@fitlab-ai/agent-infra 0.9.9 → 0.9.10

package/dist/lib/{task/commands/validate.js → internal/task-validate.js}

@@ -3,19 +3,19 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
-import { loadConfig } from '../../sandbox/config.js';
-import { detectEngine } from '../../sandbox/engine.js';
-import { runEngine } from '../../sandbox/shell.js';
-import { sandboxBranchLabel, sandboxLabel } from '../../sandbox/constants.js';
-import { fetchSandboxRows, selectSandboxContainer } from '../../sandbox/commands/list-running.js';
-import { containerNameCandidates } from '../../sandbox/constants.js';
-import { resolveSandboxTarget } from '../../sandbox/workspace-identity.js';
-import { sandboxControlPaths } from '../../sandbox/workspace-view.js';
-import { appendSandboxControlAudit, readActiveLease, readSandboxControlStatus } from '../../sandbox/control/state.js';
-import { SANDBOX_CONTROL_FUTURE_SKEW_MS, SANDBOX_CONTROL_STATUS_STALE_MS } from '../../sandbox/control/protocol.js';
-import { getProcessStartTime } from '../../server/process-state.js';
-import { assertGitWorktreeBinding } from '../../git/worktree-identity.js';
-const USAGE = `Usage: ai task validate <branch | TASK-id | N> [--scope snapshot|inplace] [--timeout <ms>] [--format text|json] -- <command> [args...]`;
+import { loadConfig } from '../sandbox/config.js';
+import { detectEngine } from '../sandbox/engine.js';
+import { runEngine } from '../sandbox/shell.js';
+import { sandboxBranchLabel, sandboxLabel } from '../sandbox/constants.js';
+import { fetchSandboxRows, selectSandboxContainer } from '../sandbox/commands/list-running.js';
+import { containerNameCandidates } from '../sandbox/constants.js';
+import { resolveSandboxTarget } from '../sandbox/workspace-identity.js';
+import { sandboxControlPaths } from '../sandbox/workspace-view.js';
+import { appendSandboxControlAudit, readActiveLease, readSandboxControlStatus } from '../sandbox/control/state.js';
+import { SANDBOX_CONTROL_FUTURE_SKEW_MS, SANDBOX_CONTROL_STATUS_STALE_MS } from '../sandbox/control/protocol.js';
+import { getProcessStartTime } from '../server/process-state.js';
+import { assertGitWorktreeBinding } from '../git/worktree-identity.js';
+const USAGE = `Usage: agent-infra-internal task-validate <branch | TASK-id | N> [--scope snapshot|inplace] [--timeout <ms>] [--format text|json] -- <command> [args...]`;
 const MAX_TIMEOUT_MS = 60 * 60 * 1000;
 const RECOVERY_GRACE_MS = 30_000;
 export function parseValidateArgs(args) {
@@ -254,36 +254,69 @@ function inplaceValidation(config, target, options) {
         }
     }
 }
-export async function validate(args) {
-    const options = parseValidateArgs(args);
+function errorCode(message) {
+    const match = message.match(/^([A-Z][A-Z0-9_]*)/);
+    return match && match[1].length >= 3 ? match[1] : 'TASK_VALIDATE_FAILED';
+}
+function fail(format, code, message) {
+    if (format === 'json') {
+        process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code, message } })}\n`);
+    }
+    else {
+        process.stderr.write(`${message}\n`);
+    }
+    process.exitCode = 1;
+}
+function sniffFormat(args) {
+    const index = args.indexOf('--format');
+    return index >= 0 && args[index + 1] === 'json' ? 'json' : 'text';
+}
+function taskValidate(args) {
+    let options;
+    try {
+        options = parseValidateArgs(args);
+    }
+    catch (error) {
+        fail(sniffFormat(args), 'TASK_VALIDATE_ARGS_INVALID', error instanceof Error ? error.message : String(error));
+        return;
+    }
     if (options.help) {
         process.stdout.write(`${USAGE}\n`);
-        return 0;
+        return;
+    }
+    try {
+        const config = loadConfig();
+        const target = resolveSandboxTarget(options.target, config.repoRoot);
+        const commit = git(config.repoRoot, ['rev-parse', target.branch]);
+        const startedAt = new Date().toISOString();
+        const result = options.scope === 'snapshot'
+            ? snapshotValidation(config.repoRoot, commit, options)
+            : inplaceValidation(config, target, options);
+        const evidence = {
+            version: 1,
+            taskId: target.workspace.mode === 'task-bound' ? target.workspace.taskId : null,
+            branch: target.branch,
+            scope: options.scope,
+            commit,
+            command: path.basename(options.command[0]),
+            startedAt,
+            completedAt: new Date().toISOString(),
+            exitCode: result.exitCode,
+            signal: result.signal,
+            cleanup: result.cleanup()
+        };
+        if (options.format === 'json') {
+            process.stdout.write(`${JSON.stringify({ status: 'applied', changed: false, evidence, error: null })}\n`);
+        }
+        else {
+            process.stdout.write(`Validation ${result.exitCode === 0 ? 'passed' : 'failed'} (${options.scope}, ${evidence.command}, cleanup=${evidence.cleanup}).\n`);
+        }
+        process.exitCode = result.exitCode;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        fail(options.format, errorCode(message), message);
     }
-    const config = loadConfig();
-    const target = resolveSandboxTarget(options.target, config.repoRoot);
-    const commit = git(config.repoRoot, ['rev-parse', target.branch]);
-    const startedAt = new Date().toISOString();
-    const result = options.scope === 'snapshot'
-        ? snapshotValidation(config.repoRoot, commit, options)
-        : inplaceValidation(config, target, options);
-    const evidence = {
-        version: 1,
-        taskId: target.workspace.mode === 'task-bound' ? target.workspace.taskId : null,
-        branch: target.branch,
-        scope: options.scope,
-        commit,
-        command: path.basename(options.command[0]),
-        startedAt,
-        completedAt: new Date().toISOString(),
-        exitCode: result.exitCode,
-        signal: result.signal,
-        cleanup: result.cleanup()
-    };
-    if (options.format === 'json')
-        process.stdout.write(`${JSON.stringify(evidence)}\n`);
-    else
-        process.stdout.write(`Validation ${result.exitCode === 0 ? 'passed' : 'failed'} (${options.scope}, ${evidence.command}, cleanup=${evidence.cleanup}).\n`);
-    return result.exitCode;
 }
-//# sourceMappingURL=validate.js.map
+export { taskValidate };
+//# sourceMappingURL=task-validate.js.map

