@bevel-software/platform-core-backend 0.35.0 → 0.36.1

package/src/core/create-core-server.ts

@@ -13,8 +13,12 @@ import { createAgentDownloadRoutes } from '../modules/workspace/agent-download.r
 import { createGitInternalsRouteGuard } from '../modules/workspace/git-internals.middleware.js';
 import { startCore } from './lifecycle.js';
 import { createDiffRoutes } from '../modules/diff/diff.routes.js';
-import { createWorkflowRoutes } from '../modules/workflow/workflow.routes.js';
-import { createEventAccess, createEventsRoutes, EventDelivery } from '../modules/workflow/index.js';
+import {
+  createEventAccess,
+  createEventsRoutes,
+  createVersionControlRoutes,
+  EventDelivery,
+} from '../modules/version-control/index.js';
 import { createAccessRoutes } from '../modules/access/access.routes.js';
 import { createAccessRequestRoutes } from '../modules/access/access-requests.routes.js';
 import { AccessRequestsService } from '../modules/access/access-requests.service.js';
@@ -32,12 +36,12 @@ import {
   createToolManualsBrowserRoutes,
   registerToolManualsTools,
 } from '../modules/tool-manuals/index.js';
-import { registerWorkflowTools } from '../modules/workflow/agent-tools/workflow.tools.js';
-import { changeRequestScope, registerChangeRequestReadTools } from '../modules/workflow/agent-tools/change-request-read.tools.js';
+import { registerVersionControlTools } from '../modules/version-control/agent-tools/version-control.tools.js';
+import { changeRequestScope, registerChangeRequestReadTools } from '../modules/version-control/agent-tools/change-request-read.tools.js';
 import { createOnboardingRoutes } from '../modules/onboarding/onboarding.routes.js';
 import { registerWorkspaceTools } from '../modules/workspace/workspace.tools.js';
 import { registerAgentGuideTool } from '../modules/agent-guide/index.js';
-import { RECOVERY_BOT_EMAIL } from '../modules/workflow/recovery-bot.js';
+import { RECOVERY_BOT_EMAIL } from '../modules/version-control/recovery-bot.js';
 import {
   registerSkillsTools,
   createSkillsRoutes,
@@ -433,6 +437,8 @@ export async function createCoreServer(
     publicBackendUrl: core.config.publicBackendUrl,
     publicFrontendUrl: core.config.publicFrontendUrl,
     kb: core.kb,
+    // Read at request time: the overlay binds the port after core is built.
+    managedSignIns: () => core.managedSignIns,
   };
   app.use('/api', createSecretsVaultPublicRoutes(secretsVaultRoutesDeps));
 
@@ -468,12 +474,12 @@ export async function createCoreServer(
   // Shared agent-access gate config, consumed by every tool surface that
   // touches the KB (file tools + graph tools). The gate decides nothing
   // itself: it calls the read and write hooks a deployment registered on
-  // `workflowService.hooks`, and carries the notes that deployment wants
+  // `versionControlService.hooks`, and carries the notes that deployment wants
   // agents to read about the gated tools. Core registers neither, so a
   // core-only deployment refuses nothing and says nothing extra.
   const agentAccessGate: AgentAccessGate = {
     recoveryBotEmail: RECOVERY_BOT_EMAIL,
-    hooks: core.workflowService.hooks,
+    hooks: core.versionControlService.hooks,
     notes: new ToolDescriptionNotes(),
   };
   // A skill's `allowed-tools`, checked against what the caller can see — on
@@ -482,8 +488,8 @@ export async function createCoreServer(
   const allowedToolsChecker = new AllowedToolsChecker(core.toolRegistry, core.toolManualService, core.kb);
   // `delete_branch` sees change requests as `get_change_request` does.
   // The history tools take the per-file read the file itself takes (`accessControl`).
-  registerWorkflowTools(core.toolRegistry, toolsRouter, ta, th, core.kb, changeRequestScope(core.accessControl, core.kb).maySee, core.accessControl, agentAccessGate);
-  // The five read tools over change requests. Separate from the workflow tools
+  registerVersionControlTools(core.toolRegistry, toolsRouter, ta, th, core.kb, changeRequestScope(core.accessControl, core.kb).maySee, core.accessControl, agentAccessGate);
+  // The five read tools over change requests. Separate from the version-control tools
   // because they are the only ones that gate their whole payload on the
   // caller's read access, so they take the access service and nothing else.
   registerChangeRequestReadTools(core.toolRegistry, toolsRouter, ta, th, core.accessControl, core.kb);
@@ -580,7 +586,14 @@ export async function createCoreServer(
   // What every connected agent is told at session start, as the hosted proxy
   // composes it: read by the local `hexis-mcp` bridge at startup and by the
   // External agent access card. Same `manualAuth`, same router, as `all-tools`.
-  toolsRouter.use(createAgentInstructionsRoutes(core.manualAuthMiddleware, core.readAgentPreamble, () => core.kb.layout));
+  toolsRouter.use(
+    createAgentInstructionsRoutes(
+      core.manualAuthMiddleware,
+      core.readAgentPreamble,
+      () => core.kb.layout,
+      () => core.kb.defaultBranch,
+    ),
+  );
   // The fingerprint of the caller's released catalog. The local `hexis-mcp`
   // server polls it to learn that a manual or a skill changed under a
   // connection it cannot be pushed to; nothing else consults it. Same
@@ -610,7 +623,7 @@ export async function createCoreServer(
   app.use('/api', toolsRouter);
 
