@bevel-software/platform-core-backend 0.35.0 → 0.36.1

package/src/modules/workspace/__tests__/workspace.routes.move-platform-files.test.ts

@@ -7,9 +7,9 @@ import express from 'express';
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 import { testKbContext } from '../../../__tests__/kb-context.js';
 import { NodeFs } from '../../kb-fs/node-fs.js';
-import type { IWorkflowService } from '@bevel-software/platform-shared';
+import type { IVersionControlService } from '@bevel-software/platform-shared';
 import type { IAccessControl } from '../../access/access-control.interface.js';
-import type { WorkflowEventBus } from '../../workflow/event-bus.js';
+import type { VersionControlEventBus } from '../../version-control/event-bus.js';
 import type { AuthService } from '../../auth/auth.service.js';
 import type { IAdminAccessService } from '../../admin/admin.interface.js';
 import { createWorkspaceRoutes } from '../workspace.routes.js';
@@ -68,16 +68,16 @@ async function makeHarness(): Promise<Harness> {
   const workspaceService = workspaceServiceMock as WorkspaceService;
 
   const acquireLock = vi.fn(async () => ({ acquired: true, lock: {} as never }));
-  const workflowServiceMock: Partial<IWorkflowService> = {
+  const versionControlServiceMock: Partial<IVersionControlService> = {
     getLock: vi.fn(async () => null),
-    acquireLock: acquireLock as unknown as IWorkflowService['acquireLock'],
+    acquireLock: acquireLock as unknown as IVersionControlService['acquireLock'],
     releaseLock: vi.fn(async () => undefined as never),
     releaseLockNoCommit: vi.fn(async () => undefined as never),
   };
-  const workflowService = workflowServiceMock as unknown as IWorkflowService;
+  const versionControlService = versionControlServiceMock as unknown as IVersionControlService;
 
   const authService = { getUserById: vi.fn(async () => USER) } as unknown as AuthService;
-  const eventBus = { emit: vi.fn() } as unknown as WorkflowEventBus;
+  const eventBus = { emit: vi.fn() } as unknown as VersionControlEventBus;
   const creatorAccess: ICreatorAccess = {
     planForCreate: async () => null,
     grantInExtractedFile: async () => null,
@@ -93,7 +93,7 @@ async function makeHarness(): Promise<Harness> {
   app.use('/api', createWorkspaceRoutes(
     workspaceService,
     authService,
-    workflowService,
+    versionControlService,
     eventBus,
     accessControl,
     testKbContext({ kbDirName: KB }),

package/src/modules/workspace/__tests__/workspace.routes.read-gate.test.ts

@@ -3,13 +3,13 @@ import type { AddressInfo } from 'node:net';
 import express from 'express';
 import { describe, it, expect, afterEach, vi } from 'vitest';
 import { testKbContext } from '../../../__tests__/kb-context.js';
-import { NodeFs } from '../../kb-fs/node-fs.js';
-import type { IWorkflowService } from '@bevel-software/platform-shared';
-import type { IAccessControl } from '../../access/access-control.interface.js';
-import type { ICreatorAccess } from '../../access-model/creator.js';
-import type { IAdminAccessService } from '../../admin/admin.interface.js';
-import type { WorkflowEventBus } from '../../workflow/event-bus.js';
-import type { AuthService } from '../../auth/auth.service.js';
+import { realDisk } from '../../../__tests__/real-disk.js';
+import type { IVersionControlService } from '@bevel-software/platform-shared';
+import type { IAccessControl } from '../../access/index.js';
+import type { ICreatorAccess } from '../../access-model/index.js';
+import type { IAdminAccessService } from '../../admin/index.js';
+import type { VersionControlEventBus } from '../../version-control/index.js';
+import type { AuthService } from '../../auth/index.js';
 import { createWorkspaceRoutes } from '../workspace.routes.js';
 import type { WorkspaceService, ReadTreeFilter } from '../workspace.service.js';
 
