@moretea-labs/forge 1.5.0-rc.1 → 1.5.0

package/src/runtime/control-plane/launcher/thin-launcher.ts

@@ -1,30 +1,42 @@
 import { spawn, spawnSync } from 'child_process';
 import {
-  claimControllerSession,
   getHandoffItem,
   getWorkContract,
-  releaseControllerSession,
   type HandoffInboxStoreOptions,
   type WorkContractStoreOptions,
 } from '../facade';
+import {
+  attachExternalControllerLaunchPid,
+  releaseExternalControllerLaunchReservation,
+  reserveExternalControllerLaunch,
+} from './launch-reservation-store';
 import type { ControllerType } from '../facade/types';
+import { codexMcpConfigArgs, resolveProviderMcpBootstrap, type ProviderMcpBootstrap } from './provider-mcp-bootstrap';
+import { getChatgptWorkConversationBinding } from './chatgpt-work-binding-store';
 
 export interface ThinLauncherRequest {
   controllerType: Exclude<ControllerType, 'human'>;
   executable?: string;
   args?: string[];
   workId: string;
-  controllerId: string;
-  sessionId: string;
-  leaseMs?: number;
+  /** Short reservation only prevents duplicate spawns; the external MCP session claims Work with its authenticated identity. */
+  launchReservationMs?: number;
   handoffId?: string;
+  /** Saved Forge ChatGPT browser session to continue. */
+  browserSessionId?: string;
+  /** Explicit ChatGPT conversation URL used when no saved Forge browser session exists. */
+  conversationUrl?: string;
+  /** Additional bounded continuation instruction, for example a Schedule occurrence. */
+  continuationPrompt?: string;
   cwd: string;
+  /** Internal launch context; populated by launchSuperController, not by callers. */
+  controllerHome?: string;
+  repoId?: string;
 }
 
 export interface ThinLauncherResult {
   controllerType: ThinLauncherRequest['controllerType'];
-  controllerId: string;
-  sessionId: string;
+  reservationId: string;
   pid: number | undefined;
   prompt: string;
   executable: string;
@@ -37,7 +49,9 @@ function resolveLauncherExecutable(request: ThinLauncherRequest): string {
     ? 'codex'
     : request.controllerType === 'claude'
       ? 'claude'
-      : '';
+      : request.controllerType === 'chatgpt'
+        ? process.env.FORGE_CLI_EXECUTABLE?.trim() || 'forge'
+        : '';
   if (!executable) throw new Error(`LAUNCHER_EXECUTABLE_REQUIRED: ${request.controllerType} requires an external launcher executable`);
   const probe = spawnSync(executable, ['--version'], {
     cwd: request.cwd,
@@ -50,6 +64,71 @@ function resolveLauncherExecutable(request: ThinLauncherRequest): string {
   return executable;
 }
 