   // The same guard on the PARSED body, for the WHOLE `/workspace/:id` prefix
-  // and ahead of EVERY router under it — the file routes, the review, workflow
+  // and ahead of EVERY router under it — the file routes, the review, version control
   // and access ones, and whatever an extension mounts below. Mounted here,
   // before the extension phase, so an overlay surface added there is covered
   // by its prefix rather than by remembering this. No auth in front of it: the
@@ -661,7 +674,7 @@ export async function createCoreServer(
   app.use('/api', core.authMiddleware, createWorkspaceRoutes(
     core.workspaceService,
     core.authService,
-    core.workflowService,
+    core.versionControlService,
     core.eventBus,
     core.accessControl,
     core.kb,
@@ -671,11 +684,12 @@ export async function createCoreServer(
     allowedToolsChecker,
     core.changeGate,
   ));
-  // Workflow is the only branches / changes / change-request surface. The
+  // Version control is the only branches / changes / change-request surface. The
   // former /git/*, /pr/*, /pr/:n/* routes are gone — every consumer goes
   // through /workflow/* now.
-  app.use('/api', core.authMiddleware, createWorkflowRoutes(
-    core.workflowService,
+  // The `/workflow/` prefix is kept for API compatibility until a core major.
+  app.use('/api', core.authMiddleware, createVersionControlRoutes(
+    core.versionControlService,
     core.workspaceService,
     core.authService,
     core.eventBus,
@@ -693,7 +707,7 @@ export async function createCoreServer(
   const eventDelivery = new EventDelivery(createEventAccess({
     accessControl: core.accessControl,
     kbDirName: core.kbDirName,
-    getChangeRequest: (number) => core.workflowService.getChangeRequest(number),
+    getChangeRequest: (number) => core.versionControlService.getChangeRequest(number),
     workspaces: {
       hasWorkspace: (workspaceId) => core.workspaceService.hasBootstrappedWorkspace(workspaceId),
       anyWorkspaceId: async () => (await core.workspaceService.findAnyWorkspaceId()) ?? core.kb.defaultWorkspaceId(),
@@ -703,7 +717,7 @@ export async function createCoreServer(
   app.use('/api', core.authMiddleware, createDiffRoutes(
     core.diffService,
     core.authService,
-    core.workflowService,
+    core.versionControlService,
     core.accessControl,
     core.kbDirName,
   ));
@@ -712,7 +726,7 @@ export async function createCoreServer(
     core.workspaceService,
     core.authService,
     core.authService,
-    core.workflowService,
+    core.versionControlService,
     core.eventBus,
     core.db,
     core.kb,
@@ -727,7 +741,7 @@ export async function createCoreServer(
     accessControl: core.accessControl,
     workspaceService: core.workspaceService,
     authService: core.authService,
-    workflow: core.workflowService,
+    versionControl: core.versionControlService,
     lifecycle: core.joinRequestsService,
     kb: core.kb,
   }));
@@ -744,9 +758,9 @@ export async function createCoreServer(
     createSkillAccessRequestRoutes({
       skillService: core.skillService,
       accessControl: core.accessControl,
-      workflow: core.workflowService,
+      versionControl: core.versionControlService,
       requests: new AccessRequestsService({
-        workflow: core.workflowService,
+        versionControl: core.versionControlService,
         workspaceService: core.workspaceService,
         lifecycle: core.joinRequestsService,
         kb: core.kb,
@@ -766,7 +780,7 @@ export async function createCoreServer(
   app.use('/api', core.authMiddleware, createPluginsRoutes(
     core.pluginIndexService,
     core.accessControl,
-    core.workflowService,
+    core.versionControlService,
     core.joinRequestsService,
     core.pluginJoinRequestJobs,
     core.pluginProvisionService,
@@ -869,12 +883,12 @@ export async function createCoreServer(
         githubApp: core.githubApp,
       },
       // What a move to another repository has to decide about, and what it
-      // runs under. Bound here rather than handed the whole workflow service:
+      // runs under. Bound here rather than handed the whole version-control service:
       // the setup routes ask two questions, hold the commit worker for the
       // move, and know nothing else about a request or a commit.
       {
-        countOpen: () => core.workflowService.countOpenChangeRequests(),
-        closeAsRepositoryReplaced: () => core.workflowService.closeOpenChangeRequestsAsRepositoryReplaced(),
+        countOpen: () => core.versionControlService.countOpenChangeRequests(),
+        closeAsRepositoryReplaced: () => core.versionControlService.closeOpenChangeRequestsAsRepositoryReplaced(),
         whileCommitsHeld: (work) => core.whileCommitsHeld(work),
       },
     ),

