@fitlab-ai/agent-infra 0.9.9 → 0.9.11

package/dist/lib/task/ledger.js

@@ -12,18 +12,25 @@ const LEDGER_TERMINAL = new Set(['confirmed', 'closed', 'human-decided']);
 // Statuses that represent a decision row awaiting or carrying a human ruling.
 const HUMAN_DECISION_STATUSES = new Set(['needs-human-decision', 'human-decided']);
 const FINDING_STATUSES = new Set(['open', 'accepted', 'adjusted', 'refuted', 'cannot-judge', 'confirmed', 'needs-human-decision', 'closed', 'human-decided']);
+const LEDGER_SECTION_MISSING_CODE = 'LEDGER_SECTION_MISSING';
+const LEDGER_SECTION_MISSING_MESSAGE = 'review disagreement ledger section is missing';
 function isReviewStage(stage) {
     return stage === 'analysis' || stage === 'plan' || stage === 'code';
 }
 // Parse all rows of the disagreement ledger table. Skips the heading, the
 // header row (`| id | ... |`) and the `|---|` separator; ignores non-`|` lines.
 // Rows with fewer than 6 columns are skipped (mirrors the JS gate parser).
-function parseLedger(content) {
+function parseLedgerDocument(content) {
     const table = parseTable(content, { sectionAliases: LEDGER_HEADINGS, columns: LEDGER_COLUMNS });
-    return table?.rows.map(({ values, sourceLine }) => ({
-        id: values.id, stage: values.stage, round: values.round, severity: values.severity,
-        status: values.status, evidence: values.evidence, sourceLine
-    })) ?? [];
+    if (!table)
+        return { present: false, rows: [] };
+    return {
+        present: true,
+        rows: table.rows.map(({ values, sourceLine }) => ({
+            id: values.id, stage: values.stage, round: values.round, severity: values.severity,
+            status: values.status, evidence: values.evidence, sourceLine
+        }))
+    };
 }
 function validateLedgerRows(rows) {
     const seen = new Set();
@@ -104,5 +111,5 @@ function nextHdId(rows) {
     }
     return `HD-${max + 1}`;
 }
-export { LEDGER_HEADINGS, LEDGER_COLUMNS, parseLedger, nextHdId, isReviewStage, validateLedgerRows, summarizeLedgerStage, LEDGER_TERMINAL, HUMAN_DECISION_STATUSES };
+export { LEDGER_HEADINGS, LEDGER_COLUMNS, parseLedgerDocument, nextHdId, isReviewStage, validateLedgerRows, summarizeLedgerStage, LEDGER_TERMINAL, HUMAN_DECISION_STATUSES, LEDGER_SECTION_MISSING_CODE, LEDGER_SECTION_MISSING_MESSAGE };
 //# sourceMappingURL=ledger.js.map