+function assertChatgptConversationUrl(value: string | undefined): string | undefined {
+  const raw = value?.trim();
+  if (!raw) return undefined;
+  let url: URL;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new Error('LAUNCHER_CHATGPT_CONVERSATION_URL_INVALID');
+  }
+  if (url.protocol !== 'https:' || !['chatgpt.com', 'www.chatgpt.com'].includes(url.hostname)) {
+    throw new Error('LAUNCHER_CHATGPT_CONVERSATION_URL_INVALID');
+  }
+  return url.toString();
+}
+
+export function buildSuperControllerInvocation(
+  request: ThinLauncherRequest,
+  executable: string,
+  prompt: string,
+  mcpBootstrap?: ProviderMcpBootstrap,
+): { executable: string; args: string[] } {
+  if (request.controllerType === 'codex') {
+    if (!mcpBootstrap) throw new Error('LAUNCHER_CODEX_FORGE_MCP_REQUIRED');
+    return {
+      executable,
+      args: [
+        '--ask-for-approval', 'never',
+        ...codexMcpConfigArgs(mcpBootstrap),
+        'exec', '--sandbox', 'workspace-write',
+        ...(request.args ?? []),
+        prompt,
+      ],
+    };
+  }
+  if (request.controllerType === 'claude') {
+    if (!(request.args ?? []).includes('--mcp-config')) {
+      throw new Error('LAUNCHER_CLAUDE_FORGE_MCP_CONFIG_REQUIRED');
+    }
+    return {
+      executable,
+      args: ['--print', '--permission-mode', 'auto', ...(request.args ?? []), prompt],
+    };
+  }
+  if (request.controllerType !== 'chatgpt') {
+    return { executable, args: [...(request.args ?? []), prompt] };
+  }
+  const browserSessionId = request.browserSessionId?.trim();
+  const conversationUrl = assertChatgptConversationUrl(request.conversationUrl);
+  if (!request.controllerHome || !request.repoId) throw new Error('LAUNCHER_CHATGPT_WORK_BINDING_CONTEXT_REQUIRED');
+  return {
+    executable,
+    args: [
+      'chatgpt', 'work-continue',
+      '--repo', request.cwd,
+      '--controller-home', request.controllerHome,
+      '--repo-id', request.repoId,
+      '--work-id', request.workId,
+      '--prompt', prompt,
+      ...(browserSessionId ? ['--session', browserSessionId] : []),
+      ...(conversationUrl ? ['--conversation-url', conversationUrl] : []),
+      ...(request.args ?? []),
+    ],
+  };
+}
+
 /**
  * Starts one external SuperController session. This module deliberately owns
  * provider process selection and prompt construction; the execution Kernel
@@ -62,36 +141,50 @@ export function launchSuperController(
   },
   request: ThinLauncherRequest,
 ): ThinLauncherResult {
-  if (!request.controllerId.trim() || !request.sessionId.trim()) throw new Error('LAUNCHER_CONTROLLER_SESSION_REQUIRED');
   const executable = resolveLauncherExecutable(request);
   const work = getWorkContract(stores.work, request.workId);
   if (!work) throw new Error(`WORK_NOT_FOUND: ${request.workId}`);
-  const session = claimControllerSession(stores.work, {
+  const reservation = reserveExternalControllerLaunch(stores.work, {
     workId: work.workId,
-    controllerId: request.controllerId,
     controllerType: request.controllerType,
-    sessionId: request.sessionId,
-    leaseMs: request.leaseMs,
+    ttlMs: request.launchReservationMs,
   });
   const handoff = request.handoffId ? getHandoffItem(stores.handoff, request.handoffId) : undefined;
-  const prompt = [
-    `Work: ${work.workId}`,
-    `Objective: ${work.objective}`,
-    `Acceptance: ${work.acceptanceCriteria.join('; ') || 'none declared'}`,
-    `Current status: ${work.status}`,
-    handoff ? `Handoff: ${handoff.summary}\nNext: ${handoff.recommendedContinuationPrompt ?? handoff.recommendedPrompt}` : '',
-    'Use the repository MCP facade directly. Claim the Work before mutation and create a handoff when control changes.',
-  ].filter(Boolean).join('\n');
+  const chatgptBinding = request.controllerType === 'chatgpt'
+    ? getChatgptWorkConversationBinding(stores.work, work.workId)
+    : undefined;
+  const prompt = (request.controllerType === 'chatgpt' && chatgptBinding)
+    ? [
+      `Continue Forge Work ${work.workId} in repo ${work.repoId}.`,
+      handoff ? `Handoff: ${handoff.summary}\nNext: ${handoff.recommendedContinuationPrompt ?? handoff.recommendedPrompt}` : '',
+      request.continuationPrompt?.trim() ? `Continuation: ${request.continuationPrompt.trim()}` : '',
+      `First call rh_work continue with repo_id=${work.repoId} and work_id=${work.workId}. Treat Forge Work/Plan/evidence as source of truth; do not invent new scope from chat history. If the claim fails, do not mutate. Continue the next safe action, finalize only when acceptance passes, and create a HandoffItem when judgement is required.`,
+    ].filter(Boolean).join('\n')
+    : [
+      `Work: ${work.workId}`,
+      `Objective: ${work.objective}`,
+      `Acceptance: ${work.acceptanceCriteria.join('; ') || 'none declared'}`,
+      `Current status: ${work.status}`,
+      handoff ? `Handoff: ${handoff.summary}\nNext: ${handoff.recommendedContinuationPrompt ?? handoff.recommendedPrompt}` : '',
+      request.continuationPrompt?.trim() ? `Continuation: ${request.continuationPrompt.trim()}` : '',
+      `No Controller ownership was preclaimed for you. First call rh_work continue with repo_id=${work.repoId} and work_id=${work.workId} through your authenticated MCP session; do not invent controller_id/session_id. If that claim does not succeed, do not mutate the repository: create no patch, command, commit, or test run until ownership is established. Then use the repository MCP facade, record verification evidence, finalize only when acceptance passes, and create a HandoffItem when judgement is required.`,
+    ].filter(Boolean).join('\n');
   try {
-    const child = spawn(executable, [...(request.args ?? []), prompt], {
+    const mcpBootstrap = request.controllerType === 'codex'
+      ? resolveProviderMcpBootstrap(stores.work.controllerHome, 'codex', reservation.reservationId)
+      : undefined;
+    const invocation = buildSuperControllerInvocation({ ...request, controllerHome: stores.work.controllerHome, repoId: work.repoId }, executable, prompt, mcpBootstrap);
+    const child = spawn(invocation.executable, invocation.args, {
       cwd: request.cwd,
       detached: true,
       stdio: 'ignore',
+      env: mcpBootstrap?.env ?? process.env,
     });
     child.unref();
-    return { controllerType: request.controllerType, controllerId: session.controllerId, sessionId: session.sessionId, pid: child.pid, prompt, executable };
+    attachExternalControllerLaunchPid(stores.work, work.workId, reservation.reservationId, child.pid);
+    return { controllerType: request.controllerType, reservationId: reservation.reservationId, pid: child.pid, prompt, executable };
   } catch (error) {
-    releaseControllerSession(stores.work, work.workId, request.controllerId);
+    releaseExternalControllerLaunchReservation(stores.work, work.workId, reservation.reservationId, 'spawn_failed');
     throw error;
   }
 }