@@ -91,13 +91,13 @@ async function makeHarness(opts: {
     createWorkspaceRoutes(
       workspaceService,
       authService,
-      {} as unknown as IWorkflowService,
-      {} as unknown as WorkflowEventBus,
+      {} as unknown as IVersionControlService,
+      {} as unknown as VersionControlEventBus,
       accessControl,
       testKbContext({ kbDirName: KB }),
       stubCreatorAccess,
       { isAdmin: async () => opts.isAdmin === true } as unknown as IAdminAccessService,
-      new NodeFs(),
+      realDisk(),
     ),
   );
   const server = await new Promise<Server>((resolve) => {
@@ -201,7 +201,7 @@ describe('read-permission gates on human read routes', () => {
   it('keeps the structural root folders visible even when nothing is readable', async () => {
     // A user with no read grants: the access batch denies everything. The
     // structural top-level folders (KnowledgeBase, Skills, Data, Agents,
-    // Pipelines, Plugins) must still resolve readable (so the explorer renders
+    // Workflows, Plugins) must still resolve readable (so the explorer renders
     // its section view), while their contents stay gated. The retired Tools/
     // root gets NO structural treatment — it is an ordinary (denied) folder.
     h = await makeHarness({ allowFn: () => false });
@@ -211,7 +211,7 @@ describe('read-permission gates on human read routes', () => {
       `${KB}/KnowledgeBase`,
       `${KB}/Data`,
       `${KB}/Agents`,
-      `${KB}/Pipelines`,
+      `${KB}/Workflows`,
       `${KB}/Plugins`,
       `${KB}/Skills`,
       `${KB}/Tools`,
@@ -223,7 +223,7 @@ describe('read-permission gates on human read routes', () => {
     expect(verdict.get(`${KB}/KnowledgeBase`)).toBe(true);
     expect(verdict.get(`${KB}/Data`)).toBe(true);
     expect(verdict.get(`${KB}/Agents`)).toBe(true);
-    expect(verdict.get(`${KB}/Pipelines`)).toBe(true);
+    expect(verdict.get(`${KB}/Workflows`)).toBe(true);
     expect(verdict.get(`${KB}/Plugins`)).toBe(true);
     expect(verdict.get(`${KB}/Skills`)).toBe(true);
     // Retired root: no override, the deny-all batch verdict stands.

package/src/modules/workspace/__tests__/workspace.service.any-workspace-credentials.test.ts

@@ -6,7 +6,7 @@ import path from 'node:path';
 import os from 'node:os';
 import { testKbContext } from '../../../__tests__/kb-context.js';
 import { NodeFs } from '../../kb-fs/node-fs.js';
-import { NodeGitRunner } from '../../workflow/git/node-git-runner.js';
+import { NodeGitRunner } from '../../version-control/git/node-git-runner.js';
 import { gitCredentials } from '../../../shared/git.contract.js';
 import { newWorkspaceService } from '../../../__tests__/workspace-service.js';
 

package/src/modules/workspace/__tests__/workspace.service.replaced-repository.test.ts

@@ -7,7 +7,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
 import { WorkspaceService } from '../workspace.service.js';
-import { NodeGitRunner } from '../../workflow/git/node-git-runner.js';
+import { NodeGitRunner } from '../../version-control/git/node-git-runner.js';
 import { newWorkspaceService } from '../../../__tests__/workspace-service.js';
 
 const execFileAsync = promisify(execFile);

package/src/modules/workspace/__tests__/workspace.service.worktrees.test.ts

@@ -8,7 +8,7 @@ import os from 'node:os';
 import { NodeFs } from '../../kb-fs/node-fs.js';
 import { KbRepository, workingCopyShape } from '../kb-repository.js';
 import { setAsideRepository } from '../set-aside-clone.js';
-import { NodeGitRunner } from '../../workflow/git/node-git-runner.js';
+import { NodeGitRunner } from '../../version-control/git/node-git-runner.js';
 import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import type { IGitRunner } from '../../../shared/git.contract.js';
 import { newWorkspaceService } from '../../../__tests__/workspace-service.js';

