@bevel-software/platform-core-backend 0.35.0 → 0.36.1

package/src/modules/{workflow → version-control}/__tests__/pending-commits.worker.concurrency.test.ts

@@ -53,7 +53,7 @@ function heldCommits() {
   const open = new Map<string, () => void>();
   let inFlight = 0;
   let peak = 0;
-  const workflow = {
+  const versionControl = {
     runPendingCommit: vi.fn(
       (workspaceId: string) =>
         new Promise<void>((resolve) => {
@@ -67,7 +67,7 @@ function heldCommits() {
     ),
   };
   return {
-    workflow,
+    versionControl,
     release: (workspaceId: string) => open.get(workspaceId)?.(),
     releaseAll: () => [...open.keys()].forEach((id) => open.get(id)?.()),
     get inFlight() {
@@ -81,12 +81,12 @@ function heldCommits() {
 
 function makeWorker(
   service: PendingCommitsService,
-  workflow: { runPendingCommit: ReturnType<typeof vi.fn> },
+  versionControl: { runPendingCommit: ReturnType<typeof vi.fn> },
   workspaceIds: string[],
 ): PendingCommitsWorker {
   const worker = new PendingCommitsWorker({
     service,
-    workflow: workflow as never,
+    versionControl: versionControl as never,
     recoveryAgent: { run: vi.fn() } as unknown as RecoveryAgentRunner,
     feedback: { send: vi.fn() } as unknown as ISystemNoticeSink,
     workspaces: { knownWorkspaces: () => workspaceIds.map((id) => ({ id, branch: 'feat/x' })) },
@@ -104,7 +104,7 @@ describe('PendingCommitsWorker.drainOnce across workspaces', () => {
   it('a workspace whose remote has stalled does not delay another workspace', async () => {
     const service = queueWith([row('ws-stalled'), row('ws-fine')]);
     const commits = heldCommits();
-    const worker = makeWorker(service, commits.workflow, ['ws-stalled', 'ws-fine']);
+    const worker = makeWorker(service, commits.versionControl, ['ws-stalled', 'ws-fine']);
 
     const pass = worker.drainOnce();
     await settle();
@@ -127,7 +127,7 @@ describe('PendingCommitsWorker.drainOnce across workspaces', () => {
     // encoded one. They are one workspace, one clone, and one drain.
     const service = queueWith([]);
     const commits = heldCommits();
-    const worker = makeWorker(service, commits.workflow, ['alice/feature', 'alice%2Ffeature']);
+    const worker = makeWorker(service, commits.versionControl, ['alice/feature', 'alice%2Ffeature']);
 
     await worker.drainOnce();
 
@@ -139,7 +139,7 @@ describe('PendingCommitsWorker.drainOnce across workspaces', () => {
     const ids = ['ws-1', 'ws-2', 'ws-3', 'ws-4', 'ws-5', 'ws-6'];
     const service = queueWith(ids.map((id) => row(id)));
     const commits = heldCommits();
-    const worker = makeWorker(service, commits.workflow, ids);
+    const worker = makeWorker(service, commits.versionControl, ids);
 
     const pass = worker.drainOnce();
     await settle();
@@ -169,7 +169,7 @@ describe('PendingCommitsWorker.drainOnce across workspaces', () => {
     (service.claimNext as ReturnType<typeof vi.fn>).mockImplementation(async () => rows.shift() ?? null);
     (service.hasReadyRow as ReturnType<typeof vi.fn>).mockImplementation(async () => rows.length > 0);
     const commits = heldCommits();
-    const worker = makeWorker(service, commits.workflow, ['ws-1']);
+    const worker = makeWorker(service, commits.versionControl, ['ws-1']);
 
     const pass = worker.drainOnce();
     await settle();
@@ -177,7 +177,7 @@ describe('PendingCommitsWorker.drainOnce across workspaces', () => {
 
     commits.release('ws-1');
     await settle();
-    expect(commits.workflow.runPendingCommit).toHaveBeenCalledTimes(2);
+    expect(commits.versionControl.runPendingCommit).toHaveBeenCalledTimes(2);
 
     commits.release('ws-1');
     await pass;

package/src/modules/{workflow → version-control}/__tests__/pending-commits.worker.test.ts

