@cassiomc1/forgeloop 1.13.0 → 2.0.0-rc.2

package/src/core/signing/sigstore.js

@@ -1,13 +1,30 @@
+import { needsExistingProjectScope, withExistingProjectScope } from "../../storage/existing-project-scope.js";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 
 import path from "node:path";
 import { ensureWithin, assertSafePath } from "../filesystem.js";
+import { withSigningStatementFile } from "./statement-file.js";
+import { withSigningBundleFile } from "./bundle-file.js";
+import { getOperationalStore } from "../../storage/operational-context.js";
+import { withOperationalAttachmentFile } from "../../storage/operational-attachments.js";
 
 const execFileAsync = promisify(execFile);
 const DEFAULT_TIMEOUT_MS = 30_000;
 const MAX_OUTPUT_BYTES = 8 * 1024 * 1024;
 
+async function withExistingSigningReadScope(target, read) {
+  if (await needsExistingProjectScope(target)) return withExistingProjectScope(target, read, { readOnly: true });
+  return read();
+}
+
+function signingTaskId(target, statementPath) {
+  const store = getOperationalStore(target);
+  const taskKey = /^\.forgeloop\/task-state\/([a-f0-9]{64})\/attestations\/statement\.json$/u.exec(statementPath)?.[1];
+  const taskId = store && taskKey ? store.taskRow(taskKey)?.task_id : null;
+  return taskId;
+}
+
 export function createSigstoreSigningProvider({
   command = "cosign",
   execFileImpl = execFileAsync,
@@ -21,7 +38,7 @@ export function createSigstoreSigningProvider({
     killSignal: "SIGTERM",
     maxBuffer: MAX_OUTPUT_BYTES,
   });
-  return {
+  const provider = {
     name: "sigstore",
     async detect() {
       try {
@@ -43,13 +60,13 @@ export function createSigstoreSigningProvider({
       try {
         await assertSafePath(target, statementPath);
         await assertSafePath(target, destinationPath);
-        await run([
+        const signed = await withSigningBundleFile(target, destinationPath, statementPath, bundleAbsolute => withSigningStatementFile(target, statementPath, statementAbsolute => run([
           "attest-blob",
-          "--statement", ensureWithin(target, statementPath),
-          "--bundle", ensureWithin(target, destinationPath),
+          "--statement", statementAbsolute,
+          "--bundle", bundleAbsolute,
           "--yes",
-        ], { cwd: path.resolve(target) });
-        return { status: "VALID", path: destinationPath };
+        ], { cwd: path.resolve(target) })));
+        return { status: "VALID", ...signed };
       } catch (error) {
         const unavailable = error.code === "ENOENT" || error.cause?.code === "ENOENT";
         const timedOut = error.code === "ETIMEDOUT" || error.killed === true || error.signal === "SIGTERM";
@@ -67,33 +84,42 @@ export function createSigstoreSigningProvider({
     async verify({ target, statementPath, bundlePath, policy = {} } = {}) {
       if (!bundlePath) return { status: "UNSIGNED", signer: null };
       try {
-        await assertSafePath(target, statementPath);
-        await assertSafePath(target, bundlePath);
-        const statementAbsolute = ensureWithin(target, statementPath);
-        const bundleAbsolute = ensureWithin(target, bundlePath);
-        const args = [
-          "verify-blob-attestation",
-          "--statement", statementAbsolute,
-          "--bundle", bundleAbsolute,
-        ];
-        const identities = Array.isArray(policy.identities)
-          ? [...new Set(policy.identities.filter((value) => typeof value === "string" && value.length > 0))]
-          : [];
-        if (policy.identity) args.push("--certificate-identity", policy.identity);
-        else if (identities.length === 1) args.push("--certificate-identity", identities[0]);
-        else if (identities.length > 1) {
-          const exactAlternatives = identities
-            .map((value) => value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&"))
-            .join("|");
-          args.push("--certificate-identity-regexp", `^(?:${exactAlternatives})$`);
-        }
-        if (policy.issuer) args.push("--certificate-oidc-issuer", policy.issuer);
-        if (policy.trustedRoot) {
-          await assertSafePath(target, policy.trustedRoot);
-          args.push("--trusted-root", ensureWithin(target, policy.trustedRoot));
-        }
-        await run(args, { cwd: path.resolve(target) });
-        return { status: "VALID", signer: policy.identity ?? (identities.length === 1 ? identities[0] : null) };
+        return await withExistingSigningReadScope(target, async () => {
+          await assertSafePath(target, statementPath);
+          await assertSafePath(target, bundlePath);
+          const taskId = signingTaskId(target, statementPath);
+          const statementAbsolute = ensureWithin(target, statementPath);
+          const bundleAbsolute = ensureWithin(target, bundlePath);
+          const args = [
+            "verify-blob-attestation",
+            "--statement", statementAbsolute,
+            "--bundle", bundleAbsolute,
+          ];
+          const identities = Array.isArray(policy.identities)
+            ? [...new Set(policy.identities.filter((value) => typeof value === "string" && value.length > 0))]
+            : [];
+          if (policy.identity) args.push("--certificate-identity", policy.identity);
+          else if (identities.length === 1) args.push("--certificate-identity", identities[0]);
+          else if (identities.length > 1) {
+            const exactAlternatives = identities
+              .map((value) => value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&"))
+              .join("|");
+            args.push("--certificate-identity-regexp", `^(?:${exactAlternatives})$`);
+          }
+          if (policy.issuer) args.push("--certificate-oidc-issuer", policy.issuer);
+          if (policy.trustedRoot) {
+            await assertSafePath(target, policy.trustedRoot);
+            args.push("--trusted-root", ensureWithin(target, policy.trustedRoot));
+          }
+          await withSigningStatementFile(target, statementPath, statementFilename => {
+            args[args.indexOf("--statement") + 1] = statementFilename;
+            return withOperationalAttachmentFile(target, bundlePath, taskId, bundleFilename => {
+              args[args.indexOf("--bundle") + 1] = bundleFilename;
+              return run(args, { cwd: path.resolve(target) });
+            });
+          });
+          return { status: "VALID", signer: policy.identity ?? (identities.length === 1 ? identities[0] : null) };
+        });
       } catch (error) {
         if (error.code === "E_ATTESTATION_SIGNER_UNAVAILABLE") throw error;
         const unavailable = error.code === "ENOENT" || error.cause?.code === "ENOENT";
@@ -126,6 +152,7 @@ export function createSigstoreSigningProvider({
       }
     },
   };
+  return provider;
 }
 
