@fitlab-ai/agent-infra 0.9.7 → 0.9.9

package/dist/lib/task/review-finalization.js

@@ -8,6 +8,7 @@ import { finalizeReviewSummaryContent } from './review-artifacts.js';
 import { resolveTaskRef } from './resolve-ref.js';
 import { validateLifecycleExecution } from './lifecycle-execution.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.js';
+import { allowsManualOverride } from './guard-override.js';
 const STAGES = {
     analysis: { family: 'review-analysis', action: 'Review Analysis' },
     plan: { family: 'review-plan', action: 'Review Plan' },
@@ -60,7 +61,7 @@ function finalizeReviewSummaryUnlocked(request, options = {}) {
     const resolved = resolveTaskRef(request.taskRef, { repoRoot: options.repoRoot });
     if (!resolved.ok)
         return failed(request, resolved.code, resolved.message, resolved.taskId);
-    if (resolved.state !== 'active') {
+    if (resolved.state !== 'active' && !allowsManualOverride(options.manualOverride, 'review-finalization', 'TASK_STATE_MISMATCH')) {
         return failed(request, 'TASK_STATE_MISMATCH', `task ${resolved.taskId} is ${resolved.state}, expected active`, resolved.taskId);
     }
     const parsedArtifact = parseArtifactName(request.artifact);
@@ -168,7 +169,7 @@ function finalizeReviewSummaryUnlocked(request, options = {}) {
     };
 }
 function finalizeReviewSummary(request, options = {}) {
-    if (request.dryRun)
+    if (request.dryRun || options.lockAlreadyHeld)
         return finalizeReviewSummaryUnlocked(request, options);
     const resolved = resolveTaskRef(request.taskRef, { repoRoot: options.repoRoot });
     if (!resolved.ok)

package/dist/lib/task/short-id.js

@@ -343,6 +343,64 @@ function loadShortIdByTaskId(repoRoot) {
     }
     return map;
 }
+function inspectShortIdRegistry(repoRoot) {
+    const registryPath = path.join(repoRoot, '.agents', 'workspace', 'active', REGISTRY_NAME);
+    if (!fs.existsSync(registryPath)) {
+        return {
+            status: 'missing',
+            error: {
+                code: 'SHORT_ID_REGISTRY_NOT_FOUND',
+                message: 'canonical short-id registry is missing'
+            }
+        };
+    }
+    let raw;
+    try {
+        raw = fs.readFileSync(registryPath, 'utf8');
+    }
+    catch {
+        return {
+            status: 'invalid',
+            error: {
+                code: 'SHORT_ID_REGISTRY_READ_FAILED',
+                message: 'canonical short-id registry is unreadable'
+            }
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return {
+            status: 'invalid',
+            error: {
+                code: 'SHORT_ID_REGISTRY_INVALID_JSON',
+                message: 'canonical short-id registry contains invalid JSON'
+            }
+        };
+    }
+    try {
+        const registry = validateRegistry(parsed, registryPath, configuredShortIdLength(repoRoot));
+        const shortIds = new Map();
+        for (const [key, taskId] of Object.entries(registry.ids))
+            shortIds.set(taskId, key);
+        return { status: 'valid', shortIds };
+    }
+    catch (error) {
+        return {
+            status: 'invalid',
+            error: {
+                code: typeof error.code === 'string'
+                    ? error.code
+                    : 'SHORT_ID_REGISTRY_INVALID_SCHEMA',
+                message: error.code === 'SHORT_ID_REGISTRY_DUPLICATE_TASK'
+                    ? 'canonical short-id registry contains duplicate task entries'
+                    : 'canonical short-id registry has invalid schema'
+            }
+        };
+    }
+}
 /**
  * Resolve a branch to its active-task short id (`NN`), or `null` when no
  * active task is bound to that branch.
@@ -371,5 +429,5 @@ function lookupShortIdByBranch(branch, repoRoot, _opts) {
     }
     return matches[0];
 }
-export { normalizeShortIdInput, isRemovedHashShortIdInput, resolveShortIdReadOnly, lookupShortIdByBranch, loadShortIdByTaskId, configuredShortIdLength, mutateShortIdRegistry, executeShortIdCommand };
+export { normalizeShortIdInput, isRemovedHashShortIdInput, resolveShortIdReadOnly, lookupShortIdByBranch, loadShortIdByTaskId, inspectShortIdRegistry, configuredShortIdLength, mutateShortIdRegistry, executeShortIdCommand };
 //# sourceMappingURL=short-id.js.map