@@ -6,7 +6,7 @@ import {
   N_TRANSIENT,
   PendingCommitsWorker,
   type RecoveryAgentRunner,
-  type WorkflowCommitDriver,
+  type VersionControlCommitDriver,
   type WorkspaceProvider,
 } from '../pending-commits.worker.js';
 import type {
@@ -16,7 +16,7 @@ import type {
 import { assertInsideRepo } from '../../kb-fs/repo-path.js';
 
 /**
- * Unit tests for the queue-draining worker. The service + workflow layers
+ * Unit tests for the queue-draining worker. The service + version-control layers
  * have their own tests; here we focus on the *decision tree* the worker
  * applies per claimed row:
  *
@@ -88,7 +88,7 @@ function makeFeedback(): ISystemNoticeSink {
 
 describe('PendingCommitsWorker.drainOnce', () => {
   let service: PendingCommitsService;
-  let workflow: WorkflowCommitDriver & {
+  let versionControl: VersionControlCommitDriver & {
     runPendingCommit: ReturnType<typeof vi.fn>;
   };
   let recoveryAgent: RecoveryAgentRunner & { run: ReturnType<typeof vi.fn> };
@@ -97,12 +97,12 @@ describe('PendingCommitsWorker.drainOnce', () => {
 
   beforeEach(() => {
     service = makeService();
-    workflow = { runPendingCommit: vi.fn() } as never;
+    versionControl = { runPendingCommit: vi.fn() } as never;
     recoveryAgent = { run: vi.fn() } as never;
     feedback = makeFeedback() as never;
     worker = new PendingCommitsWorker({
       service,
-      workflow,
+      versionControl,
       recoveryAgent,
       feedback,
       workspaces: makeWorkspaces(),
@@ -118,12 +118,12 @@ describe('PendingCommitsWorker.drainOnce', () => {
   it('happy path: claims row, runs commit, marks succeeded — no other branches taken', async () => {
     const row = makeRow();
     (service.claimNext as ReturnType<typeof vi.fn>).mockResolvedValueOnce(row);
-    workflow.runPendingCommit.mockResolvedValueOnce(undefined);
+    versionControl.runPendingCommit.mockResolvedValueOnce(undefined);
 
     await worker.drainOnce();
 
     expect(service.claimNext).toHaveBeenCalledWith('ws-1', expect.any(Date));
-    expect(workflow.runPendingCommit).toHaveBeenCalledWith(
+    expect(versionControl.runPendingCommit).toHaveBeenCalledWith(
       'ws-1',
       'feat/x',
       'Foo.md',
@@ -147,7 +147,7 @@ describe('PendingCommitsWorker.drainOnce', () => {
    */
   it("the commit author's id carries no address, and is the same for one person", async () => {
     const seen: string[] = [];
-    workflow.runPendingCommit.mockImplementation(async (_ws: string, _b: string, _p: string, user: AuthUser) => {
+    versionControl.runPendingCommit.mockImplementation(async (_ws: string, _b: string, _p: string, user: AuthUser) => {
       seen.push(user.id);
     });
     for (const authorEmail of ['alice@example.com', 'Alice@Example.com ', 'bob@example.com']) {
@@ -168,7 +168,7 @@ describe('PendingCommitsWorker.drainOnce', () => {
 
     await worker.drainOnce();
 
-    expect(workflow.runPendingCommit).not.toHaveBeenCalled();
+    expect(versionControl.runPendingCommit).not.toHaveBeenCalled();
     expect(service.markSucceeded).not.toHaveBeenCalled();
   });
 
@@ -176,7 +176,7 @@ describe('PendingCommitsWorker.drainOnce', () => {
     // attempts=0 → next attempt would be 1, which is < N_TRANSIENT (3).
     const row = makeRow({ attempts: 0 });
     (service.claimNext as ReturnType<typeof vi.fn>).mockResolvedValueOnce(row);
-    workflow.runPendingCommit.mockRejectedValueOnce(new Error('transient git error'));
+    versionControl.runPendingCommit.mockRejectedValueOnce(new Error('transient git error'));
 
     await worker.drainOnce();
 
