy' || initial.activeRequestId !== null) {
+        throw new Error('SANDBOX_VALIDATION_BROKER_NOT_IDLE');
+    }
+    const startTime = getProcessStartTime(process.pid);
+    if (!startTime)
+        throw new Error('SANDBOX_VALIDATION_OWNER_IDENTITY_UNAVAILABLE');
+    const leasePath = path.join(control.root, 'lease.json');
+    const nonce = randomUUID();
+    const issuedAt = Date.now();
+    const lease = {
+        version: 1, generation: manifest.generation, nonce,
+        owner: { pid: process.pid, startTime }, issuedAt,
+        expiresAt: issuedAt + Math.min(options.timeoutMs + RECOVERY_GRACE_MS, MAX_TIMEOUT_MS + RECOVERY_GRACE_MS),
+        taskId: target.workspace.mode === 'task-bound' ? target.workspace.taskId : null,
+        branch: target.branch, reason: 'manual-validation'
+    };
+    const originalBranch = git(manifest.worktreeRoot, ['symbolic-ref', '--quiet', '--short', 'HEAD']);
+    const originalHead = git(manifest.worktreeRoot, ['rev-parse', 'HEAD']);
+    fs.writeFileSync(leasePath, `${JSON.stringify(lease)}\n`, { flag: 'wx', mode: 0o600 });
+    let stopped = false;
+    let restored = false;
+    try {
+        appendSandboxControlAudit(manifest, 'lease-acquire', { ownerPid: process.pid });
+        waitForState(control.statusDir, (status) => status.state === 'parked' && status.reasonCode === 'SANDBOX_CONTROL_HANDOFF_ACTIVE');
+        if (row.running) {
+            runEngine(engine, 'docker', ['stop', row.name]);
+            stopped = true;
+        }
+        const refreshedRows = fetchSandboxRows(engine, sandboxLabel(config), sandboxBranchLabel(config));
+        const refreshed = selectSandboxContainer([...refreshedRows.running, ...refreshedRows.nonRunning], containerNameCandidates(config, target.branch));
+        if (!refreshed || refreshed.running)
+            throw new Error('SANDBOX_VALIDATION_CONTAINER_STILL_RUNNING');
+        const activeLease = readActiveLease(manifest);
+        if (!activeLease || activeLease.nonce !== nonce)
+            throw new Error('SANDBOX_VALIDATION_LEASE_OWNERSHIP_LOST');
+        assertGitWorktreeBinding(config.repoRoot, manifest.worktreeRoot, target.branch);
+        const result = runValidationCommand(options.command, manifest.worktreeRoot, 'inplace', options.timeoutMs, options.format === 'json');
+        return { ...result, cleanup: () => restored ? 'completed' : 'pending' };
+    }
+    finally {
+        const recoveryErrors = [];
+        try {
+            const currentBranch = git(manifest.worktreeRoot, ['symbolic-ref', '--quiet', '--short', 'HEAD']);
+            if (currentBranch !== originalBranch)
+                git(manifest.worktreeRoot, ['switch', originalBranch]);
+        }
+        catch {
+            try {
+                git(manifest.worktreeRoot, ['checkout', '--detach', originalHead]);
+                git(manifest.worktreeRoot, ['switch', originalBranch]);
+            }
+            catch (fallbackError) {
+                recoveryErrors.push(`git binding restore failed: ${fallbackError instanceof Error ? fallbackError.message : String(fallbackError)}`);
+            }
+        }
+        if (stopped) {
+            try {
+                runEngine(engine, 'docker', ['start', row.name]);
+            }
+            catch (error) {
+                recoveryErrors.push(`container start failed: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        try {
+            const currentLease = JSON.parse(fs.readFileSync(leasePath, 'utf8'));
+            if (currentLease.nonce !== nonce)
+                throw new Error('SANDBOX_VALIDATION_LEASE_OWNERSHIP_LOST');
+        }
+        catch (error) {
+            recoveryErrors.push(error instanceof Error ? error.message : String(error));
+        }
+        if (recoveryErrors.length === 0) {
+            try {
+                fs.unlinkSync(leasePath);
+                appendSandboxControlAudit(manifest, 'lease-release', { ownerPid: process.pid });
+                waitForState(control.statusDir, (status) => status.state === 'healthy');
+                restored = true;
+            }
+            catch (error) {
+                try {
+                    if (!fs.existsSync(leasePath)) {
+                        fs.writeFileSync(leasePath, `${JSON.stringify(lease)}\n`, { flag: 'wx', mode: 0o600 });
+                    }
+                    appendSandboxControlAudit(manifest, 'lease-release-failed', { ownerPid: process.pid });
+                }
+                catch (leaseError) {
+                    recoveryErrors.push(`lease preservation failed: ${leaseError instanceof Error ? leaseError.message : String(leaseError)}`);
+                }
+                recoveryErrors.push(error instanceof Error ? error.message : String(error));
+            }
+        }
+        if (recoveryErrors.length > 0) {
+            throw new Error(`SANDBOX_VALIDATION_RECOVERY_INCOMPLETE: ${recoveryErrors.join('; ')}; run 'ai sandbox start ${target.branch}'`);
+        }
+    }
+}
+export async function validate(args) {
+    const options = parseValidateArgs(args);
+    if (options.help) {
+        process.stdout.write(`${USAGE}\n`);
+        return 0;
+    }
+    const config = loadConfig();
+    const target = resolveSandboxTarget(options.target, config.repoRoot);
+    const commit = git(config.repoRoot, ['rev-parse', target.branch]);
+    const startedAt = new Date().toISOString();
+    const result = options.scope === 'snapshot'
+        ? snapshotValidation(config.repoRoot, commit, options)
+        : inplaceValidation(config, target, options);
+    const evidence = {
+        version: 1,
+        taskId: target.workspace.mode === 'task-bound' ? target.workspace.taskId : null,
+        branch: target.branch,
+        scope: options.scope,
+        commit,
+        command: path.basename(options.command[0]),
+        startedAt,
+        completedAt: new Date().toISOString(),
+        exitCode: result.exitCode,
+        signal: result.signal,
+        cleanup: result.cleanup()
+    };
+    if (options.format === 'json')
+        process.stdout.write(`${JSON.stringify(evidence)}\n`);
+    else
+        process.stdout.write(`Validation ${result.exitCode === 0 ? 'passed' : 'failed'} (${options.scope}, ${evidence.command}, cleanup=${evidence.cleanup}).\n`);
+    return result.exitCode;
+}
+//# sourceMappingURL=validate.js.map