package/src/runtime/control-plane/routing/route-policy.ts

@@ -3,11 +3,11 @@ import { createHash } from 'crypto';
 export const ROUTE_POLICY_VERSION = 'route-policy-v3' as const;
 
 export type RouteExecutionMode = 'direct_control' | 'goal_workloop' | 'handoff_only';
-export type RouteWorkMode = 'direct_edit' | 'bounded_work' | 'quick_agent' | 'issue_task' | 'campaign';
-export type RouteExecutionPath = 'fast' | 'durable' | 'campaign';
+export type RouteWorkMode = 'direct_edit' | 'bounded_work' | 'quick_agent' | 'issue_task';
+export type RouteExecutionPath = 'fast' | 'durable';
 export type RouteExecutorKind = 'direct_edit' | 'local_cli' | 'remote_api' | 'cloud_agent' | 'external_controller' | 'handoff_only';
 export type RouteApprovalState = 'approval_not_required' | 'normal_authorization_required' | 'strong_confirmation_required' | 'blocked_by_policy';
-export type ExplicitTaskMode = 'direct' | 'plan' | 'debug' | 'review' | 'campaign' | 'release' | 'scale';
+export type ExplicitTaskMode = 'direct' | 'plan' | 'debug' | 'review' | 'release' | 'scale';
 
