@fitlab-ai/agent-infra 0.9.9 → 0.9.11

package/lib/internal/task-lifecycle.ts

@@ -1,17 +1,14 @@
-import { normalizeAgentToken, AGENT_USAGE_HINT } from '../agent-clients/tokens.ts';
-import { consumeHumanOverride, failureId, overrideDryRunConflict } from '../task/human-override.ts';
-import { applyTaskLifecycle, lifecycleIntentCatalog } from '../task/lifecycle.ts';
-import type { TaskLifecycleRequest } from '../task/lifecycle.ts';
+import {
+  createDirectHostExecutionContext,
+  dispatchTaskControlOperation,
+  parseTaskControlOperation,
+  type TaskLifecycleControlRequest
+} from '../task/control-authority.ts';
+import { lifecycleIntentCatalog } from '../task/lifecycle.ts';
 import { detectRepoRoot, resolveTaskRef } from '../task/resolve-ref.ts';
-import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.ts';
+import type { TaskLifecycleResult } from '../task/lifecycle.ts';
 
 const USAGE = `Usage: agent-infra-internal task-lifecycle <N | TASK-id> <intent> --agent <agent> [intent flags] [--dry-run]\n\nIntents: ${lifecycleIntentCatalog.join(', ')}\nOverride: --override-ticket <ticket> --override-target <target> --override-scope <scope>\n`;
-const FLAGS: Record<string, string> = {
-  '--agent': 'agent', '--reason': 'reason', '--unblock-condition': 'unblockCondition',
-  '--note': 'note', '--alert-number': 'alertNumber', '--staging-dir': 'stagingDir',
-  '--issue-number': 'issueNumber', '--override-ticket': 'overrideTicket',
-  '--override-target': 'overrideTarget', '--override-scope': 'overrideScope'
-};
 
 function usageFailure(message: string): void {
   process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'LIFECYCLE_PAYLOAD_INVALID', message } })}\n`);
@@ -19,36 +16,29 @@ function usageFailure(message: string): void {
   process.exitCode = 1;
 }
 
