@fitlab-ai/agent-infra 0.9.6 → 0.9.7

package/lib/task/delegation-receipts.ts

@@ -7,12 +7,41 @@ type DelegationRole = 'executor' | 'reviewer';
 type DelegationStage = 'analysis' | 'review-analysis' | 'plan' | 'review-plan' | 'code' | 'review-code' | 'commit';
 type DelegationStatus = 'prepared' | 'activated' | 'stage-completed' | 'sealed' | 'consumed' | 'aborted' | 'expired';
 type DelegationHostEvidence = Readonly<{
-  kind: 'codex-lifecycle-v1';
+  kind: 'codex-lifecycle-v1' | 'codex-lifecycle-v2';
   hookDefinitionHash: string;
   startRevision: number;
   stopRevision: number | null;
   consumer: string | null;
   consumedAt: string | null;
+  protocolVersion?: number;
+  packageVersion?: string;
+  internalExecutableBuildHash?: string;
+  lifecycleContractHash?: string;
+  hookSource?: 'project' | 'managed' | 'isolated-user';
+  hookSourcePathDigest?: string;
+  hookSourceHash?: string;
+  capabilitySessionId?: string;
+  capabilityTurnId?: string;
+  capabilityToolUseId?: string;
+  spawnToolUseId?: string;
+  spawnObservedAt?: string;
+  controllerInstanceDigest?: string | null;
+  controlGeneration?: string | null;
+}>;
+type DelegationLifecycleProvenance = Readonly<{
+  protocolVersion: number;
+  packageVersion: string;
+  internalExecutableBuildHash: string;
+  lifecycleContractHash: string;
+  hookDefinitionHash: string;
+  hookSource: 'project' | 'managed' | 'isolated-user';
+  hookSourcePathDigest: string;
+  hookSourceHash: string;
+  capabilitySessionId: string;
+  capabilityTurnId: string;
+  capabilityToolUseId: string;
+  controllerInstanceDigest: string | null;
+  controlGeneration: string | null;
 }>;
 
 type DelegationReceipt = Readonly<{
@@ -36,11 +65,19 @@ type DelegationReceipt = Readonly<{
   agent: string | null;
   status: DelegationStatus;
   workspaceSnapshotScope?: 'task';
+  lifecycleProvenance?: DelegationLifecycleProvenance | null;
   hostEvidence?: DelegationHostEvidence | null;
   beforeFingerprint: string;
   afterFingerprint: string | null;
   changedPaths: readonly string[];
   createdAt: string;
+  preparedMonotonicMs: number;
+  spawnDispatchMonotonicMs: number | null;
+  activationDeadlineMonotonicMs: number | null;
+  spawnDispatchedAt: string | null;
+  activationDeadlineAt: string | null;
+  startEvidenceMonotonicMs: number | null;
+  activatedMonotonicMs: number | null;
   activatedAt: string | null;
   sealedAt: string | null;
   consumedAt: string | null;
@@ -64,9 +101,10 @@ function fail(code: string, message: string): ReceiptFailure {
 }
 
 function prepareDelegation(
-  input: Omit<DelegationReceipt, 'id' | 'requestedModel' | 'requestedReasoningEffort' | 'actualModel' | 'actualReasoningEffort' | 'modelFallbackReason' | 'reasoningEffortFallbackReason' | 'parentId' | 'childId' | 'spawnMode' | 'agent' | 'status' | 'hostEvidence' | 'afterFingerprint' | 'changedPaths' | 'createdAt' | 'activatedAt' | 'sealedAt' | 'consumedAt'> & Readonly<{ requestedModel: string; requestedReasoningEffort: string }>,
-  options: { id?: () => string; now?: () => string } = {}
+  input: Omit<DelegationReceipt, 'id' | 'requestedModel' | 'requestedReasoningEffort' | 'actualModel' | 'actualReasoningEffort' | 'modelFallbackReason' | 'reasoningEffortFallbackReason' | 'parentId' | 'childId' | 'spawnMode' | 'agent' | 'status' | 'hostEvidence' | 'afterFingerprint' | 'changedPaths' | 'createdAt' | 'preparedMonotonicMs' | 'spawnDispatchMonotonicMs' | 'activationDeadlineMonotonicMs' | 'spawnDispatchedAt' | 'activationDeadlineAt' | 'startEvidenceMonotonicMs' | 'activatedMonotonicMs' | 'activatedAt' | 'sealedAt' | 'consumedAt'> & Readonly<{ requestedModel: string; requestedReasoningEffort: string }>,