 /**

package/src/core/signing/statement-file.js

@@ -0,0 +1,27 @@
+import { needsExistingProjectScope, withExistingProjectScope } from "../../storage/existing-project-scope.js";
+import { mkdtemp, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { assertSafePath, ensureWithin, writeFileAtomic } from "../filesystem.js";
+import { getOperationalStore, readOperationalText } from "../../storage/operational-context.js";
+
+/** Present selected canonical bytes to external signers without a legacy mirror. */
+export async function withSigningStatementFile(target, statementPath, callback) {
+  if (await needsExistingProjectScope(target)) {
+    return withExistingProjectScope(target, () => withSigningStatementFile(target, statementPath, callback), { readOnly: true });
+  }
+  await assertSafePath(target, statementPath);
+  const source = readOperationalText(target, statementPath);
+  if (!source.selected) return callback(ensureWithin(target, statementPath));
+  const invalid = message => Object.assign(new Error(message), { code: "E_ATTESTATION_STATEMENT_INVALID" });
+  if (source.text === null) throw invalid("Selected attestation statement is missing");
+  if (getOperationalStore(target).db.isTransaction) throw invalid("External signing cannot run inside a SQLite write transaction");
+  const directory = await mkdtemp(path.join(os.tmpdir(), "forgeloop-signing-statement-"));
+  try {
+    const filename = path.join(directory, "statement.json");
+    await writeFileAtomic(filename, source.text);
+    const result = await callback(filename);
+    if (readOperationalText(target, statementPath).text !== source.text) throw invalid("Attestation statement changed during external signing");
+    return result;
+  } finally { await rm(directory, { recursive: true, force: true }); }
+}

package/src/core/sources.js

@@ -1,5 +1,19 @@
+import { CONTRACT_PRESET_IDS } from "./contract-presets.js";
 import { PROTOCOL_VERSION } from "./protocol.js";
 