package/dist/lib/task/lifecycle.js

@@ -7,6 +7,8 @@ import { parseTypedTaskFrontmatter } from './frontmatter.js';
 import { locateHotTaskDirs, resolveTaskRef, TASK_ID_RE } from './resolve-ref.js';
 import { configuredShortIdLength, executeShortIdCommand, loadShortIdByTaskId, mutateShortIdRegistry } from './short-id.js';
 import { captureTaskWriteMetadata, writeTask } from './write.js';
+import { validateCurrentTaskContract } from './current-contract.js';
+import { isValidAgentInfraVersion } from '../version.js';
 const lifecycleIntentCatalog = [
     'block', 'activate', 'cancel', 'complete', 'close-codescan', 'close-dependabot', 'restore'
 ];
@@ -57,6 +59,9 @@ function failed(request, error, extra = {}) {
         error, ...extra
     };
 }
+export function taskLifecycleFailure(request, error, taskId = null) {
+    return failed(request, error, { taskId });
+}
 function normalizedRequest(request) {
     if (!request || typeof request !== 'object' || !lifecycleIntentCatalog.includes(request.intent)) {
         return { code: 'LIFECYCLE_PAYLOAD_INVALID', message: 'intent is not in the lifecycle catalog' };
@@ -366,6 +371,11 @@ function applyTaskLifecycle(requestInput, options = {}) {
         return failed(request, { code: 'LIFECYCLE_IDENTITY_INVALID', message: 'task.md id does not match its lifecycle task id' }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
     if (!locateActivityLog(content) && !allowsManualOverride(options, 'LIFECYCLE_LOG_MISSING'))
         return failed(request, { code: 'LIFECYCLE_LOG_MISSING', message: 'task has no unique Activity Log section' }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
+    if (spec.target === 'active') {
+        const contract = validateCurrentTaskContract(content);
+        if (!contract.ok)
+            return failed(request, { code: 'LIFECYCLE_DOCUMENT_INVALID', message: contract.message }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
+    }
     const registryRequest = executeShortIdCommand({
         operation: 'list', activeDir: path.join(repoRoot, '.agents', 'workspace', 'active'),
         shortIdLength: configuredShortIdLength(repoRoot)
@@ -394,6 +404,9 @@ function applyTaskLifecycle(requestInput, options = {}) {
         }
         if (journal.taskId !== taskId || journal.intent !== request.intent)
             return failed(request, { code: 'LIFECYCLE_INTENT_CONFLICT', message: 'an in-progress lifecycle journal belongs to a different request' }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath, journalPath: initialJournalPath });
+        if (spec.target === 'active' && !isValidAgentInfraVersion(journal.metadata.agentInfraVersion)) {
+            return failed(request, { code: 'LIFECYCLE_DOCUMENT_INVALID', message: `journal metadata agentInfraVersion must be a valid v-prefixed semver (received ${journal.metadata.agentInfraVersion})` }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath, journalPath: initialJournalPath });
+        }
         if (request.dryRun) {
             if (!journal.failure)
                 return failed(request, { code: 'LIFECYCLE_JOURNAL_INVALID', message: 'existing lifecycle journal has no durable failure evidence for a read-only probe' }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath, journalPath: initialJournalPath });
@@ -411,6 +424,9 @@ function applyTaskLifecycle(requestInput, options = {}) {
         catch (error) {
             return failed(request, { code: 'LIFECYCLE_METADATA_FAILED', message: String(error) }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
         }
+        if (spec.target === 'active' && !isValidAgentInfraVersion(metadata.agentInfraVersion)) {
+            return failed(request, { code: 'LIFECYCLE_DOCUMENT_INVALID', message: `metadata agentInfraVersion must be a valid v-prefixed semver (received ${metadata.agentInfraVersion})` }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
+        }
         journal = { version: 1, taskId, intent: request.intent, intentDigest: digest, sourceState, targetState: spec.target, metadata, completedSteps: [] };
         if (request.dryRun) {
             const plannedMutations = mutationsFor(request, content, metadata, restoredFiles, allowsManualOverride(options, 'LIFECYCLE_LOG_MISSING'));