+  options: { id?: () => string; now?: () => string; monotonicNow?: () => number } = {}
 ): DelegationReceipt {
+  const monotonic = (options.monotonicNow ?? (() => Number(process.hrtime.bigint() / 1_000_000n)))();
   return Object.freeze({
     ...input,
     id: (options.id ?? randomUUID)(),
@@ -83,12 +121,41 @@ function prepareDelegation(
     afterFingerprint: null,
     changedPaths: Object.freeze([]),
     createdAt: (options.now ?? (() => new Date().toISOString()))(),
+    preparedMonotonicMs: monotonic,
+    spawnDispatchMonotonicMs: null,
+    activationDeadlineMonotonicMs: null,
+    spawnDispatchedAt: null,
+    activationDeadlineAt: null,
+    startEvidenceMonotonicMs: null,
+    activatedMonotonicMs: null,
     activatedAt: null,
     sealedAt: null,
     consumedAt: null
   });
 }
 
+function dispatchDelegation(
+  receipt: DelegationReceipt,
+  options: { now?: () => string; monotonicNow?: () => number; activationWindowMs?: number } = {}
+): ReceiptResult {
+  if (receipt.status !== 'prepared') {
+    return fail('DELEGATION_STATE_INVALID', `delegation ${receipt.id} is ${receipt.status}, expected prepared`);
+  }
+  if (receipt.spawnDispatchMonotonicMs != null || receipt.spawnDispatchedAt != null) {
+    return fail('DELEGATION_DISPATCH_REPLAY', `delegation ${receipt.id} was already dispatched`);
+  }
+  const monotonic = (options.monotonicNow ?? (() => Number(process.hrtime.bigint() / 1_000_000n)))();
+  const dispatchedAt = (options.now ?? (() => new Date().toISOString()))();
+  const window = options.activationWindowMs ?? 15_000;
+  return { ok: true, receipt: Object.freeze({
+    ...receipt,
+    spawnDispatchMonotonicMs: monotonic,
+    activationDeadlineMonotonicMs: monotonic + window,
+    spawnDispatchedAt: dispatchedAt,
+    activationDeadlineAt: new Date(Date.parse(dispatchedAt) + window).toISOString()
+  }) };
+}
+
 function activateDelegation(
   receipt: DelegationReceipt,
   event: Readonly<{
@@ -101,16 +168,45 @@ function activateDelegation(
     modelFallbackReason?: string;
     reasoningEffortFallbackReason?: string;
     hostEvidence?: Readonly<{
-      kind: 'codex-lifecycle-v1';
+      kind: 'codex-lifecycle-v1' | 'codex-lifecycle-v2';
       hookDefinitionHash: string;
       startRevision: number;
+      protocolVersion?: number;
+      packageVersion?: string;
+      internalExecutableBuildHash?: string;
+      lifecycleContractHash?: string;
+      hookSource?: 'project' | 'managed' | 'isolated-user';
+      hookSourcePathDigest?: string;
+      hookSourceHash?: string;
+      capabilitySessionId?: string;
+      capabilityTurnId?: string;
+      capabilityToolUseId?: string;
+      spawnToolUseId?: string;
+      spawnObservedAt?: string;
+      controllerInstanceDigest?: string | null;
+      controlGeneration?: string | null;
     }>;
   }>,
-  options: { now?: () => string } = {}
+  options: { now?: () => string; monotonicNow?: () => number } = {}
 ): ReceiptResult {
   const managedRole = managedDelegationRole(event.nativeAgent);
   if (!managedRole) return fail('DELEGATION_IGNORED', `subagent '${event.nativeAgent}' is not lifecycle-managed`);
   if (receipt.status !== 'prepared') return fail('DELEGATION_STATE_INVALID', `delegation ${receipt.id} is ${receipt.status}, expected prepared`);
+  if (
+    receipt.spawnDispatchMonotonicMs == null
+    || receipt.spawnDispatchedAt == null
+    || receipt.activationDeadlineAt == null
+    || receipt.activationDeadlineMonotonicMs == null
+    || !Number.isFinite(Date.parse(receipt.spawnDispatchedAt))
