@astrosheep/keiyaku 2.9.11 → 2.9.13

package/build/core/run-control/runner-lease.js

@@ -0,0 +1,172 @@
+import { initializeSqliteProcessLifetimeLockDatabase, isSqliteProcessLifetimeLockContention, openSqliteProcessLifetimeLockTransaction, SqliteProcessLifetimeLockError, sqliteProcessLifetimeLockErrorDetail, } from "./sqlite-process-lifetime-lock.js";
+export class RunnerLeaseUnavailableError extends Error {
+    code = "RUNNER_LEASE_UNAVAILABLE";
+    constructor(message, options) {
+        super(message, options);
+        this.name = "RunnerLeaseUnavailableError";
+    }
+}
+function errorDetail(error) {
+    return sqliteProcessLifetimeLockErrorDetail(error);
+}
+function isContention(error) {
+    return isSqliteProcessLifetimeLockContention(error)
+        || (error instanceof SqliteProcessLifetimeLockError && error.reason === "busy");
+}
+function openGuard(lockPath, busyTimeoutMs) {
+    return openSqliteProcessLifetimeLockTransaction({ path: lockPath, mode: "deferred", busyTimeoutMs });
+}
+function openReservation(lockPath, busyTimeoutMs) {
+    return openSqliteProcessLifetimeLockTransaction({ path: lockPath, mode: "immediate", busyTimeoutMs });
+}
+function closeTransaction(transaction) {
+    try {
+        transaction.close();
+    }
+    catch (error) {
+        return error;
+    }
+}
+function createHeldLock(lockPath, busyTimeoutMs, guard, initialReservation) {
+    let closed = false;
+    let reservation = initialReservation;
+    return {
+        releaseReservationForTransfer() {
+            if (closed || reservation === undefined)
+                return;
+            const released = reservation;
+            reservation = undefined;
+            const failure = closeTransaction(released);
+            if (failure !== undefined)
+                throw new RunnerLeaseUnavailableError(`runner lease reservation release failed: ${errorDetail(failure)}`, { cause: failure });
+        },
+        reclaimReservation() {
+            if (closed || reservation !== undefined)
+                return;
+            try {
+                reservation = openReservation(lockPath, busyTimeoutMs);
+            }
+            catch (error) {
+                throw new RunnerLeaseUnavailableError(`runner lease reservation reclaim failed: ${errorDetail(error)}`, { cause: error });
+            }
+        },
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            let failure;
+            if (reservation !== undefined)
+                failure = closeTransaction(reservation);
+            failure ??= closeTransaction(guard);
+            if (failure !== undefined)
+                throw new RunnerLeaseUnavailableError(`runner lease release failed: ${errorDetail(failure)}`, { cause: failure });
+        },
+    };
+}
+function unavailable(operation, error) {
+    return new RunnerLeaseUnavailableError(`${operation}: ${errorDetail(error)}`, { cause: error });
+}
+export function initializeRunnerLeaseDatabase(leasePath) {
+    try {
+        return initializeSqliteProcessLifetimeLockDatabase(leasePath);
+    }
+    catch (error) {
+        throw unavailable("runner lease database could not be initialized", error);
+    }
+}
+export function acquireRunnerLease(lockPath, busyTimeoutMs = 0) {
+    let guard;
+    try {
+        guard = openGuard(lockPath, busyTimeoutMs);
+    }
+    catch (error) {
+        throw unavailable("runner lease database could not be opened", error);
+    }
+    try {
+        return createHeldLock(lockPath, busyTimeoutMs, guard, openReservation(lockPath, busyTimeoutMs));
+    }
+    catch (error) {
+        closeTransaction(guard);
+        if (isContention(error))
+            throw new RunnerLeaseUnavailableError("runner lease is already held", { cause: error });
+        throw unavailable("runner lease acquisition failed", error);
+    }
+}
+export function acquireRunnerLeaseTransferTarget(lockPath, busyTimeoutMs = 0) {
+    let guard;
+    try {
+        guard = openGuard(lockPath, busyTimeoutMs);
+    }
+    catch (error) {
+        throw unavailable("runner lease transfer acquisition failed", error);
+    }
+    let closed = false;
+    return {
+        promote() {
+            if (closed)
+                throw new RunnerLeaseUnavailableError("runner lease transfer target is closed");
+            try {
+                const reservation = openReservation(lockPath, busyTimeoutMs);
+                closed = true;
+                return createHeldLock(lockPath, busyTimeoutMs, guard, reservation);
+            }
+            catch (error) {
