@bevel-software/platform-core-backend 0.34.0 → 0.36.1

package/src/core/create-core-services.ts

@@ -125,29 +125,31 @@ import {
 import {
   DbSecretsVaultService,
   McpOAuthDiscoveryService,
+  managedSignInErasure,
   registerBevelSecretsVariableLoader,
+  type ManagedSignInPort,
 } from '../modules/secrets-vault/index.js';
 import { ConnectionProbeService } from '../modules/connection-probe/index.js';
-import { GitService } from '../modules/workflow/git/git.service.js';
-import { NodeGitRunner } from '../modules/workflow/git/node-git-runner.js';
-import { PullRequestService } from '../modules/workflow/git/pull-request.service.js';
+import { GitService } from '../modules/version-control/git/git.service.js';
+import { NodeGitRunner } from '../modules/version-control/git/node-git-runner.js';
+import { PullRequestService } from '../modules/version-control/git/pull-request.service.js';
 import { WorkspaceIdMutex, WorkspaceMutex } from '../modules/kb-fs/mutex.js';
-import { assertGitVersion } from '../modules/workflow/git/git-version.js';
+import { assertGitVersion } from '../modules/version-control/git/git-version.js';
 import { DiffService } from '../modules/diff/diff.service.js';
-import { ReviewWorkflowService } from '../modules/workflow/review-workflow/review-workflow.service.js';
-import { FileLockService } from '../modules/workflow/file-lock.service.js';
-import { WorkflowEventBus } from '../modules/workflow/index.js';
+import { ChangeRequestReviewService } from '../modules/version-control/change-request-review/change-request-review.service.js';
+import { FileLockService } from '../modules/version-control/file-lock.service.js';
+import { VersionControlEventBus } from '../modules/version-control/index.js';
 import { FileChangeNotifier } from '../modules/kb-fs/file-change-notifier.js';
 import { StarterPackService } from '../modules/onboarding/starter-pack.service.js';
-import { WorkflowService } from '../modules/workflow/workflow.service.js';
-import { WorkflowHooks } from '../modules/workflow/workflow-hooks.js';
-import { ChangeRequestHooks, type IChangeRequestHooks } from '../modules/workflow/change-request-hooks.js';
-import { PendingCommitsService } from '../modules/workflow/pending-commits.service.js';
+import { VersionControlService } from '../modules/version-control/version-control.service.js';
+import { VersionControlHooks } from '../modules/version-control/version-control-hooks.js';
+import { ChangeRequestHooks, type IChangeRequestHooks } from '../modules/version-control/change-request-hooks.js';
+import { PendingCommitsService } from '../modules/version-control/pending-commits.service.js';
 import {
   PendingCommitsWorker,
   consoleSystemNoticeSink,
-} from '../modules/workflow/pending-commits.worker.js';
-import { ensureRecoveryBotUser } from '../modules/workflow/recovery-bot.js';
+} from '../modules/version-control/pending-commits.worker.js';
+import { ensureRecoveryBotUser } from '../modules/version-control/recovery-bot.js';
 import { AdminAccessService } from '../modules/admin/admin-access.service.js';
 import {
   SyncedGroupsWriter,
@@ -171,6 +173,7 @@ import { AgentAuditService, retentionDaysFrom } from '../modules/audit/agent-aud
 import { readAgentPreamble, type AgentPreambleReader } from '../modules/agent-instructions/index.js';
 import {
   agentGuideSections,
+  guideStartText,
   joinGuideSections,
   type AgentGuideReader,
   type AgentGuideSectionsReader,
@@ -296,6 +299,12 @@ export interface CoreServices {
    * `read_file` of the guide's name answer. See modules/agent-guide.
    */
   agentGuide: AgentGuideReader;
+  /**
+   * The start of that guide and the list of its sections: what a `read_file`
+   * of the guide's name answers, the same as `get_agent_guide` with no
+   * `section`. See `guideStartText`.
+   */
+  agentGuideStart: AgentGuideReader;
   /** The same guide as its sections, each with its title — what `get_agent_guide` lists and serves one of. */
   agentGuideSections: AgentGuideSectionsReader;
   mcpServerEditService: McpServerEditService;
@@ -346,9 +355,9 @@ export interface CoreServices {
   gitService: GitService;
   pullRequestService: PullRequestService;
   diffService: DiffService;
-  reviewWorkflowService: ReviewWorkflowService;
+  changeRequestReviewService: ChangeRequestReviewService;
   fileLockService: FileLockService;
-  workflowService: WorkflowService;
+  versionControlService: VersionControlService;
   /**
    * The seam for "a change request was opened": a deployment registers here
    * how the reviewers are told (the cloud's mail, say), and the open's answer
@@ -357,7 +366,7 @@ export interface CoreServices {
   changeRequestHooks: IChangeRequestHooks;
   /** Remote sync (`POST /api/sync`): a git host or pipeline makes the clones catch up. */
   kbSyncService: KbSyncService;
-  eventBus: WorkflowEventBus;
+  eventBus: VersionControlEventBus;
   fileChangeNotifier: FileChangeNotifier;
   pendingCommitsService: PendingCommitsService;
   pendingCommitsWorker: PendingCommitsWorker;
@@ -433,6 +442,12 @@ export interface CoreServices {
   // ── Server-time seams (enterprise overwrites after construction) ────────
   /** `start_session` backing — core default {@link UuidSessionSink}. */
   sessionSink: ISessionSink;
+  /**
+   * The managed sign-in port (see `CorePorts.managedSignIns`), or null when
+   * the distribution registers none. Mutable for the same reason the session
+   * sink is: the overlay builds it after core, from services core returned.
+   */
+  managedSignIns: ManagedSignInPort | null;
   /** Connection-key LLM metering view — core default unmetered. */
   usageMeter: ILlmUsageMeter;
   /** SSO plugins the auth router mounts — same array instance as the port. */
@@ -915,16 +930,16 @@ export async function createCoreServices(
   // registers its listener here, after this returns (see `AccountHooks`).
   const accountHooks = new AccountHooks();
 
