@skrr-ai/cli 0.1.21 → 0.1.23

package/dist/commands/tasks/complete.js

@@ -1,294 +1,97 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TaskCompletionMismatchError = void 0;
-exports.resolveCanonicalCompletionTaskId = resolveCanonicalCompletionTaskId;
-exports.resolveCompletionTarget = resolveCompletionTarget;
-exports.decideRecompletion = decideRecompletion;
-exports.isCompleteEndpointMissing = isCompleteEndpointMissing;
-exports.completeTaskDurably = completeTaskDurably;
+exports.describePendingReview = describePendingReview;
 const core_1 = require("@oclif/core");
-const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
-const task_extras_1 = require("../../lib/task-extras");
 const api_fetch_1 = require("../../lib/api-fetch");
 const outbox_1 = require("../../lib/outbox");
-const credential_resolver_1 = require("../../lib/credential-resolver");
-const delegated_cli_1 = require("../../lib/delegated-cli");
 const prompt_1 = require("../../lib/prompt");
-const task_report_1 = require("../../lib/task-report");
+const session_task_endpoints_1 = require("../../lib/session-task-endpoints");
 const task_resolver_1 = require("../../lib/task-resolver");
-const task_instruction_offer_1 = require("../../lib/task-instruction-offer");
-const task_transcript_1 = require("../../lib/task-transcript");
+const task_extras_1 = require("../../lib/task-extras");
 const web_url_1 = require("../../lib/web-url");
-const tasks_1 = require("../../lib/tasks");
-const git_task_1 = require("../../lib/git-task");
-/**
- * Forward any `--deliverable` value that is really a ledger coordinate.
- *
- * FAIL-OPEN, and quietly. This is a convenience bridge on the completion path:
- * the completion itself is the operation the caller asked for, and a ledger
- * write that fails must not take it down. A caller who needed the row and did
- * not get it meets the gate's refusal, which names the command that writes it.
- *
- * `local`, never anything stronger — this is the executor talking about its own
- * work, which is exactly what the authority ladder is built to weigh.
- */
-async function recordCoordinateDeliverables({ taskId, values, warn, }) {
-    const seen = new Set();
-    for (const value of values) {
-        const raw = (value ?? '').trim();
-        if (!raw || raw === 'none' || seen.has(raw)) {
-            continue;
-        }
-        seen.add(raw);
-        const parsed = (0, tasks_1.parseDeliverableCoordinate)(raw);
-        if (!parsed.ok) {
-            continue;
-        }
-        try {
-            await data_provider_1.dataService.addTaskDeliverable(taskId, parsed.value);
-        }
-        catch {
-            warn(`Recorded "${raw}" in the report but not in the deliverables ledger. ` +
-                `If the task refuses to close, run \`tasks deliverable add\` for it.`);
-        }
+function parseJson(value, label) {
+    if (!value)
+        return undefined;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        throw new Error(`${label} must be valid JSON`);
     }
 }
-/**
- * Mutation endpoints require the task's canonical UUID even though the CLI
- * accepts human-readable refs and titles. Resolve the display reference before
- * writing anything so a 404 from `POST /complete` cannot be mistaken for an
- * old server and fall through to the legacy comment-first path.
- */
-async function resolveCanonicalCompletionTaskId(taskRef, lookup) {
-    return (await resolveCompletionTarget(taskRef, lookup)).id;
-}
-/** Terminal workflow states — a task in one of these has already been closed out. */
-const TERMINAL_STATUSES = new Set(['done', 'failed']);
-/**
- * The canonical id AND the status it is in.
- *
- * The status comes free: this lookup already happens on the user path, so the
- * re-completion guard below costs no extra round trip on the common case. It is
- * also the only way to make the success line honest — `tasks complete` printed
- * "Moved task X to done" unconditionally, so a task that was ALREADY done got a
- * report of a state transition that did not happen.
- */
-async function resolveCompletionTarget(taskRef, lookup) {
-    const task = (await lookup(taskRef));
-    const id = typeof task?.id === 'string' ? task.id.trim() : '';
-    if (!id) {
-        throw new Error(`Task ${taskRef} did not resolve to a canonical id.`);
+function parseReference(raw) {
+    const split = raw.indexOf(':');
+    if (split < 1 || split === raw.length - 1) {
+        throw new Error('Evidence must use <kind>:<id-or-uri>.');
     }
-    return { id, status: typeof task?.status === 'string' ? task.status : null };
+    const kind = raw.slice(0, split);
+    const value = raw.slice(split + 1);
+    return /^[a-z][a-z0-9+.-]*:/i.test(value) || value.startsWith('/')
+        ? { kind, uri: value }
+        : { kind, id: value };
 }
-/**
- * What a second `tasks complete` on an already-closed task should do.
