@fitlab-ai/agent-infra 0.9.9 → 0.9.10

package/lib/{task/commands/validate.ts → internal/task-validate.ts}

@@ -3,28 +3,28 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
-import { loadConfig } from '../../sandbox/config.ts';
-import { detectEngine } from '../../sandbox/engine.ts';
-import { runEngine } from '../../sandbox/shell.ts';
-import { sandboxBranchLabel, sandboxLabel } from '../../sandbox/constants.ts';
-import { fetchSandboxRows, selectSandboxContainer } from '../../sandbox/commands/list-running.ts';
-import { containerNameCandidates } from '../../sandbox/constants.ts';
-import { resolveSandboxTarget } from '../../sandbox/workspace-identity.ts';
-import { sandboxControlPaths } from '../../sandbox/workspace-view.ts';
+import { loadConfig } from '../sandbox/config.ts';
+import { detectEngine } from '../sandbox/engine.ts';
+import { runEngine } from '../sandbox/shell.ts';
+import { sandboxBranchLabel, sandboxLabel } from '../sandbox/constants.ts';
+import { fetchSandboxRows, selectSandboxContainer } from '../sandbox/commands/list-running.ts';
+import { containerNameCandidates } from '../sandbox/constants.ts';
+import { resolveSandboxTarget } from '../sandbox/workspace-identity.ts';
+import { sandboxControlPaths } from '../sandbox/workspace-view.ts';
 import {
   appendSandboxControlAudit,
   readActiveLease,
   readSandboxControlStatus
-} from '../../sandbox/control/state.ts';
-import type { SandboxControlLease, SandboxControlManifest } from '../../sandbox/control/protocol.ts';
+} from '../sandbox/control/state.ts';
+import type { SandboxControlLease, SandboxControlManifest } from '../sandbox/control/protocol.ts';
 import {
   SANDBOX_CONTROL_FUTURE_SKEW_MS,
   SANDBOX_CONTROL_STATUS_STALE_MS
-} from '../../sandbox/control/protocol.ts';
-import { getProcessStartTime } from '../../server/process-state.ts';
-import { assertGitWorktreeBinding } from '../../git/worktree-identity.ts';
+} from '../sandbox/control/protocol.ts';
+import { getProcessStartTime } from '../server/process-state.ts';
+import { assertGitWorktreeBinding } from '../git/worktree-identity.ts';
 
-const USAGE = `Usage: ai task validate <branch | TASK-id | N> [--scope snapshot|inplace] [--timeout <ms>] [--format text|json] -- <command> [args...]`;
+const USAGE = `Usage: agent-infra-internal task-validate <branch | TASK-id | N> [--scope snapshot|inplace] [--timeout <ms>] [--format text|json] -- <command> [args...]`;
 const MAX_TIMEOUT_MS = 60 * 60 * 1000;
 const RECOVERY_GRACE_MS = 30_000;
 
@@ -250,33 +250,68 @@ function inplaceValidation(config: ReturnType<typeof loadConfig>, target: Return
   }
 }
 