package/dist/lib/run/tui.js

@@ -1,11 +1,12 @@
 import { renderAgentClientInvocation } from '../agent-clients/invocation.js';
 import { getAgentClientAdapter } from '../agent-clients/registry.js';
-const TUI_NAMES = new Set(['claude', 'codex', 'antigravity', 'opencode']);
+const TUI_NAMES = new Set(['claude', 'codex', 'antigravity', 'opencode', 'traecli']);
 const TUI_AGENT_CLIENT_IDS = Object.freeze({
     claude: 'claude-code',
     codex: 'codex',
     antigravity: 'antigravity-cli',
-    opencode: 'opencode'
+    opencode: 'opencode',
+    traecli: 'traecli'
 });
 function isTuiName(value) {
     return typeof value === 'string' && TUI_NAMES.has(value);
@@ -33,6 +34,8 @@ export function buildTuiCommand(tui, prompt) {
         return ['agy', ['--dangerously-skip-permissions', '--print', prompt]];
     if (tui === 'opencode')
         return ['opencode', ['run', '--dangerously-skip-permissions', prompt]];
+    if (tui === 'traecli')
+        return ['traecli', ['exec', '--dangerously-bypass-approvals-and-sandbox', prompt]];
     return ['codex', ['exec', '--dangerously-bypass-approvals-and-sandbox', prompt]];
 }
 //# sourceMappingURL=tui.js.map