package/dist/lib/task/orchestration.js

@@ -2,9 +2,10 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { parseTypedTaskFrontmatter } from './frontmatter.js';
-import { parseReviewSummary } from './review-artifacts.js';
+import { validateCurrentTaskContract } from './current-contract.js';
+import { parseReviewSummary, resolveCanonicalVerdict } from './review-artifacts.js';
 import { inspectArtifactDirectory } from './artifact-lifecycle.js';
-import { parseLedger, summarizeLedgerStage, validateLedgerRows } from './ledger.js';
+import { LEDGER_SECTION_MISSING_CODE, LEDGER_SECTION_MISSING_MESSAGE, parseLedgerDocument, summarizeLedgerStage, validateLedgerRows } from './ledger.js';
 import { resolveTaskRef } from './resolve-ref.js';
 import { activateDelegation, abortPreparedDelegation, completeDelegationStage, consumeDelegation, dispatchDelegation, foldBlankToNull, isDelegationReceipt, managedDelegationRole, prepareDelegation, sealDelegation } from './delegation-receipts.js';
 import { normalizeAgentClients } from '../agent-clients/config.js';
@@ -25,7 +26,7 @@ function supportsLifecycleDelegation(client) {
 function orchestrationPath(taskDir) {
     return path.join(taskDir, 'orchestration.json');
 }
-const ORCHESTRATION_STATE_INVALID_MESSAGE = 'orchestration.json does not match the current runtime structure; finish or clear active runs before upgrading';
+const ORCHESTRATION_STATE_INVALID_MESSAGE = 'orchestration.json does not match the current runtime structure; the file was left unchanged; rebuild the sandbox or manually repair the state before retrying';
 class OrchestrationStateError extends Error {
     code = 'ORCHESTRATION_STATE_INVALID';
     taskId;
@@ -350,9 +351,21 @@ function hasReviewAfterArtifact(taskDir, family, reviewFamily) {
 function latestReviewApproved(taskDir, family) {
     const round = highestRound(taskDir, family);
     if (round === 0)
-        return false;
-    const parsed = parseReviewSummary(fs.readFileSync(path.join(taskDir, artifactName(family, round)), 'utf8'));
-    return parsed.ok && parsed.summary.verdict === 'Approved' && parsed.summary.counts !== null;
+        return { approved: false, error: null };
+    let content;
+    try {
+        content = fs.readFileSync(path.join(taskDir, artifactName(family, round)), 'utf8');
+    }
+    catch (error) {
+        return { approved: false, error: String(error) };
+    }
+    const parsed = parseReviewSummary(content);
+    if (!parsed.ok)
+        return { approved: false, error: `${parsed.code}: ${parsed.message}` };
+    const verdict = resolveCanonicalVerdict(parsed.summary);
+    if (!verdict.ok)
+        return { approved: false, error: `${verdict.code}: ${verdict.message}` };
+    return { approved: verdict.verdict === 'Approved', error: null };
 }
 function routeFromFacts(taskDir) {
     const analysisRound = highestRound(taskDir, 'analysis');
@@ -369,7 +382,10 @@ function routeFromFacts(taskDir) {
         const round = analysisReviewRound + 1;
         return { action: 'review-analysis', role: 'reviewer', stage: 'review-analysis', round, artifact: artifactName('review-analysis', round) };
     }
-    if (!latestReviewApproved(taskDir, 'review-analysis')) {
+    const analysisVerdict = latestReviewApproved(taskDir, 'review-analysis');
+    if (analysisVerdict.error)
+        return { error: analysisVerdict.error };
+    if (!analysisVerdict.approved) {
         const round = analysisRound + 1;
         return { action: 'analyze-task', role: 'executor', stage: 'analysis', round, artifact: artifactName('analysis', round) };
     }
@@ -381,7 +397,10 @@ function routeFromFacts(taskDir) {
         const round = planReviewRound + 1;
         return { action: 'review-plan', role: 'reviewer', stage: 'review-plan', round, artifact: artifactName('review-plan', round) };
     }
-    if (!latestReviewApproved(taskDir, 'review-plan')) {
+    const planVerdict = latestReviewApproved(taskDir, 'review-plan');
+    if (planVerdict.error)
+        return { error: planVerdict.error };
+    if (!planVerdict.approved) {
         const round = planRound + 1;
         return { action: 'plan-task', role: 'executor', stage: 'plan', round, artifact: artifactName('plan', round) };
     }
@@ -393,7 +412,10 @@ function routeFromFacts(taskDir) {
         const round = codeReviewRound + 1;
         return { action: 'review-code', role: 'reviewer', stage: 'review-code', round, artifact: artifactName('review-code', round) };
     }
-    if (!latestReviewApproved(taskDir, 'review-code')) {
+    const codeVerdict = latestReviewApproved(taskDir, 'review-code');
+    if (codeVerdict.error)
+        return { error: codeVerdict.error };
+    if (!codeVerdict.approved) {
         const round = codeRound + 1;
         return { action: 'code-task', role: 'executor', stage: 'code', round, artifact: artifactName('code', round) };
     }
@@ -418,13 +440,25 @@ function routeOrchestration(taskRef, options = {}) {
         return failed('ORCHESTRATION_TASK_READ_FAILED', String(error), resolved.taskId);
     }
     let metadata;
-    try {
-        metadata = parseTypedTaskFrontmatter(content);
+    let currentLedger = null;
+    if (resolved.state === 'active') {
+        const contract = validateCurrentTaskContract(content);
+        if (!contract.ok)
+            return failed('ORCHESTRATION_CURRENT_CONTRACT_INVALID', contract.message, resolved.taskId);
+        metadata = contract.metadata;
+        currentLedger = contract.ledger;
     }
-    catch (error) {
-        return failed('ORCHESTRATION_TASK_INVALID', error instanceof Error ? error.message : String(error), resolved.taskId);
+    else {
+        try {
+            metadata = parseTypedTaskFrontmatter(content);
+        }
+        catch (error) {
+            return failed('ORCHESTRATION_TASK_INVALID', error instanceof Error ? error.message : String(error), resolved.taskId);
+        }
     }
     const routed = routeFromFacts(resolved.taskDir);
+    if (routed && 'error' in routed)
+        return failed('ORCHESTRATION_REVIEW_INVALID', routed.error, resolved.taskId);
     if (!routed)
         return failed('ORCHESTRATION_ROUTE_UNKNOWN', 'cannot determine a unique lifecycle action', resolved.taskId);
     const run = readRun(resolved.taskDir);
@@ -440,7 +474,10 @@ function routeOrchestration(taskRef, options = {}) {
         if (!review.ok || review.summary.manualValidation === null) {
             return failed('ORCHESTRATION_REVIEW_INVALID', 'latest code review has no numeric manual-validation count', resolved.taskId);
         }
-        const rows = parseLedger(content);
+        const ledger = currentLedger ?? parseLedgerDocument(content);
+        if (!ledger.present)
+            return failed('ORCHESTRATION_CURRENT_CONTRACT_INVALID', `${LEDGER_SECTION_MISSING_CODE}: ${LEDGER_SECTION_MISSING_MESSAGE}`, resolved.taskId);
+        const rows = ledger.rows;
         const ledgerError = validateLedgerRows(rows);
         if (ledgerError)
             return failed('ORCHESTRATION_LEDGER_INVALID', ledgerError.message, resolved.taskId);