-export async function validate(args: string[]): Promise<number> {
-  const options = parseValidateArgs(args);
+function errorCode(message: string): string {
+  const match = message.match(/^([A-Z][A-Z0-9_]*)/);
+  return match && match[1]!.length >= 3 ? match[1]! : 'TASK_VALIDATE_FAILED';
+}
+
+function fail(format: 'text' | 'json', code: string, message: string): void {
+  if (format === 'json') {
+    process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code, message } })}\n`);
+  } else {
+    process.stderr.write(`${message}\n`);
+  }
+  process.exitCode = 1;
+}
+
+function sniffFormat(args: string[]): 'text' | 'json' {
+  const index = args.indexOf('--format');
+  return index >= 0 && args[index + 1] === 'json' ? 'json' : 'text';
+}
+
+function taskValidate(args: string[]): void {
+  let options: ValidateOptions;
+  try {
+    options = parseValidateArgs(args);
+  } catch (error) {
+    fail(sniffFormat(args), 'TASK_VALIDATE_ARGS_INVALID', error instanceof Error ? error.message : String(error));
+    return;
+  }
   if (options.help) {
     process.stdout.write(`${USAGE}\n`);
-    return 0;
+    return;
+  }
+  try {
+    const config = loadConfig();
+    const target = resolveSandboxTarget(options.target, config.repoRoot);
+    const commit = git(config.repoRoot, ['rev-parse', target.branch]);
+    const startedAt = new Date().toISOString();
+    const result = options.scope === 'snapshot'
+      ? snapshotValidation(config.repoRoot, commit, options)
+      : inplaceValidation(config, target, options);
+    const evidence = {
+      version: 1,
+      taskId: target.workspace.mode === 'task-bound' ? target.workspace.taskId : null,
+      branch: target.branch,
+      scope: options.scope,
+      commit,
+      command: path.basename(options.command[0]!),
+      startedAt,
+      completedAt: new Date().toISOString(),
+      exitCode: result.exitCode,
+      signal: result.signal,
+      cleanup: result.cleanup()
+    };
+    if (options.format === 'json') {
+      process.stdout.write(`${JSON.stringify({ status: 'applied', changed: false, evidence, error: null })}\n`);
+    } else {
+      process.stdout.write(`Validation ${result.exitCode === 0 ? 'passed' : 'failed'} (${options.scope}, ${evidence.command}, cleanup=${evidence.cleanup}).\n`);
+    }
+    process.exitCode = result.exitCode;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    fail(options.format, errorCode(message), message);
   }
-  const config = loadConfig();
-  const target = resolveSandboxTarget(options.target, config.repoRoot);
-  const commit = git(config.repoRoot, ['rev-parse', target.branch]);
-  const startedAt = new Date().toISOString();
-  const result = options.scope === 'snapshot'
-    ? snapshotValidation(config.repoRoot, commit, options)
-    : inplaceValidation(config, target, options);
-  const evidence = {
-    version: 1,
-    taskId: target.workspace.mode === 'task-bound' ? target.workspace.taskId : null,
-    branch: target.branch,
-    scope: options.scope,
-    commit,
-    command: path.basename(options.command[0]!),
-    startedAt,
-    completedAt: new Date().toISOString(),
-    exitCode: result.exitCode,
-    signal: result.signal,
-    cleanup: result.cleanup()
-  };
-  if (options.format === 'json') process.stdout.write(`${JSON.stringify(evidence)}\n`);
-  else process.stdout.write(`Validation ${result.exitCode === 0 ? 'passed' : 'failed'} (${options.scope}, ${evidence.command}, cleanup=${evidence.cleanup}).\n`);
-  return result.exitCode;
 }
+
+export { taskValidate };

package/lib/run/tui.ts

@@ -2,14 +2,15 @@ import { renderAgentClientInvocation } from '../agent-clients/invocation.ts';
 import { getAgentClientAdapter } from '../agent-clients/registry.ts';
 import type { AgentClientId } from '../agent-clients/types.ts';
 
-export type TuiName = 'claude' | 'codex' | 'antigravity' | 'opencode';
+export type TuiName = 'claude' | 'codex' | 'antigravity' | 'opencode' | 'traecli';
 
-const TUI_NAMES = new Set(['claude', 'codex', 'antigravity', 'opencode']);
+const TUI_NAMES = new Set(['claude', 'codex', 'antigravity', 'opencode', 'traecli']);
 const TUI_AGENT_CLIENT_IDS: Readonly<Record<TuiName, AgentClientId>> = Object.freeze({
   claude: 'claude-code',
   codex: 'codex',
   antigravity: 'antigravity-cli',
-  opencode: 'opencode'
+  opencode: 'opencode',
+  traecli: 'traecli'
 });
 
 export type CommandConfig = {
@@ -46,5 +47,6 @@ export function buildTuiCommand(tui: TuiName, prompt: string): [string, string[]
   if (tui === 'claude') return ['claude', ['--dangerously-skip-permissions', '--print', prompt]];
   if (tui === 'antigravity') return ['agy', ['--dangerously-skip-permissions', '--print', prompt]];
   if (tui === 'opencode') return ['opencode', ['run', '--dangerously-skip-permissions', prompt]];
+  if (tui === 'traecli') return ['traecli', ['exec', '--dangerously-bypass-approvals-and-sandbox', prompt]];
   return ['codex', ['exec', '--dangerously-bypass-approvals-and-sandbox', prompt]];
 }