+function parseFailure(error: unknown): string {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.replace(/^TASK_CONTROL_OPERATION_INVALID: /u, '');
+}
+
 function taskLifecycle(args: string[] = []): void {
   if (args[0] === '--help' || args[0] === '-h') { process.stdout.write(USAGE); return; }
-  if (args.length < 2) { usageFailure('task ref and intent are required'); return; }
-  const values: Record<string, unknown> = { taskRef: args[0], intent: args[1], agent: '' };
-  const seen = new Set<string>();
-  for (let index = 2; index < args.length; index += 1) {
-    const flag = args[index]!;
-    if (flag === '--dry-run') {
-      if (seen.has(flag)) { usageFailure(`duplicate option '${flag}'`); return; }
-      seen.add(flag); values.dryRun = true; continue;
-    }
-    const key = FLAGS[flag];
-    if (!key) { usageFailure(`unknown option '${flag}'`); return; }
-    if (seen.has(flag)) { usageFailure(`duplicate option '${flag}'`); return; }
-    const value = args[++index];
-    if (value === undefined || value.startsWith('--')) { usageFailure(`option '${flag}' requires a value`); return; }
-    seen.add(flag);
-    values[key] = key === 'alertNumber' || key === 'issueNumber' ? Number(value) : value;
+
+  let operation;
+  try {
+    operation = parseTaskControlOperation('task-lifecycle', args);
+  } catch (error) {
+    usageFailure(parseFailure(error));
+    return;
   }
-  const agent = normalizeAgentToken(String(values.agent ?? ''));
-  if (!agent) { usageFailure(`invalid --agent '${values.agent}': ${AGENT_USAGE_HINT}`); return; }
-  values.agent = agent;
-  const dryRunConflict = overrideDryRunConflict(values);
-  if (dryRunConflict) { usageFailure(dryRunConflict.message); return; }
+  if (operation.family !== 'task-lifecycle') {
+    usageFailure('lifecycle operation is invalid');
+    return;
+  }
+
+  const request = operation.request as TaskLifecycleControlRequest;
   let repoRoot: string;
-  let taskId: string;
-  if (values.intent === 'restore') {
-    // restore's precondition is that the task does NOT exist locally yet (it only lives
-    // in a staging dir), so resolveTaskRef's existence check is inapplicable here; identity
-    // is guaranteed by applyTaskLifecycle's own full-TASK-id check plus staging validation.
+  if (request.intent === 'restore') {
     try {
       repoRoot = detectRepoRoot();
     } catch (error) {
@@ -56,53 +46,20 @@ function taskLifecycle(args: string[] = []): void {
       process.exitCode = 1;
       return;
     }
-    taskId = String(values.taskRef);
   } else {
-    const resolved = resolveTaskRef(String(values.taskRef));
+    const resolved = resolveTaskRef(request.taskRef);
     if (!resolved.ok) {
       process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: resolved.code, message: resolved.message } })}\n`);
       process.exitCode = 1;
       return;
     }
     repoRoot = resolved.repoRoot;
-    taskId = resolved.taskId;
-  }
-  let result: ReturnType<typeof applyTaskLifecycle> & { humanOverride?: unknown };
-  try {
-    result = withTaskExecutionLock(
-      repoRoot,
-      taskId,
-      `task-lifecycle.${String(values.intent)}`,
-      () => {
-        const lifecycleResult = applyTaskLifecycle(values as TaskLifecycleRequest);
-        if (lifecycleResult.status !== 'failed' || !values.overrideTicket) return lifecycleResult;
-        if (!values.overrideTarget || !values.overrideScope) {
-          return {
-            ...lifecycleResult,
-            error: { code: 'OVERRIDE_PAYLOAD_INVALID', message: 'override ticket requires --override-target and --override-scope' }
-          };
-        }
-        const override = consumeHumanOverride({
-          taskRef: String(values.taskRef),
-          ticketId: String(values.overrideTicket),
-          failureId: failureId('lifecycle.apply', lifecycleResult.error?.code ?? 'LIFECYCLE_FAILED'),
-          target: String(values.overrideTarget),
-          scope: String(values.overrideScope),
-          intent: String(values.intent) as TaskLifecycleRequest['intent'],
-          ...(values.alertNumber ? { alertNumber: Number(values.alertNumber) } : {}),
-          ...(values.issueNumber ? { issueNumber: Number(values.issueNumber) } : {}),
-          ...(values.stagingDir ? { stagingDir: String(values.stagingDir) } : {})
-        });
-        if (override.status === 'failed') return { ...lifecycleResult, humanOverride: override };
-        return { ...lifecycleResult, ...override, humanOverride: override, error: null };
-      }
-    );
-  } catch (error) {
-    if (!(error instanceof TaskExecutionLockError)) throw error;
-    process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: error.code, message: error.message } })}\n`);
-    process.exitCode = 1;
-    return;
   }
+
+  const result = dispatchTaskControlOperation(
+    createDirectHostExecutionContext({ repoRoot }),
+    operation
+  ) as TaskLifecycleResult & { humanOverride?: unknown };
   process.stdout.write(`${JSON.stringify(result)}\n`);
   if (result.status === 'failed') process.exitCode = 1;
 }

package/lib/internal/task-orchestration.ts

@@ -1,21 +1,6 @@
-import {
-  activateMatchingOrchestrationDelegation,
-  activateOrchestrationDelegation,
-  advanceOrchestration,
-  awaitOrchestrationDelegationActivation,
-  beginOrResumeOrchestration,
-  dispatchOrchestrationDelegation,
-  OrchestrationStateError,
-  pauseOrchestration,
-  recoverPreparedOrchestrationDelegation,
-  routeOrchestration,
-  sealMatchingOrchestrationDelegation,
-  sealOrchestrationDelegation,
-  statusOrchestration
-} from '../task/orchestration.ts';
-import { prepareCodexOrchestrationDelegation } from '../task/codex-orchestration.ts';
-import { isAgentClientId } from '../agent-clients/types.ts';
-import type { AgentClientId } from '../agent-clients/types.ts';
+import { createDirectHostExecutionContext, dispatchTaskControlOperation, parseTaskControlOperation } from '../task/control-authority.ts';
+import { OrchestrationStateError } from '../task/orchestration.ts';
+import { detectRepoRoot } from '../task/resolve-ref.ts';
 
 const USAGE = 'Usage: agent-infra-internal task-orchestration <task-ref|auto> <begin-or-resume|route|prepare|dispatch|await-activation|recover-prepared|hook-start|hook-stop|advance|pause|status> [options]\n';
 
@@ -28,192 +13,50 @@ function usageFailure(message: string): void {
   process.exitCode = 2;
 }
 