-  // Workflow lifecycle hooks — the ONE registry this composition shares
+  // Version-control lifecycle hooks — the ONE registry this composition shares
   // between GitService (advisory commit validation), the agent-access gate
   // (the blocking agentRead / preWrite hooks), and the composition root,
-  // which registers module-owned handlers on `workflowService.hooks` right
+  // which registers module-owned handlers on `versionControlService.hooks` right
   // after this function returns. Core registers none: no commit-time
   // validation (advisory anyway) and nothing that refuses an agent call.
-  const workflowHooks = new WorkflowHooks();
+  const versionControlHooks = new VersionControlHooks();
   const gitService = new GitService(
     workspaceService,
-    workflowHooks,
+    versionControlHooks,
     kb,
     workspaceMutex,
     accessControl,
@@ -961,7 +976,7 @@ export async function createCoreServices(
   // the post-switch backup reseed — but switchBranch is gone with the
   // per-branch workspace model, so the injection no longer applies.)
   workspaceService.setDiffService(diffService);
-  const reviewWorkflowService = new ReviewWorkflowService(
+  const changeRequestReviewService = new ChangeRequestReviewService(
     db,
     accessControl,
     workspaceService,
@@ -969,14 +984,14 @@ export async function createCoreServices(
   );
   // Late-bind the comment enricher so PullRequestService.getPrDetail includes
   // our DB-backed comments without forcing a circular constructor dependency.
-  pullRequestService.setDetailEnricher(reviewWorkflowService);
+  pullRequestService.setDetailEnricher(changeRequestReviewService);
 