package/lib/sandbox/control/controller-registration.ts

@@ -188,10 +188,12 @@ function assertRegistrationBinding(
 ): void {
   if (registration.taskId !== manifest.taskId
     || registration.controlGeneration !== manifest.generation
-    || registration.containerId !== manifest.containerIdentity.id
-    || JSON.stringify(registration.buildIdentity) !== JSON.stringify(buildIdentity)) {
+    || registration.containerId !== manifest.containerIdentity.id) {
     fail('CODEX_SANDBOX_CONTROLLER_REGISTRATION_INVALID', 'controller registration binding is invalid');
   }
+  if (registration.buildIdentity.protocolVersion !== buildIdentity.protocolVersion) {
+    fail('CODEX_LIFECYCLE_PROTOCOL_MISMATCH', 'Codex lifecycle protocol version does not match');
+  }
 }
 
 function atomicWrite(file: string, value: CodexControllerRegistrationV1): void {
@@ -322,7 +324,10 @@ export function resolveCodexControllerBinding(params: Readonly<{
   buildIdentity: LifecycleBuildIdentity;
   now?: number;
   probeProcess?: (identity: ProcessIdentity) => ProcessIdentityState;
-}>): Readonly<{ instanceDigest: string; controlGeneration: string }> {
+}>): Readonly<{
+  instanceDigest: string;
+  controlGeneration: string;
+}> {
   if (params.manifest.mode !== 'task-bound' || !params.manifest.taskId) {
     fail('SANDBOX_CONTROL_BRANCH_ONLY', 'branch-only sandboxes cannot resolve a Codex controller registration');
   }

package/lib/sandbox/control/executor.ts

@@ -146,12 +146,15 @@ function controllerFailure(error: unknown): SandboxControlExecutionResult {
     ? error.code
     : /^([A-Z][A-Z0-9_]+)/u.exec(error instanceof Error ? error.message : String(error))?.[1]
       ?? 'CODEX_SANDBOX_CONTROLLER_FAILED';
+  const message = error instanceof CodexControllerRegistrationError
+    ? error.message
+    : `${code}: controller operation failed; inspect the sandbox controller and rebuild the sandbox if needed`;
   const payload = {
     version: 1,
     status: 'failed',
     changed: false,
     lease: null,
-    error: { code, message: `${code}: controller request failed`, retryable: false }
+    error: { code, message, retryable: false }
   };
   return { exitCode: 1, stdout: `${JSON.stringify(payload)}\n`, stderr: '' };
 }
@@ -265,7 +268,10 @@ export function executeRequest(
     ));
   }
   const boundArgs = bindSandboxControlTask(request, manifest.taskId!);
-  let controllerBinding: Readonly<{ instanceDigest: string; controlGeneration: string }> | null = null;
+  let controllerBinding: Readonly<{
+    instanceDigest: string;
+    controlGeneration: string;
+  }> | null = null;
   if (request.family === 'task-orchestration') {
     if (isCodexPrepare(request.args)) {
       if (!request.controllerProof) {

package/lib/task/codex-orchestration.ts

@@ -10,10 +10,16 @@ import {
   isCodexCapabilityProvenanceDetail
 } from '../agent-clients/adapters/codex-lifecycle/capability-store.ts';
 import type { CodexCapabilityProvenanceDetail } from '../agent-clients/adapters/codex-lifecycle/capability-store.ts';
-import { computeLifecycleBuildIdentity } from '../agent-clients/adapters/codex-lifecycle/build-identity.ts';
-import type { LifecycleBuildIdentity } from '../agent-clients/adapters/codex-lifecycle/build-identity.ts';
-import { verifyCodexSandboxControllerContext } from '../agent-clients/adapters/codex-lifecycle/sandbox-controller.ts';
-import { verifyCodexSandboxControllerContext as verifyControllerContextFile } from '../agent-clients/adapters/codex-lifecycle/controller-context.ts';
+import {
+  computeLifecycleBuildIdentity,
+  verifyLifecycleBuildIdentity,
+  type LifecycleBuildIdentity,
+  type LifecycleIdentityWarning
+} from '../agent-clients/adapters/codex-lifecycle/build-identity.ts';
+import { verifyCodexSandboxControllerContextWithWarnings as verifySandboxControllerWithWarnings } from '../agent-clients/adapters/codex-lifecycle/sandbox-controller.ts';
+import {
+  verifyCodexSandboxControllerContextWithWarnings as verifyControllerContextFileWithWarnings
+} from '../agent-clients/adapters/codex-lifecycle/controller-context.ts';
 import type { AgentClientId } from '../agent-clients/types.ts';
 import { resolveTaskRef } from './resolve-ref.ts';
 import {
@@ -92,35 +98,6 @@ function requiredStore(options: CodexBridgeOptions): LifecycleStore {
   return options.store;
 }
 
