agent-exec transport 9c7c1417e62f511b5f90669f58d69da9/682c27506bb4

scripts/evidence.py

@@ -27,6 +27,7 @@ BRANCH = re.compile(r"[A-Za-z0-9][A-Za-z0-9._/-]{0,199}\Z")
 # 可选的分支目标字段：两者须同时出现或同时缺省（旧收据没有）。
 TARGET_FIELDS = ("root_target", "immediate_target")
 PRE_MERGE_CLOSED = "已完成（合入前闭合）"
+TASK_STATE = re.compile(r"^\[task-state\] registered=(.+) initial_base=([0-9a-f]+)$", re.M)
 BASE_FIELDS = {"schema", "source", "timestamp", "command", "command_sha256", "cwd", "common_dir",
                "before", "after", "after_error", "exit_code", "output", "output_sha256", "receipt_sha256"}
 
@@ -314,6 +315,25 @@ def validate_precheck(receipt, purpose="start"):
                 git("merge-base", "--is-ancestor", after["target_head"], current["target_head"])
             except EvidenceError:
                 raise EvidenceError("Precheck target history has rewound or diverged") from None
+            validate_local_scope(receipt, current, context)
+
+
+def validate_local_scope(receipt, current, context):
+    """LOCAL_READY continues one active registered task; it remains SELF local-work evidence only."""
+    card = find_card()
+    status = re.search(r"；状态：\s*([^；\s][^；\n]*)", card.read_text(encoding="utf-8"))
+    if card.resolve().parent != context["root"] / ".task" or not status or status.group(1).startswith("已"):
+        raise EvidenceError("Local continuation requires an active registered task")
+    states = TASK_STATE.findall(receipt["output"])
+    if len(states) != 1 or Path(states[0][0]) != context["root"] or states[0][1] != context["r0"]:
+        raise EvidenceError("Precheck belongs to a different task identity or initial baseline")
+    for obj in (receipt["before"], receipt["after"]):
+        if obj["status"] or obj["untracked"] or obj["tracked_diff_sha256"] != digest(b""):
+            raise EvidenceError("Precheck workspace was not clean")
+        if obj["submodules"] != current["submodules"]:
+            raise EvidenceError("Precheck component state has changed")
+    if tuple(receipt.get(key) for key in TARGET_FIELDS) != task_targets():
+        raise EvidenceError("Precheck authorization scope differs from the registered task")
 
 
 def find_card():
@@ -457,8 +477,10 @@ def main():
         if imported or validated:
             receipt = read_receipt(imported or validated)
             if validated:
-                validate_precheck(receipt, os.environ.get("VALIDATE_RECEIPT_PURPOSE", "start"))
-                report(receipt, "precheck validated")
+                purpose = os.environ.get("VALIDATE_RECEIPT_PURPOSE", "start")
+                validate_precheck(receipt, purpose)
+                report(receipt, "local continuation validated (local work only; not delivery evidence)"
+                       if purpose == "resume-local" else "precheck validated")
             else:
                 card = find_card()
                 append_card(card, receipt)