package/src/modules/workspace/__tests__/workspace.tools.agents-file.test.ts

@@ -5,7 +5,7 @@ import { tmpdir } from 'node:os';
 import { DEFAULT_KB_LAYOUT } from '@bevel-software/platform-shared';
 import { testKbContext } from '../../../__tests__/kb-context.js';
 import { GUIDE_FIRST_SENTENCE, ToolRegistry } from '../../tool-registry/index.js';
-import { WorkflowHooks, createToolHandlerFactory } from '../../../__tests__/tool-wiring.js';
+import { VersionControlHooks, createToolHandlerFactory } from '../../../__tests__/tool-wiring.js';
 import type { ToolAuth } from '../../tool-auth/index.js';
 import type { IAccessControl } from '../../access/index.js';
 import { DocExtractService } from '../file-readers/doc-extract.service.js';
@@ -51,7 +51,7 @@ async function descriptions(registry: ToolRegistry = new ToolRegistry()): Promis
     kb,
     {
       recoveryBotEmail: 'recovery-bot@bevel.local',
-      hooks: new WorkflowHooks(),
+      hooks: new VersionControlHooks(),
       notes: new ToolDescriptionNotes(),
     },
     new RoutineWritePolicyService(),
@@ -79,7 +79,7 @@ afterEach(() => kb.applyLayout({ ...DEFAULT_KB_LAYOUT }));
 
 describe('what tells an agent to read the guide first', () => {
   it('tells an agent to call get_agent_guide first, and that AGENTS.md answers with that start after the organisation\'s own', () => {
-    const rules = sharedFileRulesSection(kb.layout);
+    const rules = sharedFileRulesSection(kb.layout, kb.defaultBranch);
     expect(rules).toContain("call `get_agent_guide`: it answers the guide's start");
     expect(rules).toContain('read_file on `AGENTS.md` at the KB root answers with that start');
     expect(rules).toContain("after the organisation's own conventions file of that name");
@@ -99,10 +99,10 @@ describe('what tells an agent to read the guide first', () => {
 
   it('lists the guide under no name as a platform file, and ignores a name a deployment saved for it', () => {
     kb.applyLayout({ ...DEFAULT_KB_LAYOUT, agentsFile: 'HEXIS.md' });
-    const rules = sharedFileRulesSection(kb.layout);
+    const rules = sharedFileRulesSection(kb.layout, kb.defaultBranch);
     expect(rules).toContain('`access.md` or `.bevelignore` in any folder, `roles.yaml` at the repository root');
     expect(rules).not.toContain('HEXIS.md');
-    expect(rules).toBe(sharedFileRulesSection(DEFAULT_KB_LAYOUT));
+    expect(rules).toBe(sharedFileRulesSection(DEFAULT_KB_LAYOUT, kb.defaultBranch));
   });
 
   /**

package/src/modules/workspace/__tests__/workspace.tools.branch-errors.test.ts

@@ -20,8 +20,8 @@ import type { ToolAuth } from '../../tool-auth/tool-auth.middleware.js';
 import type { AuthService } from '../../auth/auth.service.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
 import type { ICreatorAccess } from '../../access-model/creator.js';
-import type { WorkflowEventBus } from '../../workflow/event-bus.js';
-import { WorkflowHooks } from '../../workflow/workflow-hooks.js';
+import type { VersionControlEventBus } from '../../version-control/event-bus.js';
+import { VersionControlHooks } from '../../version-control/version-control-hooks.js';
 import { ToolDescriptionNotes } from '../../workspace/agent-access.gate.js';
 import { RoutineWritePolicyService } from '../routine-write-policy.js';
 import { SpillStore } from '../spill-store.js';
@@ -146,8 +146,8 @@ describe('workspace tools — a branch that cannot be opened', () => {
         getUserById: async () => ({ id: 'u', email: 'alice@example.com', name: 'Alice' }),
       } as unknown as AuthService,
       workspaceService: workspaces,
-      workflowService: {} as never,
-      events: { emit: () => {} } as unknown as WorkflowEventBus,
+      versionControlService: {} as never,
+      events: { emit: () => {} } as unknown as VersionControlEventBus,
       kbDirName: KB_DIR,
       creatorAccess: stubCreatorAccess,
     });
@@ -196,7 +196,7 @@ describe('workspace tools — a branch that cannot be opened', () => {
       testKbContext({ kbDirName: KB_DIR }),
       {
         recoveryBotEmail: 'recovery-bot@bevel.local',
-        hooks: new WorkflowHooks(),
+        hooks: new VersionControlHooks(),
         notes: new ToolDescriptionNotes(),
       },
       new RoutineWritePolicyService(),