package/dist/lib/task/task-execution-lock.js

@@ -207,6 +207,8 @@ function withTaskExecutionLock(repoRoot, taskId, ownerName, callback, options =
     catch (error) {
         if (error instanceof TaskExecutionLockError)
             throw error;
+        if (error instanceof Error && error.name === 'OrchestrationStateError')
+            throw error;
         throw new TaskExecutionLockError('ORCHESTRATION_LOCK_FAILED', 'lifecycle task lock operation failed', { operation: ownsFixed ? 'callback' : 'acquire', errno: errno(error), key });
     }
     finally {
@@ -228,5 +230,8 @@ function withTaskExecutionLock(repoRoot, taskId, ownerName, callback, options =
         }
     }
 }
-export { TaskExecutionLockError, lockKey, mapLinkError, withTaskExecutionLock };
+function withRepositoryMutationLock(repoRoot, callback, options = {}) {
+    return withTaskExecutionLock(repoRoot, '__repository_mutation__', 'repository-mutation', callback, options);
+}
+export { TaskExecutionLockError, lockKey, mapLinkError, withRepositoryMutationLock, withTaskExecutionLock };
 //# sourceMappingURL=task-execution-lock.js.map

package/dist/lib/task/verification-engine.js

@@ -16,6 +16,7 @@ import { parseLedger, summarizeLedgerStage, validateLedgerRows } from "./ledger.
 import { equalCounts, parseReviewSummary } from "./review-artifacts.js";
 import { loadVerificationConfig } from "./verification-config.js";
 import { snapshotReview } from "../git/review-snapshot.js";
+import { OrchestrationStateError, readRun } from "./orchestration.js";
 const TASK_ENUMS = {
     type: ["feature", "bugfix", "refactor", "docs", "chore"],
     workflow: ["feature-development", "bug-fix", "refactoring"],
@@ -104,6 +105,8 @@ function runCheck(type, context, shared) {
             return checkReviewFact(context);
         case "post-review-commit":
             return checkPostReviewCommit(context);
+        case "required-pr-delivery":
+            return checkRequiredPrDelivery(context);
         case "orchestration-state":
             return checkOrchestrationState(context);
         case "orchestration-evidence":
@@ -120,22 +123,6 @@ function runCheck(type, context, shared) {
         }
     }
 }
-function isFailClosedLegacyPause(run) {
-    if (run.schemaVersion !== 1
-        || run.status !== 'paused'
-        || run.pause?.recoverable !== false
-        || !exactText(run.pause?.message)
-        || !Array.isArray(run.receipts)) {
-        return false;
-    }
-    if (run.pause.code === 'ORCHESTRATION_HISTORICAL_EFFORT_UNVERIFIED') {
-        return run.receipts.length > 0 && run.pendingDelegation === null;
-    }
-    if (run.pause.code === 'ORCHESTRATION_DELEGATION_BUSY') {
-        return run.pendingDelegation != null && run.pendingDelegation.status !== 'sealed';
-    }
-    return false;
-}
 function checkOrchestrationState({ taskDir }) {
     const file = path.join(taskDir, 'orchestration.json');
     const stat = safeStat(file);
@@ -143,16 +130,14 @@ function checkOrchestrationState({ taskDir }) {
         return failResult('orchestration-state', 'orchestration.json is missing');
     let run;
     try {
-        run = JSON.parse(fs.readFileSync(file, 'utf8'));
+        run = readRun(taskDir);
     }
     catch (error) {
-        return failResult('orchestration-state', `Invalid orchestration.json: ${String(error)}`);
-    }
-    if (isFailClosedLegacyPause(run)) {
-        return passResult('orchestration-state', 'Legacy orchestration run is safely paused');
+        const message = error instanceof OrchestrationStateError ? error.message : String(error);
+        return failResult('orchestration-state', `Invalid orchestration.json: ${message}`);
     }
-    if (![2, 3].includes(run.schemaVersion) || !['paused', 'completed'].includes(run.status)) {
-        return failResult('orchestration-state', `Expected paused or completed run, received '${run.status}'`);
+    if (!run || !['paused', 'completed'].includes(run.status)) {
+        return failResult('orchestration-state', `Expected paused or completed run, received '${run?.status ?? 'missing'}'`);
     }
     if (run.status === 'paused' && (!run.pause?.code || !run.pause?.message)) {
         return failResult('orchestration-state', 'Paused run requires a stable pause code and message');
@@ -215,13 +200,11 @@ function checkOrchestrationEvidence({ taskDir }) {
         return failResult('orchestration-evidence', 'orchestration.json is missing');
     let run;
     try {
-        run = JSON.parse(fs.readFileSync(file, 'utf8'));
+        run = readRun(taskDir);
     }
     catch (error) {
-        return failResult('orchestration-evidence', `Invalid orchestration.json: ${String(error)}`);
-    }
-    if (isFailClosedLegacyPause(run)) {
-        return passResult('orchestration-evidence', 'Legacy orchestration evidence is preserved in a fail-closed pause');