+    || !Number.isFinite(Date.parse(receipt.activationDeadlineAt))
+  ) {
+    return fail('DELEGATION_NOT_DISPATCHED', `delegation ${receipt.id} has not reached the native spawn dispatch boundary`);
+  }
+  const monotonic = (options.monotonicNow ?? (() => Number(process.hrtime.bigint() / 1_000_000n)))();
+  const wallNow = Date.parse((options.now ?? (() => new Date().toISOString()))());
+  if (wallNow > Date.parse(receipt.activationDeadlineAt)) {
+    return fail('DELEGATION_ACTIVATION_TIMEOUT', `delegation ${receipt.id} activation evidence arrived after its deadline`);
+  }
   if (managedRole !== receipt.role) return fail('DELEGATION_ROLE_MISMATCH', `managed role ${managedRole} does not match ${receipt.role}`);
   if (!event.parentId || (receipt.parentId !== null && event.parentId !== receipt.parentId) || !event.childId || event.childId === event.parentId) {
     return fail('DELEGATION_IDENTITY_INVALID', 'native parent/child identity does not match the prepared delegation');
@@ -127,6 +223,10 @@ function activateDelegation(
   if (!actualReasoningEffort || actualReasoningEffort.trim() !== actualReasoningEffort) {
     return fail('DELEGATION_REASONING_EFFORT_MISSING', 'native start event must provide a non-empty actual reasoning effort');
   }
+  if (
+    receipt.client === 'codex'
+    && event.hostEvidence?.kind !== 'codex-lifecycle-v2'
+  ) return fail('DELEGATION_HOST_EVIDENCE_REQUIRED', 'Codex activation requires trusted lifecycle-v2 host evidence');
   if (
     actualReasoningEffort !== receipt.requestedReasoningEffort
     && (!event.reasoningEffortFallbackReason || event.reasoningEffortFallbackReason.trim() === '')
@@ -148,6 +248,33 @@ function activateDelegation(
       || event.hostEvidence.startRevision < 1
     )
   ) return fail('DELEGATION_HOST_EVIDENCE_INVALID', 'Codex start evidence reference is invalid');
+  if (event.hostEvidence?.kind === 'codex-lifecycle-v2') {
+    const expected = receipt.lifecycleProvenance;
+    const spawnObservedAt = Date.parse(event.hostEvidence.spawnObservedAt ?? '');
+    const spawnDispatchedAt = Date.parse(receipt.spawnDispatchedAt);
+    const activationDeadlineAt = Date.parse(receipt.activationDeadlineAt);
+    if (
+      !expected
+      || event.hostEvidence.protocolVersion !== expected.protocolVersion
+      || event.hostEvidence.packageVersion !== expected.packageVersion
+      || event.hostEvidence.internalExecutableBuildHash !== expected.internalExecutableBuildHash
+      || event.hostEvidence.lifecycleContractHash !== expected.lifecycleContractHash
+      || event.hostEvidence.hookDefinitionHash !== expected.hookDefinitionHash
+      || event.hostEvidence.hookSource !== expected.hookSource
+      || event.hostEvidence.hookSourcePathDigest !== expected.hookSourcePathDigest
+      || event.hostEvidence.hookSourceHash !== expected.hookSourceHash
+      || event.hostEvidence.capabilitySessionId !== expected.capabilitySessionId
+      || event.hostEvidence.capabilityTurnId !== expected.capabilityTurnId
+      || !event.hostEvidence.spawnToolUseId?.trim()
+      || event.hostEvidence.spawnToolUseId === expected.capabilityToolUseId
+      || !Number.isFinite(spawnObservedAt)
+      || spawnObservedAt < spawnDispatchedAt
+      || spawnObservedAt > activationDeadlineAt
+      || event.parentId !== expected.capabilitySessionId
+      || (event.hostEvidence.controllerInstanceDigest ?? null) !== expected.controllerInstanceDigest
+      || (event.hostEvidence.controlGeneration ?? null) !== expected.controlGeneration
+    ) return fail('DELEGATION_HOST_EVIDENCE_INVALID', 'Codex lifecycle provenance does not match the prepared receipt');