-  // Workflow facade — the abstraction every app consumer should reach for
-  // instead of the individual git / PR / review-workflow services. See
+  // Version-control facade — the abstraction every app consumer should reach for
+  // instead of the individual git / PR / change-request-review services. See
   // PLAN.md for the migration story. Today it delegates straight through;
-  // implementations migrate into the workflow module over later steps.
+  // implementations migrate into the version-control module over later steps.
   const fileLockService = new FileLockService(db);
-  // Background commit queue. The `WorkflowService.releaseLock` path
+  // Background commit queue. The `VersionControlService.releaseLock` path
   // enqueues a row here instead of running commitFile + push inline; the
   // worker drains the queue out of band so a git hiccup can't block the
   // user-visible save path. See `lock-decoupling-plan.md`.
@@ -991,11 +1006,11 @@ export async function createCoreServices(
     (await pendingCommitsService.hasAnyForWorkspace(workspaceId)) ||
     (await fileLockService.hasAnyActive(workspaceId)),
   );
-  // In-process event bus: every WorkflowService mutation method that
+  // In-process event bus: every VersionControlService mutation method that
   // succeeds emits a typed event; the SSE route fans it to connected
   // browser sessions. Single instance per Node process — survives across
   // requests, doesn't survive restarts (clients reconnect + resync).
-  const eventBus = new WorkflowEventBus();
+  const eventBus = new VersionControlEventBus();
   // Office-document/PDF/email text extraction for `read_file`/`grep`, cached
   // by content hash beside the workspaces root (see `DocExtractionCache`),
   // failures included. A fresh failure is told to the people looking at the
@@ -1013,11 +1028,11 @@ export async function createCoreServices(
   // of a distribution registers its listener here, after this returns (see
   // `ChangeRequestHooks`).
   const changeRequestHooks = new ChangeRequestHooks();
-  const workflowService = new WorkflowService(
+  const versionControlService = new VersionControlService(
     db,
     gitService,
     pullRequestService,
-    reviewWorkflowService,
+    changeRequestReviewService,
     workspaceService,
     accessControl,
     fileLockService,
@@ -1026,10 +1041,10 @@ export async function createCoreServices(
     changeGate,
     eventBus,
     fileChangeNotifier,
-    // Exposed as `workflowService.hooks` — the SAME instance GitService and
+    // Exposed as `versionControlService.hooks` — the SAME instance GitService and
     // the agent-access gate consult, so a deployment's registrations against
     // it reach every hook point.
-    workflowHooks,
+    versionControlHooks,
     // Exposed as `changeRequestHooks`, the same instance, for the same reason.
     changeRequestHooks,
     // The opened event names the approvers as accounts; auth answers which
@@ -1038,7 +1053,7 @@ export async function createCoreServices(
   );
   // The leftover-branch cleanup asks the Deployment page at every round, so
   // switching it off there applies without a restart.
-  workflowService.leftoverCleanupEnabled = () => retireMergedBranchesOn(settings.resolve('retireMergedBranches'));
+  versionControlService.leftoverCleanupEnabled = () => retireMergedBranchesOn(settings.resolve('retireMergedBranches'));
 
   // Join requests: derived entirely from two copies of a plugin's `access.md`
   // (the request's branch vs the default branch), so it holds no state — it
@@ -1046,7 +1061,7 @@ export async function createCoreServices(
   // have all landed.
   const joinRequestsService = new JoinRequestsService(
     workspaceService,
-    workflowService,
+    versionControlService,
     kb,
     // Read-only: the one question a request asks of the resolver is whether
     // the person it names already holds what it proposes.
@@ -1058,7 +1073,7 @@ export async function createCoreServices(
   // answered in a database round-trip instead of a clone, and what survives a
   // restart with the request still owed.
   const pluginJoinRequestJobs = new PluginJoinRequestJobs(new DbJoinRequestStore(db), {
-    workflow: workflowService,
+    versionControl: versionControlService,
     workspaceService,
     kb,
     // A record keys on the plugin's primary FOLDER below the root, which the
@@ -1088,7 +1103,7 @@ export async function createCoreServices(
   // index counts, so a link drops that cache too.
   const pluginLinksService = new PluginLinksService(
     workspaceService,
-    workflowService,
+    versionControlService,
     accessControl,
     new AccessMutationService(workspaceService, accessControl, kb.kbDirName),
     skillService,
@@ -1101,7 +1116,7 @@ export async function createCoreServices(
   // then drops every cache that keyed on the old identity.
   const pluginRenameService = new PluginRenameService(
     workspaceService,
-    workflowService,
+    versionControlService,
     accessControl,
     pluginSource,
     disk,
@@ -1142,16 +1157,16 @@ export async function createCoreServices(
     gitRunner,
   );
 
-  // Remote sync. Drives the workflow module's per-branch pull-and-announce
+  // Remote sync. Drives the version-control module's per-branch pull-and-announce
   // over every clone the workspace service knows about; owns no git of its own.
-  const kbSyncService = new KbSyncService(workflowService, workspaceService);
+  const kbSyncService = new KbSyncService(versionControlService, workspaceService);
   // Server-scoped MCP editing — the tool page's edit form. One server's truth
   // spans a plugin's mcp.json AND plugin.json extensions block, and this is
   // the ONE writer that rewrites both entries and commits them together (see
   // McpServerEditService).
   const mcpServerEditService = new McpServerEditService(
     workspaceService,
-    workflowService,
+    versionControlService,
     accessControl,
     toolManualService,
     kb,
@@ -1164,7 +1179,7 @@ export async function createCoreServices(
   // folder's rules are at HEAD before the endpoint answers.
   const pluginProvisionService = new PluginProvisionService(
     workspaceService,
-    workflowService,
+    versionControlService,
     accessControl,
     kb,
     eventBus,
@@ -1174,26 +1189,26 @@ export async function createCoreServices(
 