+        const message = error instanceof OrchestrationStateError ? error.message : String(error);
+        return failResult('orchestration-evidence', `Invalid orchestration.json: ${message}`);
     }
     const policy = run.modelPolicy;
     if (!policy
@@ -239,18 +222,11 @@ function checkOrchestrationEvidence({ taskDir }) {
         return failResult('orchestration-evidence', 'Run model policy source or recovery history is invalid');
     }
     for (const recovery of run.recoveryHistory) {
-        const validModelRecovery = recovery.code === 'MODEL_POLICY_SUPPLEMENTED'
-            && recovery.previousSchemaVersion === 1
-            && recovery.receiptCount === 0
-            && recovery.pendingDelegation === false
-            && exactText(recovery.recoveredAt)
-            && recovery.policySource;
         const guards = recovery.guards;
-        const validCapabilityRecovery = recovery.code === 'CLIENT_CAPABILITY_ENABLED'
-            && recovery.previousSchemaVersion === 2
+        const validClaudeCodeRecovery = recovery.code === 'CLIENT_CAPABILITY_ENABLED'
             && recovery.previousStatus === 'paused'
             && recovery.previousPause?.code === 'ORCHESTRATION_CLIENT_UNSUPPORTED'
-            && recovery.client === 'codex'
+            && recovery.client === 'claude-code'
             && recovery.resultingStatus === 'running'
             && exactText(recovery.recoveredAt)
             && guards?.stepCount === 0
@@ -259,9 +235,8 @@ function checkOrchestrationEvidence({ taskDir }) {
             && guards?.receiptCount === 0
             && guards?.pendingDelegation === false
             && guards?.commitAuthorizationUnused === true
-            && guards?.completionEvidenceAbsent === true
-            && guards?.commitIntentAbsent === true;
-        if (!validModelRecovery && !validCapabilityRecovery) {
+            && guards?.completionEvidenceAbsent === true;
+        if (!validClaudeCodeRecovery) {
             return failResult('orchestration-evidence', 'Run recovery history contains invalid provenance');
         }
     }
@@ -292,35 +267,69 @@ function checkOrchestrationEvidence({ taskDir }) {
         }
         const activated = ['activated', 'stage-completed', 'sealed', 'consumed'].includes(receipt.status);
         if (activated) {
-            if (!exactText(receipt.actualModel)) {
-                return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has no host-observed actual model`);
+            const isClaudeCode = receipt.client === 'claude-code';
+            if (!isClaudeCode) {
+                if (!exactText(receipt.actualModel)) {
+                    return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has no host-observed actual model`);
+                }
+                if (!exactText(receipt.actualReasoningEffort)) {
+                    return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has no host-observed actual reasoning effort`);
+                }
             }
-            if (!exactText(receipt.actualReasoningEffort)) {
-                return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has no host-observed actual reasoning effort`);
+            // parentId/childId 校验对所有 client 保持统一（不新增分支）；spawnMode 检查按 client 判断
+            if (!exactText(receipt.parentId) || !exactText(receipt.childId) || receipt.parentId === receipt.childId) {
+                return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has invalid delegation identity`);
             }
-            if (!exactText(receipt.parentId) || !exactText(receipt.childId) || receipt.parentId === receipt.childId || receipt.spawnMode !== 'fresh') {
+            if (!isClaudeCode && receipt.spawnMode !== 'fresh') {
                 return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has invalid fresh delegation identity`);
             }
-            if (receipt.actualModel !== receipt.requestedModel && !exactText(receipt.modelFallbackReason)) {
-                return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' model fallback is not justified`);
+            if (receipt.actualModel != null && receipt.actualModel !== receipt.requestedModel) {
+                if (!isClaudeCode && !exactText(receipt.modelFallbackReason)) {
+                    return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' model fallback is not justified`);
+                }
             }
-            if (receipt.actualModel === receipt.requestedModel && receipt.modelFallbackReason !== null) {
+            if ((receipt.actualModel == null || receipt.actualModel === receipt.requestedModel)
+                && receipt.modelFallbackReason !== null) {
                 return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has an unrelated model fallback reason`);
             }