package/dist/lib/sandbox/control/controller-registration.js

@@ -126,10 +126,12 @@ function defaultProbe(manifest, identity) {
 function assertRegistrationBinding(registration, manifest, buildIdentity) {
     if (registration.taskId !== manifest.taskId
         || registration.controlGeneration !== manifest.generation
-        || registration.containerId !== manifest.containerIdentity.id
-        || JSON.stringify(registration.buildIdentity) !== JSON.stringify(buildIdentity)) {
+        || registration.containerId !== manifest.containerIdentity.id) {
         fail('CODEX_SANDBOX_CONTROLLER_REGISTRATION_INVALID', 'controller registration binding is invalid');
     }
+    if (registration.buildIdentity.protocolVersion !== buildIdentity.protocolVersion) {
+        fail('CODEX_LIFECYCLE_PROTOCOL_MISMATCH', 'Codex lifecycle protocol version does not match');
+    }
 }
 function atomicWrite(file, value) {
     const temporary = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${crypto.randomUUID()}.tmp`);

package/dist/lib/sandbox/control/executor.js

@@ -117,12 +117,15 @@ function controllerFailure(error) {
         ? error.code
         : /^([A-Z][A-Z0-9_]+)/u.exec(error instanceof Error ? error.message : String(error))?.[1]
             ?? 'CODEX_SANDBOX_CONTROLLER_FAILED';
+    const message = error instanceof CodexControllerRegistrationError
+        ? error.message
+        : `${code}: controller operation failed; inspect the sandbox controller and rebuild the sandbox if needed`;
     const payload = {
         version: 1,
         status: 'failed',
         changed: false,
         lease: null,
-        error: { code, message: `${code}: controller request failed`, retryable: false }
+        error: { code, message, retryable: false }
     };
     return { exitCode: 1, stdout: `${JSON.stringify(payload)}\n`, stderr: '' };
 }