@@ -192,7 +192,7 @@ describe('PendingCommitsWorker.drainOnce', () => {
     // crossing the budget. recoveryAgentRuns=0 → still within recovery budget.
     const row = makeRow({ attempts: N_TRANSIENT - 1, recoveryAgentRuns: 0 });
     (service.claimNext as ReturnType<typeof vi.fn>).mockResolvedValueOnce(row);
-    workflow.runPendingCommit.mockRejectedValueOnce(new Error('cannot push: needs human'));
+    versionControl.runPendingCommit.mockRejectedValueOnce(new Error('cannot push: needs human'));
     recoveryAgent.run.mockResolvedValueOnce(undefined);
 
     await worker.drainOnce();
@@ -213,7 +213,7 @@ describe('PendingCommitsWorker.drainOnce', () => {
   it('a recovery-agent crash does not abort the worker — the row stays pending for the next pass', async () => {
     const row = makeRow({ attempts: N_TRANSIENT - 1, recoveryAgentRuns: 0 });
     (service.claimNext as ReturnType<typeof vi.fn>).mockResolvedValueOnce(row);
-    workflow.runPendingCommit.mockRejectedValueOnce(new Error('cannot push'));
+    versionControl.runPendingCommit.mockRejectedValueOnce(new Error('cannot push'));
     recoveryAgent.run.mockRejectedValueOnce(new Error('codemode wiring broken'));
 
     // No throw — the worker swallows the agent crash and moves on.
@@ -233,7 +233,7 @@ describe('PendingCommitsWorker.drainOnce', () => {
       recoveryAgentRuns: N_RECOVERY,
     });
     (service.claimNext as ReturnType<typeof vi.fn>).mockResolvedValueOnce(row);
-    workflow.runPendingCommit.mockRejectedValueOnce(new Error('unrecoverable'));
+    versionControl.runPendingCommit.mockRejectedValueOnce(new Error('unrecoverable'));
 
     await worker.drainOnce();
 
@@ -265,7 +265,7 @@ describe('PendingCommitsWorker.drainOnce', () => {
     (service.claimNext as ReturnType<typeof vi.fn>).mockResolvedValueOnce(row);
     // The commit layer's own refusal, built by its producer so the shape the
     // worker switches on cannot drift from what is actually thrown.
-    workflow.runPendingCommit.mockRejectedValueOnce(captureRefusal('KnowledgeBase/Reviews/PR-12.html'));
+    versionControl.runPendingCommit.mockRejectedValueOnce(captureRefusal('KnowledgeBase/Reviews/PR-12.html'));
 
     await worker.drainOnce();
 
@@ -293,7 +293,7 @@ describe('PendingCommitsWorker.drainOnce', () => {
   it('a feedback-sink failure does not throw — the row stays needs_attention regardless', async () => {
     const row = makeRow({ attempts: N_TRANSIENT - 1, recoveryAgentRuns: N_RECOVERY });
     (service.claimNext as ReturnType<typeof vi.fn>).mockResolvedValueOnce(row);
-    workflow.runPendingCommit.mockRejectedValueOnce(new Error('unrecoverable'));
+    versionControl.runPendingCommit.mockRejectedValueOnce(new Error('unrecoverable'));
     (feedback.send as ReturnType<typeof vi.fn>).mockRejectedValueOnce(new Error('feedback DB down'));
 
     await expect(worker.drainOnce()).resolves.toBeUndefined();
@@ -324,7 +324,7 @@ describe('PendingCommitsWorker.drainOnce', () => {
     it('commits every queued row in ONE pass', async () => {
       queue(12);
       await worker.drainOnce();
-      expect(workflow.runPendingCommit).toHaveBeenCalledTimes(12);
+      expect(versionControl.runPendingCommit).toHaveBeenCalledTimes(12);
       expect(service.markSucceeded).toHaveBeenCalledTimes(12);
     });
 
@@ -333,7 +333,7 @@ describe('PendingCommitsWorker.drainOnce', () => {
       // so per-file runs cost a full parse each and all say the same thing.
       queue(5);
       await worker.drainOnce();
-      const skipped = workflow.runPendingCommit.mock.calls.map((c) => c[4]?.skipValidation);
+      const skipped = versionControl.runPendingCommit.mock.calls.map((c) => c[4]?.skipValidation);
       expect(skipped).toEqual([true, true, true, true, false]);
     });
 