package/dist/lib/task/commit-finalization.js

@@ -4,7 +4,7 @@ import path from 'node:path';
 import { locateActivityLog, appendActivityEntry, pairEntries, parseCommitAttemptStarted } from './activity-log.js';
 import { commitIntentPath, digest, readCommitIntent } from './commit-intent.js';
 import { parseTypedTaskFrontmatter } from './frontmatter.js';
-import { parseReviewSummary } from './review-artifacts.js';
+import { artifactName, maxRound, parseReviewSummary } from './review-artifacts.js';
 import { extractReviewBaseline, extractReviewedSnapshotTree, findAuthoritativeReviewCodeArtifact, parseReviewedGitTree } from './review-fingerprint.js';
 const SHA_RE = /^[a-f0-9]{40,64}$/;
 function git(repoRoot, args) {
@@ -26,6 +26,22 @@ function isAncestor(repoRoot, ancestor, descendant) {
         stdio: 'ignore'
     }).status === 0;
 }
+function hasMatchingApprovedReview(taskDir, beforeRound, baseline, tree) {
+    const entries = fs.readdirSync(taskDir);
+    for (let round = Math.min(beforeRound - 1, maxRound(entries, 'review-code')); round >= 1; round -= 1) {
+        const file = path.join(taskDir, artifactName('review-code', round));
+        if (!fs.existsSync(file))
+            continue;
+        const content = fs.readFileSync(file, 'utf8');
+        const summary = parseReviewSummary(content);
+        if (summary.ok
+            && summary.summary.verdict === 'Approved'
+            && extractReviewBaseline(content) === baseline
+            && extractReviewedSnapshotTree(content) === tree)
+            return true;
+    }
+    return false;
+}
 function outcome(disposition, overrides = {}) {
     return {
         disposition,
@@ -34,6 +50,7 @@ function outcome(disposition, overrides = {}) {
         currentHead: '',
         committedHead: null,
         commitNote: null,
+        activityNote: null,
         needsAnchor: false,
         needsLog: false,
         intent: null,
@@ -130,6 +147,12 @@ function inspectCommitFinalization(taskDir, repoRoot, taskId) {
             message: 'repository HEAD or ancestry conflicts with the commit intent'
         });
     }
+    const commitNote = git(repoRoot, ['show', '-s', '--format=%h%x20%s', intent.committedHead]);
+    const matchingDone = commitRows.filter((row) => row.done !== '' && row.note === commitNote);
+    const pushOnlyRetry = intent.phase === 'pushed'
+        && intent.baselineHead === intent.committedHead
+        && matchingDone.length === 1
+        && openRows.length === 1;
     const review = findAuthoritativeReviewCodeArtifact(taskDir);
     let needsAnchor = false;
     if (review.ok && review.path) {
@@ -147,7 +170,9 @@ function inspectCommitFinalization(taskDir, repoRoot, taskId) {
             return invalid('authoritative review-code evidence is not a valid approved snapshot', currentHead, 'COMMIT_FINALIZATION_EVIDENCE_INVALID', shared);
         }
         const committedTree = git(repoRoot, ['rev-parse', `${intent.committedHead}^{tree}`]);
-        if (reviewBaseline !== intent.baselineHead || reviewTree !== committedTree) {
+        const matchingCurrentReview = reviewBaseline === intent.baselineHead && reviewTree === committedTree;
+        if (!matchingCurrentReview
+            && !hasMatchingApprovedReview(taskDir, review.round, intent.baselineHead, committedTree)) {
             return outcome('conflict', {
                 ...shared,
                 code: 'COMMIT_FINALIZATION_CONFLICT',
@@ -155,18 +180,16 @@ function inspectCommitFinalization(taskDir, repoRoot, taskId) {
             });
         }
         const anchor = String(metadata.last_reviewed_commit ?? '').trim();
-        if (anchor && anchor !== intent.committedHead) {
+        if (anchor && anchor !== intent.committedHead && anchor !== intent.baselineHead) {
             return outcome('conflict', {
                 ...shared,
                 code: 'COMMIT_FINALIZATION_CONFLICT',
                 message: 'task review anchor conflicts with the committed intent'
             });
         }
-        needsAnchor = anchor === '';
+        needsAnchor = anchor !== intent.committedHead;
     }
-    const commitNote = git(repoRoot, ['show', '-s', '--format=%h%x20%s', intent.committedHead]);
-    const matchingDone = commitRows.filter((row) => row.done !== '' && row.note === commitNote);
-    const needsLog = matchingDone.length === 0 && openRows.length === 1;
+    const needsLog = (matchingDone.length === 0 && openRows.length === 1) || pushOnlyRetry;
     if (!(needsLog || (matchingDone.length === 1 && openRows.length === 0))) {
         return outcome('conflict', {
             ...shared,
@@ -179,12 +202,16 @@ function inspectCommitFinalization(taskDir, repoRoot, taskId) {
         ...shared,
         message: 'commit finalization can be recovered',
         commitNote,
+        activityNote: pushOnlyRetry ? `Pushed ${commitNote}` : commitNote,
         needsAnchor,
         needsLog
     });
 }
 function planCommitTaskFinalization(taskDir, inspection, agent, timestamp) {
-    if (inspection.disposition !== 'recoverable' || !inspection.committedHead || !inspection.commitNote) {
+    if (inspection.disposition !== 'recoverable'
+        || !inspection.committedHead
+        || !inspection.commitNote
+        || !inspection.activityNote) {
         throw new Error('commit finalization task mutations require a recoverable inspection');
     }
     const taskContent = fs.readFileSync(path.join(taskDir, 'task.md'), 'utf8');
@@ -207,7 +234,7 @@ function planCommitTaskFinalization(taskDir, inspection, agent, timestamp) {
                 time: timestamp,
                 step: 'Commit',
                 agent,
-                note: inspection.commitNote
+                note: inspection.activityNote
             })
         });
     }