+function parseFailure(error: unknown): string {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.replace(/^TASK_CONTROL_OPERATION_INVALID: /u, '');
+}
+
 async function taskOrchestration(args: string[] = []): Promise<void> {
   if (args[0] === '--help' || args[0] === '-h') {
     process.stdout.write(USAGE);
     return;
   }
-  if (args.length < 2) {
-    usageFailure('task ref and intent are required');
-    return;
-  }
-  const [taskRef, intent] = args;
-  if (![
-    'begin-or-resume', 'route', 'prepare', 'dispatch', 'await-activation', 'recover-prepared',
-    'hook-start', 'hook-stop', 'advance', 'pause', 'status'
-  ].includes(intent!)) {
-    usageFailure(`unknown intent '${intent}'`);
+
+  let operation;
+  try {
+    operation = parseTaskControlOperation('task-orchestration', args);
+  } catch (error) {
+    usageFailure(parseFailure(error));
     return;
   }
-  const values: Record<string, string> = {};
-  const seen = new Set<string>();
-  for (let index = 2; index < args.length; index += 1) {
-    const flag = args[index]!;
-    if (![
-      '--max-steps', '--executor-model', '--executor-reasoning-effort',
-      '--reviewer-model', '--reviewer-reasoning-effort',
-      '--client', '--requested-model', '--requested-reasoning-effort', '--capability-token',
-      '--parent-id', '--before-fingerprint',
-      '--stage', '--round', '--artifact', '--role',
-      '--native-agent', '--child-id', '--spawn-mode', '--actual-model', '--actual-reasoning-effort',
-      '--model-fallback-reason', '--reasoning-effort-fallback-reason',
-      '--exit-code', '--after-fingerprint', '--changed-paths', '--code', '--message', '--recoverable', '--agent',
-      '--git-worktree-root'
-    ].includes(flag)) {
-      usageFailure(`unknown option '${flag}'`);
-      return;
-    }
-    if (seen.has(flag)) {
-      usageFailure(`duplicate option '${flag}'`);
-      return;
-    }
-    seen.add(flag);
-    const value = args[++index];
-    if (!value || value.startsWith('--')) {
-      usageFailure(`option '${flag}' requires a value`);
-      return;
-    }
-    values[flag] = value;
-  }
-  const requireValues = (flags: string[]) => flags.find((flag) => values[flag] === undefined);
-  const coreOptions = values['--git-worktree-root'] === undefined
-    ? {}
-    : { gitWorktreeRoot: values['--git-worktree-root'] };
-  if (values['--client'] !== undefined && !isAgentClientId(values['--client'])) {
-    usageFailure(`unknown client '${values['--client']}'`);
+  if (operation.family !== 'task-orchestration') {
+    usageFailure('orchestration operation is invalid');
     return;
   }
-  let result;
+
+  let repoRoot = process.cwd();
+  try { repoRoot = detectRepoRoot(); } catch { /* domain resolution reports the repository error */ }
+
   try {
-  if (intent === 'begin-or-resume') {
-    const missing = requireValues(['--client']);
-    if (missing) { usageFailure(`intent 'begin-or-resume' requires '${missing}'`); return; }
-    const maxSteps = values['--max-steps'] === undefined ? undefined : Number(values['--max-steps']);
-    if (maxSteps !== undefined && (!Number.isInteger(maxSteps) || maxSteps < 1)) {
-      usageFailure('--max-steps must be a positive integer'); return;
-    }
-    const policyFlags = [
-      '--executor-model', '--executor-reasoning-effort',
-      '--reviewer-model', '--reviewer-reasoning-effort'
-    ];
-    const hasAnyPolicy = policyFlags.some((flag) => values[flag] !== undefined);
-    if (hasAnyPolicy && policyFlags.some((flag) => values[flag] === undefined)) {
-      usageFailure('explicit model policy requires executor/reviewer model and reasoning effort');
-      return;
-    }
-    result = beginOrResumeOrchestration(taskRef!, {
-      ...coreOptions,
-      maxSteps,
-      client: values['--client'] as AgentClientId,
-      modelPolicy: hasAnyPolicy ? {
-        executor: {
-          model: values['--executor-model']!,
-          reasoningEffort: values['--executor-reasoning-effort']!
-        },
-        reviewer: {
-          model: values['--reviewer-model']!,
-          reasoningEffort: values['--reviewer-reasoning-effort']!
-        }
-      } : undefined
-    });
-  } else if (intent === 'route') {
-    result = routeOrchestration(taskRef!, coreOptions);
-  } else if (intent === 'status') {
-    result = statusOrchestration(taskRef!, coreOptions);
-  } else if (intent === 'prepare') {
-    const missing = requireValues(['--client']);
-    if (missing) { usageFailure(`intent 'prepare' requires '${missing}'`); return; }
-    result = await prepareCodexOrchestrationDelegation(taskRef!, {
-      client: values['--client'] as AgentClientId,
-      requestedModel: values['--requested-model'],
-      requestedReasoningEffort: values['--requested-reasoning-effort'],
-      capabilityToken: values['--capability-token']
-    }, { orchestrationOptions: coreOptions });
-  } else if (intent === 'dispatch') {
-    result = dispatchOrchestrationDelegation(taskRef!, coreOptions);
-  } else if (intent === 'await-activation') {