 export interface RouteReason {
   code: string;
@@ -233,7 +233,7 @@ export function decideRoute(input: RoutePolicyInput): RouteDecision {
   const approvalConfirmed = input.policy.approvalConfirmed === true;
   const protectedPath = paths.some((path) => PROTECTED_PATH.test(path));
   const explicitMode = input.intent.explicitMode;
-  const explicitParallelMode = explicitMode === 'campaign' || explicitMode === 'scale';
+  const explicitParallelMode = explicitMode === 'scale';
   const requiresIsolation = explicitMode === 'direct'
     ? false
     : input.recovery.isolationRequired === true || explicitParallelMode;
@@ -242,7 +242,7 @@ export function decideRoute(input: RoutePolicyInput): RouteDecision {
     || explicitMode === 'debug'
     || explicitMode === 'release'
     || explicitMode === 'scale';
-  const campaignEligible = explicitParallelMode || input.intent.requiresIndependentDeliverables === true
+  const coordinationRequired = explicitParallelMode || input.intent.requiresIndependentDeliverables === true
     || independentTaskCount >= 3;
 
   if (input.policy.policyBlocked === true) {
@@ -304,7 +304,7 @@ export function decideRoute(input: RoutePolicyInput): RouteDecision {
   if (input.intent.requiresLongRunningChecks) reasons.push({ code: 'long_checks', message: 'Long-running checks require durable continuation.' });
   if (input.intent.requiresInvestigation) reasons.push({ code: 'investigation', message: 'Investigation is required before or during implementation.' });
   if (input.intent.needsDependencies) reasons.push({ code: 'dependencies', message: 'Dependency ordering requires durable Work.' });
-  if (campaignEligible) reasons.push({ code: 'independent_deliverables', message: 'Multiple independent deliverables require campaign-level coordination.' });
+  if (coordinationRequired) reasons.push({ code: 'independent_deliverables', message: 'Multiple independent deliverables require durable PlanContract/Work coordination.' });
 
   const explicitBoundedMode = explicitMode === 'plan'
     || explicitMode === 'debug'
@@ -312,7 +312,7 @@ export function decideRoute(input: RoutePolicyInput): RouteDecision {
     || explicitMode === 'release';
   const complex = explicitMode === 'direct'
     ? false
-    : campaignEligible
+    : coordinationRequired
     || explicitBoundedMode
     || requiresRecovery
     || requiresIsolation
@@ -326,19 +326,19 @@ export function decideRoute(input: RoutePolicyInput): RouteDecision {
     || secretAccess
     || (mutation && (expectedFiles > 4 || expectedChangedLines > 200));
   const executionMode: RouteExecutionMode = complex ? 'goal_workloop' : 'direct_control';
-  // Work topology is independent from executor/provider choice. Campaign is
-  // selected only for genuinely independent/parallel deliverables; Agent
-  // preference may choose an executor inside a tier but must not create the tier.
+  // Work topology is independent from executor/provider choice. Independent or
+  // parallel deliverables stay in the durable Goal Workloop and are decomposed by
+  // PlanContract/Work rather than introducing another project-level lifecycle.
   const workMode: RouteWorkMode = explicitMode === 'direct'
     ? 'direct_edit'
-    : campaignEligible
-    ? 'campaign'
+    : coordinationRequired
+    ? 'bounded_work'
     : input.intent.agentRequested
       ? expectedFiles > 10 || expectedChangedLines > 1_500 ? 'issue_task' : 'quick_agent'
       : complex
         ? 'bounded_work'
         : 'direct_edit';
-  const executionPath: RouteExecutionPath = workMode === 'campaign' ? 'campaign' : complex ? 'durable' : 'fast';
+  const executionPath: RouteExecutionPath = complex ? 'durable' : 'fast';
   const providerSelection = selectProvider(input);
   const providersWereSupplied = input.capabilities.providers !== undefined;
   if (providersWereSupplied && !providerSelection.provider) {
@@ -364,7 +364,7 @@ export function decideRoute(input: RoutePolicyInput): RouteDecision {
     workMode,
     executionPath,
     // Direct Control is intentionally contract-free. Persistence belongs to
-    // Goal Workloop/Campaign/Agent tiers; bounded direct edits rely on the
+    // Goal Workloop/Agent tiers; bounded direct edits rely on the
     // existing permission, patch, Process, and evidence boundaries instead.
     requiresWork: executionMode !== 'direct_control',
     requiresApproval: approvalRequired,