package/src/modules/workspace/__tests__/workspace.tools.test.ts

@@ -11,7 +11,7 @@ import { testKbContext } from '../../../__tests__/kb-context.js';
 import { slowRipgrep } from '../../../__tests__/slow-ripgrep.js';
 import { LocalFilesystem } from '@mastra/core/workspace';
 import { GUIDE_FIRST_SENTENCE, ToolRegistry } from '../../tool-registry/index.js';
-import { AccessControlService, WorkflowHooks, createToolHandlerFactory, type AgentOperationContext } from '../../../__tests__/tool-wiring.js';
+import { AccessControlService, VersionControlHooks, createToolHandlerFactory, type AgentOperationContext } from '../../../__tests__/tool-wiring.js';
 import { ToolError, type ToolContext } from '../../tool-helpers/index.js';
 import type { ToolAuth } from '../../tool-auth/index.js';
 import { registerWorkspaceTools } from '../workspace.tools.js';
@@ -120,7 +120,7 @@ let focusedBranch: string | undefined;
 /** The registry the tools were mounted into, so a test can inspect their defs. */
 let toolRegistry: ToolRegistry;
 /** The hook registry the tools were mounted against, so a test can register one. */
-let hooks: WorkflowHooks;
+let hooks: VersionControlHooks;
 /** The note registry the tools were mounted against, so a test can register a note. */
 let notes: ToolDescriptionNotes;
 /**
@@ -165,7 +165,7 @@ async function start(
   await docExtractor?.close();
   const extractor = new WorkerDocumentExtractor();
   docExtractor = extractor;
-  hooks = new WorkflowHooks();
+  hooks = new VersionControlHooks();
   notes = new ToolDescriptionNotes();
   callerSource = 'internal';
   tempDir = await mkdtemp(join(tmpdir(), 'ws-tools-'));
@@ -307,7 +307,7 @@ async function start(
         return { destination: '', extracted, skipped };
       },
     } as never,
-    workflowService: {} as never,
+    versionControlService: {} as never,
     events: {} as never,
     getFilesystem: async () => fs,
   });
@@ -825,10 +825,10 @@ describe('write modes and per-path outcomes', () => {
     // The paragraph that said this in BOTH descriptions is one shared rule now.
     // What stays on the tool is the input the agent fills, which is where the
     // decision is actually taken.
-    const rule = sharedFileRules(testKbContext().layout).find((r) => r.id === 'write-mode')!;
+    const rule = sharedFileRules(testKbContext().layout, testKbContext().defaultBranch).find((r) => r.id === 'write-mode')!;
     expect(rule.body).toContain('DEFAULTS TO `create`');
     expect(rule.body).toContain('On write_file and write_files');
-    expect(sharedFileRulesSection(testKbContext().layout).split(rule.body)).toHaveLength(2);
+    expect(sharedFileRulesSection(testKbContext().layout, testKbContext().defaultBranch).split(rule.body)).toHaveLength(2);
     for (const name of ['write_file', 'write_files']) {
       const def = tools.find((t) => t.name === name)!;
       expect(def.description, name).not.toContain('DEFAULTS TO `create`');
@@ -2089,7 +2089,7 @@ describe('office documents and PDFs', () => {
       // description. Checked on the whole body rather than on a phrase: the
       // drift this PR exists to prevent is a paragraph pasted back onto a
       // tool, and naming only two marker phrases would catch two of eight.
-      for (const rule of sharedFileRules(testKbContext().layout)) {
+      for (const rule of sharedFileRules(testKbContext().layout, testKbContext().defaultBranch)) {