+  }
   return { ok: true, receipt: Object.freeze({
     ...receipt,
     status: 'activated',
@@ -164,10 +291,22 @@ function activateDelegation(
       consumer: null,
       consumedAt: null
     }) : receipt.hostEvidence ?? null,
-    activatedAt: (options.now ?? (() => new Date().toISOString()))()
+    startEvidenceMonotonicMs: monotonic,
+    activatedMonotonicMs: (options.monotonicNow ?? (() => Number(process.hrtime.bigint() / 1_000_000n)))(),
+    activatedAt: new Date(wallNow).toISOString()
   }) };
 }
 
+function abortPreparedDelegation(receipt: DelegationReceipt): ReceiptResult {
+  if (receipt.status !== 'prepared') {
+    return fail('DELEGATION_STATE_INVALID', `delegation ${receipt.id} is ${receipt.status}, expected prepared`);
+  }
+  return {
+    ok: true,
+    receipt: Object.freeze({ ...receipt, status: 'aborted' as const })
+  };
+}
+
 function completeDelegationStage(
   receipt: DelegationReceipt,
   event: Readonly<{ stage: DelegationStage; round: number; artifact: string; agent: string }>
@@ -191,9 +330,12 @@ function sealDelegation(
     changedPaths: readonly string[];
     hostEvidence?: Readonly<{ stopRevision: number; consumer: string; consumedAt: string }>;
   }>,
-  options: { now?: () => string } = {}
+  options: { now?: () => string; requireHostEvidence?: boolean } = {}
 ): ReceiptResult {
   if (receipt.status !== 'stage-completed') return fail('DELEGATION_STATE_INVALID', `delegation ${receipt.id} is ${receipt.status}, expected stage-completed`);
+  if (receipt.client === 'codex' && options.requireHostEvidence !== false && !event.hostEvidence) {
+    return fail('DELEGATION_HOST_EVIDENCE_REQUIRED', 'Codex sealing requires consumed lifecycle-v2 host evidence');
+  }
   if (event.childId !== receipt.childId || event.exitCode !== 0) return fail('DELEGATION_STOP_INVALID', 'native stop identity or exit status is invalid');
   if (receipt.role === 'reviewer') {
     const taskRoot = `.agents/workspace/active/${receipt.taskId}/`;
@@ -239,10 +381,20 @@ function consumeDelegation(receipt: DelegationReceipt, options: { now?: () => st
 
 export {
   activateDelegation,
+  abortPreparedDelegation,
   completeDelegationStage,
   consumeDelegation,
+  dispatchDelegation,
   managedDelegationRole,
   prepareDelegation,
   sealDelegation
 };
-export type { DelegationHostEvidence, DelegationReceipt, DelegationRole, DelegationStage, DelegationStatus, ReceiptResult };
+export type {
+  DelegationHostEvidence,
+  DelegationLifecycleProvenance,
+  DelegationReceipt,
+  DelegationRole,
+  DelegationStage,
+  DelegationStatus,
+  ReceiptResult
+};

package/lib/task/events.ts

@@ -4,11 +4,16 @@ import { appendActivityEntry, locateActivityLog, pairEntries } from './activity-
 import {
   buildArtifactLinkSection,
   artifactName,
+  inspectArtifactDirectory,
+  parseReviewedInputReference,
+  parseCodePlanInputReference,
   parseArtifactName,
   resolveArtifactContext,
   validateCompletedArtifact
 } from './artifact-lifecycle.ts';
 import type { ArtifactContextResult, ArtifactErrorCode, ArtifactFamily, ArtifactIdentity } from './artifact-lifecycle.ts';
+import { ArtifactReceiptError, sha256File, upsertArtifactReceipt } from './artifact-receipts.ts';
+import type { ArtifactReceipt } from './artifact-receipts.ts';
 import { parseTypedTaskFrontmatter } from './frontmatter.ts';
 import {
   consumeImplementationInput,
@@ -273,6 +278,80 @@ function openStartedIdentity(rows: ReturnType<typeof pairEntries>, family: Event
   return matches.length === 1 ? matches[0] : matches.length > 1 ? { conflict: true as const } : null;