+const CONTRACT_PRESET_PREFIX = "contract-preset:";
+const BUILTIN_CONTRACT_PRESET_REFS = new Set(
+  CONTRACT_PRESET_IDS.map((presetId) => `${CONTRACT_PRESET_PREFIX}${presetId}`),
+);
+
+export function isBuiltinContractPresetRef(ref) {
+  return typeof ref === "string" && BUILTIN_CONTRACT_PRESET_REFS.has(ref);
+}
+
+export function externalContractSourceRefs(refs = []) {
+  return refs.filter((ref) => !isBuiltinContractPresetRef(ref));
+}
+
 export const SOURCE_REGISTRY_SCHEMA_VERSION = 1;
 export const SOURCE_KINDS = Object.freeze([
   "user-request",
@@ -84,3 +98,26 @@ export function assertSourceProvenance(registry, refs = [], { expectedKind } = {
   }
   return true;
 }
+
+export function assertContractPresetRefs(refs = []) {
+  for (const ref of refs) {
+    if (typeof ref === "string" && ref.startsWith(CONTRACT_PRESET_PREFIX) && !isBuiltinContractPresetRef(ref)) {
+      const error = new Error(`Unknown built-in contract preset source: ${ref}`);
+      error.code = "E_PROFILE_SOURCE_UNKNOWN";
+      throw error;
+    }
+  }
+  return true;
+}
+
+export function assertContractSourceProvenance(registry, refs = []) {
+  assertContractPresetRefs(refs);
+  const externalRefs = externalContractSourceRefs(refs);
+  if (externalRefs.length === 0) return true;
+  if (!registry) {
+    const error = new Error("External contract source references require a source registry");
+    error.code = "E_PROFILE_SOURCE_MISSING";
+    throw error;
+  }
+  return assertSourceProvenance(registry, externalRefs);
+}

package/src/core/storage-runtime-registry.js

@@ -0,0 +1,41 @@
+const owners = new WeakMap();
+function closed(message) { return Object.assign(new Error(message), { code: "E_STORAGE_RUNTIME_CLOSED" }); }
+
+/** Register lazy ownership without importing a SQLite implementation. */
+export function attachStorageConnectionOwner(context) {
+  let owner;
+  let loading;
+  let closing = false;
+  let closePromise;
+  const pending = new Set();
+  const getOwner = () => loading ??= import("../storage/connection-owner.js").then(module => {
+    owner = module.createStorageConnectionOwner();
+    return owner;
+  });
+  const proxy = {
+    run(target, callback, options) {
+      if (closing) return Promise.reject(closed("Persistent storage runtime is closing or closed"));
+      const request = getOwner().then(value => value.run(target, callback, options));
+      pending.add(request);
+      const finished = () => { pending.delete(request); };
+      request.then(finished, finished);
+      return request;
+    },
+    close() {
+      if (owner?.isActive()) return Promise.reject(closed("Close the runtime outside an active command"));
+      if (closePromise) return closePromise;
+      closing = true;
+      closePromise = (async () => {
+        await Promise.all([...pending].map(request => request.catch(() => undefined)));
+        if (loading) await (await loading).close();
+      })();
+      return closePromise;
+    },
+  };
+  owners.set(context, proxy);
+  return proxy.close;
+}
+
+export function getStorageConnectionOwner(context) {
+  return context && typeof context === "object" ? owners.get(context) ?? null : null;
+}

package/src/core/structural-quality/artifacts.js

@@ -1,4 +1,6 @@
+import { needsExistingProjectScope, withExistingProjectScope } from "../../storage/existing-project-scope.js";
 import { readdir } from "node:fs/promises";
+import { listOperationalArtifactNames, operationalArtifactExists } from "../../storage/operational-context.js";
 
 import {
   canonicalFingerprint,
@@ -205,21 +207,25 @@ export async function writeStructuralQualityBaseline(
 }
 
