@bevel-software/platform-core-backend 0.35.0 → 0.37.0

package/src/core/create-core-services.ts

@@ -125,29 +125,31 @@ import {
 import {
   DbSecretsVaultService,
   McpOAuthDiscoveryService,
+  managedSignInErasure,
   registerBevelSecretsVariableLoader,
+  type ManagedSignInPort,
 } from '../modules/secrets-vault/index.js';
 import { ConnectionProbeService } from '../modules/connection-probe/index.js';
-import { GitService } from '../modules/workflow/git/git.service.js';
-import { NodeGitRunner } from '../modules/workflow/git/node-git-runner.js';
-import { PullRequestService } from '../modules/workflow/git/pull-request.service.js';
+import { GitService } from '../modules/version-control/git/git.service.js';
+import { NodeGitRunner } from '../modules/version-control/git/node-git-runner.js';
+import { PullRequestService } from '../modules/version-control/git/pull-request.service.js';
 import { WorkspaceIdMutex, WorkspaceMutex } from '../modules/kb-fs/mutex.js';
-import { assertGitVersion } from '../modules/workflow/git/git-version.js';
+import { assertGitVersion } from '../modules/version-control/git/git-version.js';
 import { DiffService } from '../modules/diff/diff.service.js';
-import { ReviewWorkflowService } from '../modules/workflow/review-workflow/review-workflow.service.js';
-import { FileLockService } from '../modules/workflow/file-lock.service.js';
-import { WorkflowEventBus } from '../modules/workflow/index.js';
+import { ChangeRequestReviewService } from '../modules/version-control/change-request-review/change-request-review.service.js';
+import { FileLockService } from '../modules/version-control/file-lock.service.js';
+import { VersionControlEventBus } from '../modules/version-control/index.js';
 import { FileChangeNotifier } from '../modules/kb-fs/file-change-notifier.js';
 import { StarterPackService } from '../modules/onboarding/starter-pack.service.js';
-import { WorkflowService } from '../modules/workflow/workflow.service.js';
-import { WorkflowHooks } from '../modules/workflow/workflow-hooks.js';
-import { ChangeRequestHooks, type IChangeRequestHooks } from '../modules/workflow/change-request-hooks.js';
-import { PendingCommitsService } from '../modules/workflow/pending-commits.service.js';
+import { VersionControlService } from '../modules/version-control/version-control.service.js';
+import { VersionControlHooks } from '../modules/version-control/version-control-hooks.js';
+import { ChangeRequestHooks, type IChangeRequestHooks } from '../modules/version-control/change-request-hooks.js';
+import { PendingCommitsService } from '../modules/version-control/pending-commits.service.js';
 import {
   PendingCommitsWorker,
   consoleSystemNoticeSink,
-} from '../modules/workflow/pending-commits.worker.js';
-import { ensureRecoveryBotUser } from '../modules/workflow/recovery-bot.js';
+} from '../modules/version-control/pending-commits.worker.js';
+import { ensureRecoveryBotUser } from '../modules/version-control/recovery-bot.js';
 import { AdminAccessService } from '../modules/admin/admin-access.service.js';
 import {
   SyncedGroupsWriter,
@@ -353,9 +355,9 @@ export interface CoreServices {
   gitService: GitService;
   pullRequestService: PullRequestService;
   diffService: DiffService;
-  reviewWorkflowService: ReviewWorkflowService;
+  changeRequestReviewService: ChangeRequestReviewService;
   fileLockService: FileLockService;
-  workflowService: WorkflowService;
+  versionControlService: VersionControlService;
   /**
    * The seam for "a change request was opened": a deployment registers here
    * how the reviewers are told (the cloud's mail, say), and the open's answer
@@ -364,7 +366,7 @@ export interface CoreServices {
   changeRequestHooks: IChangeRequestHooks;
   /** Remote sync (`POST /api/sync`): a git host or pipeline makes the clones catch up. */
   kbSyncService: KbSyncService;
-  eventBus: WorkflowEventBus;
+  eventBus: VersionControlEventBus;
   fileChangeNotifier: FileChangeNotifier;
   pendingCommitsService: PendingCommitsService;
   pendingCommitsWorker: PendingCommitsWorker;
@@ -440,6 +442,12 @@ export interface CoreServices {
   // ── Server-time seams (enterprise overwrites after construction) ────────
   /** `start_session` backing — core default {@link UuidSessionSink}. */
   sessionSink: ISessionSink;
+  /**
+   * The managed sign-in port (see `CorePorts.managedSignIns`), or null when
+   * the distribution registers none. Mutable for the same reason the session
+   * sink is: the overlay builds it after core, from services core returned.
+   */
+  managedSignIns: ManagedSignInPort | null;
   /** Connection-key LLM metering view — core default unmetered. */
   usageMeter: ILlmUsageMeter;
   /** SSO plugins the auth router mounts — same array instance as the port. */
@@ -922,16 +930,16 @@ export async function createCoreServices(
   // registers its listener here, after this returns (see `AccountHooks`).
   const accountHooks = new AccountHooks();
 