@@ -342,16 +342,16 @@ describe('PendingCommitsWorker.drainOnce', () => {
       // would park every other user's save behind a huge migration.
       queue(200);
       await worker.drainOnce();
-      expect(workflow.runPendingCommit).toHaveBeenCalledTimes(50);
+      expect(versionControl.runPendingCommit).toHaveBeenCalledTimes(50);
     });
 
     it('gives up the pass the moment stop() lands mid-burst', async () => {
       queue(12);
-      workflow.runPendingCommit.mockImplementation(async () => {
+      versionControl.runPendingCommit.mockImplementation(async () => {
         (worker as unknown as { running: boolean }).running = false;
       });
       await worker.drainOnce();
-      expect(workflow.runPendingCommit).toHaveBeenCalledTimes(1);
+      expect(versionControl.runPendingCommit).toHaveBeenCalledTimes(1);
     });
 
     it('carries on after a transient failure and ends the pass when nothing is ready', async () => {
@@ -370,7 +370,7 @@ describe('PendingCommitsWorker.drainOnce', () => {
         .mockResolvedValueOnce(makeRow({ id: 'bad' }))
         .mockResolvedValueOnce(makeRow({ id: 'good' }))
         .mockResolvedValue(null);
-      workflow.runPendingCommit
+      versionControl.runPendingCommit
         .mockRejectedValueOnce(new Error('push rejected'))
         .mockResolvedValueOnce(undefined);
 
@@ -378,7 +378,7 @@ describe('PendingCommitsWorker.drainOnce', () => {
 
       expect(service.markTransientFailure).toHaveBeenCalledTimes(1);
       expect(service.markSucceeded).toHaveBeenCalledTimes(1);
-      expect(workflow.runPendingCommit).toHaveBeenCalledTimes(2);
+      expect(versionControl.runPendingCommit).toHaveBeenCalledTimes(2);
     });
 
     it('validates the final slot when the burst hits its ceiling', async () => {
@@ -387,7 +387,7 @@ describe('PendingCommitsWorker.drainOnce', () => {
       // backlog on an unvalidated commit.
       queue(200);
       await worker.drainOnce();
-      const calls = workflow.runPendingCommit.mock.calls;
+      const calls = versionControl.runPendingCommit.mock.calls;
       expect(calls).toHaveLength(50);
       expect(calls[49]?.[4]?.skipValidation).toBe(false);
       expect(calls[48]?.[4]?.skipValidation).toBe(true);
@@ -411,7 +411,7 @@ describe('PendingCommitsWorker.drainOnce', () => {
       await expect(worker.drainOnce()).resolves.toBeUndefined();
 
       expect(service.markSucceeded).toHaveBeenCalledTimes(1);
-      expect(workflow.runPendingCommit.mock.calls[0]?.[4]?.skipValidation).toBe(false);
+      expect(versionControl.runPendingCommit.mock.calls[0]?.[4]?.skipValidation).toBe(false);
     });
   });
 });
@@ -420,7 +420,7 @@ describe('PendingCommitsWorker lifecycle', () => {
   it('start() is idempotent; stop() awaits the in-flight pass without throwing', async () => {
     const worker = new PendingCommitsWorker({
       service: makeService(),
-      workflow: { runPendingCommit: vi.fn() },
+      versionControl: { runPendingCommit: vi.fn() },
       recoveryAgent: { run: vi.fn() },
       feedback: makeFeedback(),
       workspaces: makeWorkspaces(),

package/src/modules/{workflow → version-control}/__tests__/preserve-roles-yaml.test.ts

@@ -6,18 +6,18 @@ import os from 'node:os';
 
 import type { GitService } from '../git/git.service.js';
 import type { PullRequestService } from '../git/pull-request.service.js';
-import type { IReviewWorkflowService } from '../review-workflow/review-workflow.interface.js';
+import type { IChangeRequestReviewService } from '../change-request-review/change-request-review.interface.js';
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
 import { FileLockService } from '../file-lock.service.js';
 import { PendingCommitsService } from '../pending-commits.service.js';
-import { WorkflowService } from '../workflow.service.js';
+import { VersionControlService } from '../version-control.service.js';
 import type { Database } from '../../database/connection.js';
 import {
   PushNeedsAgentResolutionError,
   RolesYamlPreservationError,
 } from '../../../shared/domain-errors.js';
-import type { WorkflowEventBus } from '../event-bus.js';
+import type { VersionControlEventBus } from '../event-bus.js';
 import { openChangeGate } from '../../../__tests__/open-change-gate.js';
 