package/dist/lib/task/codex-orchestration.js

@@ -1,9 +1,9 @@
 import { preflightCodexLifecycleEvidence, resolveCodexSpawnedChild, resolveCodexTerminal, resolveCodexThread } from '../agent-clients/adapters/codex-lifecycle/app-server.js';
 import { createCodexLifecycleStore } from '../agent-clients/adapters/codex-lifecycle/store.js';
 import { createCodexCapabilityStore, isCodexCapabilityProvenanceDetail } from '../agent-clients/adapters/codex-lifecycle/capability-store.js';
-import { computeLifecycleBuildIdentity } from '../agent-clients/adapters/codex-lifecycle/build-identity.js';
-import { verifyCodexSandboxControllerContext } from '../agent-clients/adapters/codex-lifecycle/sandbox-controller.js';
-import { verifyCodexSandboxControllerContext as verifyControllerContextFile } from '../agent-clients/adapters/codex-lifecycle/controller-context.js';
+import { computeLifecycleBuildIdentity, verifyLifecycleBuildIdentity } from '../agent-clients/adapters/codex-lifecycle/build-identity.js';
+import { verifyCodexSandboxControllerContextWithWarnings as verifySandboxControllerWithWarnings } from '../agent-clients/adapters/codex-lifecycle/sandbox-controller.js';
+import { verifyCodexSandboxControllerContextWithWarnings as verifyControllerContextFileWithWarnings } from '../agent-clients/adapters/codex-lifecycle/controller-context.js';
 import { resolveTaskRef } from './resolve-ref.js';
 import { activateMatchingOrchestrationDelegation, hasActivatableOrchestrationDelegation, hasSealableOrchestrationDelegation, OrchestrationStateError, pauseMatchingOrchestrationDelegation, prepareOrchestrationDelegation, reconcileMatchingOrchestrationDelegation, sealMatchingOrchestrationDelegationWithHostEvidence } from './orchestration.js';
 function coreOptions(options) {
@@ -42,29 +42,6 @@ function requiredStore(options) {
         throw new Error('Codex lifecycle store is required for orchestration bridge events');
     return options.store;
 }
-function controllerContext(repoRoot, brokerController) {
-    const contextPath = process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT;
-    if (!contextPath)
-        return null;
-    if (brokerController) {
-        return verifyControllerContextFile(contextPath, {
-            repoRoot,
-            generation: process.env.AGENT_INFRA_CONTROL_GENERATION ?? brokerController.controlGeneration
-        });
-    }
-    return verifyCodexSandboxControllerContext(contextPath, { repoRoot });
-}
-function brokerBindingConflictsWithContext(repoRoot, brokerController) {
-    const contextPath = process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT;
-    if (!contextPath || !brokerController)
-        return false;
-    const context = verifyControllerContextFile(contextPath, {
-        repoRoot,
-        generation: process.env.AGENT_INFRA_CONTROL_GENERATION ?? brokerController.controlGeneration
-    });
-    return context.controllerInstanceDigest !== brokerController.instanceDigest
-        || context.controlGeneration !== brokerController.controlGeneration;
-}
 function brokerControllerBinding() {
     const raw = process.env.AGENT_INFRA_CONTROL_CONTROLLER_BINDING;
     if (!raw)
@@ -101,10 +78,17 @@ async function prepareCodexOrchestrationDelegation(taskRef, input, options = {})
         }
         const buildIdentity = options.buildIdentity ?? computeLifecycleBuildIdentity(repoRoot);
         const brokerController = brokerControllerBinding();
-        if (brokerBindingConflictsWithContext(repoRoot, brokerController)) {
-            return bridgeFailure('CODEX_SANDBOX_CONTROLLER_BINDING_MISMATCH', 'broker and local controller bindings do not match');
-        }
-        const localController = controllerContext(repoRoot, brokerController);
+        const contextPath = process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT;
+        const contextVerification = contextPath
+            ? (brokerController
+                ? verifyControllerContextFileWithWarnings(contextPath, {
+                    repoRoot,
+                    generation: process.env.AGENT_INFRA_CONTROL_GENERATION ?? brokerController.controlGeneration
+                })
+                : verifySandboxControllerWithWarnings(contextPath, { repoRoot }))
+            : null;
+        const identityWarnings = [...(contextVerification?.warnings ?? [])];
+        const localController = contextVerification?.context ?? null;
         if (localController && brokerController
             && (localController.controllerInstanceDigest !== brokerController.instanceDigest
                 || localController.controlGeneration !== brokerController.controlGeneration)) {
@@ -116,6 +100,11 @@ async function prepareCodexOrchestrationDelegation(taskRef, input, options = {})
         } : null);
         const capabilityStore = options.capabilityStore ?? createCodexCapabilityStore();
         const attested = capabilityStore.inspect(input.capabilityToken);
+        const capabilityIdentity = verifyLifecycleBuildIdentity(attested.buildIdentity, buildIdentity);
+        if (!capabilityIdentity.ok) {
+            return bridgeFailure(capabilityIdentity.code, capabilityIdentity.message);
+        }
+        identityWarnings.push(...capabilityIdentity.warnings);
         const lifecycleProvenance = {
             ...attested.buildIdentity,
             hookDefinitionHash: preflight.hookDefinitionHash,
@@ -135,7 +124,7 @@ async function prepareCodexOrchestrationDelegation(taskRef, input, options = {})
                     controlGeneration: controller.controlGeneration
                 } } : {})
         };
-        return prepareOrchestrationDelegation(taskRef, {
+        const prepared = prepareOrchestrationDelegation(taskRef, {
             ...input,
             lifecycleProvenance
         }, {
@@ -175,6 +164,9 @@ async function prepareCodexOrchestrationDelegation(taskRef, input, options = {})
                 }
             }
         });
+        return identityWarnings.length > 0 && prepared.status !== 'failed'
+            ? { ...prepared, warnings: Object.freeze(identityWarnings) }
+            : prepared;
     }
     catch (error) {
         if (error instanceof OrchestrationStateError)
@@ -216,10 +208,11 @@ async function activateCodexOrchestrationDelegation(childThreadId, options = {})
         });
         const buildIdentity = options.buildIdentity ?? computeLifecycleBuildIdentity(repoRoot);
         const contextPath = process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT;
-        const controller = contextPath
-            ? verifyCodexSandboxControllerContext(contextPath, { repoRoot })
+        const contextVerification = contextPath
+            ? verifySandboxControllerWithWarnings(contextPath, { repoRoot })
             : null;
-        return activateMatchingOrchestrationDelegation('codex', {
+        const controller = contextVerification?.context ?? null;
+        const activated = activateMatchingOrchestrationDelegation('codex', {
             nativeAgent: evidence.nativeAgent,
             childId: evidence.childThreadId,
             parentId: evidence.parentThreadId,
@@ -244,6 +237,10 @@ async function activateCodexOrchestrationDelegation(childThreadId, options = {})
                 controlGeneration: controller?.controlGeneration ?? null
             }
         }, coreOptions(options));
+        const warnings = contextVerification?.warnings ?? [];
+        return warnings.length > 0 && activated.status !== 'failed'
+            ? { ...activated, warnings: Object.freeze(warnings) }
+            : activated;
     }
     catch (error) {
         if (error instanceof OrchestrationStateError)