-function controllerContext(
-  repoRoot: string,
-  brokerController: Readonly<{ instanceDigest: string; controlGeneration: string }> | null
-) {
-  const contextPath = process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT;
-  if (!contextPath) return null;
-  if (brokerController) {
-    return verifyControllerContextFile(contextPath, {
-      repoRoot,
-      generation: process.env.AGENT_INFRA_CONTROL_GENERATION ?? brokerController.controlGeneration
-    });
-  }
-  return verifyCodexSandboxControllerContext(contextPath, { repoRoot });
-}
-
-function brokerBindingConflictsWithContext(
-  repoRoot: string,
-  brokerController: Readonly<{ instanceDigest: string; controlGeneration: string }> | null
-): boolean {
-  const contextPath = process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT;
-  if (!contextPath || !brokerController) return false;
-  const context = verifyControllerContextFile(contextPath, {
-    repoRoot,
-    generation: process.env.AGENT_INFRA_CONTROL_GENERATION ?? brokerController.controlGeneration
-  });
-  return context.controllerInstanceDigest !== brokerController.instanceDigest
-    || context.controlGeneration !== brokerController.controlGeneration;
-}
-
 function brokerControllerBinding(): Readonly<{ instanceDigest: string; controlGeneration: string }> | null {
   const raw = process.env.AGENT_INFRA_CONTROL_CONTROLLER_BINDING;
   if (!raw) return null;
@@ -166,13 +143,17 @@ async function prepareCodexOrchestrationDelegation(
     }
     const buildIdentity = options.buildIdentity ?? computeLifecycleBuildIdentity(repoRoot);
     const brokerController = brokerControllerBinding();
-    if (brokerBindingConflictsWithContext(repoRoot, brokerController)) {
-      return bridgeFailure(
-        'CODEX_SANDBOX_CONTROLLER_BINDING_MISMATCH',
-        'broker and local controller bindings do not match'
-      );
-    }
-    const localController = controllerContext(repoRoot, brokerController);
+    const contextPath = process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT;
+    const contextVerification = contextPath
+      ? (brokerController
+        ? verifyControllerContextFileWithWarnings(contextPath, {
+            repoRoot,
+            generation: process.env.AGENT_INFRA_CONTROL_GENERATION ?? brokerController.controlGeneration
+          })
+        : verifySandboxControllerWithWarnings(contextPath, { repoRoot }))
+      : null;
+    const identityWarnings: LifecycleIdentityWarning[] = [...(contextVerification?.warnings ?? [])];
+    const localController = contextVerification?.context ?? null;
     if (localController && brokerController
       && (localController.controllerInstanceDigest !== brokerController.instanceDigest
         || localController.controlGeneration !== brokerController.controlGeneration)) {
@@ -187,6 +168,11 @@ async function prepareCodexOrchestrationDelegation(
     } : null);
     const capabilityStore = options.capabilityStore ?? createCodexCapabilityStore();
     const attested = capabilityStore.inspect(input.capabilityToken);
+    const capabilityIdentity = verifyLifecycleBuildIdentity(attested.buildIdentity, buildIdentity);
+    if (!capabilityIdentity.ok) {
+      return bridgeFailure(capabilityIdentity.code!, capabilityIdentity.message!);
+    }
+    identityWarnings.push(...capabilityIdentity.warnings);
     const lifecycleProvenance = {
       ...attested.buildIdentity,
       hookDefinitionHash: preflight.hookDefinitionHash,
@@ -206,7 +192,7 @@ async function prepareCodexOrchestrationDelegation(
         controlGeneration: controller.controlGeneration
       } } : {})
     };
-    return prepareOrchestrationDelegation(taskRef, {
+    const prepared = prepareOrchestrationDelegation(taskRef, {
       ...input,
       lifecycleProvenance
     }, {
@@ -244,6 +230,9 @@ async function prepareCodexOrchestrationDelegation(
         }
       }
     });
+    return identityWarnings.length > 0 && prepared.status !== 'failed'
+      ? { ...prepared, warnings: Object.freeze(identityWarnings) }
+      : prepared;
   } catch (error) {
     if (error instanceof OrchestrationStateError) return bridgeFailure(error.code, error.message);
     const detailValue = error instanceof Error
@@ -290,10 +279,11 @@ async function activateCodexOrchestrationDelegation(
     });
     const buildIdentity = options.buildIdentity ?? computeLifecycleBuildIdentity(repoRoot);
     const contextPath = process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT;
-    const controller = contextPath
-      ? verifyCodexSandboxControllerContext(contextPath, { repoRoot })
+    const contextVerification = contextPath
+      ? verifySandboxControllerWithWarnings(contextPath, { repoRoot })
       : null;
-    return activateMatchingOrchestrationDelegation('codex', {
+    const controller = contextVerification?.context ?? null;
+    const activated = activateMatchingOrchestrationDelegation('codex', {
       nativeAgent: evidence.nativeAgent,
       childId: evidence.childThreadId,
       parentId: evidence.parentThreadId,
@@ -318,6 +308,10 @@ async function activateCodexOrchestrationDelegation(
         controlGeneration: controller?.controlGeneration ?? null
       }
     }, coreOptions(options));
+    const warnings = contextVerification?.warnings ?? [];
+    return warnings.length > 0 && activated.status !== 'failed'
+      ? { ...activated, warnings: Object.freeze(warnings) }
+      : activated;
   } catch (error) {
     if (error instanceof OrchestrationStateError) return bridgeFailure(error.code, error.message);
     return pauseBridge('ORCHESTRATION_CODEX_START_FAILED', error instanceof Error ? error.message : String(error), options);