package/src/core/create-core-services.ts

@@ -125,29 +125,31 @@ import {
 import {
   DbSecretsVaultService,
   McpOAuthDiscoveryService,
+  managedSignInErasure,
   registerBevelSecretsVariableLoader,
+  type ManagedSignInPort,
 } from '../modules/secrets-vault/index.js';
 import { ConnectionProbeService } from '../modules/connection-probe/index.js';
-import { GitService } from '../modules/workflow/git/git.service.js';
-import { NodeGitRunner } from '../modules/workflow/git/node-git-runner.js';
-import { PullRequestService } from '../modules/workflow/git/pull-request.service.js';
+import { GitService } from '../modules/version-control/git/git.service.js';
+import { NodeGitRunner } from '../modules/version-control/git/node-git-runner.js';
+import { PullRequestService } from '../modules/version-control/git/pull-request.service.js';
 import { WorkspaceIdMutex, WorkspaceMutex } from '../modules/kb-fs/mutex.js';
-import { assertGitVersion } from '../modules/workflow/git/git-version.js';
+import { assertGitVersion } from '../modules/version-control/git/git-version.js';
 import { DiffService } from '../modules/diff/diff.service.js';
-import { ReviewWorkflowService } from '../modules/workflow/review-workflow/review-workflow.service.js';
-import { FileLockService } from '../modules/workflow/file-lock.service.js';
-import { WorkflowEventBus } from '../modules/workflow/index.js';
+import { ChangeRequestReviewService } from '../modules/version-control/change-request-review/change-request-review.service.js';
+import { FileLockService } from '../modules/version-control/file-lock.service.js';
+import { VersionControlEventBus } from '../modules/version-control/index.js';
 import { FileChangeNotifier } from '../modules/kb-fs/file-change-notifier.js';
 import { StarterPackService } from '../modules/onboarding/starter-pack.service.js';
-import { WorkflowService } from '../modules/workflow/workflow.service.js';
-import { WorkflowHooks } from '../modules/workflow/workflow-hooks.js';
-import { ChangeRequestHooks, type IChangeRequestHooks } from '../modules/workflow/change-request-hooks.js';
-import { PendingCommitsService } from '../modules/workflow/pending-commits.service.js';
+import { VersionControlService } from '../modules/version-control/version-control.service.js';
+import { VersionControlHooks } from '../modules/version-control/version-control-hooks.js';
+import { ChangeRequestHooks, type IChangeRequestHooks } from '../modules/version-control/change-request-hooks.js';
+import { PendingCommitsService } from '../modules/version-control/pending-commits.service.js';
 import {
   PendingCommitsWorker,
   consoleSystemNoticeSink,
-} from '../modules/workflow/pending-commits.worker.js';
-import { ensureRecoveryBotUser } from '../modules/workflow/recovery-bot.js';
+} from '../modules/version-control/pending-commits.worker.js';
+import { ensureRecoveryBotUser } from '../modules/version-control/recovery-bot.js';
 import { AdminAccessService } from '../modules/admin/admin-access.service.js';
 import {
   SyncedGroupsWriter,
@@ -353,9 +355,9 @@ export interface CoreServices {
   gitService: GitService;
   pullRequestService: PullRequestService;
   diffService: DiffService;
-  reviewWorkflowService: ReviewWorkflowService;
+  changeRequestReviewService: ChangeRequestReviewService;