- *
- * The repo contract calls this "the only terminal closeout", and a task has one
- * canonical outcome — but a second run used to succeed silently, post another
- * TASK_OUTPUT block, and leave `tasks output` rendering the throwaway one as
- * authoritative. The real summary and its deliverables link were still on the task
- * but no longer canonical, which is the worst of the available failures: no
- * error, no warning, exit 0, and a record that now says something different.
- *
- * Refusing outright would break the case that makes retries safe. A completion
- * whose response is lost — a flaky connection, a re-run script — SHOULD be able
- * to run again, and today it collapses server-side on the shared
- * `X-Idempotency-Key`. Turning that into a hard failure would force every
- * caller to write its own is-it-already-done check.
- *
- * So the axis is not "again or not", it is "the SAME again, or something
- * different":
- *
- *   - identical report  → `noop`, exit 0. Nothing to do, and saying so is more
- *     honest than re-posting an identical block.
- *   - differing report  → `refuse`. Superseding a canonical outcome is a real
- *     decision, so it takes `--amend` and says so.
- *   - not yet terminal  → `proceed`, unchanged.
- *
- * Pure, so the rule is testable without a server.
- */
-function decideRecompletion(opts) {
-    const { priorStatus, canonicalBody, incomingBody, amend } = opts;
-    if (!priorStatus || !TERMINAL_STATUSES.has(priorStatus))
-        return 'proceed';
-    if (amend)
-        return 'proceed';
-    // No canonical block to disagree with — a task closed by a path that skipped
-    // it, so writing one is an addition rather than a replacement.
-    if (canonicalBody === null)
-        return 'proceed';
-    return canonicalBody.trim() === incomingBody.trim() ? 'noop' : 'refuse';
+function stringValue(value, field) {
+    const text = typeof value === 'string' ? value.trim() : '';
+    if (!text)
+        throw new Error(`${field} is required.`);
+    return text;
 }
-/** A 404 from the /complete endpoint means an old server without the route. */
-function isCompleteEndpointMissing(err) {
-    return err instanceof api_fetch_1.ApiFetchError && err.status === 404;
+function optionalString(value) {
+    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
 }
-/**
- * The server finalized a different task than the one we were asked to finalize.
- *
- * The session-scoped completion endpoint derives its task from the run claim
- * and deliberately ignores any client-supplied id — that is what stops a
- * compromised agent process finishing a sibling task. The corollary is that the
- * id resolved on this side is not necessarily the one that moved, so reporting
- * ours would print a success line (and a `--json` `taskId`) for a task that is
- * still open.
- */
-class TaskCompletionMismatchError extends Error {
-    requestedTaskId;
-    completedTaskId;
-    constructor(requestedTaskId, completedTaskId) {
-        super(`Asked to complete ${requestedTaskId}, but the server finalized ${completedTaskId}. ` +
-            'In an autonomous session the server derives the task from the run claim and ignores ' +
-            `the id passed here, so ${requestedTaskId} has NOT been completed. Re-run without a ` +
-            "task id to finalize this session's own task.");
-        this.name = 'TaskCompletionMismatchError';
-        this.requestedTaskId = requestedTaskId;
-        this.completedTaskId = completedTaskId;
-    }
+function stringArray(value) {
+    return Array.isArray(value) ? value.map((item) => String(item).trim()).filter(Boolean) : [];
 }
-exports.TaskCompletionMismatchError = TaskCompletionMismatchError;
-/**
- * Finalize a task durably (OSK-1969).
- *
- * Prefers the server's atomic POST /:taskId/complete (CAS move first, then
- * the TASK_OUTPUT comment — no half-finished state if this process dies).
- * Falls back to the legacy client-side two-step (comment, then move) when the
- * server predates the endpoint (HTTP 404). `noMove` keeps the historical
- * comment-only behavior and never touches the endpoint. All transport errors
- * other than the endpoint-missing 404 are rethrown for the caller's uniform
- * error handling.
- */
-async function completeTaskDurably(opts) {
-    const { taskId, status, body, summary, deliverables, verdict, report, deliveryReceipt, noMove, transport, } = opts;
-    if (noMove) {
-        const comment = await transport.addComment(taskId, body);
-        return {
-            comment,
-            movedTask: null,
-            moved: false,
-            commentFailed: false,
-            usedAtomicEndpoint: false,
-        };
-    }
-    try {
-        const response = await transport.postComplete(taskId, {
-            status,
-            summary,
-            deliverables,
-            verdict,
-            ...(report ? { report } : {}),
-            ...(deliveryReceipt ? { deliveryReceipt } : {}),
-        });
-        // Reconcile before reporting. On the session-scoped path the server owns
-        // the task selection, so a divergence here means the task we were asked to
-        // finish is still open — a silent success would hide that from the agent
-        // and from anything parsing `--json`.