package/dist/lib/task/delegation-receipts.js

@@ -15,6 +15,12 @@ function hasExactKeys(value, required, optional = []) {
 function exactText(value) {
     return typeof value === 'string' && value.length > 0 && value.trim() === value;
 }
+function validCodexBuildMetadata(value) {
+    return Number.isSafeInteger(value.protocolVersion) && value.protocolVersion > 0
+        && exactText(value.packageVersion)
+        && exactText(value.internalExecutableBuildHash)
+        && exactText(value.lifecycleContractHash);
+}
 function nullableText(value) {
     return value === null || exactText(value);
 }
@@ -92,9 +98,6 @@ function hasCurrentCodexEvidence(receipt) {
     const host = receipt.hostEvidence;
     if (host?.kind !== 'codex-lifecycle-v2'
         || host.protocolVersion !== provenance.protocolVersion
-        || host.packageVersion !== provenance.packageVersion
-        || host.internalExecutableBuildHash !== provenance.internalExecutableBuildHash
-        || host.lifecycleContractHash !== provenance.lifecycleContractHash
         || host.hookDefinitionHash !== provenance.hookDefinitionHash
         || host.hookSource !== provenance.hookSource
         || host.hookSourcePathDigest !== provenance.hookSourcePathDigest
@@ -379,9 +382,6 @@ function activateDelegation(receipt, event, options = {}) {
         const activationDeadlineAt = Date.parse(receipt.activationDeadlineAt);
         if (!expected
             || event.hostEvidence.protocolVersion !== expected.protocolVersion
-            || event.hostEvidence.packageVersion !== expected.packageVersion
-            || event.hostEvidence.internalExecutableBuildHash !== expected.internalExecutableBuildHash
-            || event.hostEvidence.lifecycleContractHash !== expected.lifecycleContractHash
             || event.hostEvidence.hookDefinitionHash !== expected.hookDefinitionHash
             || event.hostEvidence.hookSource !== expected.hookSource
             || event.hostEvidence.hookSourcePathDigest !== expected.hookSourcePathDigest
@@ -395,7 +395,8 @@ function activateDelegation(receipt, event, options = {}) {
             || spawnObservedAt > activationDeadlineAt
             || event.parentId !== expected.capabilitySessionId
             || (event.hostEvidence.controllerInstanceDigest ?? null) !== expected.controllerInstanceDigest
-            || (event.hostEvidence.controlGeneration ?? null) !== expected.controlGeneration)
+            || (event.hostEvidence.controlGeneration ?? null) !== expected.controlGeneration
+            || !validCodexBuildMetadata(event.hostEvidence))
             return fail('DELEGATION_HOST_EVIDENCE_INVALID', 'Codex lifecycle provenance does not match the prepared receipt');
     }
     return { ok: true, receipt: Object.freeze({