   fileLockService: FileLockService;
-  workflowService: WorkflowService;
+  versionControlService: VersionControlService;
   /**
    * The seam for "a change request was opened": a deployment registers here
    * how the reviewers are told (the cloud's mail, say), and the open's answer
@@ -364,7 +366,7 @@ export interface CoreServices {
   changeRequestHooks: IChangeRequestHooks;
   /** Remote sync (`POST /api/sync`): a git host or pipeline makes the clones catch up. */
   kbSyncService: KbSyncService;
-  eventBus: WorkflowEventBus;
+  eventBus: VersionControlEventBus;
   fileChangeNotifier: FileChangeNotifier;
   pendingCommitsService: PendingCommitsService;
   pendingCommitsWorker: PendingCommitsWorker;
@@ -440,6 +442,12 @@ export interface CoreServices {
   // ── Server-time seams (enterprise overwrites after construction) ────────
   /** `start_session` backing — core default {@link UuidSessionSink}. */
   sessionSink: ISessionSink;
+  /**
+   * The managed sign-in port (see `CorePorts.managedSignIns`), or null when
+   * the distribution registers none. Mutable for the same reason the session
+   * sink is: the overlay builds it after core, from services core returned.
+   */
+  managedSignIns: ManagedSignInPort | null;
   /** Connection-key LLM metering view — core default unmetered. */
   usageMeter: ILlmUsageMeter;
   /** SSO plugins the auth router mounts — same array instance as the port. */
@@ -922,16 +930,16 @@ export async function createCoreServices(
   // registers its listener here, after this returns (see `AccountHooks`).
   const accountHooks = new AccountHooks();
 
-  // Workflow lifecycle hooks — the ONE registry this composition shares
+  // Version-control lifecycle hooks — the ONE registry this composition shares
   // between GitService (advisory commit validation), the agent-access gate
   // (the blocking agentRead / preWrite hooks), and the composition root,
-  // which registers module-owned handlers on `workflowService.hooks` right
+  // which registers module-owned handlers on `versionControlService.hooks` right
   // after this function returns. Core registers none: no commit-time
   // validation (advisory anyway) and nothing that refuses an agent call.
-  const workflowHooks = new WorkflowHooks();
+  const versionControlHooks = new VersionControlHooks();
   const gitService = new GitService(
     workspaceService,
-    workflowHooks,
+    versionControlHooks,
     kb,
     workspaceMutex,
     accessControl,
@@ -968,7 +976,7 @@ export async function createCoreServices(
   // the post-switch backup reseed — but switchBranch is gone with the
   // per-branch workspace model, so the injection no longer applies.)
   workspaceService.setDiffService(diffService);
-  const reviewWorkflowService = new ReviewWorkflowService(
+  const changeRequestReviewService = new ChangeRequestReviewService(
     db,
     accessControl,
     workspaceService,
@@ -976,14 +984,14 @@ export async function createCoreServices(
   );
   // Late-bind the comment enricher so PullRequestService.getPrDetail includes
   // our DB-backed comments without forcing a circular constructor dependency.
-  pullRequestService.setDetailEnricher(reviewWorkflowService);
+  pullRequestService.setDetailEnricher(changeRequestReviewService);
 