   // Pending skills: the other half of the catalog — skills that exist only on
   // an open change request's branch. Built here rather than beside
-  // `skillService` because it needs the workflow service, which does not exist
+  // `skillService` because it needs the version-control service, which does not exist
   // that early; it holds no state of its own, so where it is constructed is the
   // only thing the ordering decides.
   const pendingSkillsService = new PendingSkillsService(
     workspaceService,
     accessControl,
     skillService,
-    workflowService,
+    versionControlService,
     kb,
   );
 
   // The same missing half, for tools: a `.tool` manual or an `mcp.json` server
   // an agent proposes is nowhere in the product until its change request
-  // merges. Built here for the same reason — it needs the workflow service —
+  // merges. Built here for the same reason — it needs the version-control service —
   // and stateless for the same reason.
   const pendingToolsService = new PendingToolsService(
     workspaceService,
     accessControl,
     toolManualService,
-    workflowService,
+    versionControlService,
     kb,
   );
 
@@ -1231,7 +1246,7 @@ export async function createCoreServices(
     packsDir: config.starterPacksDir,
     kb,
     workspaceService,
-    workflow: workflowService,
+    versionControl: versionControlService,
     adminAccess,
     settings,
     accessControl,
@@ -1281,7 +1296,7 @@ export async function createCoreServices(
   // can only exist once the vault does.
   const toolDeleteService = new ToolDeleteService(
     workspaceService,
-    workflowService,
+    versionControlService,
     accessControl,
     toolManualService,
     skillService,
@@ -1328,12 +1343,16 @@ export async function createCoreServices(
   });
 
   // GDPR erasure path: admin-driven user deletion. The core service erases the
-  // rows it owns; each module contributes its slice as a participant.
-  const accountErasureService = new AccountErasureService(
-    db,
-    reviewWorkflowService,
-    ports.erasureParticipants ?? [],
-  );
+  // rows it owns; each module contributes its slice as a participant. The
+  // vault's runs first: a managed sign-in's tokens are revoked with their
+  // provider before the user row goes and the vault rows cascade with it.
+  // The port's array is held, never copied (see `CorePorts.erasureParticipants`:
+  // the enterprise root fills it AFTER construction) and never written to
+  // (a root that rebuilds a graph over the same array would otherwise keep
+  // every past graph's vault slice): core's own slices travel beside it.
+  const accountErasureService = new AccountErasureService(db, changeRequestReviewService, ports.erasureParticipants ?? [], [
+    managedSignInErasure(secretsVaultService),
+  ]);
 