+                throw unavailable("runner lease transfer promotion failed", error);
+            }
+        },
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            const failure = closeTransaction(guard);
+            if (failure !== undefined)
+                throw unavailable("runner lease transfer release failed", failure);
+        },
+    };
+}
+export function acquireRunnerLostProof(lockPath, busyTimeoutMs = 0) {
+    let transaction;
+    try {
+        transaction = openSqliteProcessLifetimeLockTransaction({ path: lockPath, mode: "exclusive", busyTimeoutMs });
+    }
+    catch (error) {
+        if (isContention(error))
+            throw new RunnerLeaseUnavailableError("runner lease is already held", { cause: error });
+        throw unavailable("runner lost proof acquisition failed", error);
+    }
+    let closed = false;
+    return {
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            const failure = closeTransaction(transaction);
+            if (failure !== undefined)
+                throw unavailable("runner lost proof release failed", failure);
+        },
+    };
+}
+/** Positive death probe without creating a missing lock database. */
+export function observeRunnerLease(lockPath) {
+    let probe;
+    try {
+        probe = openSqliteProcessLifetimeLockTransaction({ path: lockPath, mode: "exclusive", busyTimeoutMs: 0 });
+        return { state: "released" };
+    }
+    catch (error) {
+        if (isContention(error))
+            return { state: "held" };
+        const detail = errorDetail(error);
+        return {
+            state: "unknown",
+            reason: detail.includes("rollback-journal") ? "unsupported-journal-mode" : "probe-failed",
+            detail,
+        };
+    }
+    finally {
+        try {
+            probe?.close();
+        }
+        catch { /* no probe cleanup result is death evidence */ }
+    }
+}

package/build/core/run-control/sqlite-process-lifetime-lock.js

@@ -0,0 +1,174 @@
+import * as fs from "node:fs";
+import { DatabaseSync } from "node:sqlite";
+const SQLITE_BUSY = 5;
+export class SqliteProcessLifetimeLockError extends Error {
+    reason;
+    code = "SQLITE_PROCESS_LIFETIME_LOCK_UNAVAILABLE";
+    constructor(message, reason, options) {
+        super(message, options);
+        this.reason = reason;
+        this.name = "SqliteProcessLifetimeLockError";
+    }
+}
+export function sqliteProcessLifetimeLockErrorDetail(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+export function isSqliteProcessLifetimeLockContention(error) {
+    const code = typeof error === "object" && error !== null && "code" in error
+        ? String(error.code)
+        : "";
+    const errcode = typeof error === "object" && error !== null && "errcode" in error
+        ? error.errcode
+        : undefined;
+    const message = sqliteProcessLifetimeLockErrorDetail(error).toLowerCase();
+    return errcode === SQLITE_BUSY || code === "ERR_SQLITE_BUSY" || code === "ERR_SQLITE_LOCKED"
+        || message.includes("database is locked") || message.includes("database is busy");
+}
+function assertBusyTimeout(busyTimeoutMs) {
+    if (!Number.isSafeInteger(busyTimeoutMs) || busyTimeoutMs < 0) {
+        throw new SqliteProcessLifetimeLockError("SQLite process-lifetime lock busy timeout must be a non-negative safe integer", "invalid");
+    }
+}
+function journalMode(database) {
+    const row = database.prepare("PRAGMA journal_mode").get();
+    return typeof row?.journal_mode === "string" ? row.journal_mode.toLowerCase() : undefined;
+}
+function assertSchema(database) {
+    database.prepare("SELECT singleton FROM lock_anchor LIMIT 1").get();
+}
+function closeTransaction(database) {
+    let failure;
+    try {
+        database.exec("ROLLBACK");
+    }
+    catch (error) {
+        failure = error;
+    }
+    try {
+        database.close();
+    }
+    catch (error) {
+        failure ??= error;
+    }
+    return failure;
+}
+function throwLockError(prefix, error) {
+    if (error instanceof SqliteProcessLifetimeLockError)
+        throw error;
+    if (isSqliteProcessLifetimeLockContention(error)) {
+        throw new SqliteProcessLifetimeLockError(`${prefix} is already held`, "busy", { cause: error });
+    }
+    throw new SqliteProcessLifetimeLockError(`${prefix} failed: ${sqliteProcessLifetimeLockErrorDetail(error)}`, "open-failed", { cause: error });
+}
+/**
+ * Creates only a rollback-journal schema anchor. The empty database persists no
+ * ownership facts; an open transaction is the complete physical ownership signal.