package/dist/lib/task/delegation-receipts.js

@@ -23,6 +23,7 @@ function prepareDelegation(input, options = {}) {
         spawnMode: null,
         agent: null,
         status: 'prepared',
+        hostEvidence: null,
         afterFingerprint: null,
         changedPaths: Object.freeze([]),
         createdAt: (options.now ?? (() => new Date().toISOString()))(),
@@ -65,6 +66,12 @@ function activateDelegation(receipt, event, options = {}) {
     if (actualReasoningEffort === receipt.requestedReasoningEffort && event.reasoningEffortFallbackReason) {
         return fail('DELEGATION_REASONING_EFFORT_FALLBACK_INVALID', 'reasoning-effort fallback reason is only valid when actual effort differs');
     }
+    if (event.hostEvidence
+        && (receipt.client !== 'codex'
+            || !event.hostEvidence.hookDefinitionHash.trim()
+            || !Number.isSafeInteger(event.hostEvidence.startRevision)
+            || event.hostEvidence.startRevision < 1))
+        return fail('DELEGATION_HOST_EVIDENCE_INVALID', 'Codex start evidence reference is invalid');
     return { ok: true, receipt: Object.freeze({
             ...receipt,
             status: 'activated',
@@ -75,6 +82,12 @@ function activateDelegation(receipt, event, options = {}) {
             actualReasoningEffort,
             modelFallbackReason: event.modelFallbackReason ?? null,
             reasoningEffortFallbackReason: event.reasoningEffortFallbackReason ?? null,
+            hostEvidence: event.hostEvidence ? Object.freeze({
+                ...event.hostEvidence,
+                stopRevision: null,
+                consumer: null,
+                consumedAt: null
+            }) : receipt.hostEvidence ?? null,
             activatedAt: (options.now ?? (() => new Date().toISOString()))()
         }) };
 }
@@ -105,11 +118,23 @@ function sealDelegation(receipt, event, options = {}) {
         if (disallowed)
             return fail('DELEGATION_REVIEWER_WRITE_FORBIDDEN', `reviewer changed forbidden path '${disallowed}'`);
     }
+    if (event.hostEvidence) {
+        if (!receipt.hostEvidence
+            || !Number.isSafeInteger(event.hostEvidence.stopRevision)
+            || event.hostEvidence.stopRevision <= receipt.hostEvidence.startRevision
+            || event.hostEvidence.consumer !== receipt.id
+            || !event.hostEvidence.consumedAt.trim())
+            return fail('DELEGATION_HOST_EVIDENCE_INVALID', 'Codex stop evidence reference is invalid');
+    }
     return { ok: true, receipt: Object.freeze({
             ...receipt,
             status: 'sealed',
             afterFingerprint: event.afterFingerprint,
             changedPaths: Object.freeze([...event.changedPaths]),
+            hostEvidence: event.hostEvidence && receipt.hostEvidence ? Object.freeze({
+                ...receipt.hostEvidence,
+                ...event.hostEvidence
+            }) : receipt.hostEvidence ?? null,
             sealedAt: (options.now ?? (() => new Date().toISOString()))()
         }) };
 }

package/dist/lib/task/events.js

@@ -18,7 +18,8 @@ const eventCatalog = [
     'review-plan.started', 'review-plan.completed',
     'code.started', 'code.completed',
     'review-code.started', 'review-code.completed',
-    'manual-validation.started', 'manual-validation.completed'
+    'manual-validation.started', 'manual-validation.completed',
+    'validation-run.started', 'validation-run.completed'
 ];
 const BASE_FIELDS = new Set(['taskRef', 'event', 'agent', 'dryRun']);
 const SCHEMAS = {
@@ -36,7 +37,9 @@ const SCHEMAS = {