package/lib/task/delegation-receipts.ts

@@ -108,6 +108,13 @@ function exactText(value: unknown): value is string {
   return typeof value === 'string' && value.length > 0 && value.trim() === value;
 }
 
+function validCodexBuildMetadata(value: Readonly<Record<string, unknown>>): boolean {
+  return Number.isSafeInteger(value.protocolVersion) && (value.protocolVersion as number) > 0
+    && exactText(value.packageVersion)
+    && exactText(value.internalExecutableBuildHash)
+    && exactText(value.lifecycleContractHash);
+}
+
 function nullableText(value: unknown): value is string | null {
   return value === null || exactText(value);
 }
@@ -185,9 +192,6 @@ function hasCurrentCodexEvidence(receipt: DelegationReceipt): boolean {
   if (
     host?.kind !== 'codex-lifecycle-v2'
     || host.protocolVersion !== provenance.protocolVersion
-    || host.packageVersion !== provenance.packageVersion
-    || host.internalExecutableBuildHash !== provenance.internalExecutableBuildHash
-    || host.lifecycleContractHash !== provenance.lifecycleContractHash
     || host.hookDefinitionHash !== provenance.hookDefinitionHash
     || host.hookSource !== provenance.hookSource
     || host.hookSourcePathDigest !== provenance.hookSourcePathDigest
@@ -531,9 +535,6 @@ function activateDelegation(
     if (
       !expected
       || event.hostEvidence.protocolVersion !== expected.protocolVersion
-      || event.hostEvidence.packageVersion !== expected.packageVersion
-      || event.hostEvidence.internalExecutableBuildHash !== expected.internalExecutableBuildHash
-      || event.hostEvidence.lifecycleContractHash !== expected.lifecycleContractHash
       || event.hostEvidence.hookDefinitionHash !== expected.hookDefinitionHash
       || event.hostEvidence.hookSource !== expected.hookSource
       || event.hostEvidence.hookSourcePathDigest !== expected.hookSourcePathDigest
@@ -548,6 +549,7 @@ function activateDelegation(
       || event.parentId !== expected.capabilitySessionId
       || (event.hostEvidence.controllerInstanceDigest ?? null) !== expected.controllerInstanceDigest
       || (event.hostEvidence.controlGeneration ?? null) !== expected.controlGeneration
+      || !validCodexBuildMetadata(event.hostEvidence)
     ) return fail('DELEGATION_HOST_EVIDENCE_INVALID', 'Codex lifecycle provenance does not match the prepared receipt');
   }
   return { ok: true, receipt: Object.freeze({

package/lib/task/finalization.ts

@@ -85,6 +85,13 @@ type TaskFinalizationStep = Readonly<{
   pendingSteps?: readonly string[];
 }>;
 