package/src/runtime/control-plane/runtime-cleanup.ts

@@ -76,7 +76,6 @@ const TEMP_SCAN_LEAF_DIR_NAMES = new Set([
   'audit',
   'local-jobs',
   'runs',
-  'campaigns',
   'schedules',
   'leases',
   'projections',

package/src/runtime/evidence/event-ledger.ts

@@ -18,7 +18,7 @@ export interface RuntimeEntityEvent {
   eventId: string;
   eventType: string;
   repoId: string;
-  entityType: 'job' | 'plugin' | 'schedule' | 'occurrence' | 'portfolio' | 'campaign' | 'candidate-finding' | 'release' | 'lease' | 'schedule-decision' | 'assistant-action-proposal' | 'assistant-standing-grant';
+  entityType: 'job' | 'plugin' | 'schedule' | 'occurrence' | 'portfolio' | 'candidate-finding' | 'release' | 'lease' | 'schedule-decision' | 'assistant-action-proposal' | 'assistant-standing-grant';
   entityId: string;
   correlationId?: string;
   causationId?: string;

package/src/runtime/{workflow/campaigns/workspace.ts → execution/managed-workspace.ts}

@@ -1,36 +1,38 @@
 import { createHash } from 'crypto';
 import { existsSync, mkdirSync, realpathSync } from 'fs';
 import { dirname, join, resolve } from 'path';
-import { repositoryControllerRoot } from '../../../cli/repositories/controller-home';
-import type { RepositoryRecord } from '../../../cli/repositories/types';
+import { repositoryControllerRoot } from '../../cli/repositories/controller-home';
+import type { RepositoryRecord } from '../../cli/repositories/types';
 import {
   addRepositoryCheckout,
   listRepositories,
   repositoryCheckoutRootMatches,
   selectRepositoryCheckout,
-} from '../../../cli/repositories/registry';
-import { managedWorktreePath } from '../../../cli/repositories/worktree-storage';
-import { campaignBranchName, validateBranchName } from '../../../cli/repositories/branch-name-policy';
-import { withControllerLock } from '../../../cli/repositories/locks';
-import { resolveGitExecutable } from '../../../effects/git-executable';
-import { runProcess } from '../../../effects/process-runner';
-import { readJsonFile, writeJsonAtomic } from '../../shared/json-files';
-import type { CampaignWorkspace } from './types';
+} from '../../cli/repositories/registry';
+import { managedWorktreePath } from '../../cli/repositories/worktree-storage';
+import { branchSlugSegment, validateBranchName } from '../../cli/repositories/branch-name-policy';
+import { withControllerLock } from '../../cli/repositories/locks';
+import { resolveGitExecutable } from '../../effects/git-executable';
+import { runProcess } from '../../effects/process-runner';
+import { readJsonFile, writeJsonAtomic } from '../shared/json-files';
 
-export interface EnsureCampaignWorkspaceInput {
+export interface EnsureManagedWorkspaceInput {
   requestId: string;
   title: string;
   baseRef?: string;
   branchName?: string;
 }
 
-/**
- * Neutral worktree contract used by WorkContract and legacy Campaign views.
- * The persistence location remains compatible with existing Campaign records.
- */
-export type EnsureManagedWorkspaceInput = EnsureCampaignWorkspaceInput;
+export interface ManagedWorkspace {
+  mode: 'current' | 'isolated';
+  checkoutId?: string;
+  root?: string;
+  branch?: string | null;
+  baseRevision?: string | null;
+  managed: boolean;
+}
 