 }
 
+function reviewInputFamily(family: EventFamily): ArtifactFamily {
+  return family === 'review-analysis' ? 'analysis' : family === 'review-plan' ? 'plan' : 'code';
+}
+
+function buildCompletionReceipt(
+  taskDir: string,
+  family: EventFamily,
+  artifact: ArtifactIdentity,
+  completedAt: string,
+  frontmatter: Record<string, unknown>
+): { ok: true; receipt: ArtifactReceipt } | { ok: false; message: string } | null {
+  if (family === 'code') {
+    let content: string;
+    try { content = fs.readFileSync(artifact.path, 'utf8'); }
+    catch (error) { return { ok: false, message: `cannot read ${artifact.name}: ${String(error)}` }; }
+    const input = parseCodePlanInputReference(content);
+    if (!input) return { ok: false, message: `${artifact.name} does not reference a canonical plan artifact` };
+    const startedInput = typeof frontmatter.code_input_artifact === 'string' ? frontmatter.code_input_artifact : '';
+    const startedSha256 = typeof frontmatter.code_input_sha256 === 'string' ? frontmatter.code_input_sha256 : '';
+    if (!startedInput || !startedSha256) return { ok: false, message: 'code.started plan input context is missing' };
+    if (input.name !== startedInput) return { ok: false, message: `${artifact.name} plan input '${input.name}' does not match code.started input '${startedInput}'` };
+    const plan = inspectArtifactDirectory(taskDir, 'plan');
+    if (plan.status !== 'ready' || !plan.latest || plan.latest.name !== input.name) {
+      return { ok: false, message: `code input '${input.name}' is not the latest plan artifact` };
+    }
+    try {
+      const inputSha256 = sha256File(plan.latest.path);
+      if (inputSha256 !== startedSha256) return { ok: false, message: `code input ${input.name} changed after code.started` };
+      return {
+        ok: true,
+        receipt: {
+          event: 'code.completed', output: artifact.name, input: input.name,
+          inputSha256, completedAt
+        }
+      };
+    } catch (error) {
+      return { ok: false, message: `cannot hash code input plan: ${error instanceof Error ? error.message : String(error)}` };
+    }
+  }
+  if (!family.startsWith('review-')) return null;
+  const expectedFamily = reviewInputFamily(family);
+  let content: string;
+  try { content = fs.readFileSync(artifact.path, 'utf8'); }
+  catch (error) { return { ok: false, message: `cannot read ${artifact.name}: ${String(error)}` }; }
+  const input = parseReviewedInputReference(content, expectedFamily);
+  if (!input) return { ok: false, message: `${artifact.name} does not reference a canonical ${expectedFamily} artifact` };
+  const startedInput = typeof frontmatter.review_input_artifact === 'string' ? frontmatter.review_input_artifact : '';
+  const startedSha256 = typeof frontmatter.review_input_sha256 === 'string' ? frontmatter.review_input_sha256 : '';
+  if (!startedInput || !startedSha256) return { ok: false, message: 'review started input context is missing' };
+  if (input.name !== startedInput) return { ok: false, message: `${artifact.name} input '${input.name}' does not match review.started input '${startedInput}'` };
+  const current = inspectArtifactDirectory(taskDir, expectedFamily);
+  if (current.status !== 'ready' || !current.latest || current.latest.name !== input.name) {
+    return { ok: false, message: `review input '${input.name}' is not the latest ${expectedFamily} artifact` };
+  }
+  const event = family === 'review-analysis'
+    ? 'review-analysis.completed' as const
+    : family === 'review-plan' ? 'review-plan.completed' as const : 'review-code.completed' as const;