-  // Workflow lifecycle hooks — the ONE registry this composition shares
+  // Version-control lifecycle hooks — the ONE registry this composition shares
   // between GitService (advisory commit validation), the agent-access gate
   // (the blocking agentRead / preWrite hooks), and the composition root,
-  // which registers module-owned handlers on `workflowService.hooks` right
+  // which registers module-owned handlers on `versionControlService.hooks` right
   // after this function returns. Core registers none: no commit-time
   // validation (advisory anyway) and nothing that refuses an agent call.
-  const workflowHooks = new WorkflowHooks();
+  const versionControlHooks = new VersionControlHooks();
   const gitService = new GitService(
     workspaceService,
-    workflowHooks,
+    versionControlHooks,
     kb,
     workspaceMutex,
     accessControl,
@@ -968,7 +976,7 @@ export async function createCoreServices(
   // the post-switch backup reseed — but switchBranch is gone with the
   // per-branch workspace model, so the injection no longer applies.)
   workspaceService.setDiffService(diffService);
-  const reviewWorkflowService = new ReviewWorkflowService(
+  const changeRequestReviewService = new ChangeRequestReviewService(
     db,
     accessControl,
     workspaceService,
@@ -976,14 +984,14 @@ export async function createCoreServices(
   );
   // Late-bind the comment enricher so PullRequestService.getPrDetail includes
   // our DB-backed comments without forcing a circular constructor dependency.
-  pullRequestService.setDetailEnricher(reviewWorkflowService);
+  pullRequestService.setDetailEnricher(changeRequestReviewService);
 