+type TaskCommentSyncOutcome = Readonly<{
+  receipt: TaskFinalizationReceipt;
+  step: TaskFinalizationStep;
+  changed: boolean;
+  error: FinalizationError | null;
+}>;
+
 type TaskFinalizationResult = Readonly<{
   status: 'completed' | 'failed' | 'blocked';
   changed: boolean;
@@ -390,11 +397,18 @@ function mutationPatch(current: TaskFinalizationReceipt, mutation: FinalizationM
   }
   if (mutation.scope === 'verification') {
     if (mutation.operation === 'succeeded') {
+      const resolvedTaskWarning = current.warnings.some((warning) => warning.step === 'verification' && warning.status === 'open');
       const warnings = resolveStepWarnings(current, 'verification');
-      return { verification: 'done', warningProjection: warnings.length > 0 ? 'pending' : 'done', warnings, lastError: null };
+      return {
+        verification: 'done',
+        taskComment: resolvedTaskWarning ? 'pending' : current.taskComment,
+        warningProjection: warnings.length > 0 ? 'pending' : 'done',
+        warnings,
+        lastError: null
+      };
     }
     const warnings = replaceWarning(current, warningFromError('verification', mutation.error), 'open');
-    return { verification: 'pending', warningProjection: 'pending', warnings, lastError: mutation.error };
+    return { verification: 'pending', taskComment: 'pending', warningProjection: 'pending', warnings, lastError: mutation.error };
   }
   return mutation.operation === 'succeeded'
     ? { warningProjection: 'done', lastError: null }
@@ -472,6 +486,56 @@ function reconcileWarningProjection(repoRoot: string, taskId: string, receipt: T
   catch { return receipt; }
 }
 
+function syncPendingTaskComment(input: {
+  repoRoot: string;
+  taskId: string;
+  agent: string;
+  receipt: TaskFinalizationReceipt;
+  commentSync: typeof syncPlatformComment;
+  consumedCapabilities: Set<string>;
+}): TaskCommentSyncOutcome {
+  const { repoRoot, taskId, agent, commentSync, consumedCapabilities } = input;
+  let receipt = input.receipt;
+  if (receipt.taskComment !== 'pending') {
+    return {
+      receipt,
+      step: { status: receipt.taskComment === 'skipped' ? 'skipped' : 'no-op', changed: false, error: null },
+      changed: false,
+      error: null
+    };
+  }
+  try {
+    const result = commentSync(taskId, { kind: 'task', agent, cwd: repoRoot });
+    const step = commentStep(result);
+    if (result.status === 'applied' || result.status === 'no-op') {
+      const skipped = result.error?.code === 'ISSUE_NOT_LINKED';
+      const capability = issueCapability(receipt, 'task-comment');
+      receipt = applyFinalizationReceiptMutationUnderLock(repoRoot, receipt, capability, {
+        scope: 'task-comment', operation: 'succeeded', state: skipped ? 'skipped' : 'done'
+      }, consumedCapabilities);
+      receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
+      return { receipt, step: skipped ? { ...step, status: 'skipped' } : step, changed: result.changed, error: null };
+    }
+    const detail = step.error ?? { code: 'COMMENT_SYNC_FAILED', message: 'task comment synchronization failed', retryable: true };
+    const capability = issueCapability(receipt, 'task-comment');
+    receipt = applyFinalizationReceiptMutationUnderLock(repoRoot, receipt, capability, {
+      scope: 'task-comment', operation: 'failed', error: detail
+    }, consumedCapabilities);
+    receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
+    return { receipt, step, changed: result.changed, error: detail };
+  } catch (error) {
+    const detail = errorOf(error, 'COMMENT_SYNC_FAILED', true);
+    try {
+      const capability = issueCapability(receipt, 'task-comment');
+      receipt = applyFinalizationReceiptMutationUnderLock(repoRoot, receipt, capability, {
+        scope: 'task-comment', operation: 'failed', error: detail
+      }, consumedCapabilities);
+      receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
+    } catch { /* preserve the primary error */ }
+    return { receipt, step: { status: 'blocked', changed: false, error: detail }, changed: false, error: detail };
+  }
+}
+
 function terminalResult(
   taskId: string,
   receipt: TaskFinalizationReceipt,
@@ -603,46 +667,15 @@ function applyUnderLock(
   }
 