+  try {
+    const stat = fs.lstatSync(current.latest.path);
+    if (!stat.isFile() || stat.isSymbolicLink()) throw new Error('review input is not a regular file');
+    const inputSha256 = sha256File(current.latest.path);
+    if (inputSha256 !== startedSha256) return { ok: false, message: `review input ${input.name} changed after review.started` };
+    return {
+      ok: true,
+      receipt: {
+        event, output: artifact.name, input: input.name,
+        inputSha256, completedAt
+      }
+    };
+  } catch (error) {
+    return { ok: false, message: `cannot hash review input ${input.name}: ${error instanceof Error ? error.message : String(error)}` };
+  }
+}
+
 function applyTaskEventUnlocked(request: TaskEventRequest, options: TaskEventOptions = {}): TaskEventResult {
   const invalid = validateTaskEventRequest(request);
   if (invalid) return failed(request, invalid);
@@ -371,18 +450,60 @@ function applyTaskEventUnlocked(request: TaskEventRequest, options: TaskEventOpt
   let metadata;
   try { metadata = (options.metadataProvider ?? captureTaskWriteMetadata)(); }
   catch (error) { return failed(normalized, { code: 'METADATA_CAPTURE_FAILED', message: String(error) }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath }); }
+  let completionReceipt: ArtifactReceipt | null = null;
+  if (eventIdentity.phase === 'completed' && completedArtifact) {
+    const receipt = buildCompletionReceipt(resolved.taskDir, eventIdentity.family, completedArtifact, metadata.timestamp, frontmatter);
+    if (receipt && !receipt.ok) {
+      return failed(normalized, { code: 'EVENT_ARTIFACT_CONFLICT', message: receipt.message }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+    }
+    completionReceipt = receipt?.receipt ?? null;
+  }
   const step = eventIdentity.phase === 'started' || eventIdentity.target === null ? currentStep : eventIdentity.target;
   const logStep = eventIdentity.phase === 'started' ? `${eventIdentity.action} [started]` : eventIdentity.action;
   const body = appendActivityEntry(section, { time: metadata.timestamp, step: logStep, agent: normalized.agent, note: eventIdentity.note });
   const frontmatterSet: Record<string, string> = { current_step: step, assigned_to: normalized.agent };
+  let frontmatterRemove: string[] | undefined;
+  if (eventIdentity.phase === 'started' && eventIdentity.family === 'code') {
+    const planInput = artifactContext?.inputs.find((input) => input.family === 'plan');
+    if (!planInput) return failed(normalized, { code: 'EVENT_ARTIFACT_CONFLICT', message: 'code.started plan input context is unavailable' }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: step, action: eventIdentity.action, phase: eventIdentity.phase, artifactContext });
+    try {
+      frontmatterSet.code_input_artifact = planInput.name;
+      frontmatterSet.code_input_sha256 = sha256File(planInput.path);
+    } catch (error) {
+      return failed(normalized, { code: 'EVENT_ARTIFACT_CONFLICT', message: `cannot hash code.started plan input: ${error instanceof Error ? error.message : String(error)}` }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: step, action: eventIdentity.action, phase: eventIdentity.phase, artifactContext });
+    }
+  } else if (eventIdentity.phase === 'completed' && eventIdentity.family === 'code') {
+    frontmatterRemove = ['code_input_artifact', 'code_input_sha256'];
+  } else if (eventIdentity.phase === 'started' && eventIdentity.family.startsWith('review-')) {
+    const expectedFamily = reviewInputFamily(eventIdentity.family);