+ */
+export function initializeSqliteProcessLifetimeLockDatabase(lockPath) {
+    let database;
+    try {
+        database = new DatabaseSync(lockPath);
+        database.exec("PRAGMA busy_timeout=0");
+        database.exec("PRAGMA journal_mode=DELETE");
+        database.exec("CREATE TABLE IF NOT EXISTS lock_anchor (singleton INTEGER PRIMARY KEY CHECK (singleton = 1))");
+        assertSchema(database);
+        if (journalMode(database) !== "delete") {
+            throw new SqliteProcessLifetimeLockError("SQLite process-lifetime lock database does not use rollback-journal mode", "invalid");
+        }
+    }
+    catch (error) {
+        throwLockError("SQLite process-lifetime lock database initialization", error);
+    }
+    finally {
+        try {
+            database?.close();
+        }
+        catch { /* the causal initialization error is retained */ }
+    }
+    return lockPath;
+}
+export function openSqliteProcessLifetimeLockTransaction(input) {
+    const busyTimeoutMs = input.busyTimeoutMs ?? 0;
+    assertBusyTimeout(busyTimeoutMs);
+    if (!input.create) {
+        try {
+            if (!fs.lstatSync(input.path).isFile()) {
+                throw new SqliteProcessLifetimeLockError("SQLite process-lifetime lock database is not a regular file", "invalid");
+            }
+        }
+        catch (error) {
+            if (error instanceof SqliteProcessLifetimeLockError)
+                throw error;
+            throw new SqliteProcessLifetimeLockError(`SQLite process-lifetime lock database is not initialized: ${sqliteProcessLifetimeLockErrorDetail(error)}`, "open-failed", { cause: error });
+        }
+    }
+    let database;
+    try {
+        database = new DatabaseSync(input.path);
+        database.exec(`PRAGMA busy_timeout=${busyTimeoutMs}`);
+        if (input.create) {
+            database.exec("PRAGMA journal_mode=DELETE");
+            database.exec("CREATE TABLE IF NOT EXISTS lock_anchor (singleton INTEGER PRIMARY KEY CHECK (singleton = 1))");
+        }
+        database.exec(`BEGIN ${input.mode.toUpperCase()}`);
+        // A DEFERRED transaction becomes a process-lifetime guard only after this read
+        // acquires its SHARED lock. Keep this inside every transaction mode.