   let taskComment: TaskFinalizationStep | null = null;
-  try {
-    receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
-    if (receipt.taskComment !== 'pending') {
-      taskComment = {
-        status: receipt.taskComment === 'skipped' ? 'skipped' : 'no-op',
-        changed: false,
-        error: null
-      };
-    } else {
-      const result = commentSync(taskId, { kind: 'task', agent: request.agent, cwd: repoRoot });
-      taskComment = commentStep(result);
-      if (result.status === 'applied' || result.status === 'no-op') {
-        const skipped = result.error?.code === 'ISSUE_NOT_LINKED';
-        const capability = issueCapability(receipt, 'task-comment');
-        receipt = applyFinalizationReceiptMutationUnderLock(repoRoot, receipt, capability, {
-          scope: 'task-comment', operation: 'succeeded', state: skipped ? 'skipped' : 'done'
-        }, consumedCapabilities);
-        receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
-        taskComment = skipped ? { ...taskComment, status: 'skipped' } : taskComment;
-        changed = changed || result.changed;
-      } else {
-        const detail = taskComment.error ?? { code: 'COMMENT_SYNC_FAILED', message: 'task comment synchronization failed', retryable: true };
-        const capability = issueCapability(receipt, 'task-comment');
-        receipt = applyFinalizationReceiptMutationUnderLock(repoRoot, receipt, capability, {
-          scope: 'task-comment', operation: 'failed', error: detail
-        }, consumedCapabilities);
-        receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
-        return terminalResult(taskId, receipt, { lifecycle: lifecycleResult, taskComment, verification: null }, changed, taskComment.error);
-      }
-    }
-  } catch (error) {
-    const detail = errorOf(error, 'COMMENT_SYNC_FAILED', true);
-    try {
-      const capability = issueCapability(receipt, 'task-comment');
-      receipt = applyFinalizationReceiptMutationUnderLock(repoRoot, receipt, capability, {
-        scope: 'task-comment', operation: 'failed', error: detail
-      }, consumedCapabilities);
-      receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
-    } catch { /* preserve the primary error */ }
-    return terminalResult(taskId, receipt, { lifecycle: lifecycleResult, taskComment: { status: 'blocked', changed: false, error: detail }, verification: null }, changed, detail);
+  receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
+  const initialComment = syncPendingTaskComment({
+    repoRoot, taskId, agent: request.agent, receipt, commentSync, consumedCapabilities
+  });
+  receipt = initialComment.receipt;
+  taskComment = initialComment.step;
+  changed = changed || initialComment.changed;
+  if (initialComment.error) {
+    return terminalResult(taskId, receipt, { lifecycle: lifecycleResult, taskComment, verification: null }, changed, initialComment.error);
   }
 
   let verification: TaskFinalizationStep | null = null;
@@ -662,6 +695,15 @@ function applyUnderLock(
           scope: 'verification', operation: 'succeeded'
         }, consumedCapabilities);
         receipt = reconcileWarningProjection(repoRoot, taskId, receipt, consumedCapabilities);
+        const finalComment = syncPendingTaskComment({
+          repoRoot, taskId, agent: request.agent, receipt, commentSync, consumedCapabilities
+        });
+        receipt = finalComment.receipt;
+        if (finalComment.step.status !== 'no-op') taskComment = finalComment.step;
+        changed = changed || finalComment.changed;
+        if (finalComment.error) {
+          return terminalResult(taskId, receipt, { lifecycle: lifecycleResult, taskComment, verification }, changed, finalComment.error);
+        }
       } else {
         const detail = verification.error ?? { code: 'VERIFY_FAILED', message: 'verification failed', retryable: true };
         const capability = issueCapability(receipt, 'verification');

package/lib/task/index.ts

@@ -10,7 +10,6 @@ Commands:
   ls [--all | --blocked | --completed]   List tasks (default: active)
   show [--task <ref>]                    Print a task.md
   status [--task <ref>]                  Aggregated status view (metadata / artifacts / git / platform)
-  validate <ref> [options] -- <command>  Run host validation in snapshot or inplace scope
 