-            if (receipt.actualReasoningEffort !== receipt.requestedReasoningEffort
-                && !exactText(receipt.reasoningEffortFallbackReason)) {
-                return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' reasoning-effort fallback is not justified`);
+            if (receipt.actualReasoningEffort != null && receipt.actualReasoningEffort !== receipt.requestedReasoningEffort) {
+                if (!isClaudeCode && !exactText(receipt.reasoningEffortFallbackReason)) {
+                    return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' reasoning-effort fallback is not justified`);
+                }
             }
-            if (receipt.actualReasoningEffort === receipt.requestedReasoningEffort
+            if ((receipt.actualReasoningEffort == null || receipt.actualReasoningEffort === receipt.requestedReasoningEffort)
                 && receipt.reasoningEffortFallbackReason !== null) {
                 return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has an unrelated reasoning-effort fallback reason`);
             }
             if (receipt.client === 'codex') {
+                const activatedCodex = ['activated', 'stage-completed', 'sealed', 'consumed'].includes(receipt.status);
                 const host = receipt.hostEvidence;
-                if (host?.kind !== 'codex-lifecycle-v1'
-                    || !exactText(host.hookDefinitionHash)
-                    || !Number.isSafeInteger(host.startRevision)
-                    || host.startRevision < 1) {
+                const provenance = receipt.lifecycleProvenance;
+                if (!provenance
+                    || (activatedCodex && (host?.kind !== 'codex-lifecycle-v2'
+                        || host.protocolVersion !== provenance.protocolVersion
+                        || host.packageVersion !== provenance.packageVersion
+                        || host.internalExecutableBuildHash !== provenance.internalExecutableBuildHash
+                        || host.lifecycleContractHash !== provenance.lifecycleContractHash
+                        || host.hookDefinitionHash !== provenance.hookDefinitionHash
+                        || host.hookSource !== provenance.hookSource
+                        || host.hookSourcePathDigest !== provenance.hookSourcePathDigest
+                        || host.hookSourceHash !== provenance.hookSourceHash
+                        || host.capabilitySessionId !== provenance.capabilitySessionId
+                        || receipt.parentId !== provenance.capabilitySessionId
+                        || host.capabilityTurnId !== provenance.capabilityTurnId
+                        || host.controllerInstanceDigest !== provenance.controllerInstanceDigest
+                        || host.controlGeneration !== provenance.controlGeneration
+                        || host.spawnToolUseId === provenance.capabilityToolUseId
+                        || !exactText(host.spawnToolUseId)
+                        || !Number.isFinite(Date.parse(host.spawnObservedAt ?? ''))
+                        || !Number.isFinite(Date.parse(receipt.spawnDispatchedAt ?? ''))
+                        || !Number.isFinite(Date.parse(receipt.activationDeadlineAt ?? ''))
+                        || Date.parse(host.spawnObservedAt ?? '') < Date.parse(receipt.spawnDispatchedAt ?? '')
+                        || Date.parse(host.spawnObservedAt ?? '') > Date.parse(receipt.activationDeadlineAt ?? '')
+                        || !exactText(host.hookDefinitionHash)
+                        || !Number.isSafeInteger(host.startRevision)
+                        || host.startRevision < 1))) {
                     return failResult('orchestration-evidence', `Receipt '${receipt.id ?? '(unknown)'}' has invalid Codex start evidence`);
                 }
                 if (['sealed', 'consumed'].includes(receipt.status) && (!Number.isSafeInteger(host.stopRevision)
@@ -412,6 +421,60 @@ function checkTaskMeta({ taskDir, config }) {
     const warningSuffix = warnings.length > 0 ? `; warnings: ${warnings.join("; ")}` : "";
     return passResult("task-meta", `Task metadata valid (${requiredFields.length} required fields checked${warningSuffix})`, warnings);
 }
+function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }) {
+    const task = loadTask(taskDir);
+    if (!task.ok)
+        return failResult('required-pr-delivery', task.message);
+    let projectConfig = {};
+    try {
+        const file = path.join(repositoryRoot, '.agents', '.airc.json');
+        if (safeStat(file)?.isFile())
+            projectConfig = JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        return failResult('required-pr-delivery', 'Project configuration is invalid');
+    }
+    const flow = projectConfig.prFlow;
+    const status = String(task.metadata.pr_status || 'pending');