 /**
@@ -78,12 +78,12 @@ describe('mergeChangeRequest — roles.yaml preservation guard', () => {
     // Simulate a concurrent editor already holding the roles.yaml lock. When set,
     // acquire returns { acquired: false } and the restore must fail-closed.
     lockHeldBy?: string;
-    events?: WorkflowEventBus;
+    events?: VersionControlEventBus;
   }) {
     const ac = noopAccessControl();
-    const reviewWorkflow = {
+    const changeRequestReview = {
       mergePr: vi.fn().mockResolvedValue({ prNumber: 1, sha: 'merged', mergedAt: 't' }),
-    } as unknown as IReviewWorkflowService;
+    } as unknown as IChangeRequestReviewService;
 
     const workspaceService = {
       getOrCreateForBranch: vi.fn(async (branch: string) => ({ id: encodeURIComponent(branch) })),
@@ -132,44 +132,44 @@ describe('mergeChangeRequest — roles.yaml preservation guard', () => {
     const release = vi.fn(async () => undefined);
     const fileLocks = { acquire, release } as unknown as FileLockService;
 
-    const svc = new WorkflowService(
+    const svc = new VersionControlService(
       {} as unknown as Database,
-      git, prs, reviewWorkflow, workspaceService, ac,
+      git, prs, changeRequestReview, workspaceService, ac,
       fileLocks, {} as unknown as PendingCommitsService,
       testKbContext({ kbDirName: KB_DIR }),
       openChangeGate(),
       opts.events,
     );
-    // Conflicts are now surfaced by the local merge inside `reviewWorkflow.mergePr`
+    // Conflicts are now surfaced by the local merge inside `changeRequestReview.mergePr`
     // (mocked to resolve here), so there's no provider "mergeable" pre-check to stub.
-    return { svc, git, prs, reviewWorkflow, fileLocks };
+    return { svc, git, prs, changeRequestReview, fileLocks };
   }
 
-  async function merge(svc: WorkflowService) {
+  async function merge(svc: VersionControlService) {
     return svc.mergeChangeRequest(1, USER, 'sha', [], 'open', 'Title', BASE, 'w1', { bypass: false });
   }
 
   it('no-ops when the CR does not change roles.yaml (identical content)', async () => {
-    const { svc, git, reviewWorkflow } = makeSvc({ headRoles: BASE_ROLES, baseRoles: BASE_ROLES });
+    const { svc, git, changeRequestReview } = makeSvc({ headRoles: BASE_ROLES, baseRoles: BASE_ROLES });
     await merge(svc);
     // No restore write/commit/push, but the merge still proceeds.
     expect(git.commitFile).not.toHaveBeenCalled();
     expect(git.push).not.toHaveBeenCalled();
-    expect(reviewWorkflow.mergePr).toHaveBeenCalledTimes(1);
+    expect(changeRequestReview.mergePr).toHaveBeenCalledTimes(1);
   });
 
   it('no-ops when neither base nor head has a roles.yaml (both absent)', async () => {
-    const { svc, git, reviewWorkflow } = makeSvc({ headRoles: null, baseRoles: null });
+    const { svc, git, changeRequestReview } = makeSvc({ headRoles: null, baseRoles: null });
     await merge(svc);
     expect(git.commitFile).not.toHaveBeenCalled();
-    expect(reviewWorkflow.mergePr).toHaveBeenCalledTimes(1);
+    expect(changeRequestReview.mergePr).toHaveBeenCalledTimes(1);
   });
 
   it('restores base roles.yaml on the source branch when the CR changed it (escalation guard)', async () => {
     // Seed the source workspace with the ATTACKER version, as it would be after
     // reset-to-origin of the CR head.
     await fs.writeFile(path.join(headRepoDir, 'roles.yaml'), ATTACKER_ROLES);
-    const { svc, git, reviewWorkflow, fileLocks } = makeSvc({ headRoles: ATTACKER_ROLES, baseRoles: BASE_ROLES });
+    const { svc, git, changeRequestReview, fileLocks } = makeSvc({ headRoles: ATTACKER_ROLES, baseRoles: BASE_ROLES });
 
     await merge(svc);
 