   // MCP (remote agent access). ExternalApiKeyService handles connection-key
   // lifecycle. McpService is a GENERIC, STATELESS proxy: per request it
@@ -1376,11 +1395,13 @@ export async function createCoreServices(
   // serves the same composition to the local bridge and the frontend card.
   const readPreamble: AgentPreambleReader = () => readAgentPreamble(workspaceService, kb, disk);
   // The guide every agent is told to read first, composed when asked for —
-  // the layout is read per call, so a name the setup save applies lands
-  // without a restart, and the distribution's hook sees every composition.
+  // the layout and the default branch are read per call, so a name the setup
+  // save applies lands without a restart, and the distribution's hook sees
+  // every composition.
   const agentGuideSectionsReader: AgentGuideSectionsReader = () =>
-    agentGuideSections(kb.layout, ports.agentGuide, { kbDirName });
+    agentGuideSections(kb.layout, ports.agentGuide, { kbDirName, defaultBranch: kb.defaultBranch });
   const agentGuide: AgentGuideReader = async () => joinGuideSections(await agentGuideSectionsReader());
+  const agentGuideStart: AgentGuideReader = async () => guideStartText(await agentGuideSectionsReader());
   // The Audit log. Records through the proxy below (every call an external
   // agent makes), reads keys through the key service so their shape is
   // defined once, and prunes past the retention setting — read per sweep, so
@@ -1402,7 +1423,7 @@ export async function createCoreServices(
       workspaceService,
       accessControl,
       authService,
-      workflowService,
+      versionControlService,
       gitService,
       accountLinks: new AccountLinkService(db),
       // The SAME extension-to-reader registry `read_file` dispatches on, so the
@@ -1435,9 +1456,12 @@ export async function createCoreServices(
       // For the needs-authorization setup link surfaced to external agents.
       publicFrontendUrl: config.publicFrontendUrl,
       readAgentPreamble: readPreamble,
-      // The guide's name the shared file rules spell, read per request so a name
-      // the setup save applies lands without a restart.
+      // The root-folder and platform-file names the shared file rules spell,
+      // read per request so a layout the setup save applies lands without a restart.
       kbLayout: () => kb.layout,
+      // The branch the shared rules name as the one people read — a getter
+      // too, so the name in effect is the one an agent is told.
+      defaultBranch: () => kb.defaultBranch,
       secretsScope,
       // Read at listing time, by when the hints below exist.
       readOnlyOverrides: () => readOnlyHints.overrides(),
@@ -1515,7 +1539,7 @@ export async function createCoreServices(
   const resolveToolContext = createToolContextResolver({
     authService,
     workspaceService,
-    workflowService,
+    versionControlService,
     events: eventBus,
     kbDirName: kbDirName,
     creatorAccess,
@@ -1575,7 +1599,7 @@ export async function createCoreServices(
     // swallowed the `opts` carrying `skipValidation`, so the burst-validation
     // skip was a no-op in production while every unit test — which stubs this
     // port — passed. No wrapper, no gap to fall through.
-    workflow: workflowService,
+    versionControl: versionControlService,
     // Both escalation sinks come through CorePorts: the recovery agent and the
     // notice sink are enterprise-owned (background-agent factory / feedback
     // dashboard); core defaults skip recovery and log to stderr.
@@ -1635,7 +1659,7 @@ export async function createCoreServices(
       source,
       ...createSyncedGroupsCommitter({
         workspaceService,
-        workflowService,
+        versionControlService,
         accessControl,
         eventBus,
         kbDirName,
@@ -1651,7 +1675,7 @@ export async function createCoreServices(
   // directory token route drives.
   const groupsAdminService = new GroupsAdminService(
     workspaceService,
-    workflowService,
+    versionControlService,
     accessControl,
     disk,
     kbDirName,
@@ -1663,7 +1687,7 @@ export async function createCoreServices(
   // The deployment owner is never removed this way.
   const userAccessRemovalService = new UserAccessRemovalService(
     workspaceService,
-    workflowService,
+    versionControlService,
     accessControl,
     disk,
     kbDirName,
@@ -1723,6 +1747,7 @@ export async function createCoreServices(
     pendingToolsService,
     readAgentPreamble: readPreamble,
     agentGuide,
+    agentGuideStart,
     agentGuideSections: agentGuideSectionsReader,
     pluginIndexService,
     pluginProvisionService,
@@ -1744,9 +1769,9 @@ export async function createCoreServices(
     gitService,
     pullRequestService,
     diffService,
-    reviewWorkflowService,
+    changeRequestReviewService,
     fileLockService,
-    workflowService,
+    versionControlService,
     changeRequestHooks,
     kbSyncService,
     eventBus,
@@ -1779,6 +1804,7 @@ export async function createCoreServices(
     // Server-time seams — defaults here; the enterprise overlay overwrites
     // (or, for the array, pushes into) these after construction.
     sessionSink: ports.sessionSink ?? new UuidSessionSink(),
+    managedSignIns: ports.managedSignIns ?? null,
     usageMeter: ports.usageMeter ?? unmeteredLlmUsage,
     authProviders,
   };