package/dist/lib/task/review-artifacts.js

@@ -159,27 +159,46 @@ function finalizeReviewSummaryContent(content, counts) {
         content: content.slice(0, parsed.findingsStart) + line + content.slice(parsed.findingsEnd)
     };
 }
+function resolveCanonicalVerdict(summary) {
+    if (summary.counts === null) {
+        return {
+            ok: false,
+            verdict: null,
+            code: 'REVIEW_FINDING_COUNTS_NOT_FINALIZED',
+            message: 'review summary finding counts are not finalized'
+        };
+    }
+    if (summary.verdict === 'Approved' && !equalCounts(summary.counts, { blocker: 0, major: 0, minor: 0 })) {
+        return {
+            ok: false,
+            verdict: null,
+            code: 'REVIEW_VERDICT_FINDING_MISMATCH',
+            message: 'Approved verdict requires zero finalized findings'
+        };
+    }
+    return { ok: true, verdict: summary.verdict };
+}
 function parseVerdict(reviewPath) {
     if (!fs.existsSync(reviewPath)) {
-        return { ok: false, verdict: null, message: `Review artifact not found: ${path.basename(reviewPath)}` };
+        return { ok: false, verdict: null, code: 'REVIEW_ARTIFACT_NOT_FOUND', message: `Review artifact not found: ${path.basename(reviewPath)}` };
+    }
+    let content;
+    try {
+        content = fs.readFileSync(reviewPath, 'utf8');
+    }
+    catch (error) {
+        return { ok: false, verdict: null, code: 'REVIEW_ARTIFACT_READ_FAILED', message: `Review artifact could not be read: ${String(error)}` };
     }
-    const parsed = parseReviewSummary(fs.readFileSync(reviewPath, 'utf8'));
+    const parsed = parseReviewSummary(content);
     if (!parsed.ok) {
         return {
             ok: false,
             verdict: null,
+            code: parsed.code === 'REVIEW_SUMMARY_PLACEHOLDER_INVALID' ? parsed.code : 'REVIEW_SUMMARY_NOT_FOUND',
             message: `cannot parse review summary in ${path.basename(reviewPath)}: ${parsed.message}`
         };
     }
-    const { verdict, counts } = parsed.summary;
-    if (verdict !== 'Approved')
-        return { ok: true, verdict };
-    return {
-        ok: true,
-        verdict: counts && equalCounts(counts, { blocker: 0, major: 0, minor: 0 })
-            ? 'Approved'
-            : 'Approved-with-issues'
-    };
+    return resolveCanonicalVerdict(parsed.summary);
 }
-export { artifactName, equalCounts, escapeRegExp, extractSection, finalizeReviewSummaryContent, maxRound, normalizeVerdict, parseReviewSummary, parseVerdict };
+export { artifactName, equalCounts, escapeRegExp, extractSection, finalizeReviewSummaryContent, maxRound, normalizeVerdict, parseReviewSummary, parseVerdict, resolveCanonicalVerdict };
 //# sourceMappingURL=review-artifacts.js.map