-  // Workflow facade — the abstraction every app consumer should reach for
-  // instead of the individual git / PR / review-workflow services. See
+  // Version-control facade — the abstraction every app consumer should reach for
+  // instead of the individual git / PR / change-request-review services. See
   // PLAN.md for the migration story. Today it delegates straight through;
-  // implementations migrate into the workflow module over later steps.
+  // implementations migrate into the version-control module over later steps.
   const fileLockService = new FileLockService(db);
-  // Background commit queue. The `WorkflowService.releaseLock` path
+  // Background commit queue. The `VersionControlService.releaseLock` path
   // enqueues a row here instead of running commitFile + push inline; the
   // worker drains the queue out of band so a git hiccup can't block the
   // user-visible save path. See `lock-decoupling-plan.md`.
@@ -998,11 +1006,11 @@ export async function createCoreServices(
     (await pendingCommitsService.hasAnyForWorkspace(workspaceId)) ||
     (await fileLockService.hasAnyActive(workspaceId)),
   );
-  // In-process event bus: every WorkflowService mutation method that
+  // In-process event bus: every VersionControlService mutation method that
   // succeeds emits a typed event; the SSE route fans it to connected
   // browser sessions. Single instance per Node process — survives across
   // requests, doesn't survive restarts (clients reconnect + resync).
-  const eventBus = new WorkflowEventBus();
+  const eventBus = new VersionControlEventBus();
   // Office-document/PDF/email text extraction for `read_file`/`grep`, cached
   // by content hash beside the workspaces root (see `DocExtractionCache`),
   // failures included. A fresh failure is told to the people looking at the
@@ -1016,15 +1024,19 @@ export async function createCoreServices(
   // id-repair keeps the id namespace collision-free. Subscribers are registered
   // below, once the reacting services exist.
   const fileChangeNotifier = new FileChangeNotifier();
+  // Every commit the git service lands — a save, an autosave checkpoint, a
+  // batch, a merge, a `commit_change` — reaches the notifier through this one
+  // registration, and nothing else emits on it (a test pins both).
+  versionControlHooks.onCommitLanded((change) => fileChangeNotifier.emit(change));
   // Who tells the reviewers of an opened change request: the composition root
   // of a distribution registers its listener here, after this returns (see
   // `ChangeRequestHooks`).
   const changeRequestHooks = new ChangeRequestHooks();
-  const workflowService = new WorkflowService(
+  const versionControlService = new VersionControlService(
     db,
     gitService,
     pullRequestService,
-    reviewWorkflowService,
+    changeRequestReviewService,
     workspaceService,
     accessControl,
     fileLockService,
@@ -1032,11 +1044,10 @@ export async function createCoreServices(
     kb,
     changeGate,
     eventBus,
-    fileChangeNotifier,
-    // Exposed as `workflowService.hooks` — the SAME instance GitService and
+    // Exposed as `versionControlService.hooks` — the SAME instance GitService and
     // the agent-access gate consult, so a deployment's registrations against
     // it reach every hook point.
-    workflowHooks,
+    versionControlHooks,
     // Exposed as `changeRequestHooks`, the same instance, for the same reason.
     changeRequestHooks,
     // The opened event names the approvers as accounts; auth answers which
@@ -1045,7 +1056,7 @@ export async function createCoreServices(
   );
   // The leftover-branch cleanup asks the Deployment page at every round, so
   // switching it off there applies without a restart.
-  workflowService.leftoverCleanupEnabled = () => retireMergedBranchesOn(settings.resolve('retireMergedBranches'));
+  versionControlService.leftoverCleanupEnabled = () => retireMergedBranchesOn(settings.resolve('retireMergedBranches'));
 
   // Join requests: derived entirely from two copies of a plugin's `access.md`
   // (the request's branch vs the default branch), so it holds no state — it
@@ -1053,7 +1064,7 @@ export async function createCoreServices(
   // have all landed.
   const joinRequestsService = new JoinRequestsService(
     workspaceService,
-    workflowService,
+    versionControlService,
     kb,
     // Read-only: the one question a request asks of the resolver is whether
     // the person it names already holds what it proposes.
@@ -1065,7 +1076,7 @@ export async function createCoreServices(
   // answered in a database round-trip instead of a clone, and what survives a
   // restart with the request still owed.
   const pluginJoinRequestJobs = new PluginJoinRequestJobs(new DbJoinRequestStore(db), {
-    workflow: workflowService,
+    versionControl: versionControlService,
     workspaceService,
     kb,
     // A record keys on the plugin's primary FOLDER below the root, which the
@@ -1095,7 +1106,7 @@ export async function createCoreServices(
   // index counts, so a link drops that cache too.
   const pluginLinksService = new PluginLinksService(
     workspaceService,
-    workflowService,
+    versionControlService,
     accessControl,
     new AccessMutationService(workspaceService, accessControl, kb.kbDirName),
     skillService,
@@ -1108,7 +1119,7 @@ export async function createCoreServices(
   // then drops every cache that keyed on the old identity.
   const pluginRenameService = new PluginRenameService(
     workspaceService,
-    workflowService,
+    versionControlService,
     accessControl,
     pluginSource,
     disk,
@@ -1149,16 +1160,16 @@ export async function createCoreServices(
     gitRunner,
   );
 