+    const prNumber = parsePrNumber(task.metadata.pr_number);
+    if (flow === 'disabled')
+        return passResult('required-pr-delivery', 'Pull request delivery is disabled by project policy');
+    if (flow === 'required' && (status !== 'created' || prNumber === null)) {
+        return failResult('required-pr-delivery', 'Project policy requires a bound pull request before completion');
+    }
+    if (flow !== 'required' && status === 'pending') {
+        return failResult('required-pr-delivery', 'Pull request delivery is pending; create a PR or explicitly skip it');
+    }
+    if (status === 'created' && prNumber === null) {
+        return failResult('required-pr-delivery', 'Task claims a created pull request without a valid pr_number');
+    }
+    if (flow === 'required') {
+        if (mode === 'gate') {
+            return passResult('required-pr-delivery', 'Bound pull request shape is valid; merged-state inspection is reserved for hard preflight');
+        }
+        const inspected = inspectPlatformPullRequest(task.metadata.id, { cwd: repositoryRoot });
+        if (inspected.status === 'blocked') {
+            return blockedResult('required-pr-delivery', inspected.error?.message || 'Unable to inspect the required pull request', inspected.error?.code || 'PR_INSPECTION_BLOCKED');
+        }
+        const pullRequest = inspected.pullRequest;
+        const repository = inspected.platform.repository?.toLowerCase() || '';
+        const taskBranch = String(task.metadata.branch || '').trim();
+        if (inspected.status !== 'no-op' || !pullRequest || pullRequest.number !== prNumber) {
+            return failResult('required-pr-delivery', 'Bound pull request identity could not be verified');
+        }
+        if (!repository
+            || pullRequest.repository.toLowerCase() !== repository
+            || pullRequest.base.repository.toLowerCase() !== repository
+            || (taskBranch && pullRequest.head.ref !== taskBranch)) {
+            return failResult('required-pr-delivery', 'Bound pull request identity does not match the task');
+        }
+        if (pullRequest.state !== 'closed' || !pullRequest.mergedAt || !pullRequest.mergeCommitSha) {
+            return failResult('required-pr-delivery', 'Project policy requires the bound pull request to be merged');
+        }
+        return passResult('required-pr-delivery', `Pull request delivery policy satisfied (merged PR #${prNumber})`);
+    }
+    return passResult('required-pr-delivery', `Pull request delivery policy satisfied (${status})`);
+}
 function validateTaskBranch(metadata) {
     if (isBlank(metadata.branch)) {
         return null;
@@ -774,7 +837,7 @@ function checkReviewLedger({ taskDir, config }) {
         return passResult("review-ledger", "Disagreement ledger has no entries");
     }
     const stageScope = Array.isArray(config.stage_scope) ? config.stage_scope : null;
-    const maxRounds = Number(resolveReviewSetting(config, "max_handshake_rounds", DEFAULT_MAX_HANDSHAKE_ROUNDS));
+    const maxRounds = Number(resolveReviewSetting(config, "maxHandshakeRounds", DEFAULT_MAX_HANDSHAKE_ROUNDS));
     const problems = [];
     let inScopeCount = 0;
     for (const cells of rows) {
@@ -1311,7 +1374,14 @@ function verifyInProcess({ mode, skillName, taskDir, artifactFile, checks: reque
         for (const [type, checkConfig] of Object.entries(verifyConfig.checks || {})) {
             if (checkConfig === null)
                 continue;
-            const result = runCheck(type, { skillName, taskDir: path.resolve(taskDir), artifactFile, config: checkConfig }, shared);
+            const result = runCheck(type, {
+                mode,
+                skillName,
+                taskDir: path.resolve(taskDir),
+                artifactFile,
+                repositoryRoot: repoRoot,
+                config: checkConfig
+            }, shared);
             checks.push(result);
             if (result.status === "blocked")
                 break;
@@ -1325,7 +1395,16 @@ function verifyInProcess({ mode, skillName, taskDir, artifactFile, checks: reque
         return { skill: skillName, ...failResult(type, `Unknown check type '${type}' for skill '${skillName}'.`) };
     if (config === null)
         return { skill: skillName, ...passResult(type, `Check '${type}' is disabled for skill '${skillName}'.`) };
-    return { skill: skillName, ...runCheck(type, { skillName, taskDir: path.resolve(taskDir), artifactFile, config }, shared) };
+    return {
+        skill: skillName,
+        ...runCheck(type, {
+            skillName,
+            taskDir: path.resolve(taskDir),
+            artifactFile,
+            repositoryRoot: repoRoot,
+            config
+        }, shared)
+    };
 }
 export { verifyInProcess };
 //# sourceMappingURL=verification-engine.js.map