package/dist/lib/task/finalization.js

@@ -269,11 +269,18 @@ function mutationPatch(current, mutation) {
     }
     if (mutation.scope === 'verification') {
         if (mutation.operation === 'succeeded') {
+            const resolvedTaskWarning = current.warnings.some((warning) => warning.step === 'verification' && warning.status === 'open');
             const warnings = resolveStepWarnings(current, 'verification');
-            return { verification: 'done', warningProjection: warnings.length > 0 ? 'pending' : 'done', warnings, lastError: null };
+            return {
+                verification: 'done',
+                taskComment: resolvedTaskWarning ? 'pending' : current.taskComment,
+                warningProjection: warnings.length > 0 ? 'pending' : 'done',
+                warnings,
+                lastError: null
+            };
         }
         const warnings = replaceWarning(current, warningFromError('verification', mutation.error), 'open');
-        return { verification: 'pending', warningProjection: 'pending', warnings, lastError: mutation.error };
+        return { verification: 'pending', taskComment: 'pending', warningProjection: 'pending', warnings, lastError: mutation.error };
     }
     return mutation.operation === 'succeeded'
         ? { warningProjection: 'done', lastError: null }
@@ -339,6 +346,50 @@ function reconcileWarningProjection(repoRoot, taskId, receipt, consumed) {
         return receipt;
     }
 }
+function syncPendingTaskComment(input) {
+    const { repoRoot, taskId, agent, commentSync, consumedCapabilities } = input;
+    let receipt = input.receipt;
+    if (receipt.taskComment !== 'pending') {
+        return {
+            receipt,
+            step: { status: receipt.taskComment === 'skipped' ? 'skipped' : 'no-op', changed: false, error: null },
+            changed: false,
+            error: null
+        };
+    }
+    try {
+        const result = commentSync(taskId, { kind: 'task', agent, cwd: repoRoot });
+        const step = commentStep(result);
+        if (result.status === 'applied' || result.status === 'no-op') {
+            const skipped = result.error?.code === 'ISSUE_NOT_LINKED';
+            const capability = issueCapability(receipt, 'task-comment');
+            receipt = applyFinalizationReceiptMutationUnderLock(repoRoot, receipt, capability, {
+                scope: 'task-comment', operation: 'succeeded', state: skipped ? 'skipped' : 'done'
+            }, consumedCapabilities);
+            receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
+            return { receipt, step: skipped ? { ...step, status: 'skipped' } : step, changed: result.changed, error: null };
+        }
+        const detail = step.error ?? { code: 'COMMENT_SYNC_FAILED', message: 'task comment synchronization failed', retryable: true };
+        const capability = issueCapability(receipt, 'task-comment');
+        receipt = applyFinalizationReceiptMutationUnderLock(repoRoot, receipt, capability, {
+            scope: 'task-comment', operation: 'failed', error: detail
+        }, consumedCapabilities);
+        receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
+        return { receipt, step, changed: result.changed, error: detail };
+    }
+    catch (error) {
+        const detail = errorOf(error, 'COMMENT_SYNC_FAILED', true);
+        try {
+            const capability = issueCapability(receipt, 'task-comment');
+            receipt = applyFinalizationReceiptMutationUnderLock(repoRoot, receipt, capability, {
+                scope: 'task-comment', operation: 'failed', error: detail
+            }, consumedCapabilities);
+            receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
+        }
+        catch { /* preserve the primary error */ }
+        return { receipt, step: { status: 'blocked', changed: false, error: detail }, changed: false, error: detail };
+    }
+}
 function terminalResult(taskId, receipt, steps, changed, error = null) {
     const pending = pendingSteps(receipt);
     const blocked = [steps.lifecycle, steps.taskComment, steps.verification].some((step) => step?.status === 'blocked');
@@ -458,50 +509,15 @@ function applyUnderLock(request, taskId, options) {
         return failed(taskId, detail, { lifecycle: lifecycleResult });
     }
     let taskComment = null;
-    try {
-        receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
-        if (receipt.taskComment !== 'pending') {
-            taskComment = {
-                status: receipt.taskComment === 'skipped' ? 'skipped' : 'no-op',
-                changed: false,
-                error: null
-            };
-        }
-        else {
-            const result = commentSync(taskId, { kind: 'task', agent: request.agent, cwd: repoRoot });
-            taskComment = commentStep(result);
-            if (result.status === 'applied' || result.status === 'no-op') {
-                const skipped = result.error?.code === 'ISSUE_NOT_LINKED';
-                const capability = issueCapability(receipt, 'task-comment');
-                receipt = applyFinalizationReceiptMutationUnderLock(repoRoot, receipt, capability, {
-                    scope: 'task-comment', operation: 'succeeded', state: skipped ? 'skipped' : 'done'
-                }, consumedCapabilities);
-                receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
-                taskComment = skipped ? { ...taskComment, status: 'skipped' } : taskComment;
-                changed = changed || result.changed;
-            }
-            else {
-                const detail = taskComment.error ?? { code: 'COMMENT_SYNC_FAILED', message: 'task comment synchronization failed', retryable: true };
-                const capability = issueCapability(receipt, 'task-comment');
-                receipt = applyFinalizationReceiptMutationUnderLock(repoRoot, receipt, capability, {
-                    scope: 'task-comment', operation: 'failed', error: detail
-                }, consumedCapabilities);
-                receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
-                return terminalResult(taskId, receipt, { lifecycle: lifecycleResult, taskComment, verification: null }, changed, taskComment.error);
-            }
-        }
-    }
-    catch (error) {
-        const detail = errorOf(error, 'COMMENT_SYNC_FAILED', true);
-        try {
-            const capability = issueCapability(receipt, 'task-comment');
-            receipt = applyFinalizationReceiptMutationUnderLock(repoRoot, receipt, capability, {
-                scope: 'task-comment', operation: 'failed', error: detail
-            }, consumedCapabilities);
-            receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
-        }
-        catch { /* preserve the primary error */ }
-        return terminalResult(taskId, receipt, { lifecycle: lifecycleResult, taskComment: { status: 'blocked', changed: false, error: detail }, verification: null }, changed, detail);
+    receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
+    const initialComment = syncPendingTaskComment({
+        repoRoot, taskId, agent: request.agent, receipt, commentSync, consumedCapabilities
+    });
+    receipt = initialComment.receipt;
+    taskComment = initialComment.step;
+    changed = changed || initialComment.changed;
+    if (initialComment.error) {
+        return terminalResult(taskId, receipt, { lifecycle: lifecycleResult, taskComment, verification: null }, changed, initialComment.error);
     }
     let verification = null;
     try {
@@ -518,6 +534,16 @@ function applyUnderLock(request, taskId, options) {
                     scope: 'verification', operation: 'succeeded'
                 }, consumedCapabilities);
                 receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
+                const finalComment = syncPendingTaskComment({
+                    repoRoot, taskId, agent: request.agent, receipt, commentSync, consumedCapabilities
+                });
+                receipt = finalComment.receipt;
+                if (finalComment.step.status !== 'no-op')
+                    taskComment = finalComment.step;
+                changed = changed || finalComment.changed;
+                if (finalComment.error) {
+                    return terminalResult(taskId, receipt, { lifecycle: lifecycleResult, taskComment, verification }, changed, finalComment.error);
+                }
             }
             else {
                 const detail = verification.error ?? { code: 'VERIFY_FAILED', message: 'verification failed', retryable: true };