package/dist/lib/task/review-finalization.js

@@ -1,10 +1,11 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
-import { locateActivityLog, pairEntries } from './activity-log.js';
+import { locateActivityLog, pairEntries, startedBackedRows } from './activity-log.js';
 import { parseArtifactName, validateCompletedArtifact } from './artifact-lifecycle.js';
-import { parseLedger, summarizeLedgerStage, validateLedgerRows } from './ledger.js';
+import { LEDGER_SECTION_MISSING_CODE, LEDGER_SECTION_MISSING_MESSAGE, parseLedgerDocument, summarizeLedgerStage, validateLedgerRows } from './ledger.js';
 import { finalizeReviewSummaryContent } from './review-artifacts.js';
+import { inspectDecisionDetailDuplicates, repairDecisionDetailDuplicates } from './decision-details.js';
 import { resolveTaskRef } from './resolve-ref.js';
 import { validateLifecycleExecution } from './lifecycle-execution.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.js';
@@ -40,7 +41,7 @@ function openReviewRound(content, action, round) {
     if (!section)
         return false;
     const expected = `${action} (Round ${round})`;
-    return pairEntries(section.entries).filter((row) => (row.step === expected && Boolean(row.started) && !row.done)).length === 1;
+    return startedBackedRows(pairEntries(section.entries)).filter((row) => (row.step === expected && !row.done)).length === 1;
 }
 function cleanupTemp(fileSystem, tempPath) {
     try {
@@ -103,7 +104,11 @@ function finalizeReviewSummaryUnlocked(request, options = {}) {
     }
     let rows;
     try {
-        rows = parseLedger(taskContent);
+        const ledger = parseLedgerDocument(taskContent);
+        if (!ledger.present) {
+            return failed(request, 'REVIEW_LEDGER_INVALID', `${LEDGER_SECTION_MISSING_CODE}: ${LEDGER_SECTION_MISSING_MESSAGE}`, resolved.taskId);
+        }
+        rows = ledger.rows;
     }
     catch (error) {
         return failed(request, 'REVIEW_LEDGER_INVALID', String(error), resolved.taskId);
@@ -113,11 +118,19 @@ function finalizeReviewSummaryUnlocked(request, options = {}) {
         return failed(request, 'REVIEW_LEDGER_INVALID', `${ledgerError.code}: ${ledgerError.message}`, resolved.taskId);
     }
     const stageStatus = summarizeLedgerStage(rows, stage);
-    const transformed = finalizeReviewSummaryContent(artifactContent, stageStatus.unresolvedFindingCounts);
+    const repaired = repairDecisionDetailDuplicates(artifactContent);
+    if (!repaired.ok) {
+        return failed(request, 'REVIEW_DECISION_DETAIL_INVALID', `${repaired.code}: ${repaired.message}`, resolved.taskId, stageStatus);
+    }
+    const detailInspection = inspectDecisionDetailDuplicates(repaired.content);
+    if (!detailInspection.ok) {
+        return failed(request, 'REVIEW_DECISION_DETAIL_INVALID', `${detailInspection.code}: ${detailInspection.message}`, resolved.taskId, stageStatus);
+    }
+    const transformed = finalizeReviewSummaryContent(repaired.content, stageStatus.unresolvedFindingCounts);
     if (!transformed.ok) {
         return failed(request, transformed.code, transformed.message, resolved.taskId, stageStatus);
     }
-    if (!transformed.changed) {
+    if (!repaired.changed && !transformed.changed) {
         return {
             ...failed(request, 'REVIEW_ARTIFACT_CONFLICT', '', resolved.taskId, stageStatus),
             status: 'no-op',