-interface CampaignWorkspaceManifest {
+interface ManagedWorkspaceManifest {
   schemaVersion: 1;
   repoId: string;
   requestId: string;
@@ -51,7 +53,7 @@ function git(root: string, args: string[], timeoutMs = 30_000): string {
   });
   if (!result.ok) {
     const detail = result.stderr || result.error || `exit ${result.status}`;
-    throw new Error(`CAMPAIGN_WORKSPACE_GIT_FAILED: git ${args.join(' ')}: ${detail}`);
+    throw new Error(`MANAGED_WORKSPACE_GIT_FAILED: git ${args.join(' ')}: ${detail}`);
   }
   return result.stdout.trim();
 }
@@ -64,9 +66,9 @@ function gitSucceeds(root: string, args: string[]): boolean {
 }
 
 function assertBranch(root: string, branch: string): string {
-  const normalized = validateBranchName(branch, { purpose: 'CAMPAIGN_WORKSPACE_BRANCH' });
+  const normalized = validateBranchName(branch, { purpose: 'MANAGED_WORKSPACE_BRANCH' });
   if (!gitSucceeds(root, ['check-ref-format', '--branch', normalized])) {
-    throw new Error(`CAMPAIGN_WORKSPACE_BRANCH_INVALID: ${normalized}`);
+    throw new Error(`MANAGED_WORKSPACE_BRANCH_INVALID: ${normalized}`);
   }
   return normalized;
 }
@@ -77,22 +79,22 @@ function existingWorkspace(path: string, branch: string): boolean {
     timeoutMs: 15_000,
     maxOutputBytes: 8 * 1024,
   });
-  if (!root.ok) throw new Error(`CAMPAIGN_WORKSPACE_PATH_OCCUPIED: ${path}`);
+  if (!root.ok) throw new Error(`MANAGED_WORKSPACE_PATH_OCCUPIED: ${path}`);
   if (realpathSync(root.stdout.trim()) !== realpathSync(path)) {
-    throw new Error(`CAMPAIGN_WORKSPACE_PATH_MISMATCH: ${path}`);
+    throw new Error(`MANAGED_WORKSPACE_PATH_MISMATCH: ${path}`);
   }
   const currentBranch = git(path, ['branch', '--show-current']);
   if (currentBranch !== branch) {
-    throw new Error(`CAMPAIGN_WORKSPACE_BRANCH_MISMATCH: expected ${branch}, found ${currentBranch || 'detached'}`);
+    throw new Error(`MANAGED_WORKSPACE_BRANCH_MISMATCH: expected ${branch}, found ${currentBranch || 'detached'}`);
   }
   return true;
 }
 
 function manifestPath(controllerHome: string, repoId: string, identity: string): string {
-  return join(repositoryControllerRoot(controllerHome, repoId), 'campaigns', 'workspaces', `${identity}.json`);
+  return join(repositoryControllerRoot(controllerHome, repoId), 'managed-workspaces', `${identity}.json`);
 }
 
-export function currentCampaignWorkspace(repository: RepositoryRecord): CampaignWorkspace {
+export function currentManagedWorkspace(repository: RepositoryRecord): ManagedWorkspace {
   return {
     mode: 'current',
     checkoutId: repository.activeCheckoutId,
@@ -106,41 +108,40 @@ export function currentCampaignWorkspace(repository: RepositoryRecord): Campaign
 export function ensureManagedWorkspace(
   controllerHome: string,
   repository: RepositoryRecord,
-  input: EnsureCampaignWorkspaceInput,
-): CampaignWorkspace {
+  input: EnsureManagedWorkspaceInput,
+): ManagedWorkspace {
   const requestId = input.requestId.trim();
-  if (!requestId) throw new Error('CAMPAIGN_REQUEST_ID_REQUIRED');
+  if (!requestId) throw new Error('MANAGED_WORKSPACE_REQUEST_ID_REQUIRED');
   const identity = suffix(repository.repoId, requestId);
   const sourceRoot = repository.canonicalRoot;
   const requestedBranch = assertBranch(
     sourceRoot,
-    input.branchName?.trim() || campaignBranchName({ title: input.title, identity }),
+    input.branchName?.trim() || `work/${branchSlugSegment(input.title)}-${identity}`,
   );
   const requestedBaseRef = input.baseRef?.trim() || 'HEAD';
   const requestedPath = managedWorktreePath(
     controllerHome,
     repository.repoId,
-    `campaign-${identity}`,
+    `work-${identity}`,
     listRepositories(controllerHome, { includeRemoved: true }),
   );
   const statePath = manifestPath(controllerHome, repository.repoId, identity);
 