-  // Workflow facade — the abstraction every app consumer should reach for
-  // instead of the individual git / PR / review-workflow services. See
+  // Version-control facade — the abstraction every app consumer should reach for
+  // instead of the individual git / PR / change-request-review services. See
   // PLAN.md for the migration story. Today it delegates straight through;
-  // implementations migrate into the workflow module over later steps.
+  // implementations migrate into the version-control module over later steps.
   const fileLockService = new FileLockService(db);
-  // Background commit queue. The `WorkflowService.releaseLock` path
+  // Background commit queue. The `VersionControlService.releaseLock` path
   // enqueues a row here instead of running commitFile + push inline; the
   // worker drains the queue out of band so a git hiccup can't block the
   // user-visible save path. See `lock-decoupling-plan.md`.
@@ -998,11 +1006,11 @@ export async function createCoreServices(
     (await pendingCommitsService.hasAnyForWorkspace(workspaceId)) ||
     (await fileLockService.hasAnyActive(workspaceId)),
   );
-  // In-process event bus: every WorkflowService mutation method that
+  // In-process event bus: every VersionControlService mutation method that
   // succeeds emits a typed event; the SSE route fans it to connected
   // browser sessions. Single instance per Node process — survives across
   // requests, doesn't survive restarts (clients reconnect + resync).
-  const eventBus = new WorkflowEventBus();
+  const eventBus = new VersionControlEventBus();
   // Office-document/PDF/email text extraction for `read_file`/`grep`, cached
   // by content hash beside the workspaces root (see `DocExtractionCache`),
   // failures included. A fresh failure is told to the people looking at the
@@ -1020,11 +1028,11 @@ export async function createCoreServices(
   // of a distribution registers its listener here, after this returns (see
   // `ChangeRequestHooks`).
   const changeRequestHooks = new ChangeRequestHooks();
-  const workflowService = new WorkflowService(
+  const versionControlService = new VersionControlService(
     db,
     gitService,
     pullRequestService,
-    reviewWorkflowService,
+    changeRequestReviewService,
     workspaceService,
     accessControl,
     fileLockService,
@@ -1033,10 +1041,10 @@ export async function createCoreServices(
     changeGate,
     eventBus,
     fileChangeNotifier,
-    // Exposed as `workflowService.hooks` — the SAME instance GitService and
+    // Exposed as `versionControlService.hooks` — the SAME instance GitService and
     // the agent-access gate consult, so a deployment's registrations against
     // it reach every hook point.
-    workflowHooks,
+    versionControlHooks,
     // Exposed as `changeRequestHooks`, the same instance, for the same reason.
     changeRequestHooks,
     // The opened event names the approvers as accounts; auth answers which
@@ -1045,7 +1053,7 @@ export async function createCoreServices(
   );
   // The leftover-branch cleanup asks the Deployment page at every round, so
   // switching it off there applies without a restart.
-  workflowService.leftoverCleanupEnabled = () => retireMergedBranchesOn(settings.resolve('retireMergedBranches'));
+  versionControlService.leftoverCleanupEnabled = () => retireMergedBranchesOn(settings.resolve('retireMergedBranches'));
 
   // Join requests: derived entirely from two copies of a plugin's `access.md`
   // (the request's branch vs the default branch), so it holds no state — it
@@ -1053,7 +1061,7 @@ export async function createCoreServices(
   // have all landed.
   const joinRequestsService = new JoinRequestsService(
     workspaceService,
-    workflowService,
+    versionControlService,
     kb,
     // Read-only: the one question a request asks of the resolver is whether
     // the person it names already holds what it proposes.
@@ -1065,7 +1073,7 @@ export async function createCoreServices(
   // answered in a database round-trip instead of a clone, and what survives a
   // restart with the request still owed.
   const pluginJoinRequestJobs = new PluginJoinRequestJobs(new DbJoinRequestStore(db), {
-    workflow: workflowService,
+    versionControl: versionControlService,
     workspaceService,
     kb,
     // A record keys on the plugin's primary FOLDER below the root, which the
@@ -1095,7 +1103,7 @@ export async function createCoreServices(
   // index counts, so a link drops that cache too.
   const pluginLinksService = new PluginLinksService(
     workspaceService,
-    workflowService,
+    versionControlService,
     accessControl,
     new AccessMutationService(workspaceService, accessControl, kb.kbDirName),
     skillService,
@@ -1108,7 +1116,7 @@ export async function createCoreServices(
   // then drops every cache that keyed on the old identity.
   const pluginRenameService = new PluginRenameService(
     workspaceService,
-    workflowService,
+    versionControlService,
     accessControl,
     pluginSource,
     disk,
@@ -1149,16 +1157,16 @@ export async function createCoreServices(
     gitRunner,
   );
 