-  // Remote sync. Drives the workflow module's per-branch pull-and-announce
+  // Remote sync. Drives the version-control module's per-branch pull-and-announce
   // over every clone the workspace service knows about; owns no git of its own.
-  const kbSyncService = new KbSyncService(workflowService, workspaceService);
+  const kbSyncService = new KbSyncService(versionControlService, workspaceService);
   // Server-scoped MCP editing — the tool page's edit form. One server's truth
   // spans a plugin's mcp.json AND plugin.json extensions block, and this is
   // the ONE writer that rewrites both entries and commits them together (see
   // McpServerEditService).
   const mcpServerEditService = new McpServerEditService(
     workspaceService,
-    workflowService,
+    versionControlService,
     accessControl,
     toolManualService,
     kb,
@@ -1171,7 +1182,7 @@ export async function createCoreServices(
   // folder's rules are at HEAD before the endpoint answers.
   const pluginProvisionService = new PluginProvisionService(
     workspaceService,
-    workflowService,
+    versionControlService,
     accessControl,
     kb,
     eventBus,
@@ -1181,26 +1192,26 @@ export async function createCoreServices(
 
   // Pending skills: the other half of the catalog — skills that exist only on
   // an open change request's branch. Built here rather than beside
-  // `skillService` because it needs the workflow service, which does not exist
+  // `skillService` because it needs the version-control service, which does not exist
   // that early; it holds no state of its own, so where it is constructed is the
   // only thing the ordering decides.
   const pendingSkillsService = new PendingSkillsService(
     workspaceService,
     accessControl,
     skillService,
-    workflowService,
+    versionControlService,
     kb,
   );
 
   // The same missing half, for tools: a `.tool` manual or an `mcp.json` server
   // an agent proposes is nowhere in the product until its change request
-  // merges. Built here for the same reason — it needs the workflow service —
+  // merges. Built here for the same reason — it needs the version-control service —
   // and stateless for the same reason.
   const pendingToolsService = new PendingToolsService(
     workspaceService,
     accessControl,
     toolManualService,
-    workflowService,
+    versionControlService,
     kb,
   );
 
@@ -1238,7 +1249,7 @@ export async function createCoreServices(
     packsDir: config.starterPacksDir,
     kb,
     workspaceService,
-    workflow: workflowService,
+    versionControl: versionControlService,
     adminAccess,
     settings,
     accessControl,
@@ -1246,7 +1257,6 @@ export async function createCoreServices(
     pluginSource,
     pluginLocks: pluginProvisionService,
     events: eventBus,
-    fileChanges: fileChangeNotifier,
     // Its own lock: one starter-pack choice at a time, a concern no other
     // service's mutex serialises.
     choosing: new WorkspaceMutex(),
@@ -1288,7 +1298,7 @@ export async function createCoreServices(
   // can only exist once the vault does.
   const toolDeleteService = new ToolDeleteService(
     workspaceService,
-    workflowService,
+    versionControlService,
     accessControl,
     toolManualService,
     skillService,
@@ -1335,12 +1345,16 @@ export async function createCoreServices(
   });
 
   // GDPR erasure path: admin-driven user deletion. The core service erases the
-  // rows it owns; each module contributes its slice as a participant.
-  const accountErasureService = new AccountErasureService(
-    db,
-    reviewWorkflowService,
-    ports.erasureParticipants ?? [],
-  );
+  // rows it owns; each module contributes its slice as a participant. The
+  // vault's runs first: a managed sign-in's tokens are revoked with their
+  // provider before the user row goes and the vault rows cascade with it.
+  // The port's array is held, never copied (see `CorePorts.erasureParticipants`:
+  // the enterprise root fills it AFTER construction) and never written to
+  // (a root that rebuilds a graph over the same array would otherwise keep
+  // every past graph's vault slice): core's own slices travel beside it.
+  const accountErasureService = new AccountErasureService(db, changeRequestReviewService, ports.erasureParticipants ?? [], [
+    managedSignInErasure(secretsVaultService),
+  ]);
 