package/dist/lib/task/verification.js

@@ -4,6 +4,7 @@ import path from 'node:path';
 import { verifyInProcess } from './verification-engine.js';
 import { parseArtifactName } from './artifact-lifecycle.js';
 import { resolveTaskRef } from './resolve-ref.js';
+import { allowsManualOverride } from './guard-override.js';
 const gate = (skill, expectedState, artifactFamily) => ({
     skill, expectedState, mode: 'gate', ...(artifactFamily ? { artifactFamily } : {})
 });
@@ -20,7 +21,8 @@ const VERIFICATION_CATALOG = {
     'block-task.completed': gate('block-task', 'blocked'),
     'cancel-task.completed': gate('cancel-task', 'completed'),
     'commit.completed': gate('commit', 'active'),
-    'complete-task.preflight': { skill: 'complete-task', expectedState: 'active', mode: 'checks', checks: ['review-ledger', 'manual-validation', 'post-review-commit', 'platform-sync-preflight'] },
+    'complete-task.preflight': { skill: 'complete-task', expectedState: 'active', mode: 'checks', checks: ['required-pr-delivery'] },
+    'complete-task.hard-preflight': { skill: 'complete-task', expectedState: 'active', mode: 'checks', checks: ['required-pr-delivery'] },
     'complete-task.completed': gate('complete-task', 'completed'),
     'create-pr.completed': gate('create-pr', 'active'),
     'create-task.completed': gate('create-task', 'active'),
@@ -47,7 +49,7 @@ function verifyTaskEvent(request, options = {}) {
     if (!resolved.ok)
         return failure(request, resolved.code, resolved.message, { taskId: resolved.taskId, skill: spec.skill, mode: spec.mode });
     const identity = { taskId: resolved.taskId, taskDir: resolved.taskDir, taskState: resolved.state, skill: spec.skill, mode: spec.mode };
-    if (resolved.state !== spec.expectedState) {
+    if (resolved.state !== spec.expectedState && !allowsManualOverride(options.manualOverride, 'task-verify', 'VERIFY_TASK_STATE_MISMATCH')) {
         return failure(request, 'VERIFY_TASK_STATE_MISMATCH', `event '${request.event}' requires workspace '${spec.expectedState}', received '${resolved.state}'`, identity);
     }
     if (spec.artifactFamily) {
@@ -66,12 +68,23 @@ function verifyTaskEvent(request, options = {}) {
     if (spec.mode === 'gate') {
         const payload = engine({ mode: 'gate', skillName: spec.skill, taskDir: resolved.taskDir, artifactFile: request.artifact, checks: [], repositoryRoot: resolved.repoRoot });
         const status = payload.gate;
+        if (status !== 'pass' && allowsManualOverride(options.manualOverride, 'verification-engine', status === 'blocked' ? 'CHECK_BLOCKED' : 'CHECK_FAILED')) {
+            invocations.push({ status: 'pass', exitCode: 0, payload: { ...payload, gate: 'pass', humanOverride: 'human-approved', originalGate: status } });
+            return {
+                status: 'pass', changed: false, event: request.event, requestRef: request.taskRef,
+                ...identity, artifact: request.artifact ?? null, invocations, error: null
+            };
+        }
         invocations.push({ status, exitCode: { pass: 0, fail: 1, blocked: 2 }[status], payload });
     }
     else {
         for (const check of spec.checks ?? []) {
             const payload = engine({ mode: 'checks', skillName: spec.skill, taskDir: resolved.taskDir, artifactFile: request.artifact, checks: [check], repositoryRoot: resolved.repoRoot });
             const status = payload.status;
+            if (status !== 'pass' && allowsManualOverride(options.manualOverride, 'verification-engine', status === 'blocked' ? 'CHECK_BLOCKED' : 'CHECK_FAILED')) {
+                invocations.push({ status: 'pass', exitCode: 0, payload: { ...payload, status: 'pass', humanOverride: 'human-approved', originalStatus: status } });
+                break;
+            }
             invocations.push({ status, exitCode: { pass: 0, fail: 1, blocked: 2 }[status], payload });
             if (status !== 'pass')
                 break;