@@ -202,7 +202,7 @@ describe('mergeChangeRequest — roles.yaml preservation guard', () => {
       USER,
     );
     // ...and only THEN does the merge proceed.
-    expect(reviewWorkflow.mergePr).toHaveBeenCalledTimes(1);
+    expect(changeRequestReview.mergePr).toHaveBeenCalledTimes(1);
   });
 
   it('ABORTS the merge when roles.yaml is locked by a concurrent editor (fail-closed)', async () => {
@@ -210,7 +210,7 @@ describe('mergeChangeRequest — roles.yaml preservation guard', () => {
     // it — acquire returns { acquired: false }, so the merge aborts rather than
     // writing over (or being overwritten by) the live edit.
     await fs.writeFile(path.join(headRepoDir, 'roles.yaml'), ATTACKER_ROLES);
-    const { svc, git, reviewWorkflow } = makeSvc({
+    const { svc, git, changeRequestReview } = makeSvc({
       headRoles: ATTACKER_ROLES,
       baseRoles: BASE_ROLES,
       lockHeldBy: 'Someone Else',
@@ -220,7 +220,7 @@ describe('mergeChangeRequest — roles.yaml preservation guard', () => {
     // Nothing was written/committed/pushed, and the merge never ran.
     expect(git.commitFile).not.toHaveBeenCalled();
     expect(git.push).not.toHaveBeenCalled();
-    expect(reviewWorkflow.mergePr).not.toHaveBeenCalled();
+    expect(changeRequestReview.mergePr).not.toHaveBeenCalled();
     // The on-disk attacker version is untouched — the lock holder's edit stands.
     const onDisk = await fs.readFile(path.join(headRepoDir, 'roles.yaml'), 'utf-8');
     expect(onDisk).toBe(ATTACKER_ROLES);
@@ -240,13 +240,13 @@ describe('mergeChangeRequest — roles.yaml preservation guard', () => {
   it('ABORTS the merge when the host refuses the restore push, keeping the restore locally (409, saved-locally, banner)', async () => {
     await fs.writeFile(path.join(headRepoDir, 'roles.yaml'), ATTACKER_ROLES);
     const emit = vi.fn();
-    const { svc, git, reviewWorkflow, fileLocks } = makeSvc({
+    const { svc, git, changeRequestReview, fileLocks } = makeSvc({
       headRoles: ATTACKER_ROLES,
       baseRoles: BASE_ROLES,
       pushImpl: async () => {
         throw new Error('git push failed: remote: Internal Server Error');
       },
-      events: { emit } as unknown as WorkflowEventBus,
+      events: { emit } as unknown as VersionControlEventBus,
     });
 
     const err = await merge(svc).catch((e: unknown) => e);
@@ -258,7 +258,7 @@ describe('mergeChangeRequest — roles.yaml preservation guard', () => {
     expect(JSON.stringify((err as PushNeedsAgentResolutionError).payload)).not.toContain('Internal Server Error');
     // Fail-closed: the merge must NOT have run — origin still carries the
     // divergent roles.yaml.
-    expect(reviewWorkflow.mergePr).not.toHaveBeenCalled();
+    expect(changeRequestReview.mergePr).not.toHaveBeenCalled();
     // The local result stays: base version on disk, committed, lock dropped.
     expect(await fs.readFile(path.join(headRepoDir, 'roles.yaml'), 'utf-8')).toBe(BASE_ROLES);
     expect(git.commitFile).toHaveBeenCalled();
@@ -274,7 +274,7 @@ describe('mergeChangeRequest — roles.yaml preservation guard', () => {
   it('a non-fast-forward restore push takes the cooperative pull-rebase, then the merge proceeds', async () => {
     await fs.writeFile(path.join(headRepoDir, 'roles.yaml'), ATTACKER_ROLES);
     let pushes = 0;
-    const { svc, git, reviewWorkflow } = makeSvc({
+    const { svc, git, changeRequestReview } = makeSvc({
       headRoles: ATTACKER_ROLES,
       baseRoles: BASE_ROLES,
       pushImpl: async () => {
@@ -285,13 +285,13 @@ describe('mergeChangeRequest — roles.yaml preservation guard', () => {
     await merge(svc);
     expect(git.pull).toHaveBeenCalled();
     expect(git.push).toHaveBeenCalledTimes(2);
-    expect(reviewWorkflow.mergePr).toHaveBeenCalledTimes(1);
+    expect(changeRequestReview.mergePr).toHaveBeenCalledTimes(1);
   });
 