   // MCP (remote agent access). ExternalApiKeyService handles connection-key
   // lifecycle. McpService is a GENERIC, STATELESS proxy: per request it
@@ -1411,7 +1425,7 @@ export async function createCoreServices(
       workspaceService,
       accessControl,
       authService,
-      workflowService,
+      versionControlService,
       gitService,
       accountLinks: new AccountLinkService(db),
       // The SAME extension-to-reader registry `read_file` dispatches on, so the
@@ -1444,9 +1458,12 @@ export async function createCoreServices(
       // For the needs-authorization setup link surfaced to external agents.
       publicFrontendUrl: config.publicFrontendUrl,
       readAgentPreamble: readPreamble,
-      // The guide's name the shared file rules spell, read per request so a name
-      // the setup save applies lands without a restart.
+      // The root-folder and platform-file names the shared file rules spell,
+      // read per request so a layout the setup save applies lands without a restart.
       kbLayout: () => kb.layout,
+      // The branch the shared rules name as the one people read — a getter
+      // too, so the name in effect is the one an agent is told.
+      defaultBranch: () => kb.defaultBranch,
       secretsScope,
       // Read at listing time, by when the hints below exist.
       readOnlyOverrides: () => readOnlyHints.overrides(),
@@ -1524,7 +1541,7 @@ export async function createCoreServices(
   const resolveToolContext = createToolContextResolver({
     authService,
     workspaceService,
-    workflowService,
+    versionControlService,
     events: eventBus,
     kbDirName: kbDirName,
     creatorAccess,
@@ -1584,7 +1601,7 @@ export async function createCoreServices(
     // swallowed the `opts` carrying `skipValidation`, so the burst-validation
     // skip was a no-op in production while every unit test — which stubs this
     // port — passed. No wrapper, no gap to fall through.
-    workflow: workflowService,
+    versionControl: versionControlService,
     // Both escalation sinks come through CorePorts: the recovery agent and the
     // notice sink are enterprise-owned (background-agent factory / feedback
     // dashboard); core defaults skip recovery and log to stderr.
@@ -1644,7 +1661,7 @@ export async function createCoreServices(
       source,
       ...createSyncedGroupsCommitter({
         workspaceService,
-        workflowService,
+        versionControlService,
         accessControl,
         eventBus,
         kbDirName,
@@ -1660,7 +1677,7 @@ export async function createCoreServices(
   // directory token route drives.
   const groupsAdminService = new GroupsAdminService(
     workspaceService,
-    workflowService,
+    versionControlService,
     accessControl,
     disk,
     kbDirName,
@@ -1672,7 +1689,7 @@ export async function createCoreServices(
   // The deployment owner is never removed this way.
   const userAccessRemovalService = new UserAccessRemovalService(
     workspaceService,
-    workflowService,
+    versionControlService,
     accessControl,
     disk,
     kbDirName,
@@ -1754,9 +1771,9 @@ export async function createCoreServices(
     gitService,
     pullRequestService,
     diffService,
-    reviewWorkflowService,
+    changeRequestReviewService,
     fileLockService,
-    workflowService,
+    versionControlService,
     changeRequestHooks,
     kbSyncService,
     eventBus,
@@ -1789,6 +1806,7 @@ export async function createCoreServices(
     // Server-time seams — defaults here; the enterprise overlay overwrites
     // (or, for the array, pushes into) these after construction.
     sessionSink: ports.sessionSink ?? new UuidSessionSink(),
+    managedSignIns: ports.managedSignIns ?? null,
     usageMeter: ports.usageMeter ?? unmeteredLlmUsage,
     authProviders,
   };