-  // Remote sync. Drives the workflow module's per-branch pull-and-announce
+  // Remote sync. Drives the version-control module's per-branch pull-and-announce
   // over every clone the workspace service knows about; owns no git of its own.
-  const kbSyncService = new KbSyncService(workflowService, workspaceService);
+  const kbSyncService = new KbSyncService(versionControlService, workspaceService);
   // Server-scoped MCP editing — the tool page's edit form. One server's truth
   // spans a plugin's mcp.json AND plugin.json extensions block, and this is
   // the ONE writer that rewrites both entries and commits them together (see
   // McpServerEditService).
   const mcpServerEditService = new McpServerEditService(
     workspaceService,
-    workflowService,
+    versionControlService,
     accessControl,
     toolManualService,
     kb,
@@ -1171,7 +1179,7 @@ export async function createCoreServices(
   // folder's rules are at HEAD before the endpoint answers.
   const pluginProvisionService = new PluginProvisionService(
     workspaceService,
-    workflowService,
+    versionControlService,
     accessControl,
     kb,
     eventBus,
@@ -1181,26 +1189,26 @@ export async function createCoreServices(
 
   // Pending skills: the other half of the catalog — skills that exist only on
   // an open change request's branch. Built here rather than beside
-  // `skillService` because it needs the workflow service, which does not exist
+  // `skillService` because it needs the version-control service, which does not exist
   // that early; it holds no state of its own, so where it is constructed is the
   // only thing the ordering decides.
   const pendingSkillsService = new PendingSkillsService(
     workspaceService,
     accessControl,
     skillService,
-    workflowService,
+    versionControlService,
     kb,
   );
 
   // The same missing half, for tools: a `.tool` manual or an `mcp.json` server
   // an agent proposes is nowhere in the product until its change request
-  // merges. Built here for the same reason — it needs the workflow service —
+  // merges. Built here for the same reason — it needs the version-control service —
   // and stateless for the same reason.
   const pendingToolsService = new PendingToolsService(
     workspaceService,
     accessControl,
     toolManualService,
-    workflowService,
+    versionControlService,
     kb,
   );
 
@@ -1238,7 +1246,7 @@ export async function createCoreServices(
     packsDir: config.starterPacksDir,
     kb,
     workspaceService,
-    workflow: workflowService,
+    versionControl: versionControlService,
     adminAccess,
     settings,
     accessControl,
@@ -1288,7 +1296,7 @@ export async function createCoreServices(
   // can only exist once the vault does.
   const toolDeleteService = new ToolDeleteService(
     workspaceService,
-    workflowService,
+    versionControlService,
     accessControl,
     toolManualService,
     skillService,
@@ -1335,12 +1343,16 @@ export async function createCoreServices(
   });
 
   // GDPR erasure path: admin-driven user deletion. The core service erases the
-  // rows it owns; each module contributes its slice as a participant.
-  const accountErasureService = new AccountErasureService(
-    db,
-    reviewWorkflowService,
-    ports.erasureParticipants ?? [],
-  );
+  // rows it owns; each module contributes its slice as a participant. The
+  // vault's runs first: a managed sign-in's tokens are revoked with their
+  // provider before the user row goes and the vault rows cascade with it.
+  // The port's array is held, never copied (see `CorePorts.erasureParticipants`:
+  // the enterprise root fills it AFTER construction) and never written to
+  // (a root that rebuilds a graph over the same array would otherwise keep
+  // every past graph's vault slice): core's own slices travel beside it.
+  const accountErasureService = new AccountErasureService(db, changeRequestReviewService, ports.erasureParticipants ?? [], [
+    managedSignInErasure(secretsVaultService),
+  ]);
 