package/dist/lib/task/workflow-warning-intents.js

@@ -2,6 +2,8 @@ import fs from 'node:fs';
 import { resolveTaskRef } from './resolve-ref.js';
 import { WORKFLOW_WARNING_COLUMNS, WORKFLOW_WARNING_HEADINGS, WORKFLOW_WARNING_SEVERITIES, WORKFLOW_WARNING_STATUSES, parseWorkflowWarnings } from './workflow-warnings.js';
 import { captureTaskWriteMetadata, writeTask } from './write.js';
+import { allowsManualOverride } from './guard-override.js';
+import { retryHintForWarning } from './operation-outcome.js';
 function failed(intent, code, message, taskId = null, entityId = null) {
     return { status: 'failed', changed: false, intent: intent.kind, taskId, entityId, before: null, after: null, warnings: [], operations: [], error: { code, message } };
 }
@@ -54,7 +56,8 @@ function applyWorkflowWarningIntent(intent, options = {}) {
     const resolved = resolveTaskRef(intent.taskRef, { repoRoot: options.repoRoot });
     if (!resolved.ok)
         return failed(intent, resolved.code, resolved.message, resolved.taskId);
-    if (resolved.state !== 'active')
+    const stateOverride = allowsManualOverride(options.manualOverride, 'workflow-warning', 'TASK_STATE_MISMATCH');
+    if (resolved.state !== 'active' && !stateOverride)
         return failed(intent, 'TASK_STATE_MISMATCH', `task ${resolved.taskId} is ${resolved.state}, expected active`, resolved.taskId);
     let content;
     let rows;
@@ -114,7 +117,7 @@ function applyWorkflowWarningIntent(intent, options = {}) {
             after = { ...before, status: intent.status, resolvedAt: metadata.timestamp, resolution };
     }
     const writeResult = writeTask({
-        taskRef: intent.taskRef, expectedState: 'active', mutations: [...sectionMutation(content), rowMutation(after)], dryRun: intent.dryRun
+        taskRef: intent.taskRef, expectedState: stateOverride ? resolved.state : 'active', mutations: [...sectionMutation(content), rowMutation(after)], dryRun: intent.dryRun
     }, {
         ...options,
         taskLocation: { repoRoot: resolved.repoRoot, taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, state: resolved.state },
@@ -127,5 +130,53 @@ function applyWorkflowWarningIntent(intent, options = {}) {
         entityId: after.id, before, after, warnings: [], operations: writeResult.operations, error: null
     };
 }
-export { applyWorkflowWarningIntent };
+function projectFinalizationWarning(taskRef, warning, options = {}) {
+    const resolved = resolveTaskRef(taskRef, { repoRoot: options.repoRoot });
+    if (!resolved.ok)
+        return { status: 'failed', changed: false, error: { code: resolved.code, message: resolved.message } };
+    if (resolved.state !== 'completed')
+        return { status: 'failed', changed: false, error: { code: 'TASK_STATE_MISMATCH', message: `task ${resolved.taskId} is ${resolved.state}, expected completed` } };
+    let content;
+    let rows;
+    try {
+        content = fs.readFileSync(resolved.taskMdPath, 'utf8');
+        rows = parseWorkflowWarnings(content);
+    }
+    catch (error) {
+        return { status: 'failed', changed: false, error: { code: 'WARNING_DOCUMENT_INVALID', message: error instanceof Error ? error.message : String(error) } };
+    }
+    const metadata = (options.metadataProvider ?? captureTaskWriteMetadata)();
+    const existing = rows.find((row) => row.step === warning.step && row.code === warning.code && row.target === warning.target);
+    const after = existing
+        ? {
+            ...existing,
+            severity: warning.severity,
+            status: warning.status,
+            message: warning.message,
+            action: retryHintForWarning(warning),
+            resolvedAt: warning.resolvedAt || (warning.status === 'resolved' ? metadata.timestamp : ''),
+            resolution: warning.status === 'resolved' ? 'Resolved by a successful finalization retry' : ''
+        }
+        : {
+            id: nextWarningId(rows), time: metadata.timestamp, step: warning.step,
+            severity: warning.severity, code: warning.code, status: warning.status,
+            target: warning.target, message: warning.message, action: retryHintForWarning(warning),
+            resolvedAt: warning.resolvedAt || '', resolution: warning.status === 'resolved' ? 'Resolved by a successful finalization retry' : ''
+        };
+    if (existing && JSON.stringify(existing) === JSON.stringify(after))
+        return { status: 'no-op', changed: false, error: null };
+    const written = writeTask({
+        taskRef: resolved.taskId,
+        expectedState: 'completed',
+        mutations: [...sectionMutation(content), rowMutation(after)]
+    }, {
+        ...options,
+        taskLocation: { repoRoot: resolved.repoRoot, taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, state: 'completed' },
+        metadataProvider: () => metadata
+    });
+    if (written.status === 'failed')
+        return { status: 'failed', changed: false, error: { code: written.error.code, message: written.error.message } };
+    return { status: written.status === 'applied' ? 'applied' : 'no-op', changed: written.changed, error: null };
+}
+export { applyWorkflowWarningIntent, projectFinalizationWarning };
 //# sourceMappingURL=workflow-warning-intents.js.map