-    const missing = requireValues(['--stage', '--round', '--artifact', '--role']);
-    if (missing) { usageFailure(`intent 'await-activation' requires '${missing}'`); return; }
-    const round = Number(values['--round']);
-    if (!Number.isSafeInteger(round) || round < 1) {
-      usageFailure('--round must be a positive integer'); return;
-    }
-    if (!['executor', 'reviewer'].includes(values['--role']!)) {
-      usageFailure('--role must be executor or reviewer'); return;
-    }
-    result = await awaitOrchestrationDelegationActivation(taskRef!, {
-      stage: values['--stage'] as Parameters<typeof awaitOrchestrationDelegationActivation>[1]['stage'],
-      round,
-      artifact: values['--artifact']!,
-      role: values['--role'] as 'executor' | 'reviewer'
-    }, coreOptions);
-  } else if (intent === 'recover-prepared') {
-    result = recoverPreparedOrchestrationDelegation(taskRef!, coreOptions);
-  } else if (intent === 'hook-start') {
-    const missing = requireValues([
-      ...(taskRef === 'auto' ? ['--client'] : []),
-      '--native-agent', '--child-id', '--parent-id'
-    ]);
-    if (missing) { usageFailure(`intent 'hook-start' requires '${missing}'`); return; }
-    const event = {
-      nativeAgent: values['--native-agent']!, childId: values['--child-id']!,
-      parentId: values['--parent-id']!, spawnMode: values['--spawn-mode'],
-      actualModel: values['--actual-model'],
-      actualReasoningEffort: values['--actual-reasoning-effort'],
-      modelFallbackReason: values['--model-fallback-reason'],
-      reasoningEffortFallbackReason: values['--reasoning-effort-fallback-reason']
-    };
-    result = taskRef === 'auto'
-      ? activateMatchingOrchestrationDelegation(values['--client'] as AgentClientId, event, coreOptions)
-      : activateOrchestrationDelegation(taskRef!, event, coreOptions);
-  } else if (intent === 'hook-stop') {
-    if (taskRef === 'auto') {
-      const missing = requireValues(['--client', '--native-agent', '--child-id']);
-      if (missing) { usageFailure(`intent 'hook-stop' requires '${missing}'`); return; }
-      result = sealMatchingOrchestrationDelegation(values['--client'] as AgentClientId, {
-        nativeAgent: values['--native-agent']!, childId: values['--child-id']!,
-        actualModel: values['--actual-model'],
-        actualReasoningEffort: values['--actual-reasoning-effort'],
-        modelFallbackReason: values['--model-fallback-reason'],
-        reasoningEffortFallbackReason: values['--reasoning-effort-fallback-reason']
-      }, coreOptions);
-    } else {
-      const missing = requireValues(['--child-id', '--exit-code', '--after-fingerprint']);
-      if (missing) { usageFailure(`intent 'hook-stop' requires '${missing}'`); return; }
-      const exitCode = Number(values['--exit-code']);
-      if (!Number.isInteger(exitCode)) { usageFailure('--exit-code must be an integer'); return; }
-      result = sealOrchestrationDelegation(taskRef!, {
-        childId: values['--child-id']!, exitCode,
-        afterFingerprint: values['--after-fingerprint']!,
-        changedPaths: values['--changed-paths'] ? values['--changed-paths']!.split(',').filter(Boolean) : [],
-        actualModel: values['--actual-model'],
-        actualReasoningEffort: values['--actual-reasoning-effort'],
-        modelFallbackReason: values['--model-fallback-reason'],
-        reasoningEffortFallbackReason: values['--reasoning-effort-fallback-reason']
-      }, coreOptions);
-    }
-  } else if (intent === 'advance') {
-    result = advanceOrchestration(taskRef!, coreOptions);
-  } else {
-    const missing = requireValues(['--code', '--message', '--recoverable']);
-    if (missing) { usageFailure(`intent 'pause' requires '${missing}'`); return; }
-    if (!['true', 'false'].includes(values['--recoverable']!)) { usageFailure('--recoverable must be true or false'); return; }
-    result = pauseOrchestration(taskRef!, values['--code']!, values['--message']!, values['--recoverable'] === 'true', coreOptions);
-  }
+    const result = await dispatchTaskControlOperation(
+      createDirectHostExecutionContext({
+        repoRoot,
+        ...(process.env.AGENT_INFRA_RUNTIME_DIR ? { runtimeDir: process.env.AGENT_INFRA_RUNTIME_DIR } : {})
+      }),
+      operation
+    );
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+    if (result.status === 'failed') process.exitCode = 1;
   } catch (error) {
     if (!(error instanceof OrchestrationStateError)) throw error;
-    result = {
-      status: 'failed' as const,
-      changed: false,
-      taskId: error.taskId,
-      run: null,
-      next: null,
+    process.stdout.write(`${JSON.stringify({
+      status: 'failed', changed: false, taskId: error.taskId, run: null, next: null,
       error: { code: error.code, message: error.message }
-    };
+    })}\n`);
+    process.exitCode = 1;
   }
-  const output = result;
-  process.stdout.write(`${JSON.stringify(output)}\n`);
-  if (result.status === 'failed') process.exitCode = 1;
 }
 