-        const finalizedTaskId = response.task?.id;
-        if (finalizedTaskId && finalizedTaskId !== taskId) {
-            throw new TaskCompletionMismatchError(taskId, finalizedTaskId);
-        }
-        return {
-            comment: response.comment ?? null,
-            movedTask: response.task ?? null,
-            moved: true,
-            commentFailed: response.commentFailed === true,
-            ...(response.advisories?.length ? { advisories: response.advisories } : {}),
-            usedAtomicEndpoint: true,
-        };
-    }
-    catch (err) {
-        if (err instanceof TaskCompletionMismatchError)
-            throw err;
-        if (!isCompleteEndpointMissing(err) || transport.allowLegacyFallback === false) {
-            throw err;
-        }
-    }
-    // Old server — legacy non-atomic two-step, byte-identical to the historical
-    // behavior (comment first, then move).
-    const comment = await transport.addComment(taskId, body);
-    const movedTask = await transport.moveTask(taskId, status === 'completed' ? 'done' : 'failed');
-    return {
-        comment,
-        movedTask,
-        moved: true,
-        commentFailed: false,
-        usedAtomicEndpoint: false,
-    };
+function describePendingReview({ statusType, taskId, resultId, bin, }) {
+    if (statusType !== 'review')
+        return null;
+    return ('The Result was submitted, but the Task is not done yet. An independent reviewer must ' +
+        `accept this exact Result with: ${bin} tasks review ${taskId} --result-id ${resultId || '<result-id>'} --decision accepted`);
 }
 class TasksComplete extends base_command_1.BaseCommand {
-    static description = 'Post a canonical TASK_OUTPUT comment and finish a task';
+    static description = 'Submit one versioned Result and advance the Task workflow';
     static examples = [
-        '<%= config.bin %> tasks complete <task-id> --summary "Shipped the fix." --verdict approved',
-        '<%= config.bin %> tasks complete --summary "Shipped the fix." --verdict approved',
-        '<%= config.bin %> tasks complete --task <task-id> --summary "Shipped the fix." --json',
-        '<%= config.bin %> tasks complete <task-id> --status failed --summary "Could not deploy." --verdict blocked',
-        '<%= config.bin %> tasks complete <task-id> --from-json task-output.json --json',
-        '<%= config.bin %> tasks complete <task-id> --summary "Comment only" --no-move',
+        '<%= config.bin %> tasks complete <task> --summary "Implemented and verified the fix" --deliverable <resource-link-id>',
+        '<%= config.bin %> tasks complete <task> --summary "Do not ship" --conclusion-type release_recommendation --conclusion-json \'{"posture":"no_ship"}\'',
+        '<%= config.bin %> tasks complete <task> --status blocked --summary "Waiting for production credentials" --remaining "A workspace owner must grant access"',
     ];
     static args = {
         id: core_1.Args.string({
-            description: 'Task ID or identifier; defaults to OVERSKY_SESSION_TASK_ID in task runtimes',
+            description: 'Task id or ref; defaults to the bound runtime Task',
             required: false,
             ignoreStdin: true,
         }),
     };
     static flags = {
-        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
-        task: core_1.Flags.string({
-            description: 'Task ID or identifier; overrides daemon runtime context',
-        }),
-        'from-json': core_1.Flags.string({
-            description: 'Path to JSON with taskId, status, summary, deliverables, and verdict; "-" for stdin',
-        }),
-        amend: core_1.Flags.boolean({
-            description: 'Supersede the canonical outcome of an already-completed task. Without it, a differing report on a closed task is refused',
-        }),
-        status: core_1.Flags.string({
-            description: 'TASK_OUTPUT status',
-            options: ['completed', 'failed'],
-            default: 'completed',
+        task: core_1.Flags.string({ description: 'Task id; overrides runtime context' }),
+        status: core_1.Flags.string({ options: ['completed', 'failed', 'blocked'] }),
+        summary: core_1.Flags.string({ description: 'The Result in one readable paragraph' }),
+        body: core_1.Flags.string({ description: 'Long-form Result body' }),
+        'conclusion-type': core_1.Flags.string({
+            description: 'Domain conclusion type, such as release_recommendation',
         }),
-        summary: core_1.Flags.string({ description: 'Completion summary' }),
-        deliverables: core_1.Flags.string({
-            description: 'Deliverables produced, or "none". Repeatable, and interchangeable with --deliverable. ' +
-                `The whole TASK_OUTPUT block (status + summary + deliverables + verdict) must fit in ${data_provider_1.TASK_OUTPUT_BODY_MAX} ` +
-                'characters — link to commits, PRs, or file paths rather than pasting content.',
-            // Repeatable, even though `--deliverable` already is. The two spellings sit
-            // one letter apart and both read as "the deliverables go here", so the wrong
-            // one gets typed — and oclif answered that with "Flag --deliverables can only
-            // be specified once", which names the flag you used and not the sibling
-            // that does what you wanted. Dogfooded (OSK-266) by losing a completion
-            // call to exactly that, then re-running with the two references pre-joined
-            // into one string, which is the workaround rather than the shape.