   it('ABORTS the merge if the CR (PR) cannot be resolved', async () => {
-    const { svc, reviewWorkflow } = makeSvc({ headRoles: BASE_ROLES, baseRoles: BASE_ROLES, getPrResult: null });
+    const { svc, changeRequestReview } = makeSvc({ headRoles: BASE_ROLES, baseRoles: BASE_ROLES, getPrResult: null });
     await expect(merge(svc)).rejects.toBeInstanceOf(RolesYamlPreservationError);
-    expect(reviewWorkflow.mergePr).not.toHaveBeenCalled();
+    expect(changeRequestReview.mergePr).not.toHaveBeenCalled();
   });
 
   it('refreshes the merge inputs from the updated PR head after a preservation commit', async () => {
@@ -299,13 +299,13 @@ describe('mergeChangeRequest — roles.yaml preservation guard', () => {
     // (resolved pre-preservation) go stale. mergeChangeRequest must re-resolve them
     // from the live PR before merging, not forward the originals.
     await fs.writeFile(path.join(headRepoDir, 'roles.yaml'), ATTACKER_ROLES);
-    const { svc, prs, reviewWorkflow } = makeSvc({ headRoles: ATTACKER_ROLES, baseRoles: BASE_ROLES });
+    const { svc, prs, changeRequestReview } = makeSvc({ headRoles: ATTACKER_ROLES, baseRoles: BASE_ROLES });
 
     await merge(svc);
 
     expect(prs.getPrDetail).toHaveBeenCalledWith(1, expect.objectContaining({ fresh: true }));
     // mergePr is called with the REFRESHED head sha, not the original 'sha'.
-    expect(reviewWorkflow.mergePr).toHaveBeenCalledWith(
+    expect(changeRequestReview.mergePr).toHaveBeenCalledWith(
       1, USER, 'sha-after-preserve', [], 'open', 'Title', BASE, 'w1', { bypass: false },
     );
   });
@@ -313,10 +313,10 @@ describe('mergeChangeRequest — roles.yaml preservation guard', () => {
   it('does NOT refresh (keeps the caller inputs) when the CR does not touch roles.yaml', async () => {
     // No preservation commit → no head advance → nothing to refresh; the original
     // headSha/approvals flow straight through.
-    const { svc, prs, reviewWorkflow } = makeSvc({ headRoles: BASE_ROLES, baseRoles: BASE_ROLES });
+    const { svc, prs, changeRequestReview } = makeSvc({ headRoles: BASE_ROLES, baseRoles: BASE_ROLES });
     await merge(svc);
     expect(prs.getPrDetail).not.toHaveBeenCalled();
-    expect(reviewWorkflow.mergePr).toHaveBeenCalledWith(
+    expect(changeRequestReview.mergePr).toHaveBeenCalledWith(
       1, USER, 'sha', [], 'open', 'Title', BASE, 'w1', { bypass: false },
     );
   });
@@ -327,14 +327,14 @@ describe('mergeChangeRequest — roles.yaml preservation guard', () => {
     // origin/head would still carry the divergent roles.yaml, so this must fail
     // closed rather than return "nothing to do".
     await fs.writeFile(path.join(headRepoDir, 'roles.yaml'), BASE_ROLES);
-    const { svc, git, reviewWorkflow } = makeSvc({
+    const { svc, git, changeRequestReview } = makeSvc({
       headRoles: ATTACKER_ROLES,
       baseRoles: BASE_ROLES,
       commitFileResult: null,
     });
     await expect(merge(svc)).rejects.toBeInstanceOf(RolesYamlPreservationError);
     expect(git.push).not.toHaveBeenCalled();
-    expect(reviewWorkflow.mergePr).not.toHaveBeenCalled();
+    expect(changeRequestReview.mergePr).not.toHaveBeenCalled();
   });
 
   it('a merge retried after a refused restore push pushes the restore that is already committed, then merges', async () => {
@@ -345,7 +345,7 @@ describe('mergeChangeRequest — roles.yaml preservation guard', () => {
     // of everything origin has. The retry must push it and merge, not refuse
     // "out of sync" forever.
     await fs.writeFile(path.join(headRepoDir, 'roles.yaml'), BASE_ROLES);
-    const { svc, git, reviewWorkflow } = makeSvc({
+    const { svc, git, changeRequestReview } = makeSvc({
       headRoles: ATTACKER_ROLES,
       baseRoles: BASE_ROLES,
       commitFileResult: null,
@@ -353,7 +353,7 @@ describe('mergeChangeRequest — roles.yaml preservation guard', () => {
     });
     await expect(merge(svc)).resolves.toMatchObject({ kind: 'merged' });
     expect(git.push).toHaveBeenCalledTimes(1);
-    expect(reviewWorkflow.mergePr).toHaveBeenCalled();
+    expect(changeRequestReview.mergePr).toHaveBeenCalled();
   });
 