     'review-code.started': { optional: ['round'] },
     'review-code.completed': { required: ['artifact', 'verdict', 'blockers', 'major', 'minor', 'manualValidation'], optional: ['round', 'orchestrated'] },
     'manual-validation.started': { optional: ['round'] },
-    'manual-validation.completed': { required: ['artifact', 'summaryResult'], optional: ['round'] }
+    'manual-validation.completed': { required: ['artifact', 'summaryResult'], optional: ['round'] },
+    'validation-run.started': { optional: ['round'] },
+    'validation-run.completed': { required: ['artifact'], optional: ['round'] }
 };
 function validateTaskEventRequest(request) {
     if (!eventCatalog.includes(request.event))
@@ -84,7 +87,8 @@ const FAMILY = {
     'review-plan': { artifact: 'review-plan', started: ['technical-design', 'technical-design-review'], completed: ['technical-design', 'technical-design-review'], target: 'technical-design-review', label: 'Review Plan' },
     code: { artifact: 'code', started: ['technical-design-review', 'code-review'], completed: ['technical-design-review', 'code-review'], target: 'code', label: 'Code Task' },
     'review-code': { artifact: 'review-code', started: ['code', 'code-review', 'commit'], completed: ['code', 'code-review', 'commit'], target: 'code-review', label: 'Review Code' },
-    'manual-validation': { artifact: 'manual-validation', started: ['code-review', 'commit'], completed: ['code-review', 'commit'], target: null, label: 'Complete Manual Validation' }
+    'manual-validation': { artifact: 'manual-validation', started: ['code-review', 'commit'], completed: ['code-review', 'commit'], target: null, label: 'Complete Manual Validation' },
+    'validation-run': { artifact: 'validation-run', started: ['code-review', 'commit'], completed: ['code-review', 'commit'], target: null, label: 'Run Manual Validation' }
 };
 const REVIEW_LEDGER_STAGES = {
     'review-analysis': 'analysis',
@@ -180,6 +184,8 @@ function identity(request) {
         note = `Fixed ${request.blockers} blockers, ${request.major} major, ${request.minor} minor issues${request.manualValidation ? `, skipped ${request.manualValidation} manual-validation` : ''} → ${request.artifact}`;
     else if (family === 'code')
         note = `Code implemented, ${request.filesModified} files modified, ${request.testsPassed} tests passed → ${request.artifact}`;
+    else if (family === 'validation-run')
+        note = `Validation evidence recorded → ${request.artifact}`;
     else {
         const verdict = request.verdict === 'approved' ? 'Approved' : request.verdict === 'changes-requested' ? 'Changes Requested' : 'Rejected';
         note = `Verdict: ${verdict}, blockers: ${request.blockers}, major: ${request.major}, minor: ${request.minor}, Manual-validation: ${request.manualValidation} → ${request.artifact}`;
@@ -329,7 +335,7 @@ function applyTaskEventUnlocked(request, options = {}) {
     if (findingCountError)
         return failed(normalized, findingCountError, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
     let orchestrationCompletion = null;
-    if (eventIdentity.phase === 'completed' && eventIdentity.family !== 'manual-validation') {
+    if (eventIdentity.phase === 'completed' && eventIdentity.family !== 'manual-validation' && eventIdentity.family !== 'validation-run') {
         const orchestrationStage = eventIdentity.family === 'analyze' ? 'analysis' : eventIdentity.family;
         const execution = validateLifecycleExecution(normalized.taskRef, {
             mode: normalized.orchestrated ? 'orchestrated' : 'standalone',