 export async function listStructuralQualityEvaluations(target, taskId, packageRoot = getPackageRoot()) {
+  if (await needsExistingProjectScope(target)) {
+    return withExistingProjectScope(target, () => listStructuralQualityEvaluations(target, taskId, packageRoot), { readOnly: true });
+  }
   const relativeDirectory = taskStructuralQualityEvaluationsDirectory(taskId);
-  await assertSafePath(target, relativeDirectory);
-  const absoluteDirectory = ensureWithin(target, relativeDirectory);
-  if (!(await fileExists(absoluteDirectory))) return [];
-  let entries;
-  try {
-    entries = await readdir(absoluteDirectory, { withFileTypes: true });
-  } catch (error) {
-    throw qualityArtifactError(E_STRUCTURAL_QUALITY_EVIDENCE_STALE, `Unable to list structural-quality evaluations: ${error.message}`, [relativeDirectory]);
+  let names = listOperationalArtifactNames(target, taskId, "structural-quality/evaluations");
+  if (names === null) {
+    await assertSafePath(target, relativeDirectory);
+    const absoluteDirectory = ensureWithin(target, relativeDirectory);
+    if (!(await fileExists(absoluteDirectory))) return [];
+    try {
+      names = (await readdir(absoluteDirectory, { withFileTypes: true })).filter(entry => entry.isFile()).map(entry => entry.name);
+    } catch (error) {
+      throw qualityArtifactError(E_STRUCTURAL_QUALITY_EVIDENCE_STALE, `Unable to list structural-quality evaluations: ${error.message}`, [relativeDirectory]);
+    }
   }
-  const candidates = entries
-    .filter((entry) => entry.isFile())
-    .map((entry) => {
-      const match = /^cycle-(\d+)-attempt-(\d+)\.json$/u.exec(entry.name);
-      return match ? { name: entry.name, verificationCycle: Number(match[1]), attempt: Number(match[2]) } : null;
+  const candidates = names
+    .map((name) => {
+      const match = /^cycle-(\d+)-attempt-(\d+)\.json$/u.exec(name);
+      return match ? { name, verificationCycle: Number(match[1]), attempt: Number(match[2]) } : null;
     })
     .filter(Boolean)
     .filter((item) => item.verificationCycle >= 1 && item.attempt >= 1)
@@ -267,7 +273,7 @@ export async function writeStructuralQualityEvaluation(target, taskId, verificat
     throw qualityArtifactError(E_STRUCTURAL_QUALITY_EVIDENCE_STALE, `Evaluation identity does not match ${relativePath}`, [relativePath]);
   }
   validateStructuralQualityArtifact(value, relativePath);
-  const existing = await fileExists(ensureWithin(target, relativePath));
+  const existing = operationalArtifactExists(target, relativePath) ?? await fileExists(ensureWithin(target, relativePath));
   if (existing) {
     const current = await readStructuralQualityEvaluation(target, taskId, cycle, normalizedAttempt, packageRoot);
     if (current.fingerprint === canonicalFingerprint(value)) return { ...current, existing: true, identical: true };

package/src/core/structural-quality/service.js

@@ -1,3 +1,5 @@
+import { needsExistingProjectScope } from "../../storage/existing-project-scope.js";
+import { withProjectReadSnapshot } from "../../storage/project-read-snapshot.js";
 import { canonicalFingerprint, readJsonArtifact } from "../artifacts.js";
 import { readConfig } from "../config.js";
 import { readContract } from "../contract.js";
@@ -36,6 +38,22 @@ import {
 import { appendProtocolEvent } from "../events.js";
 import { getPackageRoot } from "../templates.js";
 import { withTaskMutation } from "../task-command.js";
+import { withTaskTransaction } from "../transaction.js";
+import { getOperationalStore } from "../../storage/operational-context.js";
+
+async function withQualityMutation(target, options, operation, callback) {
+  const native = Boolean(getOperationalStore(target)) || await needsExistingProjectScope(target);
+  for (let retry = 0; ; retry += 1) {
+    try {
+      return await withTaskMutation(target, options, operation, callback);
+    } catch (error) {
+      // These callbacks persist an already captured observation. A native
+      // conflict discards their staged writes; rerun admission and bindings
+      // against current records without invoking the provider again.
+      if (!native || error.code !== "E_STATE_REVISION_CONFLICT" || retry >= 2) throw error;
+    }
+  }
+}
 import { findTaskById } from "../task-discovery.js";
 import { currentChangedPaths } from "../repository.js";
 import { assertClaimsCoverChangedPaths } from "../task-scope.js";
@@ -142,7 +160,11 @@ function normalizeScanResult(result, provider, detection, projectPath) {
   };
 }
 