+        assertSchema(database);
+        if (journalMode(database) !== "delete") {
+            throw new SqliteProcessLifetimeLockError("SQLite process-lifetime lock database does not use rollback-journal mode", "invalid");
+        }
+    }
+    catch (error) {
+        if (database !== undefined)
+            closeTransaction(database);
+        throwLockError("SQLite process-lifetime lock acquisition", error);
+    }
+    let closed = false;
+    return {
+        path: input.path,
+        database,
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            const failure = closeTransaction(database);
+            if (failure !== undefined) {
+                throw new SqliteProcessLifetimeLockError(`SQLite process-lifetime lock release failed: ${sqliteProcessLifetimeLockErrorDetail(failure)}`, "release-failed", { cause: failure });
+            }
+        },
+    };
+}
+function waitForRetry(milliseconds, signal) {
+    return new Promise((resolve, reject) => {
+        const abort = () => {
+            clearTimeout(timer);
+            reject(signal?.reason ?? new DOMException("operation aborted", "AbortError"));
+        };
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", abort);
+            resolve();
+        }, milliseconds);
+        signal?.addEventListener("abort", abort, { once: true });
+    });
+}
+/** Waits for the sole BEGIN IMMEDIATE owner. Cancellation is the only time bound. */
+export async function acquireSqliteProcessLifetimeLock(input) {
+    const retryMs = input.retryMs ?? 25;
+    assertBusyTimeout(retryMs);
+    for (;;) {
+        input.signal?.throwIfAborted();
+        try {
+            return openSqliteProcessLifetimeLockTransaction({
+                path: input.path,
+                mode: "immediate",
+                busyTimeoutMs: 0,
+                create: true,
+            });
+        }
+        catch (error) {
+            if (!(error instanceof SqliteProcessLifetimeLockError) || error.reason !== "busy")
+                throw error;
+            await waitForRetry(retryMs, input.signal);
+        }
+    }
+}

package/build/core/seal.js

@@ -1,4 +1,5 @@
 import { FlowError } from "../flow-error.js";
+import { requireCommitCoordinate } from "../git/commits.js";
 import { createGit, parseRevListOutput, wrapGitError } from "../git/core.js";
 import { effectiveScope } from "./lifecycle-history.js";
 import { scopePathEvidence, } from "./scope.js";
@@ -42,13 +43,7 @@ export async function receiptsAfterFence(cwd, entries, head = "HEAD") {
     return revList(cwd, getFence(entries), await resolveCommit(cwd, head));
 }
 async function resolveCommit(cwd, revision) {
-    const git = createGit(cwd);
-    try {
-        return (await git.raw(["rev-parse", "--verify", `${revision}^{commit}`])).trim();
-    }
-    catch (error) {
-        throw wrapGitError(`rev-parse ${revision}`, error, cwd);
-    }
+    return (await requireCommitCoordinate(cwd, revision)).commit;
 }
 async function revList(cwd, from, to) {
     const git = createGit(cwd);
@@ -120,15 +115,18 @@ async function auditScope(cwd, entries, paths) {
         ...await scopeViolations(cwd, paths, scope),
         ...taskNamespaceViolations(paths, findBind(entries).data.scope),
     ].filter((row, index, all) => all.findIndex((candidate) => candidate.path === row.path) === index);
-    if (scopeViolationEvidence.length > 0) {
-        throw new ScopeAuditError(findBind(entries).contract, scope, scopeViolationEvidence);
-    }
     const violations = scopeViolationEvidence.map((violation) => violation.path);
     return {
         scopeAudit: { violations },
         scopeViolationEvidence,
     };
 }
+function admitScope(contract, scope, capture, policy) {
+    if (policy === "refuse" && capture.scopeViolationEvidence.length > 0) {
+        throw new ScopeAuditError(contract, scope, capture.scopeViolationEvidence);
+    }
+    return capture;
+}
 export class ScopeAuditError extends FlowError {
     scopeViolationEvidence;
     constructor(_contractId, scope, evidence) {
@@ -155,7 +153,7 @@ function currentFoldedSealArc(model) {
     return model.seal === null ? model.intent.arc : null;
 }
 /** Current-read admission capture: scope and fence come only from the folded model. */
-export async function captureFoldedSeal(cwd, model, head = "HEAD", scopeAppend = []) {
+export async function captureFoldedSeal(cwd, model, head = "HEAD", scopeAppend = [], scopePolicy) {
     const arc = currentFoldedSealArc(model);
     if (arc === null)
         return null;
@@ -168,14 +166,18 @@ export async function captureFoldedSeal(cwd, model, head = "HEAD", scopeAppend =
     ]);