package/dist/lib/task/index.js

@@ -10,7 +10,6 @@ Commands:
   ls [--all | --blocked | --completed]   List tasks (default: active)
   show [--task <ref>]                    Print a task.md
   status [--task <ref>]                  Aggregated status view (metadata / artifacts / git / platform)
-  validate <ref> [options] -- <command>  Run host validation in snapshot or inplace scope
 
 Examples:
   ai task cat 11 analysis
@@ -30,7 +29,6 @@ Examples:
   ai task show 11
   ai task show TASK-20260612-162737
   ai task status 11
-  ai task validate 11 -- npm test
 
 Run 'ai task <command> --help' for details.`;
 export async function runTask(args) {
@@ -91,13 +89,6 @@ export async function runTask(args) {
             status(rest);
             break;
         }
-        case 'validate': {
-            const { validate } = await import('./commands/validate.js');
-            const exitCode = await validate(rest);
-            if (exitCode !== 0)
-                process.exitCode = exitCode;
-            break;
-        }
         default:
             process.stderr.write(`Unknown task command: ${subcommand}\n\n`);
             process.stdout.write(`${USAGE}\n`);

package/dist/lib/task/orchestration.js

@@ -25,7 +25,7 @@ function supportsLifecycleDelegation(client) {
 function orchestrationPath(taskDir) {
     return path.join(taskDir, 'orchestration.json');
 }
-const ORCHESTRATION_STATE_INVALID_MESSAGE = 'orchestration.json does not match the current runtime structure; finish or clear active runs before upgrading';
+const ORCHESTRATION_STATE_INVALID_MESSAGE = 'orchestration.json does not match the current runtime structure; the file was left unchanged; rebuild the sandbox or manually repair the state before retrying';
 class OrchestrationStateError extends Error {
     code = 'ORCHESTRATION_STATE_INVALID';
     taskId;