         expect(def!.description, `${name} / ${rule.id}`).not.toContain(rule.body);
       }
       // The two lead-in labels the paragraphs used to arrive under are gone
@@ -2278,10 +2278,10 @@ describe('office documents and PDFs', () => {
   it('says where the images a page uses go — once, in the shared rules', async () => {
     await start();
     const tools = await toolRegistry.listInternal();
-    const rule = sharedFileRules(testKbContext().layout).find((r) => r.id === 'images-in-pages')!;
+    const rule = sharedFileRules(testKbContext().layout, testKbContext().defaultBranch).find((r) => r.id === 'images-in-pages')!;
     expect(rule.body).toContain('`assets/` folder next to the page');
     expect(rule.body).toContain('![Approval screen](./assets/approval-screen.png)');
-    expect(sharedFileRulesSection(testKbContext().layout)).toContain(rule.body);
+    expect(sharedFileRulesSection(testKbContext().layout, testKbContext().defaultBranch)).toContain(rule.body);
     for (const name of ['write_file', 'write_files']) {
       expect(tools.find((t) => t.name === name)!.description, name).not.toContain('`assets/` folder next to the page');
     }
@@ -2402,7 +2402,7 @@ describe('start_session', () => {
     // The default branch's workspace directory, for the tests about the
     // `firstRun` note. Without one the workspace service is a bare stand-in
     // the note's check cannot use, which is what every other test here wants:
-    // the call answers with the id alone.
+    // the call answers with the id and the default branch, never `firstRun`.
     defaultWorkspaceDir?: string,
     // The starter pack the knowledge base was filled from, for the note.
     starterPacks?: FirstRunStarterSource,
@@ -2422,7 +2422,7 @@ describe('start_session', () => {
             getWorkspacePath: async () => defaultWorkspaceDir,
           }
         : {}) as never,
-      workflowService: {} as never,
+      versionControlService: {} as never,
       events: {} as never,
       getFilesystem: async () => ({}) as never,
     });
@@ -2448,7 +2448,7 @@ describe('start_session', () => {
     registerWorkspaceTools(
       registry, router, auth, toolHandler,
       new SpillStore(join(tmpdir(), 'bevel-test-spills')), new DocExtractService(join(tmpdir(), 'bevel-test-doc-extract'), extractor), access, testKbContext({ kbDirName: KB_DIR }),
-      { recoveryBotEmail: RECOVERY_BOT, hooks: new WorkflowHooks(), notes: new ToolDescriptionNotes() },
+      { recoveryBotEmail: RECOVERY_BOT, hooks: new VersionControlHooks(), notes: new ToolDescriptionNotes() },
       new RoutineWritePolicyService(),
       sink ?? fakeSessionSink,
       undefined,
@@ -2583,7 +2583,7 @@ describe('start_session', () => {
     registerWorkspaceTools(
       registry, router, noopAuth, (() => () => {}) as never,
       new SpillStore(join(tmpdir(), 'bevel-test-spills')), new DocExtractService(join(tmpdir(), 'bevel-test-doc-extract'), extractor), allowAll, testKbContext({ kbDirName: KB_DIR }),
-      { recoveryBotEmail: RECOVERY_BOT, hooks: new WorkflowHooks(), notes: new ToolDescriptionNotes() },
+      { recoveryBotEmail: RECOVERY_BOT, hooks: new VersionControlHooks(), notes: new ToolDescriptionNotes() },
       new RoutineWritePolicyService(),
       {} as never,
     );
@@ -2682,7 +2682,7 @@ describe('start_session', () => {
 