     const effectiveScope = [...model.effectiveScope, ...scopeAppend];
     const bind = model.history.find((row) => row.entry.kind === "bind")?.entry;
-    const scopeViolationEvidence = [
-        ...await scopeViolations(cwd, paths, effectiveScope),
-        ...taskNamespaceViolations(paths, bind?.kind === "bind" ? bind.data.scope : []),
-    ].filter((row, index, all) => all.findIndex((candidate) => candidate.path === row.path) === index);
-    if (scopeViolationEvidence.length > 0) {
-        throw new ScopeAuditError(model.contract, effectiveScope, scopeViolationEvidence);
+    const ordinaryViolations = await scopeViolations(cwd, paths, effectiveScope);
+    const namespaceViolations = taskNamespaceViolations(paths, bind?.kind === "bind" ? bind.data.scope : []);
+    if (namespaceViolations.length > 0) {
+        throw new ScopeAuditError(model.contract, effectiveScope, namespaceViolations);
     }
-    return { arc, oldFence, newFence, receipts, diffstat: stat, scopeAudit: { violations: [] }, scopeViolationEvidence };
+    const scopeViolationEvidence = ordinaryViolations
+        .filter((row, index, all) => all.findIndex((candidate) => candidate.path === row.path) === index);
+    const scopeAudit = admitScope(model.contract, effectiveScope, {
+        scopeAudit: { violations: scopeViolationEvidence.map((violation) => violation.path) },
+        scopeViolationEvidence,
+    }, scopePolicy);
+    return { arc, oldFence, newFence, receipts, diffstat: stat, ...scopeAudit };
 }
 /** Current seal intent: open explicit arc, else derived a0 while no explicit arc has ever existed. */
 export function currentSealArc(entries) {
@@ -219,7 +221,14 @@ export async function previewSeal(cwd, entries, head = "HEAD") {
     };
 }
 export async function captureSeal(cwd, entries, head = "HEAD") {
-    return (await previewSeal(cwd, entries, head)).capture;
+    const preview = await previewSeal(cwd, entries, head);
+    if (!preview.capture)
+        return null;
+    admitScope("direct seal", effectiveScope(entries), {
+        scopeAudit: preview.capture.scopeAudit,
+        scopeViolationEvidence: preview.capture.scopeViolationEvidence,
+    }, "refuse");
+    return preview.capture;
 }
 /** Folded renew capture: preserve receipt hashes while auditing rebased delivery content. */
 export async function captureFoldedRenewSeal(input) {
@@ -239,21 +248,24 @@ export async function captureFoldedRenewSeal(input) {
     ]);
     const scope = [...input.effectiveScope, ...input.pendingScopeOverlay];
     const bindScope = await acceptedBindScope(input.cwd, input.contract);
-    const scopeViolationEvidence = [
-        ...await scopeViolations(input.cwd, paths, scope),
-        ...taskNamespaceViolations(paths, bindScope),
-    ].filter((row, index, all) => all.findIndex((candidate) => candidate.path === row.path) === index);
-    if (scopeViolationEvidence.length > 0) {
-        throw new ScopeAuditError(input.contract, scope, scopeViolationEvidence);
+    const ordinaryViolations = await scopeViolations(input.cwd, paths, scope);
+    const namespaceViolations = taskNamespaceViolations(paths, bindScope);
+    if (namespaceViolations.length > 0) {
+        throw new ScopeAuditError(input.contract, scope, namespaceViolations);
     }
+    const scopeViolationEvidence = ordinaryViolations
+        .filter((row, index, all) => all.findIndex((candidate) => candidate.path === row.path) === index);
+    const scopeAudit = admitScope(input.contract, scope, {
+        scopeAudit: { violations: scopeViolationEvidence.map((violation) => violation.path) },
+        scopeViolationEvidence,
+    }, input.scopePolicy);
     return {
         arc,
         oldFence,
         newFence: receiptHead,
         receipts,
         diffstat: stat,
-        scopeAudit: { violations: [] },
-        scopeViolationEvidence,
+        ...scopeAudit,
     };
 }
 export async function sealCurrentArc(input) {
@@ -301,7 +313,7 @@ export async function sealCurrentArc(input) {
         prepare: async (admission) => {
             if (admission.business.existing)
                 return { capture: admission.business.existing.capture, existing: { transactionObjectId: admission.business.existing.transactionObjectId } };
-            return { capture: input.capture ?? await captureFoldedSeal(admission.business.targetRoot, admission.business.lifecycle, "HEAD") };
+            return { capture: input.capture ?? await captureFoldedSeal(admission.business.targetRoot, admission.business.lifecycle, "HEAD", [], "refuse") };
         },
         revalidate: ({ session, prepared }) => {
             assertOperable(input.contractId, session.lifecycle);