+    const input = artifactContext?.inputs.find((candidate) => candidate.family === expectedFamily);
+    if (!input) return failed(normalized, { code: 'EVENT_ARTIFACT_CONFLICT', message: `review.started ${expectedFamily} input context is unavailable` }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: step, action: eventIdentity.action, phase: eventIdentity.phase, artifactContext });
+    try {
+      frontmatterSet.review_input_artifact = input.name;
+      frontmatterSet.review_input_sha256 = sha256File(input.path);
+    } catch (error) {
+      return failed(normalized, { code: 'EVENT_ARTIFACT_CONFLICT', message: `cannot hash review.started input: ${error instanceof Error ? error.message : String(error)}` }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: step, action: eventIdentity.action, phase: eventIdentity.phase, artifactContext });
+    }
+  } else if (eventIdentity.phase === 'completed' && eventIdentity.family.startsWith('review-')) {
+    frontmatterRemove = ['review_input_artifact', 'review_input_sha256'];
+  }
   if (eventIdentity.phase === 'started' && normalized.implementationInput) frontmatterSet.last_reviewed_commit = '';
   const mutations: Parameters<typeof writeTask>[0]['mutations'][number][] = [
-    { kind: 'frontmatter', set: frontmatterSet }
+    { kind: 'frontmatter', set: frontmatterSet, remove: frontmatterRemove }
   ];
   if (completedArtifact) {
     const link = buildArtifactLinkSection(content, completedArtifact);
     mutations.push({ kind: 'section', aliases: link.aliases, heading: link.heading, body: link.body });
   }
+  if (completionReceipt) {
+    try {
+      const receiptSection = upsertArtifactReceipt(content, completionReceipt);
+      mutations.push({ kind: 'section', aliases: receiptSection.aliases, heading: receiptSection.heading, body: receiptSection.body });
+    } catch (error) {
+      const message = error instanceof ArtifactReceiptError ? error.message : String(error);
+      return failed(normalized, { code: 'EVENT_ARTIFACT_CONFLICT', message }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
+    }
+  }
   if (eventIdentity.phase === 'completed' && normalized.implementationInput) {
     let implementationRows;
     try {

package/lib/task/ledger.ts

@@ -61,7 +61,22 @@ function validateLedgerRows(rows: readonly LedgerRow[]): LedgerValidationError |
   for (const row of rows) {
     if (seen.has(row.id)) return { code: 'LEDGER_DUPLICATE_ID', message: `duplicate ledger id '${row.id}'` };
     seen.add(row.id);
-    if (/^PRC-[1-9]\d*$/.test(row.id)) continue;
+    if (/^PRC-[1-9]\d*$/.test(row.id)) {
+      if (
+        row.stage !== 'post-review-commit' ||
+        row.round !== '-' ||
+        row.severity !== '-' ||
+        row.status !== 'human-decided' ||
+        row.evidence === '' ||
+        /[\r\n]/.test(row.evidence)
+      ) {
+        return { code: 'LEDGER_DOCUMENT_INVALID', message: `post-review exemption row '${row.id}' is invalid` };
+      }
+      continue;
+    }
+    if (row.stage === 'post-review-commit') {
+      return { code: 'LEDGER_DOCUMENT_INVALID', message: `post-review exemption row '${row.id}' must use a PRC id` };
+    }
     if (!/^(AN|PL|CD|HD)-[1-9]\d*$/.test(row.id)) return { code: 'LEDGER_ID_INVALID', message: `ledger id '${row.id}' is invalid` };
     if (!['analysis', 'plan', 'code', 'post-review-commit'].includes(row.stage)) return { code: 'LEDGER_STAGE_INVALID', message: `ledger stage '${row.stage}' is invalid` };
     if (!FINDING_STATUSES.has(row.status)) return { code: 'LEDGER_STATUS_INVALID', message: `ledger status '${row.status}' is invalid` };