package/dist/lib/task/finalization-artifacts.js

@@ -6,7 +6,8 @@ const COMPLETION_BACKFILL_FAMILIES = [
     'review-plan',
     'code',
     'review-code',
-    'manual-validation'
+    'manual-validation',
+    'validation-run'
 ];
 function inspectCompletionArtifacts(taskRef, options = {}) {
     const artifacts = [];

package/dist/lib/task/implementation-inputs.js

@@ -114,14 +114,8 @@ function finalizeImplementationInput(rows, id, decisionEvidence, decidedAt) {
     next.forEach(validateInput);
     return next;
 }
-function selectPendingImplementationInput(rows, reviewCompletedAt) {
-    const reviewEpoch = Date.parse(reviewCompletedAt.replace(' ', 'T'));
-    if (!Number.isFinite(reviewEpoch))
-        throw new Error('latest review completion time is invalid');
+function selectPendingImplementationInput(rows) {
     const pending = rows.filter((row) => row.needsImplementation && row.status === 'pending');
-    const stale = pending.find((row) => Date.parse(row.decidedAt.replace(' ', 'T')) <= reviewEpoch);
-    if (stale)
-        throw new Error(`implementation input ${stale.id} is not later than the latest approved review`);
     return [...pending].sort((left, right) => {
         const time = Date.parse(left.decidedAt.replace(' ', 'T')) - Date.parse(right.decidedAt.replace(' ', 'T'));
         return time || Number.parseInt(left.id.slice(3), 10) - Number.parseInt(right.id.slice(3), 10);

package/dist/lib/task/index.js

@@ -10,6 +10,7 @@ Commands:
   ls [--all | --blocked | --completed]   List tasks (default: active)
   show [--task <ref>]                    Print a task.md
   status [--task <ref>]                  Aggregated status view (metadata / artifacts / git / platform)
+  validate <ref> [options] -- <command>  Run host validation in snapshot or inplace scope
 
 Examples:
   ai task cat 11 analysis
@@ -29,6 +30,7 @@ Examples:
   ai task show 11
   ai task show TASK-20260612-162737
   ai task status 11
+  ai task validate 11 -- npm test
 
 Run 'ai task <command> --help' for details.`;
 export async function runTask(args) {
@@ -89,6 +91,13 @@ export async function runTask(args) {
             status(rest);
             break;
         }
+        case 'validate': {
+            const { validate } = await import('./commands/validate.js');
+            const exitCode = await validate(rest);
+            if (exitCode !== 0)
+                process.exitCode = exitCode;
+            break;
+        }
         default:
             process.stderr.write(`Unknown task command: ${subcommand}\n\n`);
             process.stdout.write(`${USAGE}\n`);