-            multiple: true,
-            default: ['none'],
+        'conclusion-json': core_1.Flags.string({ description: 'JSON value for the domain conclusion' }),
+        'structured-schema': core_1.Flags.string({ description: 'Schema name for --structured-json' }),
+        'structured-json': core_1.Flags.string({
+            description: 'Task-type-specific structured Result JSON object',
         }),
         deliverable: core_1.Flags.string({
-            description: 'A single artifact reference (repeatable); joined with commas. Prefer this ' +
-                'over pre-joining into --deliverables.',
-            multiple: true,
-        }),
-        verdict: core_1.Flags.string({ description: 'Final verdict', default: 'approved' }),
-        outcome: core_1.Flags.string({
-            description: 'Reader-facing conclusion for the durable task report',
-        }),
-        finding: core_1.Flags.string({
-            description: 'Concrete finding for the durable task report (repeatable)',
-            multiple: true,
-        }),
-        evidence: core_1.Flags.string({
-            description: 'Supporting rationale or evidence for the durable task report (repeatable)',
             multiple: true,
+            description: 'Exact Task Resource link id produced by `tasks deliverable add`',
         }),
-        next: core_1.Flags.string({
-            description: 'Follow-up or next action for the durable task report (repeatable)',
-            multiple: true,
+        evidence: core_1.Flags.string({ multiple: true, description: 'Evidence as <kind>:<id-or-uri>' }),
+        remaining: core_1.Flags.string({ multiple: true, description: 'Remaining work item' }),
+        'source-run': core_1.Flags.string({ multiple: true, description: 'Contributing Task Run id' }),
+        'run-id': core_1.Flags.string({ description: 'Expected current Task Run id' }),
+        'spec-version': core_1.Flags.integer({
+            description: 'Task specification version this Result answers',
         }),
-        'no-move': core_1.Flags.boolean({
-            description: 'Only post the TASK_OUTPUT comment; do not move task status',
+        'idempotency-key': core_1.Flags.string({ description: 'Stable retry key for this exact closeout' }),
+        'from-json': core_1.Flags.string({
+            description: 'JSON file containing the same canonical Result fields; "-" for stdin',
         }),
+        json: core_1.Flags.boolean({ description: 'Output JSON' }),
     };
     async run() {
         this.requireAuth();
@@ -298,51 +101,26 @@ class TasksComplete extends base_command_1.BaseCommand {
             try {
                 jsonBody = await (0, prompt_1.readJsonBody)(flags['from-json']);
             }
-            catch (err) {
+            catch (error) {
                 this.failWithCliError({
-                    message: err.message,
+                    message: error.message,
                     code: 'INVALID_JSON_INPUT',
                     exit: 1,
                     retryable: false,
                 });
             }
         }
-        const input = (0, prompt_1.mergeDefined)(jsonBody, {
-            status: flags.status,
-            summary: flags.summary,
-            // Both spellings, pooled, then normalized to the one-line form the server
-            // stores. Pooling rather than letting one win: someone who passes both has
-            // named deliverables in each, and silently dropping half of them is worse
-            // than either flag being unavailable.
-            deliverables: (0, data_provider_1.normalizeTaskOutputDeliverables)([
-                ...(flags.deliverable ?? []),
-                // The literal default is dropped when it is only the default; a user
-                // who typed `--deliverables none` alongside a real one meant the real one.
-                ...(flags.deliverables ?? []).filter((value) => value !== 'none'),
-            ]) || 'none',
-            verdict: flags.verdict,
-        });
-        // `--verdict` is deliberately not enumerated — a reviewer task passes a
-        // JSON posture object, and `normalizeReviewPosture` accepts synonyms. But
-        // when it recognises nothing it derives the posture from the criteria
-        // rather than failing, so a typo is recorded and silently means something
-        // else. Warn over the set the server actually matches; never refuse.
-        if (!(0, tasks_1.verdictIsRecognized)(input.verdict)) {
-            this.warn(`Verdict "${input.verdict}" is not one the server recognises ` +
-                `(${tasks_1.RECOGNIZED_TASK_VERDICTS.join(', ')}, or a JSON review posture). ` +
-                'It will be recorded as written, and a review will fall back to what the criteria imply.');
-        }
-        let taskIdentity;
+        let identity;
         try {
-            taskIdentity = (0, task_resolver_1.resolveTaskIdentity)({
+            identity = (0, task_resolver_1.resolveTaskIdentity)({
                 positionalId: args.id,
                 flagTask: flags.task,
                 jsonBody,
                 jsonKeys: ['taskId', 'task', 'id'],
             });
         }
-        catch (err) {
-            const failure = (0, task_resolver_1.taskResolutionFailure)(err);
+        catch (error) {
+            const failure = (0, task_resolver_1.taskResolutionFailure)(error);
             this.failWithCliError({
                 message: failure.message,
                 code: failure.code,
@@ -351,348 +129,131 @@ class TasksComplete extends base_command_1.BaseCommand {
                 details: { suggestion: failure.suggestion, context: failure.details },
             });
         }
-        let status;
-        let summary;
-        let deliverables;
-        let verdict;
-        let report;
+        let conclusionValue;
+        let structuredValue;
         try {
-            status = normalizeStatus(input.status);
-            summary = requireOutputField(input.summary, 'summary');
-            deliverables =
-                optionalOutputField((0, data_provider_1.normalizeTaskOutputDeliverables)(input.deliverables)) || 'none';
-            verdict =
-                optionalOutputField(input.verdict) || (status === 'completed' ? 'approved' : 'failed');
-            const jsonReport = input.report && typeof input.report === 'object'
-                ? input.report
-                : undefined;
-            const reportInput = {
-                outcome: flags.outcome ?? jsonReport?.outcome,
-                findings: flags.finding?.length ? flags.finding : jsonReport?.findings,
-                evidence: flags.evidence?.length ? flags.evidence : jsonReport?.evidence,
-                nextActions: flags.next?.length
-                    ? flags.next
-                    : (jsonReport?.nextActions ?? jsonReport?.next),
-            };
-            if ((0, task_report_1.hasTaskReportInput)(reportInput)) {
-                // Summary remains the compact completion acknowledgement. A report's
-                // outcome is the readable conclusion in the task detail, so default it
-                // to summary when a caller supplied findings but no duplicate outcome.