@@ -319,7 +331,7 @@ export async function sealCurrentArc(input) {
         effect: async ({ context, prepared }) => {
             const capture = prepared.capture;
             if (!capture)
-                return { kind: "refused-before-effects", authoritativeHead: context.session.lifecycle.observedLedgerHead, refusal: { code: "NO_OPEN_ARC", message: "no current arc requires sealing" } };
+                return { kind: "refused-before-effects", authoritativeHead: context.session.pins.repositoryLedgerHead, refusal: { code: "NO_OPEN_ARC", message: "no current arc requires sealing" } };
             const at = new Date(input.nowMs).toISOString();
             {
                 const { scopeViolationEvidence: _scopeViolationEvidence, ...durableCapture } = capture;
@@ -333,11 +345,11 @@ export async function sealCurrentArc(input) {
                 };
                 const result = prepared.existing
                     ? await context.replayCommitted({ transactionObjectId: prepared.existing.transactionObjectId })
-                    : await context.publishAuthoritative({ verb: "seal", admittedLedgerHead: context.session.lifecycle.observedLedgerHead, acceptedLifecycleTail: context.session.lifecycle.history.at(-1).objectId, entries: [entry] });
+                    : await context.publishAuthoritative({ verb: "seal", admittedLedgerHead: context.session.pins.repositoryLedgerHead, acceptedLifecycleTail: context.session.lifecycle.contractHead, entries: [entry] });
                 if (result.status === "indeterminate")
-                    return { kind: "precommit-effects-only", authoritativeHead: result.currentHead ?? context.session.lifecycle.observedLedgerHead };
+                    return { kind: "precommit-effects-only", authoritativeHead: result.currentHead ?? context.session.pins.repositoryLedgerHead };
                 if (result.status !== "committed")
-                    return { kind: "refused-before-effects", authoritativeHead: result.currentHead ?? context.session.lifecycle.observedLedgerHead, refusal: { code: "LEDGER_CAS_CONFLICT", message: `contract ${input.contractId} changed while sealing` } };
+                    return { kind: "refused-before-effects", authoritativeHead: result.currentHead ?? context.session.pins.repositoryLedgerHead, refusal: { code: "LEDGER_CAS_CONFLICT", message: `contract ${input.contractId} changed while sealing` } };
                 return { kind: "committed", commit: result, entryKind: "seal", value: {
                         ...capture,
                         sealedBy: input.sealedBy,

package/build/core/settlement/claim-delivery.js

@@ -1,6 +1,6 @@
 import { FlowError } from "../../flow-error.js";
-import { createGit, errorContainsAnyPattern, MISSING_HEAD_PATTERNS, runGitProcess } from "../../git/core.js";
-import { shortCommitHash } from "../../git/commits.js";
+import { createGit, runGitProcess } from "../../git/core.js";
+import { readCommitCoordinate, shortCommitHash } from "../../git/commits.js";
 import { assertHonestClaimEvidence, buildHonestClaimMerge, } from "../repository-ledger/claim-evidence.js";
 async function successfulGit(cwd, args, input) {
     const result = await runGitProcess(cwd, args, input === undefined ? undefined : { input });
@@ -22,16 +22,29 @@ export async function buildClaimLanding(input) {
     }
 }
 export async function resolveCommit(cwd, rev) {
-    return await successfulGit(cwd, ["rev-parse", "--verify", `${rev}^{commit}`]);
+    const read = await readCommitCoordinate(cwd, rev);
+    if (read.status === "ok")
+        return read.coordinate.commit;
+    if (read.status === "failed") {
+        const detail = read.result.stderr.trim() || read.error.message || `exit ${String(read.result.status)}`;
+        throw new FlowError("INTERNAL_STATE", `git rev-parse ${rev} failed: ${detail}`, { cause: read.error });
+    }
+    if (read.status === "malformed") {
+        throw new FlowError("INTERNAL_STATE", `git rev-parse ${rev} failed: ${read.detail}`);
+    }
+    throw new FlowError("INTERNAL_STATE", `git rev-parse ${rev} failed: revision does not resolve to a commit`);
 }
 export async function resolveCommitOrNull(cwd, rev) {
-    const result = await runGitProcess(cwd, ["rev-parse", "--verify", `${rev}^{commit}`]);
-    if (result.status === 0 && !result.error)
-        return result.stdout.trim();
-    if (errorContainsAnyPattern(result.stderr, MISSING_HEAD_PATTERNS))
+    const read = await readCommitCoordinate(cwd, rev);
+    if (read.status === "ok")
+        return read.coordinate.commit;
+    if (read.status === "missing" || read.status === "non-commit")
         return null;