package/dist/lib/task/verification-engine.js

@@ -12,8 +12,10 @@ import { resolveMaterializedReviewedHeadRelation } from "../platform/change-requ
 import { resolveReviewedHeadRelation } from "../platform/merged-pr-equivalence.js";
 import { resolveLocalReviewedCommitRelation } from "../git/reviewed-commit-equivalence.js";
 import { parseTypedTaskFrontmatter } from "./frontmatter.js";
-import { parseLedger, summarizeLedgerStage, validateLedgerRows } from "./ledger.js";
+import { LEDGER_SECTION_MISSING_CODE, LEDGER_SECTION_MISSING_MESSAGE, parseLedgerDocument, summarizeLedgerStage, validateLedgerRows } from "./ledger.js";
+import { isValidAgentInfraVersion } from "../version.js";
 import { equalCounts, parseReviewSummary } from "./review-artifacts.js";
+import { inspectDecisionDetailDuplicates } from "./decision-details.js";
 import { loadVerificationConfig } from "./verification-config.js";
 import { snapshotReview } from "../git/review-snapshot.js";
 import { OrchestrationStateError, readRun } from "./orchestration.js";
@@ -34,7 +36,6 @@ const DEFAULT_REQUIRED_FIELDS = [
     "assigned_to"
 ];
 const DATE_TIME_PATTERN = /^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(?:[+-]\d{2}:\d{2})?$/;
-const AGENT_INFRA_VERSION_PATTERN = /^v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 const ACTIVITY_LOG_PATTERN = /^- (\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(?:[+-]\d{2}:\d{2})?) — \*\*(.+?)\*\* by (.+?) — (.+)$/;
 // Start markers (action suffixed with ` [started]`) are excluded from the
 // "latest action" / freshness computation so a step's in-flight marker never
@@ -89,6 +90,8 @@ function runCheck(type, context, shared) {
             return checkTaskMeta(context);
         case "artifact":
             return checkArtifact(context);
+        case "decision-details":
+            return checkDecisionDetails(context);
         case "implementation-input":
             return checkImplementationInput(context);
         case "activity-log":
@@ -308,9 +311,6 @@ function checkOrchestrationEvidence({ taskDir }) {
                 if (!provenance
                     || (activatedCodex && (host?.kind !== 'codex-lifecycle-v2'
                         || host.protocolVersion !== provenance.protocolVersion
-                        || host.packageVersion !== provenance.packageVersion
-                        || host.internalExecutableBuildHash !== provenance.internalExecutableBuildHash
-                        || host.lifecycleContractHash !== provenance.lifecycleContractHash
                         || host.hookDefinitionHash !== provenance.hookDefinitionHash
                         || host.hookSource !== provenance.hookSource
                         || host.hookSourcePathDigest !== provenance.hookSourcePathDigest
@@ -355,18 +355,17 @@ function checkTaskMeta({ taskDir, config }) {
     const metadata = task.metadata;
     const requiredFields = config.required_fields || DEFAULT_REQUIRED_FIELDS;
     const missingFields = requiredFields.filter((field) => isBlank(metadata[field]));
-    const blockingMissingFields = missingFields.filter((field) => field !== "agent_infra_version");
+    const currentTask = metadata.status === 'active';
+    const blockingMissingFields = missingFields.filter((field) => field !== "agent_infra_version" || currentTask);
     const warnings = [];
-    if (missingFields.includes("agent_infra_version")) {
+    if (missingFields.includes("agent_infra_version") && !currentTask) {
         warnings.push("field 'agent_infra_version' missing — historical task or skipped version stamp");
     }
     if (blockingMissingFields.length > 0) {
         return failResult("task-meta", `Missing required fields: ${blockingMissingFields.join(", ")}`);
     }
-    if (!isBlank(metadata.agent_infra_version) &&
-        metadata.agent_infra_version !== "unknown" &&
-        !AGENT_INFRA_VERSION_PATTERN.test(metadata.agent_infra_version)) {
-        return failResult("task-meta", `Invalid agent_infra_version: ${metadata.agent_infra_version}`);
+    if (currentTask && !isValidAgentInfraVersion(metadata.agent_infra_version)) {
+        return failResult("task-meta", `Invalid agent_infra_version: ${String(metadata.agent_infra_version ?? 'missing')}`);
     }
     const invalidDates = ["created_at", "updated_at", "completed_at", "blocked_at", "cancelled_at"]
         .filter((field) => !isBlank(metadata[field]) && !DATE_TIME_PATTERN.test(metadata[field]));
@@ -530,6 +529,21 @@ function checkArtifact({ taskDir, config, artifactFile }) {
     }
     return passResult("artifact", `${path.basename(artifactPath)} passed (${requiredSections.length} sections)`);
 }
+function checkDecisionDetails({ taskDir, artifactFile }) {
+    const resolvedArtifact = resolveArtifactPath(taskDir, "", artifactFile);
+    if (!resolvedArtifact.ok)
+        return failResult("decision-details", resolvedArtifact.message);
+    const artifactPath = resolvedArtifact.path;
+    const stat = safeStat(artifactPath);
+    if (!stat?.isFile())
+        return failResult("decision-details", `Artifact not found: ${path.basename(artifactPath)}`);
+    if (stat.size === 0)
+        return passResult("decision-details", `${path.basename(artifactPath)} contains no decision details`);
+    const inspection = inspectDecisionDetailDuplicates(fs.readFileSync(artifactPath, "utf8"));
+    if (!inspection.ok)
+        return failResult("decision-details", `${path.basename(artifactPath)}: ${inspection.message}`);
+    return passResult("decision-details", `${path.basename(artifactPath)} has no duplicate decision detail ids`);
+}
 function checkReviewSummary({ taskDir, config, artifactFile }) {
     const stage = String(config.stage || "");
     if (!["analysis", "plan", "code"].includes(stage)) {
@@ -550,7 +564,10 @@ function checkReviewSummary({ taskDir, config, artifactFile }) {
         return failResult("review-summary", task.message);
     let rows;
     try {
-        rows = parseLedger(task.content);
+        const ledger = parseLedgerDocument(task.content);
+        if (!ledger.present)
+            return failResult("review-summary", `${LEDGER_SECTION_MISSING_CODE}: ${LEDGER_SECTION_MISSING_MESSAGE}`);
+        rows = ledger.rows;
     }
     catch (error) {
         return failResult("review-summary", `Invalid disagreement ledger: ${String(error)}`);
@@ -820,13 +837,12 @@ function checkReviewLedger({ taskDir, config }) {
     if (!task.ok) {
         return failResult("review-ledger", task.message);
     }
-    const section = getSectionContent(task.content, LEDGER_SECTION_NAMES);
-    if (!section.trim()) {
-        return passResult("review-ledger", "No disagreement ledger section; treated as no open disagreements");
-    }
     let rows;
     try {
-        rows = parseLedger(task.content).map((row) => [
+        const ledger = parseLedgerDocument(task.content);
+        if (!ledger.present)
+            return failResult("review-ledger", `${LEDGER_SECTION_MISSING_CODE}: ${LEDGER_SECTION_MISSING_MESSAGE}`);
+        rows = ledger.rows.map((row) => [
             row.id, row.stage, row.round, row.severity, row.status, row.evidence
         ]);
     }
@@ -1071,7 +1087,11 @@ function formatPostReviewExemptions(exemptions) {
 }
 function resolvePostReviewExemption(content) {
     try {
-        const rows = parseLedger(content);
+        const ledger = parseLedgerDocument(content);
+        if (!ledger.present) {
+            return { ok: false, code: "POST_REVIEW_EXEMPTION_INVALID", message: `${LEDGER_SECTION_MISSING_CODE}: ${LEDGER_SECTION_MISSING_MESSAGE}` };
+        }
+        const rows = ledger.rows;
         const invalid = validateLedgerRows(rows);
         if (invalid) {
             return {