     /**
      * The note is a read: it says what the knowledge folder holds. A caller
-     * who may not read the folder gets the id alone, and a pack page the
+     * who may not read the folder gets the id and the default branch alone, and a pack page the
      * caller may not read is judged as anybody's page, so the note never
      * tells them it is still a placeholder.
      */
@@ -2690,7 +2690,7 @@ describe('start_session', () => {
       const closed = { ...allowAll, canRead: async () => false } as unknown as IAccessControl;
       const base = await startSessionApp('external', undefined, wsDir, undefined, closed);
       const res = (await (await postRaw(`${base}/api/agent/tools/start_session`)).json()) as { firstRun?: string };
-      expect(res).toEqual({ sessionId: 'thread-xyz' });
+      expect(res).toEqual({ sessionId: 'thread-xyz', defaultBranch: 'target-company-state' });
     });
 
     it('judges the folder as the caller may see it: a page they may not read leaves the note standing', async () => {
@@ -2723,15 +2723,15 @@ describe('start_session', () => {
       } as unknown as IAccessControl;
       const base = await startSessionApp('external', undefined, wsDir, starter, pageClosed);
       const res = (await (await postRaw(`${base}/api/agent/tools/start_session`)).json()) as { firstRun?: string };
-      expect(res).toEqual({ sessionId: 'thread-xyz' });
+      expect(res).toEqual({ sessionId: 'thread-xyz', defaultBranch: 'target-company-state' });
     });
 
-    it('never costs the session id: a workspace it cannot read answers with the id alone', async () => {
+    it('never costs the session id: a workspace it cannot read answers with the id and the default branch', async () => {
       await rm(wsDir, { recursive: true, force: true });
 
       const res = await startSession();
 
-      expect(res).toEqual({ sessionId: 'thread-xyz' });
+      expect(res).toEqual({ sessionId: 'thread-xyz', defaultBranch: 'target-company-state' });
     });
   });
 });
@@ -2768,7 +2768,7 @@ describe('branch is a required parameter in the tool contract', () => {
       new DocExtractService(join(tmpdir(), 'bevel-test-doc-extract'), extractor),
       allowAll,
       testKbContext({ kbDirName: KB_DIR }),
-      { recoveryBotEmail: RECOVERY_BOT, hooks: new WorkflowHooks(), notes: new ToolDescriptionNotes() },
+      { recoveryBotEmail: RECOVERY_BOT, hooks: new VersionControlHooks(), notes: new ToolDescriptionNotes() },
       new RoutineWritePolicyService(),
       {} as never,
       // Skill check, change gate, uploads, guide, downloads, starter packs, disk: not this harness's business.
@@ -4212,7 +4212,7 @@ describe('preflight for moves and deletes', () => {
       expect(d.description).toMatch(/destination must not exist/);
       // What refuses a move, and the dry-run/confirm protocol it shares with the
       // deletes, are shared rules — stated once, in the two shared places.
-      const rules = sharedFileRulesSection(testKbContext().layout);
+      const rules = sharedFileRulesSection(testKbContext().layout, testKbContext().defaultBranch);
       expect(rules).toContain('is a platform file and stays in its folder.');
       expect(rules).toContain('`dryRun: true`');
       expect(rules).toContain('`confirm: true`');
@@ -4240,7 +4240,7 @@ describe('preflight for moves and deletes', () => {
       const d = await def('delete_folder');
       expect(d.description).toContain('a non-empty folder wants `confirm: true`');
       // The protocol itself, and what a platform folder does to it, are shared.
-      const rules = sharedFileRulesSection(testKbContext().layout);
+      const rules = sharedFileRulesSection(testKbContext().layout, testKbContext().defaultBranch);
       expect(rules).toContain('`dryRun: true`');
       // Anyone's: a move asks when it changes who else may open or edit the file too (`holderChanges`).
       expect(rules).toContain("A non-empty folder is deleted, and a move that changes anyone's access runs, only with `confirm: true`");
@@ -4265,7 +4265,7 @@ describe('preflight for moves and deletes', () => {
       expect(stat.description).toContain('shared rules on what these tools never move or delete');
       // The proposal route applies to every tool a permission can refuse, so it
       // is stated once in the shared rules rather than on each of them.
-      expect(sharedFileRulesSection(testKbContext().layout)).toContain('`write-denied`');
+      expect(sharedFileRulesSection(testKbContext().layout, testKbContext().defaultBranch)).toContain('`write-denied`');
       for (const name of ['move_file', 'delete_file', 'delete_folder']) {
         expect((await def(name)).description.startsWith(GUIDE_FIRST_SENTENCE), name).toBe(true);
       }
@@ -4383,7 +4383,7 @@ describe('a write refused for permissions says whether and how to propose it', (
     await fs.writeFile(DENIED, 'old text\n');
     await freeDestinationFor(tool);
     denyWrites();
-    const workflowCalls = workspacePathCalls.length;
+    const versionControlCalls = workspacePathCalls.length;
 
     const { status, json } = await call(base, tool, body);
 