   it('still ABORTS when the base version is on disk but the clone is BEHIND origin/head (fail-closed)', async () => {
@@ -363,7 +363,7 @@ describe('mergeChangeRequest — roles.yaml preservation guard', () => {
     // the merge would land it — so holding unpushed work is not the question,
     // holding all of origin is.
     await fs.writeFile(path.join(headRepoDir, 'roles.yaml'), BASE_ROLES);
-    const { svc, git, reviewWorkflow } = makeSvc({
+    const { svc, git, changeRequestReview } = makeSvc({
       headRoles: ATTACKER_ROLES,
       baseRoles: BASE_ROLES,
       commitFileResult: null,
@@ -371,12 +371,12 @@ describe('mergeChangeRequest — roles.yaml preservation guard', () => {
     });
     await expect(merge(svc)).rejects.toBeInstanceOf(RolesYamlPreservationError);
     expect(git.push).not.toHaveBeenCalled();
-    expect(reviewWorkflow.mergePr).not.toHaveBeenCalled();
+    expect(changeRequestReview.mergePr).not.toHaveBeenCalled();
   });
 
   it('ABORTS when the probe for "does HEAD hold origin/head" itself fails (fail-closed, not open)', async () => {
     await fs.writeFile(path.join(headRepoDir, 'roles.yaml'), BASE_ROLES);
-    const { svc, git, reviewWorkflow } = makeSvc({
+    const { svc, git, changeRequestReview } = makeSvc({
       headRoles: ATTACKER_ROLES,
       baseRoles: BASE_ROLES,
       commitFileResult: null,
@@ -384,7 +384,7 @@ describe('mergeChangeRequest — roles.yaml preservation guard', () => {
     });
     await expect(merge(svc)).rejects.toBeInstanceOf(RolesYamlPreservationError);
     expect(git.push).not.toHaveBeenCalled();
-    expect(reviewWorkflow.mergePr).not.toHaveBeenCalled();
+    expect(changeRequestReview.mergePr).not.toHaveBeenCalled();
   });
 
   it('ABORTS the merge when the post-preservation CR detail cannot be reloaded (fail-closed)', async () => {
@@ -392,24 +392,24 @@ describe('mergeChangeRequest — roles.yaml preservation guard', () => {
     // re-resolved. If the fresh detail is unavailable, abort — never fall back to
     // the stale headSha/approvals.
     await fs.writeFile(path.join(headRepoDir, 'roles.yaml'), ATTACKER_ROLES);
-    const { svc, reviewWorkflow } = makeSvc({
+    const { svc, changeRequestReview } = makeSvc({
       headRoles: ATTACKER_ROLES,
       baseRoles: BASE_ROLES,
       getPrDetailResult: null,
     });
     await expect(merge(svc)).rejects.toBeInstanceOf(RolesYamlPreservationError);
-    expect(reviewWorkflow.mergePr).not.toHaveBeenCalled();
+    expect(changeRequestReview.mergePr).not.toHaveBeenCalled();
   });
 
   it('ABORTS the merge when reading roles.yaml fails for a non-absence reason (fail-closed)', async () => {
     // readFileAtRef now rethrows real git errors (only true absence maps to null),
     // so a fatal read must surface as RolesYamlPreservationError — never be mistaken
     // for "roles.yaml absent" and waved through.
-    const { svc, git, reviewWorkflow } = makeSvc({ headRoles: ATTACKER_ROLES, baseRoles: BASE_ROLES });
+    const { svc, git, changeRequestReview } = makeSvc({ headRoles: ATTACKER_ROLES, baseRoles: BASE_ROLES });
     (git.readFileAtRef as unknown as ReturnType<typeof vi.fn>).mockRejectedValue(
       new Error('git show failed: fatal: unable to read tree object'),
     );
     await expect(merge(svc)).rejects.toBeInstanceOf(RolesYamlPreservationError);
-    expect(reviewWorkflow.mergePr).not.toHaveBeenCalled();
+    expect(changeRequestReview.mergePr).not.toHaveBeenCalled();
   });
 });