-                report = (0, task_report_1.buildTaskReport)({ ...reportInput, outcome: reportInput.outcome ?? summary });
-            }
+            conclusionValue = parseJson(flags['conclusion-json'], '--conclusion-json');
+            structuredValue = parseJson(flags['structured-json'], '--structured-json');
         }
-        catch (err) {
+        catch (error) {
             this.failWithCliError({
-                message: err.message,
-                code: 'INVALID_TASK_OUTPUT',
+                message: error.message,
+                code: 'INVALID_RESULT_JSON',
                 exit: 1,
                 retryable: false,
             });
         }
-        if (report && flags['no-move']) {
-            this.failWithCliError({
-                message: '--no-move cannot persist a completion report atomically. Run `skrr tasks report` first, or complete the task without --no-move.',
-                code: 'TASK_REPORT_REQUIRES_COMPLETION',
+        if (Boolean(flags['conclusion-type']) !== Boolean(flags['conclusion-json'])) {
+            this.error('--conclusion-type and --conclusion-json must be supplied together', { exit: 1 });
+        }
+        if (Boolean(flags['structured-schema']) !== Boolean(flags['structured-json'])) {
+            this.error('--structured-schema and --structured-json must be supplied together', {
                 exit: 1,
-                retryable: false,
             });
         }
-        // OSK-2941 — refuse locally, before the work of a round trip, using the SAME
-        // budget the server enforces. Discovering an undocumented cap by HTTP 400
-        // after a run has already finished is the failure being fixed; a caller must
-        // be able to see the limit without provoking it.
-        const budget = (0, data_provider_1.measureTaskOutputBudget)({ status, summary, deliverables, verdict });
-        if (!budget.fits) {
+        if (structuredValue &&
+            (typeof structuredValue !== 'object' || Array.isArray(structuredValue))) {
+            this.error('--structured-json must contain a JSON object', { exit: 1 });
+        }
+        const input = (0, prompt_1.mergeDefined)(jsonBody, {
+            status: flags.status,
+            summary: flags.summary,
+            body: flags.body,
+            conclusion: flags['conclusion-type']
+                ? { type: flags['conclusion-type'], value: conclusionValue }
+                : undefined,
+            structuredContent: flags['structured-schema']
+                ? {
+                    schema: flags['structured-schema'],
+                    value: structuredValue,
+                }
+                : undefined,
+            resourceLinkIds: flags.deliverable,
+            evidenceRefs: flags.evidence?.map(parseReference),
+            remainingWork: flags.remaining?.map((summary) => ({ summary })),
+            sourceRunIds: flags['source-run'],
+            expectedRunId: flags['run-id'],
+            expectedSpecVersion: flags['spec-version'],
+            idempotencyKey: flags['idempotency-key'],
+        });
+        let status;
+        let summary;
+        try {
+            const candidate = optionalString(input.status) || 'completed';
+            if (!['completed', 'failed', 'blocked'].includes(candidate)) {
+                throw new Error('status must be completed, failed, or blocked.');
+            }
+            status = candidate;
+            summary = stringValue(input.summary, 'summary');
+        }
+        catch (error) {
             this.failWithCliError({
-                message: (0, data_provider_1.describeTaskOutputOverflow)(budget),
-                code: 'TASK_OUTPUT_TOO_LONG',
+                message: error.message,
+                code: 'INVALID_TASK_RESULT',
                 exit: 1,
                 retryable: false,
-                details: {
-                    limit: budget.limit,
-                    length: budget.length,
-                    overBy: budget.overBy,
-                    fieldLengths: budget.fieldLengths,
-                },
             });
         }
-        const body = formatTaskOutput({ status, summary, deliverables, verdict });
-        // Artifact text such as a commit SHA is a delivery claim. The local probe
-        // both verifies remote-default ancestry and anchors a commit that has no
-        // local branch before the completion request can release this run.