   return withControllerLock(
     controllerHome,
-    { scope: 'worktree', repoId: repository.repoId, worktreeId: `campaign-${identity}` },
-    `ensure-campaign-workspace:${requestId}`,
+    { scope: 'worktree', repoId: repository.repoId, worktreeId: `work-${identity}` },
+    `ensure-managed-workspace:${requestId}`,
     () => {
-      const manifest = existsSync(statePath) ? readJsonFile<CampaignWorkspaceManifest>(statePath) : undefined;
+      const manifest = existsSync(statePath) ? readJsonFile<ManagedWorkspaceManifest>(statePath) : undefined;
       if (manifest && (
         manifest.repoId !== repository.repoId
         || manifest.requestId !== requestId
         || manifest.branch !== requestedBranch
       )) {
-        throw new Error(`CAMPAIGN_WORKSPACE_REQUEST_CONFLICT: ${requestId}`);
+        throw new Error(`MANAGED_WORKSPACE_REQUEST_CONFLICT: ${requestId}`);
       }
       const branch = manifest?.branch ?? requestedBranch;
-      // Existing manifests are authoritative compatibility evidence. They may
-      // point at legacy nested worktrees; never move an active worktree in place.
+      // Persisted manifests are authoritative evidence; never move an active worktree in place.
       const path = manifest?.path ? resolve(manifest.path) : requestedPath;
       const baseRevision = manifest?.baseRevision ?? git(sourceRoot, ['rev-parse', '--verify', `${requestedBaseRef}^{commit}`]);
 
@@ -156,7 +157,7 @@ export function ensureManagedWorkspace(
         }
       }
       if (!repositoryCheckoutRootMatches(repository, path)) {
-        throw new Error(`CAMPAIGN_WORKSPACE_REPOSITORY_MISMATCH: ${path}`);
+        throw new Error(`MANAGED_WORKSPACE_REPOSITORY_MISMATCH: ${path}`);
       }
 
       const record = addRepositoryCheckout({
@@ -170,7 +171,7 @@ export function ensureManagedWorkspace(
         existsSync(candidate.canonicalRoot)
         && realpathSync(candidate.canonicalRoot) === canonicalWorkspacePath,
       );
-      if (!checkout) throw new Error(`CAMPAIGN_WORKSPACE_CHECKOUT_NOT_REGISTERED: ${path}`);
+      if (!checkout) throw new Error(`MANAGED_WORKSPACE_CHECKOUT_NOT_REGISTERED: ${path}`);
       const selected = selectRepositoryCheckout(record, checkout.checkoutId);
       if (!manifest) {
         writeJsonAtomic(statePath, {
@@ -181,7 +182,7 @@ export function ensureManagedWorkspace(
           path: selected.canonicalRoot,
           baseRevision,
           createdAt: new Date().toISOString(),
-        } satisfies CampaignWorkspaceManifest);
+        } satisfies ManagedWorkspaceManifest);
       }
       return {
         mode: 'isolated',
@@ -190,11 +191,8 @@ export function ensureManagedWorkspace(
         branch,
         baseRevision,
         managed: true,
-      } satisfies CampaignWorkspace;
+      } satisfies ManagedWorkspace;
     },
     120_000,
   );
 }
-
-/** @deprecated Campaign compatibility alias. New Work paths use ensureManagedWorkspace. */
-export const ensureCampaignWorkspace = ensureManagedWorkspace;

package/src/runtime/execution/process-runtime/check-facade.ts

@@ -52,6 +52,12 @@ export interface RunCheckFacadeInput {
     issueId?: string;
     taskId?: string;
   };
+  /** Work-scoped verification runs against HEAD plus only scope-owned dirty paths. */
+  verificationSnapshot?: {
+    workId: string;
+    allowedPaths: readonly string[];
+    forbiddenPaths: readonly string[];
+  };
 }
 