 export { taskOrchestration };

package/lib/{task/commands/validate.ts → internal/task-validate.ts}

@@ -3,28 +3,29 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
-import { loadConfig } from '../../sandbox/config.ts';
-import { detectEngine } from '../../sandbox/engine.ts';
-import { runEngine } from '../../sandbox/shell.ts';
-import { sandboxBranchLabel, sandboxLabel } from '../../sandbox/constants.ts';
-import { fetchSandboxRows, selectSandboxContainer } from '../../sandbox/commands/list-running.ts';
-import { containerNameCandidates } from '../../sandbox/constants.ts';
-import { resolveSandboxTarget } from '../../sandbox/workspace-identity.ts';
-import { sandboxControlPaths } from '../../sandbox/workspace-view.ts';
+import { loadConfig } from '../sandbox/config.ts';
+import { detectEngine } from '../sandbox/engine.ts';
+import { runEngine } from '../sandbox/shell.ts';
+import { sandboxBranchLabel, sandboxLabel } from '../sandbox/constants.ts';
+import { fetchSandboxRows, selectSandboxContainer } from '../sandbox/commands/list-running.ts';
+import { containerNameCandidates } from '../sandbox/constants.ts';
+import { resolveSandboxTarget } from '../sandbox/workspace-identity.ts';
+import { sandboxControlPaths } from '../sandbox/workspace-view.ts';
 import {
   appendSandboxControlAudit,
   readActiveLease,
   readSandboxControlStatus
-} from '../../sandbox/control/state.ts';
-import type { SandboxControlLease, SandboxControlManifest } from '../../sandbox/control/protocol.ts';
+} from '../sandbox/control/state.ts';
+import type { SandboxControlLease } from '../sandbox/control/protocol.ts';
+import { readSandboxControlManifest } from '../sandbox/control/lifecycle.ts';
 import {
   SANDBOX_CONTROL_FUTURE_SKEW_MS,
   SANDBOX_CONTROL_STATUS_STALE_MS
-} from '../../sandbox/control/protocol.ts';
-import { getProcessStartTime } from '../../server/process-state.ts';
-import { assertGitWorktreeBinding } from '../../git/worktree-identity.ts';
+} from '../sandbox/control/protocol.ts';
+import { getProcessStartTime } from '../server/process-state.ts';
+import { assertGitWorktreeBinding } from '../git/worktree-identity.ts';
 
-const USAGE = `Usage: ai task validate <branch | TASK-id | N> [--scope snapshot|inplace] [--timeout <ms>] [--format text|json] -- <command> [args...]`;
+const USAGE = `Usage: agent-infra-internal task-validate <branch | TASK-id | N> [--scope snapshot|inplace] [--timeout <ms>] [--format text|json] -- <command> [args...]`;
 const MAX_TIMEOUT_MS = 60 * 60 * 1000;
 const RECOVERY_GRACE_MS = 30_000;
 