package/src/core/lifecycle.ts

@@ -4,7 +4,7 @@ import type { AdvisoryLease } from '../modules/database/advisory-lock.js';
 import { bootMaySurvive, type KbStartupRunner } from '../modules/workspace/startup/kb-startup-runner.js';
 import { noteBesideCheckout } from '../modules/workspace/startup/beside-checkout.js';
 import { unregisterBevelSecretsVariableLoader } from '../modules/secrets-vault/secrets-variable-loader.js';
-import type { WorkflowService } from '../modules/workflow/workflow.service.js';
+import type { VersionControlService } from '../modules/version-control/version-control.service.js';
 import type { PluginJoinRequestJobs } from '../modules/plugins/join-request-jobs.service.js';
 import type { TmpSweeper } from '../modules/workspace/workspace-tmp.js';
 import { printable } from '../shared/printable.js';
@@ -292,7 +292,7 @@ export interface BootableCore {
   config: { workspacesRoot: string };
   kbDirName: string;
   kbStartupRunner: Pick<KbStartupRunner, 'runAll' | 'retryUntilMaintained'>;
-  workflowService: Pick<WorkflowService, 'closeChangeRequestsWithDeletedBranches' | 'tidyAfterSweep'>;
+  versionControlService: Pick<VersionControlService, 'closeChangeRequestsWithDeletedBranches' | 'tidyAfterSweep'>;
   pluginJoinRequestJobs: Pick<PluginJoinRequestJobs, 'startSweeping'>;
   /** The periodic sweep of every workspace's `tmp/` folder, started here and stopped by {@link stopCore}. */
   tmpSweeper: Pick<TmpSweeper, 'startSweeping'>;
@@ -393,7 +393,7 @@ export async function startCore<C extends BootableCore>(
   // have been unusable since the branch went away, so landing a few seconds
   // into uptime is soon enough. Errors are swallowed inside the sweep, which
   // fails safe by closing nothing.
-  void core.workflowService
+  void core.versionControlService
     .closeChangeRequestsWithDeletedBranches()
     .then((n) => {
       if (n > 0) {
@@ -404,7 +404,7 @@ export async function startCore<C extends BootableCore>(
     // Then the tidy-up: open requests that propose nothing are closed, and the
     // branches merged requests left behind removed (behind its own setting).
     // Fails safe on a failed fetch, and never throws.
-    .then(() => core.workflowService.tidyAfterSweep());
+    .then(() => core.versionControlService.tidyAfterSweep());
 
   // Recorded join requests that are still owed, resumed — now, and then on a
   // timer. SEQUENCED AFTER the startup phase for the same reason as the sweep
@@ -481,12 +481,12 @@ export interface CoreStopDeps {
    */
   documentExtractor?: { close(): Promise<void> };
   /**
-   * The workflow service, for the tidy-up it runs after each sweep (closing
+   * The version-control service, for the tidy-up it runs after each sweep (closing
    * empty requests, removing leftover branches): detached from whatever
    * started it, so stopped and awaited here before the pool goes. Optional:
    * a caller that has not built one passes nothing.
    */
-  workflowService?: { stopTidying(): void; drainTidy(): Promise<void> };
+  versionControlService?: { stopTidying(): void; drainTidy(): Promise<void> };
   /** The startup phase's retry, if the boot left one asking — see {@link BootableCore.startupRetry}. */
   startupRetry?: { stop(): void } | null;
   /** The database — its pool is ended last, once nothing above can still need it. */
@@ -582,7 +582,7 @@ async function releaseCore(deps: CoreStopDeps, remaining: () => number, log: (m:
   deps.startupRetry?.stop();
   // The post-sweep tidy-up: no new round, and the one under way stops at its
   // next request or branch. Synchronous.
-  deps.workflowService?.stopTidying();
+  deps.versionControlService?.stopTidying();
   // Clearing the interval stops future ticks; it does nothing to a job a
   // tick already started, which holds a claim it heartbeats through the
   // pool and is mid-clone or mid-push. Awaited here, in the budget: a job
@@ -614,8 +614,8 @@ async function releaseCore(deps: CoreStopDeps, remaining: () => number, log: (m:
   // The tidy-up in flight fetches and deletes branches through the pool and
   // the default branch's checkout: awaited, so the next graph for this
   // tenant cannot find a branch deletion still running under it.
-  if (deps.workflowService) {
-    await bounded(deps.workflowService.drainTidy(), remaining(), 'finishing the branch tidy-up', log);
+  if (deps.versionControlService) {
+    await bounded(deps.versionControlService.drainTidy(), remaining(), 'finishing the branch tidy-up', log);
   }
   // Its ripgrep runs end with the graph; a search still running is answered busy or stopped.
   if (deps.patternMatcher) {

package/src/core-config.ts

@@ -3,7 +3,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { defaultKbTemplateDir, defaultStarterPacksDir } from './assets.js';
 import { assertKeyDecodesTo32Bytes } from './shared/token-crypto.js';
-import { DEFAULT_GIT_TIMEOUT_MS } from './modules/workflow/git/node-git-runner.js';
+import { DEFAULT_GIT_TIMEOUT_MS } from './modules/version-control/git/node-git-runner.js';
 import { DEFAULT_DB_SCHEMA, assertSchemaName } from './modules/database/connection.js';
 import { logger } from './shared/logging.js';
 import { hasControlCharacter } from './modules/kb-fs/repo-path.js';
@@ -145,7 +145,7 @@ export interface ProcessConfig {
 }
 