package/src/core/lifecycle.ts

@@ -4,7 +4,7 @@ import type { AdvisoryLease } from '../modules/database/advisory-lock.js';
 import { bootMaySurvive, type KbStartupRunner } from '../modules/workspace/startup/kb-startup-runner.js';
 import { noteBesideCheckout } from '../modules/workspace/startup/beside-checkout.js';
 import { unregisterBevelSecretsVariableLoader } from '../modules/secrets-vault/secrets-variable-loader.js';
-import type { WorkflowService } from '../modules/workflow/workflow.service.js';
+import type { VersionControlService } from '../modules/version-control/version-control.service.js';
 import type { PluginJoinRequestJobs } from '../modules/plugins/join-request-jobs.service.js';
 import type { TmpSweeper } from '../modules/workspace/workspace-tmp.js';
 import { printable } from '../shared/printable.js';
@@ -292,7 +292,7 @@ export interface BootableCore {
   config: { workspacesRoot: string };
   kbDirName: string;
   kbStartupRunner: Pick<KbStartupRunner, 'runAll' | 'retryUntilMaintained'>;
-  workflowService: Pick<WorkflowService, 'closeChangeRequestsWithDeletedBranches' | 'tidyAfterSweep'>;
+  versionControlService: Pick<VersionControlService, 'closeChangeRequestsWithDeletedBranches' | 'tidyAfterSweep'>;
   pluginJoinRequestJobs: Pick<PluginJoinRequestJobs, 'startSweeping'>;
   /** The periodic sweep of every workspace's `tmp/` folder, started here and stopped by {@link stopCore}. */
   tmpSweeper: Pick<TmpSweeper, 'startSweeping'>;
@@ -393,7 +393,7 @@ export async function startCore<C extends BootableCore>(
   // have been unusable since the branch went away, so landing a few seconds
   // into uptime is soon enough. Errors are swallowed inside the sweep, which
   // fails safe by closing nothing.
-  void core.workflowService
+  void core.versionControlService
     .closeChangeRequestsWithDeletedBranches()
     .then((n) => {
       if (n > 0) {
@@ -404,7 +404,7 @@ export async function startCore<C extends BootableCore>(
     // Then the tidy-up: open requests that propose nothing are closed, and the
     // branches merged requests left behind removed (behind its own setting).
     // Fails safe on a failed fetch, and never throws.
-    .then(() => core.workflowService.tidyAfterSweep());
+    .then(() => core.versionControlService.tidyAfterSweep());
 
   // Recorded join requests that are still owed, resumed — now, and then on a
   // timer. SEQUENCED AFTER the startup phase for the same reason as the sweep
@@ -481,12 +481,12 @@ export interface CoreStopDeps {
    */
   documentExtractor?: { close(): Promise<void> };
   /**
-   * The workflow service, for the tidy-up it runs after each sweep (closing
+   * The version-control service, for the tidy-up it runs after each sweep (closing
    * empty requests, removing leftover branches): detached from whatever
    * started it, so stopped and awaited here before the pool goes. Optional:
    * a caller that has not built one passes nothing.
    */
-  workflowService?: { stopTidying(): void; drainTidy(): Promise<void> };
+  versionControlService?: { stopTidying(): void; drainTidy(): Promise<void> };
   /** The startup phase's retry, if the boot left one asking — see {@link BootableCore.startupRetry}. */
   startupRetry?: { stop(): void } | null;
   /** The database — its pool is ended last, once nothing above can still need it. */
@@ -582,7 +582,7 @@ async function releaseCore(deps: CoreStopDeps, remaining: () => number, log: (m:
   deps.startupRetry?.stop();
   // The post-sweep tidy-up: no new round, and the one under way stops at its
   // next request or branch. Synchronous.
-  deps.workflowService?.stopTidying();
+  deps.versionControlService?.stopTidying();
   // Clearing the interval stops future ticks; it does nothing to a job a
   // tick already started, which holds a claim it heartbeats through the
   // pool and is mid-clone or mid-push. Awaited here, in the budget: a job
@@ -614,8 +614,8 @@ async function releaseCore(deps: CoreStopDeps, remaining: () => number, log: (m:
   // The tidy-up in flight fetches and deletes branches through the pool and
   // the default branch's checkout: awaited, so the next graph for this
   // tenant cannot find a branch deletion still running under it.
-  if (deps.workflowService) {
-    await bounded(deps.workflowService.drainTidy(), remaining(), 'finishing the branch tidy-up', log);
+  if (deps.versionControlService) {
+    await bounded(deps.versionControlService.drainTidy(), remaining(), 'finishing the branch tidy-up', log);
   }
   // Its ripgrep runs end with the graph; a search still running is answered busy or stopped.
   if (deps.patternMatcher) {

package/src/core-config.ts

@@ -3,7 +3,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { defaultKbTemplateDir, defaultStarterPacksDir } from './assets.js';
 import { assertKeyDecodesTo32Bytes } from './shared/token-crypto.js';
-import { DEFAULT_GIT_TIMEOUT_MS } from './modules/workflow/git/node-git-runner.js';
+import { DEFAULT_GIT_TIMEOUT_MS } from './modules/version-control/git/node-git-runner.js';
 import { DEFAULT_DB_SCHEMA, assertSchemaName } from './modules/database/connection.js';
 import { logger } from './shared/logging.js';
 import { hasControlCharacter } from './modules/kb-fs/repo-path.js';
@@ -145,7 +145,7 @@ export interface ProcessConfig {
 }
 