package/dist/lib/task/verification-review.js

@@ -1,3 +1,3 @@
 export { extractReviewBaseline, extractReviewDiffBase, extractReviewDiffFingerprint, extractReviewedSnapshotTree, findAuthoritativeReviewCodeArtifact, loadPostReviewConfig, parseReviewVerdict, resolvePostReviewGlobs } from './review-fingerprint.js';
-export { parseLedger, summarizeLedgerStage, validateLedgerRows } from './ledger.js';
+export { parseLedgerDocument, summarizeLedgerStage, validateLedgerRows } from './ledger.js';
 //# sourceMappingURL=verification-review.js.map

package/dist/lib/task/workspace-snapshot.js

@@ -26,12 +26,6 @@ function captureWorktreeTree(repoRoot, forcedPath) {
         fs.rmSync(tempDir, { recursive: true, force: true });
     }
 }
-function captureLegacyWorkspaceSnapshot(repoRoot, taskId) {
-    const workspaceRelative = taskId
-        ? `.agents/workspace/active/${taskId}`
-        : '.agents/workspace/active';
-    return captureWorktreeTree(repoRoot, workspaceRelative);
-}
 function taskFileFingerprints(stateRoot, taskId) {
     const activeRoot = path.join(stateRoot, '.agents', 'workspace', 'active');
     const roots = taskId ? [path.join(activeRoot, taskId)] : [activeRoot];
@@ -46,6 +40,8 @@ function taskFileFingerprints(stateRoot, taskId) {
         }
         if (!stat.isFile() && !stat.isSymbolicLink())
             return;
+        if (relative.startsWith('.agents/workspace/active/') && path.posix.basename(relative) === 'orchestration.json')
+            return;
         const content = stat.isSymbolicLink()
             ? Buffer.from(fs.readlinkSync(absolute))
             : fs.readFileSync(absolute);
@@ -81,13 +77,11 @@ function decodeWorkspaceFingerprint(value) {
         throw new Error(`ORCHESTRATION_SNAPSHOT_FAILED: ${error instanceof Error ? error.message : String(error)}`);
     }
 }
-function captureWorkspaceSnapshot(contextOrRoot, taskId) {
-    if (typeof contextOrRoot === 'string')
-        return captureLegacyWorkspaceSnapshot(contextOrRoot, taskId ?? null);
+function captureWorkspaceSnapshot(context) {
     return encodeWorkspaceFingerprint({
         version: 2,
-        gitTree: captureWorktreeTree(contextOrRoot.gitRoot, null),
-        taskFiles: taskFileFingerprints(contextOrRoot.stateRoot, contextOrRoot.taskId)
+        gitTree: captureWorktreeTree(context.gitRoot, null),
+        taskFiles: taskFileFingerprints(context.stateRoot, context.taskId)
     });
 }
 function captureRepositorySnapshot(repoRoot) {

package/dist/lib/task/write.js

@@ -1,10 +1,11 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { VERSION } from '../version.js';
+import { isValidAgentInfraVersion, VERSION } from '../version.js';
 import { parseTypedTaskFrontmatter, updateTaskFrontmatter } from './frontmatter.js';
 import { resolveTaskRef } from './resolve-ref.js';
 import { allowsManualOverride } from './guard-override.js';
 import { mutateTableRow, upsertSection } from './sections.js';
+import { validateCurrentTaskContract } from './current-contract.js';
 const DEFAULT_FILE_SYSTEM = {
     readFileSync: (file) => fs.readFileSync(file, 'utf8'),
     statModeSync: (file) => fs.statSync(file).mode,
@@ -84,6 +85,12 @@ function writeTask(request, options = {}) {
     catch (error) {
         return failure(request, identity, 'TASK_READ_FAILED', error instanceof Error ? error.message : String(error));
     }
+    if (resolved.state === 'active') {
+        const contract = validateCurrentTaskContract(original);
+        if (!contract.ok) {
+            return failure(request, identity, contract.code, contract.message);
+        }
+    }
     let candidate = original;
     const operations = [];
     try {
@@ -154,6 +161,9 @@ function writeTask(request, options = {}) {
     catch (error) {
         return failure(request, identity, 'METADATA_CAPTURE_FAILED', error instanceof Error ? error.message : String(error), operations);
     }
+    if (resolved.state === 'active' && !isValidAgentInfraVersion(metadata.agentInfraVersion)) {
+        return failure(request, identity, 'TASK_CURRENT_CONTRACT_INVALID', `metadata agentInfraVersion must be a valid v-prefixed semver (received ${metadata.agentInfraVersion})`, operations, metadata);
+    }
     if (candidate === original) {
         return {
             status: 'no-op',