 Examples:
   ai task cat 11 analysis
@@ -30,7 +29,6 @@ Examples:
   ai task show 11
   ai task show TASK-20260612-162737
   ai task status 11
-  ai task validate 11 -- npm test
 
 Run 'ai task <command> --help' for details.`;
 
@@ -95,12 +93,6 @@ export async function runTask(args: string[]): Promise<void> {
       status(rest);
       break;
     }
-    case 'validate': {
-      const { validate } = await import('./commands/validate.ts');
-      const exitCode = await validate(rest);
-      if (exitCode !== 0) process.exitCode = exitCode;
-      break;
-    }
     default:
       process.stderr.write(`Unknown task command: ${subcommand}\n\n`);
       process.stdout.write(`${USAGE}\n`);

package/lib/task/orchestration.ts

@@ -119,6 +119,7 @@ type OrchestrationResult = Readonly<{
   taskId: string | null;
   run: OrchestrationRun | null;
   next: OrchestrationNext | null;
+  warnings?: readonly Readonly<{ code: string; message: string; action: string }>[];
   error: Readonly<{
     code: string;
     message: string;
@@ -181,7 +182,7 @@ function orchestrationPath(taskDir: string): string {
   return path.join(taskDir, 'orchestration.json');
 }
 
-const ORCHESTRATION_STATE_INVALID_MESSAGE = 'orchestration.json does not match the current runtime structure; finish or clear active runs before upgrading';
+const ORCHESTRATION_STATE_INVALID_MESSAGE = 'orchestration.json does not match the current runtime structure; the file was left unchanged; rebuild the sandbox or manually repair the state before retrying';
 
 class OrchestrationStateError extends Error {
   readonly code = 'ORCHESTRATION_STATE_INVALID';

package/lib/task/verification-engine.ts

@@ -341,9 +341,6 @@ function checkOrchestrationEvidence({ taskDir }: any): any {
           || (activatedCodex && (
             host?.kind !== 'codex-lifecycle-v2'
             || host.protocolVersion !== provenance.protocolVersion
-            || host.packageVersion !== provenance.packageVersion
-            || host.internalExecutableBuildHash !== provenance.internalExecutableBuildHash
-            || host.lifecycleContractHash !== provenance.lifecycleContractHash
             || host.hookDefinitionHash !== provenance.hookDefinitionHash
             || host.hookSource !== provenance.hookSource
             || host.hookSourcePathDigest !== provenance.hookSourcePathDigest

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fitlab-ai/agent-infra",
-  "version": "0.9.9",
+  "version": "0.9.10",
   "description": "Bootstrap tool for AI multi-tool collaboration infrastructure — works with Claude Code, Codex, Antigravity CLI, and OpenCode",
   "license": "MIT",
   "type": "module",

package/templates/.agents/QUICKSTART.en.md

@@ -27,11 +27,10 @@ npm install
 npm run build
 ```
 
-Lifecycle hooks always invoke `agent-infra-internal` through `PATH`; they do not implicitly switch to checkout source or `dist`. In a Codex sandbox, the controller's `PATH`-first shim is authoritative and binds the controller's selected executable. Skills, rules, hooks, and task data continue to come from the current checkout. The commands above develop the CLI itself and do not change hook executable selection. If shell commands must also resolve to this checkout, link it and compare the active version with the package version:
+Lifecycle hooks always invoke `agent-infra-internal` through `PATH`; they do not implicitly switch to checkout source or `dist`. In a Codex sandbox, the controller's `PATH`-first shim is authoritative and binds the controller's selected executable. Skills, rules, hooks, and task data continue to come from the current checkout. The commands above develop the CLI itself and do not change hook executable selection. To run the CLI from the current checkout, invoke the build output directly and compare its version with the package version. Do not run `npm link` on the host: it writes to npm's global prefix and can shadow a stable installation managed by Homebrew or npm.
 
 ```bash
-npm link
-ai version --raw
+node ./dist/bin/cli.js version --raw
 node -p "'v' + require('./package.json').version"
 ```