package/dist/lib/task/write.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { VERSION } from '../version.js';
 import { parseTypedTaskFrontmatter, updateTaskFrontmatter } from './frontmatter.js';
 import { resolveTaskRef } from './resolve-ref.js';
+import { allowsManualOverride } from './guard-override.js';
 import { mutateTableRow, upsertSection } from './sections.js';
 const DEFAULT_FILE_SYSTEM = {
     readFileSync: (file) => fs.readFileSync(file, 'utf8'),
@@ -70,7 +71,7 @@ function writeTask(request, options = {}) {
         taskMdPath: resolved.taskMdPath,
         actualState: resolved.state
     };
-    if (resolved.state !== request.expectedState) {
+    if (resolved.state !== request.expectedState && !allowsManualOverride(options.manualOverride, 'task.write', 'TASK_STATE_MISMATCH')) {
         return failure(request, identity, 'TASK_STATE_MISMATCH', `task ${resolved.taskId} is ${resolved.state}, expected ${request.expectedState}`);
     }
     const io = { ...DEFAULT_FILE_SYSTEM, ...options.fileSystem };

package/dist/lifecycle-build-manifest.json

@@ -1,6 +1,6 @@
 {
   "protocolVersion": 3,
-  "packageVersion": "0.9.7",
-  "sourceInputHash": "ee12d1ec7a586eeaba04deb4253ccd7f5d16552915ca141e493248c0728459a9",
-  "internalExecutableBuildHash": "0eceb914e6c1cb9937b86d34bfbf933d1010f499b9976813556146d2e6fa0132"
+  "packageVersion": "0.9.9",
+  "sourceInputHash": "2f2db695db557531b3139eccd1bd530fbeb7b99409e2d49338f3b4646aac9ef6",
+  "internalExecutableBuildHash": "1391ebe2614f3071e7a60920325046a47f1473e7fb23c821327072f947f639d3"
 }

package/lib/agent-clients/adapters/claude-code.ts

@@ -16,7 +16,7 @@ const claudeCodeAdapter = defineAgentClientAdapter({
     commands: { level: 'integrated' },
     hooks: { level: 'integrated' },
     subagents: { level: 'experimental' },
-    orchestration: { level: 'unsupported' },
+    orchestration: { level: 'experimental' },
     sandbox: { level: 'integrated' },
     verification: { level: 'compatible' }
   },
@@ -26,8 +26,8 @@ const claudeCodeAdapter = defineAgentClientAdapter({
     guidance: 'Use the host model picker for the complete model and reasoning-effort catalog.'
   },
   delegationEvidence: {
-    actualModel: 'unavailable',
-    actualReasoningEffort: 'unavailable'
+    actualModel: 'host-event',
+    actualReasoningEffort: 'spawn-ack'
   },
   project: {
     ownedPathPrefixes: ['.claude/'],