-        const deliveryReceipt = status === 'completed' && !flags['no-move']
-            ? ((0, git_task_1.inspectTaskDeliveryArtifacts)({ deliverables, taskRef: taskIdentity.id }) ?? undefined)
-            : undefined;
-        // Computed once, OUTSIDE the try, so the original attempt and the queued
-        // replay carry the same key. Must match the payload the outbox stores.
-        const completionPayload = {
+        const payload = {
+            status,
             summary,
-            deliverables,
-            verdict,
-            ...(report ? { report } : {}),
-            ...(deliveryReceipt ? { deliveryReceipt } : {}),
-            noMove: !!flags['no-move'],
+            body: optionalString(input.body),
+            conclusion: input.conclusion,
+            structuredContent: input.structuredContent,
+            resourceLinkIds: Array.isArray(input.resourceLinkIds)
+                ? stringArray(input.resourceLinkIds)
+                : [],
+            evidenceRefs: Array.isArray(input.evidenceRefs) ? input.evidenceRefs : [],
+            remainingWork: Array.isArray(input.remainingWork) ? input.remainingWork : [],
+            contributors: Array.isArray(input.contributors)
+                ? input.contributors
+                : [],
+            sourceRunIds: stringArray(input.sourceRunIds),
+            expectedRunId: optionalString(input.expectedRunId),
+            expectedSpecVersion: typeof input.expectedSpecVersion === 'number' ? input.expectedSpecVersion : undefined,
         };
-        const completionIdempotencyKey = (0, outbox_1.idempotencyKeyFor)('task-complete', taskIdentity.id, JSON.stringify(completionPayload));
-        const sessionCompletionPath = autonomousSessionCompletionPath();
-        // Resolved OUTSIDE the write's try/catch. It is a GET, so a failure here is
-        // not a queueable write — and the re-completion guard has to be able to
-        // refuse without `queueWriteOrFail` treating the refusal as an outage worth
-        // replaying later.
-        //
-        // The session endpoint derives its task from the trusted run claim and does
-        // not need (or permit) a broad task lookup. The normal user and
-        // delegated-daemon path does: task routes read OSK refs, while mutation
-        // services key on UUIDs. Passing the ref straight through caused the atomic
-        // endpoint's task-level 404 to look like "endpoint missing"; legacy fallback
-        // then posted TASK_OUTPUT before its move 404'd.
-        let completionTaskId = taskIdentity.id;
-        // Captured at resolution so the guard and the success line can both tell
-        // "already closed" from "just closed".
-        let priorStatus = null;
-        if (!sessionCompletionPath) {
-            try {
-                const target = await resolveCompletionTarget(await this.resolveTaskReference(taskIdentity.id), (taskRef) => data_provider_1.dataService.getTask(taskRef, { enrich: false }));
-                completionTaskId = target.id;
-                priorStatus = target.status;
-            }
-            catch (err) {
-                this.handleApiError(err);
-            }
-        }
-        // A task that is already closed gets one extra read, and only then — the
-        // first completion of a task never pays for this.
-        if (decideRecompletion({
-            priorStatus,
-            canonicalBody: '',
-            incomingBody: body,
-            amend: flags.amend,
-        }) !== 'proceed') {
-            let canonicalBody = null;
+        const idempotencyKey = optionalString(input.idempotencyKey) ||
+            (0, outbox_1.idempotencyKeyFor)('task-complete', identity.id, JSON.stringify(payload));
+        const sessionPath = await (0, session_task_endpoints_1.sessionScopedTaskPath)('completion');
+        let taskId = identity.id;
+        if (!sessionPath) {
             try {
-                canonicalBody = (await (0, task_transcript_1.fetchLatestTaskOutputComment)(completionTaskId))?.body ?? null;
+                const resolved = await this.resolveTaskReference(identity.id);
+                taskId = String(resolved);
             }
-            catch {
-                // Unreadable history must not block a completion: falling through to
-                // `proceed` is exactly today's behaviour, which is the safe direction
-                // for a guard whose whole job is to protect a record it cannot see.