-export async function resolveStructuralQualityContext({
+export async function resolveStructuralQualityContext(options = {}) {
+  return withProjectReadSnapshot(options.target, () => resolveStructuralQualityContextObservation(options));
+}
+
+async function resolveStructuralQualityContextObservation({
   target,
   packageRoot = getPackageRoot(),
   taskId,
@@ -378,31 +400,43 @@ export async function captureStructuralQualityBaseline({ target, packageRoot = g
     scope: updatedInputs.scope,
     snapshot: scan.snapshot,
   };
-  const written = await writeStructuralQualityBaseline(target, taskId, value, packageRoot, { phase: inputs.state.phase, replace, taskId });
-  if (!written.identical) {
-    await appendProtocolEvent(target, {
-      taskId,
-      event: "STRUCTURAL_QUALITY_BASELINE_RECORDED",
-      details: {
-        artifactRef: written.path,
-        artifactFingerprint: written.fingerprint,
-        providerId: scan.provider.id,
-        providerVersion: scan.provider.version,
-        replaced: Boolean(existing),
-        supersededFingerprint: existing?.fingerprint ?? null,
-      },
-    }, packageRoot, { taskId });
-  }
-  return {
-    status: written.existing ? "REPLACED" : "CAPTURED",
-    mode: policy.mode,
-    provider: scan.provider,
-    artifactRef: written.path,
-    artifactFingerprint: written.fingerprint,
-    baseline: written.value,
-    existing: written.existing,
-    identical: written.identical,
-  };
+  return withTaskTransaction({ target, taskId, packageRoot, operation: "quality-baseline" }, async () => {
+    const currentInputs = await taskInputs(target, packageRoot, taskId, { runtimeContext, timeoutMs, maxOutputBytes });
+    if (currentInputs.state.phase !== "PLANNED"
+      || currentInputs.contract.fingerprint !== inputs.contract.fingerprint
+      || currentInputs.route.fingerprint !== inputs.route.fingerprint
+      || structuralQualityPolicyFingerprint(currentInputs.policy) !== policyFingerprint
+      || currentInputs.scopeFingerprint !== inputs.scopeFingerprint) {
+      throw qualityError(E_STRUCTURAL_QUALITY_OBSERVATION_EPOCH_STALE, "Task baseline configuration changed during observation");
+    }
+    await assertReadyPreflight(target, packageRoot, taskId);
+    const currentBaseline = await readStructuralQualityBaseline(target, taskId, packageRoot);
+    const written = await writeStructuralQualityBaseline(target, taskId, value, packageRoot, { phase: currentInputs.state.phase, replace, taskId });
+    if (!written.identical) {
+      await appendProtocolEvent(target, {
+        taskId,
+        event: "STRUCTURAL_QUALITY_BASELINE_RECORDED",
+        details: {
+          artifactRef: written.path,
+          artifactFingerprint: written.fingerprint,
+          providerId: scan.provider.id,
+          providerVersion: scan.provider.version,
+          replaced: Boolean(currentBaseline),
+          supersededFingerprint: currentBaseline?.fingerprint ?? null,
+        },
+      }, packageRoot, { taskId });
+    }
+    return {
+      status: written.existing ? "REPLACED" : "CAPTURED",
+      mode: policy.mode,
+      provider: scan.provider,
+      artifactRef: written.path,
+      artifactFingerprint: written.fingerprint,
+      baseline: written.value,
+      existing: written.existing,
+      identical: written.identical,
+    };
+  });
 }
 
 async function persistEvaluationAndCheck({ target, packageRoot, taskId, inputs, persisted, authorityContext, runtimeContext }) {
@@ -443,7 +477,7 @@ async function persistEvaluationAndCheck({ target, packageRoot, taskId, inputs,
     runtimeContext,
     taskId: context?.taskId ?? taskId,
   });
-  const recorded = await withTaskMutation(target, { taskId, packageRoot }, "quality-verify-check", async (context) => {
+  const recorded = await withQualityMutation(target, { taskId, packageRoot }, "quality-verify-check", async (context) => {
     const effectiveTaskId = context?.taskId ?? taskId;
     const evaluations = await listStructuralQualityEvaluations(target, effectiveTaskId, packageRoot);
     const latest = evaluations
@@ -599,34 +633,33 @@ export async function evaluateStructuralQuality({ target, packageRoot = getPacka
 
   // Execute provider observation OUTSIDE task mutation lock
   const sourceFingerprintBefore = await computeMaterialSourceFingerprint(target);
+  // Every non-pass branch binds the same reserved task/cycle and source epoch.
+  const evaluationInputs = {
+    taskId,
+    inputs: initialInputs,
+    cycle,
+    attempt,
+    policy,
+    baseline,
+    sourceMaterialFingerprint: sourceFingerprintBefore,
+  };
   let evaluation;
 