   // MCP (remote agent access). ExternalApiKeyService handles connection-key
   // lifecycle. McpService is a GENERIC, STATELESS proxy: per request it
@@ -1411,7 +1423,7 @@ export async function createCoreServices(
       workspaceService,
       accessControl,
       authService,
-      workflowService,
+      versionControlService,
       gitService,
       accountLinks: new AccountLinkService(db),
       // The SAME extension-to-reader registry `read_file` dispatches on, so the
@@ -1444,9 +1456,12 @@ export async function createCoreServices(
       // For the needs-authorization setup link surfaced to external agents.
       publicFrontendUrl: config.publicFrontendUrl,
       readAgentPreamble: readPreamble,
-      // The guide's name the shared file rules spell, read per request so a name
-      // the setup save applies lands without a restart.
+      // The root-folder and platform-file names the shared file rules spell,
+      // read per request so a layout the setup save applies lands without a restart.
       kbLayout: () => kb.layout,
+      // The branch the shared rules name as the one people read — a getter
+      // too, so the name in effect is the one an agent is told.
+      defaultBranch: () => kb.defaultBranch,
       secretsScope,
       // Read at listing time, by when the hints below exist.
       readOnlyOverrides: () => readOnlyHints.overrides(),
@@ -1524,7 +1539,7 @@ export async function createCoreServices(
   const resolveToolContext = createToolContextResolver({
     authService,
     workspaceService,
-    workflowService,
+    versionControlService,
     events: eventBus,
     kbDirName: kbDirName,
     creatorAccess,
@@ -1584,7 +1599,7 @@ export async function createCoreServices(
     // swallowed the `opts` carrying `skipValidation`, so the burst-validation
     // skip was a no-op in production while every unit test — which stubs this
     // port — passed. No wrapper, no gap to fall through.
-    workflow: workflowService,
+    versionControl: versionControlService,
     // Both escalation sinks come through CorePorts: the recovery agent and the
     // notice sink are enterprise-owned (background-agent factory / feedback
     // dashboard); core defaults skip recovery and log to stderr.
@@ -1644,7 +1659,7 @@ export async function createCoreServices(
       source,
       ...createSyncedGroupsCommitter({
         workspaceService,
-        workflowService,
+        versionControlService,
         accessControl,
         eventBus,
         kbDirName,
@@ -1660,7 +1675,7 @@ export async function createCoreServices(
   // directory token route drives.
   const groupsAdminService = new GroupsAdminService(
     workspaceService,
-    workflowService,
+    versionControlService,
     accessControl,
     disk,
     kbDirName,
@@ -1672,7 +1687,7 @@ export async function createCoreServices(
   // The deployment owner is never removed this way.
   const userAccessRemovalService = new UserAccessRemovalService(
     workspaceService,
-    workflowService,
+    versionControlService,
     accessControl,
     disk,
     kbDirName,
@@ -1754,9 +1769,9 @@ export async function createCoreServices(
     gitService,
     pullRequestService,
     diffService,
-    reviewWorkflowService,
+    changeRequestReviewService,
     fileLockService,
-    workflowService,
+    versionControlService,
     changeRequestHooks,
     kbSyncService,
     eventBus,
@@ -1789,6 +1804,7 @@ export async function createCoreServices(
     // Server-time seams — defaults here; the enterprise overlay overwrites
     // (or, for the array, pushes into) these after construction.
     sessionSink: ports.sessionSink ?? new UuidSessionSink(),
+    managedSignIns: ports.managedSignIns ?? null,
     usageMeter: ports.usageMeter ?? unmeteredLlmUsage,
     authProviders,
   };