 /**
- * Configuration for the CORE platform: the git-backed workspace/workflow,
+ * Configuration for the CORE platform: the git-backed workspace and version control,
  * skills, tools, secrets vault, access control, and the MCP surface. Contains
  * NO LLM, connector, or SSO-provider settings — those live on the enterprise
  * `AppConfig` (config.ts), which extends this class. A core-only deployment
@@ -372,7 +372,7 @@ export class CoreConfig implements TenantConfig, ProcessConfig {
   readonly trustProxy: string;
   /**
    * Deadline in milliseconds on every git command, after which the child is
-   * killed and the call fails (see `modules/workflow/git/node-git-runner.ts`).
+   * killed and the call fails (see `modules/version-control/git/node-git-runner.ts`).
    *
    * Configurable because the right ceiling depends on the deployment's own git
    * host and the size of its knowledge base: a first clone over a slow link can

package/src/index.ts

@@ -1,6 +1,6 @@
 /**
  * @bevel-software/platform-core-backend — the open-source core of the Bevel platform:
- * git-backed knowledge workspace, workflow (branches / change requests /
+ * git-backed knowledge workspace, version control (branches / change requests /
  * locks / SSE), skills, tool manuals + registry + auth, secrets vault, access
  * control, diff/backup ledger, code-mode and the remote MCP surface.
  *
@@ -122,7 +122,7 @@ export type { ISessionSink } from './modules/workspace/session-sink.js';
 export type {
   ISystemNoticeSink,
   RecoveryAgentRunner,
-} from './modules/workflow/pending-commits.worker.js';
+} from './modules/version-control/pending-commits.worker.js';
 export type { ILlmUsageMeter } from './modules/tool-auth/llm-usage-meter.js';
 export type { AuthProviderPlugin } from './modules/auth/auth.routes.js';
 export type { IErasureParticipant } from './modules/auth/account-erasure.service.js';
@@ -144,17 +144,17 @@ export {
   type IAccountAdmission,
 } from './modules/auth/account-admission.js';
 export {
-  WorkflowHooks,
+  VersionControlHooks,
   type CommitValidationHook,
   type CommitValidationContext,
   type AgentOperationContext,
   type AgentReadHook,
   type PreWriteHook,
-} from './modules/workflow/workflow-hooks.js';
+} from './modules/version-control/version-control-hooks.js';
 export {
   ChangeRequestHooks,
   type ChangeRequestOpenedEvent,
   type ChangeRequestOpenedHook,
   type ChangeRequestPerson,
   type IChangeRequestHooks,
-} from './modules/workflow/change-request-hooks.js';
+} from './modules/version-control/change-request-hooks.js';

package/src/modules/access/__tests__/access-control.admin-root-floor.test.ts

@@ -9,8 +9,8 @@ import { NodeFs } from '../../kb-fs/node-fs.js';
 
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
 import type { AuthService } from '../../auth/auth.service.js';
-import type { WorkflowService } from '../../workflow/workflow.service.js';
-import type { WorkflowEventBus } from '../../workflow/event-bus.js';
+import type { VersionControlService } from '../../version-control/version-control.service.js';
+import type { VersionControlEventBus } from '../../version-control/event-bus.js';
 import { usersDbDouble } from './users-db-double.js';
 import { AccessControlService } from '../access-control.service.js';
 import {
@@ -317,8 +317,8 @@ describe('Admin write floor at the repository root', () => {
             acquireLock: async () => ({ acquired: true, lock: {} }),
             releaseLock: async () => undefined,
             releaseLockNoCommit: async () => undefined,
-          } as unknown as WorkflowService,
-          { emit: () => {} } as unknown as WorkflowEventBus,
+          } as unknown as VersionControlService,
+          { emit: () => {} } as unknown as VersionControlEventBus,
           usersDbDouble(),
           testKbContext({ kbDirName: KB }),
           new NodeFs(),

package/src/modules/access/__tests__/access-own-read-grant.test.ts

@@ -4,9 +4,9 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
 
-import type { WorkspaceService } from '../../workspace/workspace.service.js';
+import type { WorkspaceService } from '../../workspace/index.js';
 import { AccessControlService } from '../access-control.service.js';
-import { registerAccessFrontmatterExtensions } from '../../access-model/access-grammar.js';
+import { registerAccessFrontmatterExtensions } from '../../access-model/index.js';
 
 const KB = 'knowledge-base';
 