   if (!baseline) {
     evaluation = nonPassEvaluation({
-      taskId,
-      inputs: initialInputs,
-      cycle,
-      attempt,
-      policy,
+      ...evaluationInputs,
       reasonCode: E_STRUCTURAL_QUALITY_BASELINE_MISSING,
       sourceObservation: { beforeFingerprint: sourceFingerprintBefore, afterFingerprint: sourceFingerprintBefore, stable: true },
-      sourceMaterialFingerprint: sourceFingerprintBefore,
     });
   } else {
     try {
       const scopeChanged = baseline.value.bindings?.scopeFingerprint !== initialInputs.scopeFingerprint;
       if (scopeChanged) {
         evaluation = nonPassEvaluation({
-          taskId,
-          inputs: initialInputs,
-          cycle,
-          attempt,
-          policy,
+          ...evaluationInputs,
           reasonCode: E_STRUCTURAL_QUALITY_EVALUATION_INCOMPARABLE,
           reasonCodes: ["PROVIDER_CONFIG_CHANGED"],
-          baseline,
           sourceObservation: { beforeFingerprint: sourceFingerprintBefore, afterFingerprint: sourceFingerprintBefore, stable: true },
-          sourceMaterialFingerprint: sourceFingerprintBefore,
         });
         evaluation.comparison.reasonCodes = [E_STRUCTURAL_QUALITY_EVALUATION_INCOMPARABLE, "PROVIDER_CONFIG_CHANGED"];
       } else {
@@ -643,18 +676,12 @@ export async function evaluateStructuralQuality({ target, packageRoot = getPacka
 
         if (!isStable) {
           evaluation = nonPassEvaluation({
-          taskId,
-          inputs: initialInputs,
-          cycle,
-          attempt,
-          policy,
+          ...evaluationInputs,
           reasonCode: E_STRUCTURAL_QUALITY_SOURCE_DRIFT,
           providerId: scan.provider.id,
           providerVersion: scan.provider.version,
           detection: scan.detection,
-          baseline,
           sourceObservation: { beforeFingerprint: sourceFingerprintBefore, afterFingerprint: sourceFingerprintAfter, stable: false },
-          sourceMaterialFingerprint: sourceFingerprintBefore,
           });
         } else {
           const updatedInputs = initialInputs;
@@ -699,26 +726,20 @@ export async function evaluateStructuralQuality({ target, packageRoot = getPacka
       const sourceFingerprintAfter = await computeMaterialSourceFingerprint(target).catch(() => sourceFingerprintBefore);
       const code = error.code ?? E_STRUCTURAL_QUALITY_PROVIDER_UNAVAILABLE;
       evaluation = nonPassEvaluation({
-        taskId,
-        inputs: initialInputs,
-        cycle,
-        attempt,
-        policy,
+        ...evaluationInputs,
         reasonCode: code,
         providerId: policy.provider,
-        baseline,
         sourceObservation: {
           beforeFingerprint: sourceFingerprintBefore,
           afterFingerprint: sourceFingerprintAfter,
           stable: sourceFingerprintBefore === sourceFingerprintAfter,
         },
-        sourceMaterialFingerprint: sourceFingerprintBefore,
         });
       }
   }
 
   // Commit under task mutation lock
-  const captured = await withTaskMutation(target, { taskId, packageRoot }, "quality-verify-evaluation", async (context) => {
+  const captured = await withQualityMutation(target, { taskId, packageRoot }, "quality-verify-evaluation", async (context) => {
     const lockedTaskId = context?.taskId ?? taskId;
     const inputs = await taskInputs(target, packageRoot, lockedTaskId, { runtimeContext, timeoutMs, maxOutputBytes });
     if (inputs.state.phase !== "VERIFYING") {
@@ -908,7 +929,11 @@ function projectionFromArtifacts(policy, baseline, current, state, evaluations =
   return projection;
 }
 
-export async function projectStructuralQualityStatus({ target, packageRoot = getPackageRoot(), taskId, runtimeContext } = {}) {
+export async function projectStructuralQualityStatus(options = {}) {
+  return withProjectReadSnapshot(options.target, () => projectStructuralQualityStatusObservation(options));
+}
+
+async function projectStructuralQualityStatusObservation({ target, packageRoot = getPackageRoot(), taskId, runtimeContext } = {}) {
   const config = await loadOptionalConfig(target, packageRoot);
   const policy = configuredPolicy(config);
   if (!policy || policy.mode === "off") return emptyProjection(null);

package/src/core/target-layout.js

@@ -26,7 +26,7 @@ export function targetPathForSource(sourcePath) {
 }
 
 export function legacyPathForSource(sourcePath) {
-  return sourcePath === ".forgeloop/forgeloop.gitignore" ? ".forgeloop/.gitignore" : sourcePath;
+  return sourcePath;
 }
 
 export function isKitPath(relativePath) {