-    const detail = result.stderr.trim() || result.error?.message || `exit ${String(result.status)}`;
-    throw new FlowError("INTERNAL_STATE", `git rev-parse ${rev} failed: ${detail}`, { cause: result.error });
+    if (read.status === "malformed") {
+        throw new FlowError("INTERNAL_STATE", `git rev-parse ${rev} failed: ${read.detail}`);
+    }
+    const detail = read.result.stderr.trim() || read.error.message || `exit ${String(read.result.status)}`;
+    throw new FlowError("INTERNAL_STATE", `git rev-parse ${rev} failed: ${detail}`, { cause: read.error });
 }
 /** Prove parent order and tree identity independently of mutable refs. */
 export async function proveClaimLanding(cwd, landing) {

package/build/core/settlement/claim.js

@@ -179,7 +179,7 @@ export async function claimContract(input) {
                 : await context.publishAuthoritative({
                     verb: "claim",
                     admittedLedgerHead: admission.ledgerHead,
-                    acceptedLifecycleTail: context.session.lifecycle.history.at(-1).objectId,
+                    acceptedLifecycleTail: context.session.lifecycle.contractHead,
                     entries: [{
                             v: 2,
                             kind: "claim",
@@ -221,11 +221,13 @@ export async function claimContract(input) {
                 },
             });
             await context.session.completeReplay("retire");
-            const taskRow = context.journal.all().find((row) => row.effect === "task-board-projection" && row.status === "succeeded");
-            const taskFacts = taskRow?.status === "succeeded" ? taskRow.receipt?.facts : undefined;
-            const warnings = isJsonObject(taskFacts) && Array.isArray(taskFacts.warnings)
-                ? taskFacts.warnings.filter((warning) => typeof warning === "string")
-                : [];
+            const warnings = ["task-board-projection", "target-worktree-projection"].flatMap((effect) => {
+                const row = context.journal.all().find((candidate) => candidate.effect === effect && candidate.status === "succeeded");
+                const facts = row?.status === "succeeded" ? row.receipt?.facts : undefined;
+                return isJsonObject(facts) && Array.isArray(facts.warnings)
+                    ? facts.warnings.filter((warning) => typeof warning === "string")
+                    : [];
+            });
             const cleanupRow = context.journal.all().find((row) => row.effect === "worktree-projection" && row.status === "succeeded");
             const cleanupFacts = cleanupRow?.status === "succeeded" ? cleanupRow.receipt?.facts : undefined;
             const deliveryRefRow = context.journal.all().find((row) => row.effect === "delivery-ref-projection" && row.status === "succeeded");

package/build/core/settlement/petition-claim-gates.js

@@ -8,7 +8,7 @@ import { getDiffStats } from "../../git/diff/preview.js";
 import { readDiff } from "../../git/diff/read.js";
 import { getCurrentBranch } from "../../git/branches.js";
 import { getLatestCommitHash } from "../../git/staging.js";
-import { createGit } from "../../git/core.js";
+import { requireCommitCoordinate } from "../../git/commits.js";
 import { DIFF_PREVIEW_TEXT_MAX_CHARS } from "../../keiyaku.js";
 import { FlowError } from "../../flow-error.js";
 import { persistResponseHistory } from "../transcripts.js";
@@ -100,13 +100,14 @@ export function createOathGate() {
 export function createCommandVerificationGate() {
     return {
         name: "command",
-        async evaluate({ cwd, coordinationRoot, verificationPlan, verificationCandidate, input }) {
-            const repositoryRoot = coordinationRoot ?? cwd;
+        async evaluate({ cwd, repositoryRoot, verificationPlan, verificationCandidate, input }) {
             for (const verification of verificationPlan) {
                 logInfo(`[CLAIM] Running ${verification.source}: ${verification.label}`, { cwd, section: "script", progressOnly: true });
             }
-            const evidence = await runVerificationPlan({ cwd, candidate: verificationCandidate, plan: verificationPlan, signal: input.signal, coordinationKey: JSON.stringify({ repository: repositoryRoot, candidate: verificationCandidate, plan: verificationPlan }), coordinationRoot: repositoryRoot });
-            const runnerFailure = evidence.find((result) => result.execution.status === "runner_failed");
+            const invocation = await runVerificationPlan({ cwd, candidate: verificationCandidate, plan: verificationPlan, signal: input.signal, root: repositoryRoot ?? cwd });
+            // Petition owns the run: abort cancels and awaitTerminal observes cleanup.