@@ -74,12 +74,12 @@ describe('a file-own read grant on a whole-document configuration file', () => {
   beforeEach(async () => {
     root = await fs.mkdtemp(path.join(os.tmpdir(), 'own-read-'));
     repo = path.join(root, ws, KB);
-    await fs.mkdir(path.join(repo, 'Pipelines'), { recursive: true });
+    await fs.mkdir(path.join(repo, 'Workflows'), { recursive: true });
     await fs.mkdir(path.join(repo, 'Agents'), { recursive: true });
     await fs.writeFile(path.join(repo, 'roles.yaml'), ROLES_YAML);
     await fs.writeFile(path.join(repo, 'access.md'), '---\nwrite:\n  - Admin\ndownload:\n  - Admin\nowner: []\n---\n');
-    await fs.writeFile(path.join(repo, 'Pipelines', 'access.md'), '---\nwrite: []\n---\n');
-    await fs.writeFile(path.join(repo, 'Pipelines', 'Coding-Delivery.pipeline'), PIPELINE);
+    await fs.writeFile(path.join(repo, 'Workflows', 'access.md'), '---\nwrite: []\n---\n');
+    await fs.writeFile(path.join(repo, 'Workflows', 'Coding-Delivery.workflow'), PIPELINE);
     await fs.writeFile(path.join(repo, 'Agents', 'access.md'), '---\nwrite: []\n---\n');
     await fs.writeFile(path.join(repo, 'Agents', 'delivery-coder.agent'), AGENT);
   });
@@ -93,26 +93,26 @@ describe('a file-own read grant on a whole-document configuration file', () => {
     );
 
   it('the grantee reads the file (registered kinds)', async () => {
-    registerAccessFrontmatterExtensions(['.pipeline', '.agent']);
+    registerAccessFrontmatterExtensions(['.workflow', '.agent']);
     const s = svc();
-    expect(await s.canRead(ws, 'coding-agent@bevel.software', 'Pipelines/Coding-Delivery.pipeline')).toBe(true);
+    expect(await s.canRead(ws, 'coding-agent@bevel.software', 'Workflows/Coding-Delivery.workflow')).toBe(true);
     expect(await s.canRead(ws, 'coding-agent@bevel.software', 'Agents/delivery-coder.agent')).toBe(true);
-    expect(await s.canWrite(ws, 'coding-agent@bevel.software', 'Pipelines/Coding-Delivery.pipeline')).toBe(true);
+    expect(await s.canWrite(ws, 'coding-agent@bevel.software', 'Workflows/Coding-Delivery.workflow')).toBe(true);
     // Batch path, which the explorer and the tool catalog use.
     const batch = await s.canReadBatch(ws, 'coding-agent@bevel.software', [
-      'Pipelines/Coding-Delivery.pipeline',
+      'Workflows/Coding-Delivery.workflow',
       'Agents/delivery-coder.agent',
-      'Pipelines/README.md',
+      'Workflows/README.md',
     ]);
     expect([...batch.entries()]).toEqual([
-      ['Pipelines/Coding-Delivery.pipeline', true],
+      ['Workflows/Coding-Delivery.workflow', true],
       ['Agents/delivery-coder.agent', true],
-      ['Pipelines/README.md', false],
+      ['Workflows/README.md', false],
     ]);
   });
 
   it('a stranger does not', async () => {
-    registerAccessFrontmatterExtensions(['.pipeline', '.agent']);
-    expect(await svc().canRead(ws, 'someone@else.io', 'Pipelines/Coding-Delivery.pipeline')).toBe(false);
+    registerAccessFrontmatterExtensions(['.workflow', '.agent']);
+    expect(await svc().canRead(ws, 'someone@else.io', 'Workflows/Coding-Delivery.workflow')).toBe(false);
   });
 });