package/src/core/lifecycle.ts

@@ -4,7 +4,7 @@ import type { AdvisoryLease } from '../modules/database/advisory-lock.js';
 import { bootMaySurvive, type KbStartupRunner } from '../modules/workspace/startup/kb-startup-runner.js';
 import { noteBesideCheckout } from '../modules/workspace/startup/beside-checkout.js';
 import { unregisterBevelSecretsVariableLoader } from '../modules/secrets-vault/secrets-variable-loader.js';
-import type { WorkflowService } from '../modules/workflow/workflow.service.js';
+import type { VersionControlService } from '../modules/version-control/version-control.service.js';
 import type { PluginJoinRequestJobs } from '../modules/plugins/join-request-jobs.service.js';
 import type { TmpSweeper } from '../modules/workspace/workspace-tmp.js';
 import { printable } from '../shared/printable.js';
@@ -292,7 +292,7 @@ export interface BootableCore {
   config: { workspacesRoot: string };
   kbDirName: string;
   kbStartupRunner: Pick<KbStartupRunner, 'runAll' | 'retryUntilMaintained'>;
-  workflowService: Pick<WorkflowService, 'closeChangeRequestsWithDeletedBranches' | 'tidyAfterSweep'>;
+  versionControlService: Pick<VersionControlService, 'closeChangeRequestsWithDeletedBranches' | 'tidyAfterSweep'>;
   pluginJoinRequestJobs: Pick<PluginJoinRequestJobs, 'startSweeping'>;
   /** The periodic sweep of every workspace's `tmp/` folder, started here and stopped by {@link stopCore}. */
   tmpSweeper: Pick<TmpSweeper, 'startSweeping'>;
@@ -393,7 +393,7 @@ export async function startCore<C extends BootableCore>(
   // have been unusable since the branch went away, so landing a few seconds
   // into uptime is soon enough. Errors are swallowed inside the sweep, which
   // fails safe by closing nothing.
-  void core.workflowService
+  void core.versionControlService
     .closeChangeRequestsWithDeletedBranches()
     .then((n) => {
       if (n > 0) {
@@ -404,7 +404,7 @@ export async function startCore<C extends BootableCore>(
     // Then the tidy-up: open requests that propose nothing are closed, and the
     // branches merged requests left behind removed (behind its own setting).
     // Fails safe on a failed fetch, and never throws.
-    .then(() => core.workflowService.tidyAfterSweep());
+    .then(() => core.versionControlService.tidyAfterSweep());
 
   // Recorded join requests that are still owed, resumed — now, and then on a
   // timer. SEQUENCED AFTER the startup phase for the same reason as the sweep
@@ -481,12 +481,12 @@ export interface CoreStopDeps {
    */
   documentExtractor?: { close(): Promise<void> };
   /**
-   * The workflow service, for the tidy-up it runs after each sweep (closing
+   * The version-control service, for the tidy-up it runs after each sweep (closing
    * empty requests, removing leftover branches): detached from whatever
    * started it, so stopped and awaited here before the pool goes. Optional:
    * a caller that has not built one passes nothing.
    */
-  workflowService?: { stopTidying(): void; drainTidy(): Promise<void> };
+  versionControlService?: { stopTidying(): void; drainTidy(): Promise<void> };
   /** The startup phase's retry, if the boot left one asking — see {@link BootableCore.startupRetry}. */
   startupRetry?: { stop(): void } | null;
   /** The database — its pool is ended last, once nothing above can still need it. */
@@ -582,7 +582,7 @@ async function releaseCore(deps: CoreStopDeps, remaining: () => number, log: (m:
   deps.startupRetry?.stop();
   // The post-sweep tidy-up: no new round, and the one under way stops at its
   // next request or branch. Synchronous.
-  deps.workflowService?.stopTidying();
+  deps.versionControlService?.stopTidying();
   // Clearing the interval stops future ticks; it does nothing to a job a
   // tick already started, which holds a claim it heartbeats through the
   // pool and is mid-clone or mid-push. Awaited here, in the budget: a job
@@ -614,8 +614,8 @@ async function releaseCore(deps: CoreStopDeps, remaining: () => number, log: (m:
   // The tidy-up in flight fetches and deletes branches through the pool and
   // the default branch's checkout: awaited, so the next graph for this
   // tenant cannot find a branch deletion still running under it.
-  if (deps.workflowService) {
-    await bounded(deps.workflowService.drainTidy(), remaining(), 'finishing the branch tidy-up', log);
+  if (deps.versionControlService) {
+    await bounded(deps.versionControlService.drainTidy(), remaining(), 'finishing the branch tidy-up', log);
   }
   // Its ripgrep runs end with the graph; a search still running is answered busy or stopped.
   if (deps.patternMatcher) {