-                canonicalBody = null;
-            }
-            const decision = decideRecompletion({
-                priorStatus,
-                canonicalBody,
-                incomingBody: body,
-                amend: flags.amend,
-            });
-            if (decision === 'noop') {
-                const url = (0, web_url_1.taskUrlFrom)(this.cliConfig.baseURL, { id: completionTaskId });
-                if (flags.json) {
-                    this.log(JSON.stringify({
-                        taskId: completionTaskId,
-                        status: priorStatus,
-                        alreadyCompleted: true,
-                        changed: false,
-                        url: url ? `${url}#task-outcome` : url,
-                    }, null, 2));
-                    return;
-                }
-                this.log(`Already ${priorStatus}; this report is identical to the canonical one — nothing to do.`);
-                if (url)
-                    this.log(`Outcome: ${url}#task-outcome`);
-                return;
-            }
-            if (decision === 'refuse') {
-                this.failWithCliError({
-                    message: `Task ${completionTaskId} is already ${priorStatus}, and this report differs from its canonical ` +
-                        `outcome — completing again would silently replace it (deliverables included).\n` +
-                        `  → re-run with \`--amend\` to supersede it deliberately, or read what is there now with ` +
-                        `\`${this.config.bin} tasks output ${completionTaskId}\`.`,
-                    code: 'TASK_ALREADY_COMPLETED',
-                    exit: 1,
-                    retryable: false,
-                    details: { taskId: completionTaskId, status: priorStatus },
-                });
+            catch (error) {
+                this.handleApiError(error);
             }
         }
-        // THE THIRD SPELLING, BRIDGED.
-        //
-        // `--deliverable` here is PROSE for the TASK_OUTPUT block. The ledger the
-        // completion gate reads is written by `tasks deliverable add`, and nothing
-        // connected the two — so an agent that ran
-        // `tasks complete --deliverable code:abc@origin/main` had, from its own
-        // point of view, recorded its deliverable, and was then refused by a gate
-        // whose message told it to record its deliverable.
-        //
-        // Three surfaces in one CLI answer to the word (`tasks deliverable add`,
-        // this flag, and `tasks report --deliverable`), and the project's own
-        // operating instructions teach the two that do NOT write the ledger. That
-        // is a documentation problem only if you believe people read the docs
-        // before the error; the cheaper fix is to make the wrong spelling do the
-        // right thing when what was typed is unambiguously a coordinate.
-        //
-        // Deliberately narrow: only values that PARSE as `<kind>:<identity>` are
-        // forwarded. A prose reference like `report.pdf` is left exactly as it was —
-        // guessing a coordinate out of prose is how the ledger fills with rows
-        // nobody can look up again.
-        await recordCoordinateDeliverables({
-            taskId: completionTaskId,
-            values: [...(flags.deliverable ?? []), ...(flags.deliverables ?? [])],
-            warn: (message) => this.warn(message),
-        });
         let result;
         try {
-            result = await completeTaskDurably({
-                taskId: completionTaskId,
-                status,
-                body,
-                summary,
-                deliverables,
-                verdict,
-                report,
-                deliveryReceipt,
-                noMove: !!flags['no-move'],
-                transport: {
-                    postComplete: (taskId, payload) => (0, api_fetch_1.apiFetch)(
-                    // A managed session supplies its own completion path; otherwise the
-                    // lib owns the URL so the endpoint stays visible to the parity check.
-                    sessionCompletionPath ?? (0, task_extras_1.taskCompletePath)(taskId), {
-                        method: 'POST',
-                        body: payload,
-                        // Same key the outbox will replay with — see `spaces create`.
-                        // Without it on THIS attempt, a completion that lands and loses
-                        // its response would be applied twice on replay.
-                        headers: { 'X-Idempotency-Key': completionIdempotencyKey },
-                    }),
-                    addComment: (taskId, commentBody) => data_provider_1.dataService.addTaskComment({ taskId, data: { body: commentBody } }),
-                    moveTask: (taskId, taskStatus) => data_provider_1.dataService.moveTask({ taskId, status: taskStatus }),
-                    allowLegacyFallback: sessionCompletionPath ? false : undefined,
-                },
+            result = await (0, api_fetch_1.apiFetch)(sessionPath || (0, task_extras_1.taskCompletePath)(taskId), {
+                method: 'POST',
+                body: { ...payload, idempotencyKey },
+                headers: { 'X-Idempotency-Key': idempotencyKey },
             });
         }
-        catch (err) {
-            // The completion summary/deliverables/verdict are authored content — the
-            // record of what the agent actually did. Losing that to a 503 costs the
-            // reasoning, not just a retry, so an OUTAGE queues it durably (OSK-2806)
-            // while every 4xx still fails immediately through handleApiError.
-            //
-            // The key is derived from (taskId, payload) so replaying THIS completion
-            // collapses onto the original server-side rather than double-completing;
-            // `requestIdempotency` on POST /api/tasks/:taskId/complete is what makes
-            // that hold.
-            this.queueWriteOrFail(err, {
-                command: 'tasks complete',
-                summary: `completion of task ${taskIdentity.id}`,
-                method: 'post',
-                url: `/api/tasks/${encodeURIComponent(taskIdentity.id)}/complete`,
-                body: completionPayload,
-                idempotencyKey: completionIdempotencyKey,
-            });
+        catch (error) {
+            this.handleApiError(error);
         }
-        const { comment, movedTask } = result;
-        // Report the task the SERVER finalized, not the one resolved locally.
-        // `completeTaskDurably` already refuses a divergence, so these agree by the
-        // time we get here — preferring the server's id keeps that true even if a
-        // future path stops throwing.