@@ -152,7 +153,7 @@ function inplaceValidation(config: ReturnType<typeof loadConfig>, target: Return
     base: config.controlBase, project: config.project,
     container: row.name, identity: target.workspace
   });
-  const manifest = JSON.parse(fs.readFileSync(control.manifestPath, 'utf8')) as SandboxControlManifest;
+  const manifest = readSandboxControlManifest(control.manifestPath);
   const initial = readSandboxControlStatus(control.statusDir);
   const now = Date.now();
   if (initial.generation !== manifest.generation
@@ -250,33 +251,68 @@ function inplaceValidation(config: ReturnType<typeof loadConfig>, target: Return
   }
 }
 
-export async function validate(args: string[]): Promise<number> {
-  const options = parseValidateArgs(args);
+function errorCode(message: string): string {
+  const match = message.match(/^([A-Z][A-Z0-9_]*)/);
+  return match && match[1]!.length >= 3 ? match[1]! : 'TASK_VALIDATE_FAILED';
+}
+
+function fail(format: 'text' | 'json', code: string, message: string): void {
+  if (format === 'json') {
+    process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code, message } })}\n`);
+  } else {
+    process.stderr.write(`${message}\n`);
+  }
+  process.exitCode = 1;
+}
+
+function sniffFormat(args: string[]): 'text' | 'json' {
+  const index = args.indexOf('--format');
+  return index >= 0 && args[index + 1] === 'json' ? 'json' : 'text';
+}
+
+function taskValidate(args: string[]): void {
+  let options: ValidateOptions;
+  try {
+    options = parseValidateArgs(args);
+  } catch (error) {
+    fail(sniffFormat(args), 'TASK_VALIDATE_ARGS_INVALID', error instanceof Error ? error.message : String(error));
+    return;
+  }
   if (options.help) {
     process.stdout.write(`${USAGE}\n`);
-    return 0;
+    return;
+  }
+  try {
+    const config = loadConfig();
+    const target = resolveSandboxTarget(options.target, config.repoRoot);
+    const commit = git(config.repoRoot, ['rev-parse', target.branch]);
+    const startedAt = new Date().toISOString();
+    const result = options.scope === 'snapshot'
+      ? snapshotValidation(config.repoRoot, commit, options)
+      : inplaceValidation(config, target, options);
+    const evidence = {
+      version: 1,
+      taskId: target.workspace.mode === 'task-bound' ? target.workspace.taskId : null,
+      branch: target.branch,
+      scope: options.scope,
+      commit,
+      command: path.basename(options.command[0]!),
+      startedAt,
+      completedAt: new Date().toISOString(),
+      exitCode: result.exitCode,
+      signal: result.signal,
+      cleanup: result.cleanup()
+    };
+    if (options.format === 'json') {
+      process.stdout.write(`${JSON.stringify({ status: 'applied', changed: false, evidence, error: null })}\n`);
+    } else {
+      process.stdout.write(`Validation ${result.exitCode === 0 ? 'passed' : 'failed'} (${options.scope}, ${evidence.command}, cleanup=${evidence.cleanup}).\n`);
+    }
+    process.exitCode = result.exitCode;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    fail(options.format, errorCode(message), message);
   }
-  const config = loadConfig();
-  const target = resolveSandboxTarget(options.target, config.repoRoot);
-  const commit = git(config.repoRoot, ['rev-parse', target.branch]);
-  const startedAt = new Date().toISOString();
-  const result = options.scope === 'snapshot'
-    ? snapshotValidation(config.repoRoot, commit, options)
-    : inplaceValidation(config, target, options);
-  const evidence = {
-    version: 1,
-    taskId: target.workspace.mode === 'task-bound' ? target.workspace.taskId : null,
-    branch: target.branch,
-    scope: options.scope,
-    commit,
-    command: path.basename(options.command[0]!),
-    startedAt,
-    completedAt: new Date().toISOString(),
-    exitCode: result.exitCode,
-    signal: result.signal,
-    cleanup: result.cleanup()
-  };
-  if (options.format === 'json') process.stdout.write(`${JSON.stringify(evidence)}\n`);
-  else process.stdout.write(`Validation ${result.exitCode === 0 ? 'passed' : 'failed'} (${options.scope}, ${evidence.command}, cleanup=${evidence.cleanup}).\n`);
-  return result.exitCode;
 }
+
+export { taskValidate };