 /**
- * Configuration for the CORE platform: the git-backed workspace/workflow,
+ * Configuration for the CORE platform: the git-backed workspace and version control,
  * skills, tools, secrets vault, access control, and the MCP surface. Contains
  * NO LLM, connector, or SSO-provider settings — those live on the enterprise
  * `AppConfig` (config.ts), which extends this class. A core-only deployment
@@ -372,7 +372,7 @@ export class CoreConfig implements TenantConfig, ProcessConfig {
   readonly trustProxy: string;
   /**
    * Deadline in milliseconds on every git command, after which the child is
-   * killed and the call fails (see `modules/workflow/git/node-git-runner.ts`).
+   * killed and the call fails (see `modules/version-control/git/node-git-runner.ts`).
    *
    * Configurable because the right ceiling depends on the deployment's own git
    * host and the size of its knowledge base: a first clone over a slow link can

package/src/index.ts

@@ -1,6 +1,6 @@
 /**
  * @bevel-software/platform-core-backend — the open-source core of the Bevel platform:
- * git-backed knowledge workspace, workflow (branches / change requests /
+ * git-backed knowledge workspace, version control (branches / change requests /
  * locks / SSE), skills, tool manuals + registry + auth, secrets vault, access
  * control, diff/backup ledger, code-mode and the remote MCP surface.
  *
@@ -122,7 +122,7 @@ export type { ISessionSink } from './modules/workspace/session-sink.js';
 export type {
   ISystemNoticeSink,
   RecoveryAgentRunner,
-} from './modules/workflow/pending-commits.worker.js';
+} from './modules/version-control/pending-commits.worker.js';
 export type { ILlmUsageMeter } from './modules/tool-auth/llm-usage-meter.js';
 export type { AuthProviderPlugin } from './modules/auth/auth.routes.js';
 export type { IErasureParticipant } from './modules/auth/account-erasure.service.js';
@@ -144,17 +144,17 @@ export {
   type IAccountAdmission,
 } from './modules/auth/account-admission.js';
 export {
-  WorkflowHooks,
+  VersionControlHooks,
   type CommitValidationHook,
   type CommitValidationContext,
   type AgentOperationContext,
   type AgentReadHook,
   type PreWriteHook,
-} from './modules/workflow/workflow-hooks.js';
+} from './modules/version-control/version-control-hooks.js';
 export {
   ChangeRequestHooks,
   type ChangeRequestOpenedEvent,
   type ChangeRequestOpenedHook,
   type ChangeRequestPerson,
   type IChangeRequestHooks,
-} from './modules/workflow/change-request-hooks.js';
+} from './modules/version-control/change-request-hooks.js';

package/src/modules/access/__tests__/access-control.admin-root-floor.test.ts

@@ -9,8 +9,8 @@ import { NodeFs } from '../../kb-fs/node-fs.js';
 
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
 import type { AuthService } from '../../auth/auth.service.js';
-import type { WorkflowService } from '../../workflow/workflow.service.js';
-import type { WorkflowEventBus } from '../../workflow/event-bus.js';
+import type { VersionControlService } from '../../version-control/version-control.service.js';
+import type { VersionControlEventBus } from '../../version-control/event-bus.js';
 import { usersDbDouble } from './users-db-double.js';
 import { AccessControlService } from '../access-control.service.js';
 import {
@@ -317,8 +317,8 @@ describe('Admin write floor at the repository root', () => {
             acquireLock: async () => ({ acquired: true, lock: {} }),
             releaseLock: async () => undefined,
             releaseLockNoCommit: async () => undefined,
-          } as unknown as WorkflowService,
-          { emit: () => {} } as unknown as WorkflowEventBus,
+          } as unknown as VersionControlService,
+          { emit: () => {} } as unknown as VersionControlEventBus,
           usersDbDouble(),
           testKbContext({ kbDirName: KB }),
           new NodeFs(),