package/dist/lib/task/verification-engine.js

@@ -308,9 +308,6 @@ function checkOrchestrationEvidence({ taskDir }) {
                 if (!provenance
                     || (activatedCodex && (host?.kind !== 'codex-lifecycle-v2'
                         || host.protocolVersion !== provenance.protocolVersion
-                        || host.packageVersion !== provenance.packageVersion
-                        || host.internalExecutableBuildHash !== provenance.internalExecutableBuildHash
-                        || host.lifecycleContractHash !== provenance.lifecycleContractHash
                         || host.hookDefinitionHash !== provenance.hookDefinitionHash
                         || host.hookSource !== provenance.hookSource
                         || host.hookSourcePathDigest !== provenance.hookSourcePathDigest

package/dist/lifecycle-build-manifest.json

@@ -1,6 +1,6 @@
 {
   "protocolVersion": 3,
-  "packageVersion": "0.9.9",
-  "sourceInputHash": "2f2db695db557531b3139eccd1bd530fbeb7b99409e2d49338f3b4646aac9ef6",
-  "internalExecutableBuildHash": "1391ebe2614f3071e7a60920325046a47f1473e7fb23c821327072f947f639d3"
+  "packageVersion": "0.9.10",
+  "sourceInputHash": "fae928c7a46686dd39f9f57424e3caff8aed3ce5de5700475b4a3a8f2954b3a3",
+  "internalExecutableBuildHash": "a5e143239a8fdd93c4696125aab04b28d7baf59c2a65488705fe930d4965f354"
 }

package/lib/agent-clients/adapters/codex-lifecycle/build-identity.ts

@@ -28,6 +28,13 @@ type IdentityVerification = Readonly<{
   ok: boolean;
   code: string | null;
   message: string | null;
+  warnings: readonly LifecycleIdentityWarning[];
+}>;
+
+type LifecycleIdentityWarning = Readonly<{
+  code: 'CODEX_LIFECYCLE_BUILD_MISMATCH' | 'CODEX_LIFECYCLE_CONTRACT_MISMATCH';
+  message: string;
+  action: 'rebuild-sandbox';
 }>;
 
 function exactText(value: unknown): value is string {
@@ -201,25 +208,32 @@ function verifyLifecycleBuildIdentity(
     return {
       ok: false,
       code: 'CODEX_LIFECYCLE_PROTOCOL_MISMATCH',
-      message: 'Codex lifecycle protocol version does not match'
+      message: 'Codex lifecycle protocol version does not match',
+      warnings: []
     };
   }
+  const warnings: LifecycleIdentityWarning[] = [];
   if (actual.packageVersion !== expected.packageVersion
     || actual.internalExecutableBuildHash !== expected.internalExecutableBuildHash) {
-    return {
-      ok: false,
+    warnings.push({
       code: 'CODEX_LIFECYCLE_BUILD_MISMATCH',
-      message: 'Codex lifecycle executable build identity does not match'
-    };
+      message: 'Codex lifecycle executable build identity differs; rebuild the sandbox if the runtime is stale',
+      action: 'rebuild-sandbox'
+    });
   }
   if (actual.lifecycleContractHash !== expected.lifecycleContractHash) {
-    return {
-      ok: false,
+    warnings.push({
       code: 'CODEX_LIFECYCLE_CONTRACT_MISMATCH',
-      message: 'Codex lifecycle contract identity does not match'
-    };
+      message: 'Codex lifecycle contract identity differs; rebuild the sandbox if the runtime is stale',
+      action: 'rebuild-sandbox'
+    });
   }
-  return { ok: true, code: null, message: null };
+  return {
+    ok: true,
+    code: null,
+    message: null,
+    warnings: Object.freeze(warnings)
+  };
 }
 
 export {
@@ -233,6 +247,7 @@ export {
 };
 export type {
   IdentityVerification,
+  LifecycleIdentityWarning,
   LifecycleBuildIdentity,
   LifecycleManifestFiles,
   LifecycleBuildIdentityOptions