@@ -4406,12 +4406,12 @@ describe('a write refused for permissions says whether and how to propose it', (
     // The read verdict was asked of the repo-relative path.
     expect(calls).toContain('Sales/deal.md');
     // Nothing was created: no workspace was resolved for the DRAFT the answer
-    // suggests, and the context's workflow service is an empty stub, so a
+    // suggests, and the context's version-control service is an empty stub, so a
     // create_branch or change request would have 500d. (The tools that
     // preflight do resolve the CALLER's own workspace on the way — to read
     // the on-disk spelling and refuse links — which is not a draft.)
     const forDraft = workspacePathCalls
-      .slice(workflowCalls)
+      .slice(versionControlCalls)
       .filter((b) => b.includes(draft) || b.includes(encodeURIComponent(draft)));
     expect(forDraft).toEqual([]);
   });
@@ -4522,8 +4522,8 @@ describe('a write refused for permissions says whether and how to propose it', (
     // stated in the handshake instructions and in the managed guide, and in no
     // description. The refusal ITSELF still spells the steps out — that is what
     // the tests above this one assert.
-    const rule = sharedFileRules(testKbContext().layout).find((r) => r.id === 'refused-for-permissions')!;
-    expect(sharedFileRulesSection(testKbContext().layout)).toContain(rule.body);
+    const rule = sharedFileRules(testKbContext().layout, testKbContext().defaultBranch).find((r) => r.id === 'refused-for-permissions')!;
+    expect(sharedFileRulesSection(testKbContext().layout, testKbContext().defaultBranch)).toContain(rule.body);
     for (const def of tools) {
       expect(def.description ?? '', def.name).not.toContain('If this is refused for permissions');
       expect(def.description ?? '', def.name).not.toContain(rule.body);

package/src/modules/workspace/agent-access.gate.ts

@@ -2,7 +2,7 @@
  * Agent access gate — the per-call seam every gated agent tool runs through.
  *
  * It decides nothing of its own. It calls the hooks a DEPLOYMENT registered
- * (`WorkflowHooks`): one before an agent read of a knowledge-base path, one
+ * (`VersionControlHooks`): one before an agent read of a knowledge-base path, one
  * before an agent write. A hook that throws refuses the operation and the
  * caller sees that hook's own message and status. With no hook registered —
  * every core-only deployment — nothing is refused and nothing is recorded, and
@@ -21,7 +21,7 @@
 
 import type { JsonSchema } from '../tool-registry/index.js';
 import type { ToolContext } from '../tool-helpers/index.js';
-import type { WorkflowHooks } from '../workflow/index.js';
+import type { VersionControlHooks } from '../version-control/index.js';
 
 /**
  * What the `sessionId` input says on its own, before any deployment note. The
@@ -97,11 +97,11 @@ export interface AgentAccessGate {
   /** Lowercased email of the recovery/merge bot, which never reaches the hooks. */
   recoveryBotEmail: string;
   /**
-   * The workflow lifecycle-hook registry holding the BLOCKING `agentRead` and
+   * The version-control lifecycle-hook registry holding the BLOCKING `agentRead` and
    * `preWrite` hooks. Core registers none; a deployment registers against
-   * `workflowService.hooks` — pass that same instance here.
+   * `versionControlService.hooks` — pass that same instance here.
    */
-  hooks: WorkflowHooks;
+  hooks: VersionControlHooks;
   /** The notes a deployment adds to what agents read about these tools. */
   notes: ToolDescriptionNotes;
 }