-        const completedTaskId = movedTask?.id ?? taskIdentity.id;
-        const payload = {
-            success: true,
-            taskId: completedTaskId,
-            task: taskIdentity,
-            moved: !flags['no-move'],
-            moveStatus: movedTask?.status ?? null,
-            comment,
-            movedTask,
-            taskOutput: {
-                status,
-                summary,
-                deliverables,
-                verdict,
-                ...(report ? { report } : {}),
-                body,
-            },
-            ...(result.advisories?.length ? { advisories: result.advisories } : {}),
-        };
+        const url = (0, web_url_1.taskUrlFrom)(this.cliConfig.baseURL, { id: taskId });
         if (flags.json) {
-            const url = movedTask
-                ? (0, web_url_1.taskUrlFrom)(this.cliConfig.baseURL, movedTask)
-                : (0, web_url_1.taskUrlFrom)(this.cliConfig.baseURL, { id: completedTaskId });
-            this.log(JSON.stringify({ ...payload, url: report && url ? `${url}#task-outcome` : url }, null, 2));
+            this.log(JSON.stringify({ ...result, url }, null, 2));
             return;
         }
-        const commentId = comment
-            ? (comment.id ?? comment._id)
-            : undefined;
-        this.log(`Posted TASK_OUTPUT comment ${commentId ?? '?'} on task ${completedTaskId}`);
-        if (movedTask) {
-            // Only claim a transition that happened. This printed unconditionally, so
-            // `tasks complete` on an already-done task reported "Moved task X to
-            // done" when nothing moved — a state change asserted by the one tool the
-            // reader is trusting to tell them the state.
-            const newStatus = movedTask.status;
-            this.log(priorStatus && priorStatus === newStatus
-                ? `Task ${completedTaskId} was already ${newStatus}; the outcome was amended.`
-                : `Moved task ${completedTaskId} to ${newStatus}`);
-        }
-        for (const advisory of result.advisories ?? []) {
-            // One warn per unmet condition. Each already reads as an observation —
-            // the completion happened — so the CLI relays them rather than
-            // re-wording them into something that sounds like a failure.
+        this.log(`Submitted Result v${result.result.version}; Task is ${result.task.statusType || result.task.status || 'updated'}.`);
+        const pending = describePendingReview({
+            statusType: result.task.statusType,
+            taskId,
+            resultId: result.result.id,
+            bin: this.config.bin,
+        });
+        if (pending)
+            this.log(pending);
+        for (const advisory of result.advisories || [])
             this.warn(advisory.message);
-        }
-        if (report) {
-            const url = (0, web_url_1.taskUrlFrom)(this.cliConfig.baseURL, movedTask ?? { id: completedTaskId });
-            if (url)
-                this.log(`Outcome: ${url}#task-outcome`);
-        }
-        await (0, task_instruction_offer_1.maybeOfferTaskManagementInstructions)((message) => this.log(message));
+        if (url)
+            this.log(`Task: ${url}#task-result`);
     }
 }
 exports.default = TasksComplete;
-function autonomousSessionCompletionPath() {
-    // A daemon-delegated CLI credential has the regular user command surface;
-    // use the normal atomic endpoint so completion, comments, and moves all
-    // share the same full-permission principal.
-    if ((0, delegated_cli_1.isDelegatedCliSession)())
-        return null;
-    if (!(0, credential_resolver_1.resolveTrustedAutonomousCredential)())
-        return null;
-    const sessionId = (process.env.OVERSKY_SESSION_ID || '').trim();
-    if (!sessionId) {
-        throw new Error('Autonomous task completion requires OVERSKY_SESSION_ID.');
-    }
-    return `/api/agentic/sessions/${encodeURIComponent(sessionId)}/task-completion`;
-}
-function normalizeStatus(value) {
-    const normalized = optionalString(value) || 'completed';
-    if (normalized === 'completed' || normalized === 'failed') {
-        return normalized;
-    }
-    throw new Error('status must be "completed" or "failed".');
-}
-function requireOutputField(value, field) {
-    const normalized = optionalOutputField(value);
-    if (!normalized) {
-        throw new Error(`${field} is required.`);
-    }
-    return normalized;
-}
-function optionalOutputField(value) {
-    if (value === undefined || value === null)
-        return undefined;
-    const normalized = String(value)
-        .replace(/---TASK_OUTPUT---/gi, 'TASK_OUTPUT')
-        .replace(/---END_OUTPUT---/gi, 'END_OUTPUT')
-        .replace(/[\r\n]+/g, ' ')
-        .replace(/\s+/g, ' ')
-        .trim();
-    return normalized || undefined;
-}
-function optionalString(value) {
-    if (value === undefined || value === null)
-        return undefined;
-    const normalized = String(value).trim();
-    return normalized || undefined;
-}
-// Rendering is shared with the API (`@skrr-ai/data-provider`), so the string
-// measured by the local preflight is byte-identical to the one the server stores.
-const formatTaskOutput = data_provider_1.renderTaskOutputBody;