package/dist/lib/update.js

@@ -8,27 +8,9 @@ import { renderFile, copySkillDir } from './render.js';
 const defaults = JSON.parse(fs.readFileSync(new URL('./defaults.json', import.meta.url), 'utf8'));
 const CONFIG_DIR = '.agents';
 const CONFIG_PATH = path.join(CONFIG_DIR, '.airc.json');
-// One-time migration of the legacy project-level PR switch to the three-state
-// `prFlow` preference. `true` (the old default / "PR flow on") maps to the
-// strong constraint `required`; `false` maps to `disabled`. A missing or
-// already-migrated config is left untouched (idempotent). Returns the new
-// prFlow value when a migration happened, otherwise null.
-function migratePrFlow(config) {
-    if (config.requiresPullRequest === true) {
-        delete config.requiresPullRequest;
-        config.prFlow = 'required';
-        return 'required';
-    }
-    if (config.requiresPullRequest === false) {
-        delete config.requiresPullRequest;
-        config.prFlow = 'disabled';
-        return 'disabled';
-    }
-    return null;
-}
-async function cmdUpdate() {
+async function cmdSync() {
     console.log('');
-    console.log('  ai update');
+    console.log('  ai sync');
     console.log('  ==================================');
     console.log('');
     // check config exists
@@ -61,7 +43,6 @@ async function cmdUpdate() {
     const sandboxAdded = !config.sandbox;
     const taskAdded = !config.task;
     const labelsAdded = !config.labels;
-    const prFlowMigrated = migratePrFlow(config);
     if (platformAdded)
         config.platform = structuredClone(defaults.platform);
     if (sandboxAdded)
@@ -78,19 +59,13 @@ async function cmdUpdate() {
         platformType,
         language
     });
-    info(`Updating seed files for: ${project}`);
+    info(`Syncing seed files for: ${project}`);
     console.log('');
     // update skill
     copySkillDir(path.join(templateDir, '.agents', 'skills', 'update-agent-infra'), path.join('.agents', 'skills', 'update-agent-infra'), replacements, language, platformType);
     ok('Updated .agents/skills/update-agent-infra/');
     renderFile(path.join(templateDir, '.agents', 'scripts', 'lib', 'agent-infra-package.js'), path.join('.agents', 'scripts', 'lib', 'agent-infra-package.js'), replacements);
     ok('Updated .agents/scripts/lib/agent-infra-package.js');
-    try {
-        fs.unlinkSync(path.join('.agents', 'skills', 'update-agent-infra', 'scripts', 'sync-templates.cjs'));
-    }
-    catch {
-        // Ignore missing legacy script from pre-ESM installs.
-    }
     const added = {
         managed: workflowPlan.projectAssets.registry.managed.filter((entry) => !currentRegistry.managed.includes(entry)),
         merged: workflowPlan.projectAssets.registry.merged.filter((entry) => !currentRegistry.merged.includes(entry))
@@ -110,7 +85,7 @@ async function cmdUpdate() {
                 ok(`  merged: ${entry}`);
             }
         }
-        else if (platformAdded || sandboxAdded || taskAdded || labelsAdded || prFlowMigrated) {
+        else if (platformAdded || sandboxAdded || taskAdded || labelsAdded) {
             if (platformAdded) {
                 info(`Default platform config added to ${CONFIG_PATH}.`);
             }
@@ -123,9 +98,6 @@ async function cmdUpdate() {
             if (labelsAdded) {
                 info(`Default labels.in config added to ${CONFIG_PATH}.`);
             }
-            if (prFlowMigrated) {
-                info(`Migrated legacy requiresPullRequest to prFlow="${prFlowMigrated}" in ${CONFIG_PATH}.`);
-            }
         }
         else {
             info(`File registry changed in ${CONFIG_PATH}.`);
@@ -142,14 +114,11 @@ async function cmdUpdate() {
         if (hasNewEntries && platformAdded) {
             info(`Default platform config added to ${CONFIG_PATH}.`);
         }
-        if (hasNewEntries && prFlowMigrated) {
-            info(`Migrated legacy requiresPullRequest to prFlow="${prFlowMigrated}" in ${CONFIG_PATH}.`);
-        }
         ok(`Updated ${CONFIG_PATH}`);
     }
     // done
     console.log('');
-    ok('Seed files updated successfully!');
+    ok('Seed files synced successfully!');
     console.log('');
     if (workflowPlan.nextSteps.length === 0) {
         console.log('  No Agent Client project integration enabled.');
@@ -165,5 +134,5 @@ async function cmdUpdate() {
         console.log('');
     }
 }
-export { cmdUpdate };
+export { cmdSync };
 //# sourceMappingURL=update.js.map