+            const evidence = await invocation.awaitTerminal();
+            const runnerFailure = evidence.results.find((result) => result.execution.status === "runner_failed");
             if (runnerFailure?.execution.status === "runner_failed") {
                 return {
                     pass: false,
@@ -120,7 +121,7 @@ export function createCommandVerificationGate() {
                     },
                 };
             }
-            const commandFailure = evidence.find((result) => result.execution.status === "executed" && result.execution.code !== 0);
+            const commandFailure = evidence.results.find((result) => result.execution.status === "executed" && result.execution.code !== 0);
             if (commandFailure?.execution.status === "executed") {
                 return {
                     pass: false,
@@ -134,7 +135,7 @@ export function createCommandVerificationGate() {
                     },
                 };
             }
-            return { pass: true, verification: [...evidence] };
+            return { pass: true, verification: [...evidence.results] };
         },
     };
 }
@@ -193,7 +194,7 @@ export function createAgentReviewGate() {
                 authority: { kind: "repository" },
                 binding: { kind: "commission", commissionId: contractId },
             });
-            const reviewHeadBeforeWrite = (await createGit(cwd).revparse(["--verify", "HEAD^{commit}"])).trim();
+            const reviewHeadBeforeWrite = (await requireCommitCoordinate(cwd, "HEAD")).commit;
             const raw = subagentResult.finalMessage.trim();
             const passed = raw.startsWith(REVIEW_PASS_TOKEN);
             const observations = passed ? raw.slice(REVIEW_PASS_TOKEN.length).trim() || undefined : undefined;

package/build/core/settlement/petition-head-guard.js

@@ -1,13 +1,12 @@
 import { FlowError } from "../../flow-error.js";
-import { createGit } from "../../git/core.js";
+import { requireCommitCoordinate } from "../../git/commits.js";
 const CONCURRENT_MODIFICATION_CODE = "CONCURRENT_MODIFICATION";
 export async function assertHeadUnchanged(cwd, expectedHead, operation) {
-    const git = createGit(cwd);
     const [expectedCommit, currentHead] = await Promise.all([
-        git.raw(["rev-parse", "--verify", `${expectedHead}^{commit}`]),
-        git.raw(["rev-parse", "--verify", "HEAD^{commit}"]),
+        requireCommitCoordinate(cwd, expectedHead),
+        requireCommitCoordinate(cwd, "HEAD"),
     ]);
-    if (currentHead.trim() === expectedCommit.trim())
+    if (currentHead.commit === expectedCommit.commit)
         return;
-    throw new FlowError(CONCURRENT_MODIFICATION_CODE, `concurrent ${operation} modification detected: repository HEAD changed from ${expectedHead} to ${currentHead.trim()} while the ${operation} was running`);
+    throw new FlowError(CONCURRENT_MODIFICATION_CODE, `concurrent ${operation} modification detected: repository HEAD changed from ${expectedHead} to ${currentHead.commit} while the ${operation} was running`);
 }