package/src/modules/workspace/git-internals.middleware.ts

@@ -12,7 +12,7 @@ const GIT_GUARDED_QUERY_KEYS = ['path', 'toDir'] as const;
 const GIT_GUARDED_BODY_KEYS = ['path', 'oldPath', 'newPath', 'destination', 'paths', 'ancestor'] as const;
 /**
  * `from` names a PATH on the prospective-access route (`?from=<file>&toDir=…`)
- * and a BRANCH on the workflow comparison (`?from=<branch>`), so it is judged
+ * and a BRANCH on the version-control comparison (`?from=<branch>`), so it is judged
  * only where it is a path — a branch called after the git folder is refused
  * by the branch-name rule, not by this one.
  */
@@ -49,7 +49,7 @@ export function gitGuardedInputs(req: express.Request): string[] {
  * request must not make the server do.
  *
  * Mounted at the app, ahead of every router under that prefix — the file
- * routes, the review routes, the workflow and access ones, and whatever an
+ * routes, the review routes, the version-control and access ones, and whatever an
  * extension mounts — so a router added later is covered by the fact of its
  * prefix rather than by remembering this. The services underneath refuse
  * again on their own; this is what keeps the refusal ahead of the gates.

package/src/modules/workspace/kb-repository.ts

@@ -76,7 +76,7 @@ const READY_MARKER = 'hexis-repository-ready';
 /** Where a converted clone's stash and other local refs are kept, per workspace (see `importLocalRefs`). */
 export const CONVERTED_REFS = 'refs/kb-converted';
 
-/** Fallback committer identity; every workflow commit overrides it with `--author`. */
+/** Fallback committer identity; every version-control commit overrides it with `--author`. */
 const BOT_NAME = 'Bevel Workflow';
 const BOT_EMAIL = 'bevel-workflow@bevel.software';
 

package/src/modules/workspace/startup/__tests__/kb-startup-runner.degraded.test.ts

@@ -5,7 +5,7 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { KbRemoteUnreachableError } from '../kb-startup-runner.js';
-import { NodeGitRunner } from '../../../workflow/git/node-git-runner.js';
+import { NodeGitRunner } from '../../../version-control/git/node-git-runner.js';
 import { GitRunError, NO_GIT_CREDENTIALS, type IGitRunner } from '../../../../shared/git.contract.js';
 import type { OnServerStart, ServerStartContext, StepResult } from '../on-server-start.js';
 import { newKbStartupRunner } from '../../../../__tests__/workspace-service.js';

package/src/modules/workspace/startup/__tests__/kb-startup-runner.test.ts

@@ -6,7 +6,7 @@ import { promisify } from 'node:util';
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { NodeGitRunner } from '../../../workflow/git/node-git-runner.js';
+import { NodeGitRunner } from '../../../version-control/git/node-git-runner.js';
 import { ClassifiedFailure, classifyGitFailure, failureOf } from '../../../../shared/git-failure.js';
 import { GitRunError, gitCredentials } from '../../../../shared/git.contract.js';
 import type { OnServerStart, ServerStartContext, StepResult } from '../on-server-start.js';

package/src/modules/workspace/startup/__tests__/kb-startup-runner.worktrees.test.ts

@@ -5,7 +5,7 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { workingCopyShape } from '../../kb-repository.js';
-import { NodeGitRunner } from '../../../workflow/git/node-git-runner.js';
+import { NodeGitRunner } from '../../../version-control/git/node-git-runner.js';
 import { gitCredentials, type IGitRunner } from '../../../../shared/git.contract.js';
 import type { OnServerStart, ServerStartContext, StepResult } from '../on-server-start.js';
 import { newKbStartupRunner } from '../../../../__tests__/workspace-service.js';

package/src/modules/workspace/startup/kb-git.ts

@@ -14,7 +14,7 @@ import { redactSecret, urlQuerySecrets } from '../../../shared/redact-secret.js'
  * runs through (`shared/git.contract.ts`).
  */
 
-/** Fallback committer identity; workflow commits override with `--author`. */
+/** Fallback committer identity; version-control commits override with `--author`. */
 export const BOT_NAME = 'Bevel Workflow';
 export const BOT_EMAIL = 'bevel-workflow@bevel.software';