 export function processCheckSemanticScopeKey(

package/src/runtime/execution/process-runtime/check-result.ts

@@ -0,0 +1,45 @@
+import { createHash, randomUUID } from 'crypto';
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'fs';
+import { dirname, join } from 'path';
+import { processLogDir } from './store';
+
+export interface PersistedCheckResultReceipt {
+  schemaVersion: 1;
+  receiptId: string;
+  checkId: string;
+  cacheKey: string;
+  ok: boolean;
+  status: number;
+  timedOut: boolean;
+  failureClass?: 'acceptance_failure' | 'infrastructure_failure';
+  validatedRevision?: string;
+  executedAt: string;
+  originalExecutedAt?: string;
+  cacheHit?: boolean;
+}
+
+export function allocatePersistedCheckResultReceiptPath(controllerHome: string, repoId: string): string {
+  const root = join(processLogDir(controllerHome, repoId), 'check-results');
+  mkdirSync(root, { recursive: true });
+  return join(root, `${randomUUID()}.json`);
+}
+
+export function writePersistedCheckResultReceipt(path: string, input: Omit<PersistedCheckResultReceipt, 'schemaVersion' | 'receiptId'>): PersistedCheckResultReceipt {
+  const digest = createHash('sha256').update(JSON.stringify(input)).digest('hex');
+  const receipt: PersistedCheckResultReceipt = { schemaVersion: 1, receiptId: `check_result_${digest.slice(0, 24)}`, ...input };
+  mkdirSync(dirname(path), { recursive: true });
+  const temporary = `${path}.${process.pid}.${Date.now()}.tmp`;
+  writeFileSync(temporary, `${JSON.stringify(receipt, null, 2)}\n`, { mode: 0o600 });
+  renameSync(temporary, path);
+  return receipt;
+}
+
+export function readPersistedCheckResultReceipt(path: string | undefined): PersistedCheckResultReceipt | undefined {
+  if (!path || !existsSync(path)) return undefined;
+  try {
+    const value = JSON.parse(readFileSync(path, 'utf8')) as PersistedCheckResultReceipt;
+    return value?.schemaVersion === 1 && typeof value.receiptId === 'string' && typeof value.cacheKey === 'string' ? value : undefined;
+  } catch {
+    return undefined;
+  }
+}

package/src/runtime/execution/process-runtime/check-runner-sidecar.ts

@@ -1,16 +1,21 @@
 #!/usr/bin/env bun
 import { createHash } from 'crypto';
+import { rmSync } from 'fs';
 import { resolve } from 'path';
 import {
-  runControllerCheck,
+  controllerCheckExecutionIdentity,
+  runControllerCheckAsync,
   snapshotControllerCheck,
 } from '../../../cli/controller/check-runner';
+import { writePersistedCheckResultReceipt } from './check-result';
 
 interface ParsedArgs {
   repo: string;
   checkId: string;
   timeoutMs?: number;
   expectedCheckFingerprint: string;
+  resultReceiptPath?: string;
+  cleanupRoot?: string;
 }
 
 function requiredValue(argv: string[], flag: string): string {
@@ -31,30 +36,51 @@ function parseArgs(argv: string[]): ParsedArgs {
     checkId: requiredValue(argv, '--check-id'),
     timeoutMs,
     expectedCheckFingerprint: requiredValue(argv, '--expected-check-fingerprint'),
+    resultReceiptPath: argv.includes('--result-receipt') ? requiredValue(argv, '--result-receipt') : undefined,
+    cleanupRoot: argv.includes('--cleanup-root') ? requiredValue(argv, '--cleanup-root') : undefined,
   };
 }
 
-export function runPersistedCheckSidecar(argv = process.argv.slice(2)): number {
+export async function runPersistedCheckSidecar(argv = process.argv.slice(2)): Promise<number> {
   const args = parseArgs(argv);
   const root = resolve(args.repo);
-  const snapshot = snapshotControllerCheck(root, args.checkId);
-  const actualFingerprint = createHash('sha256').update(JSON.stringify(snapshot)).digest('hex');
-  if (actualFingerprint !== args.expectedCheckFingerprint) {
-    throw new Error('CHECK_SNAPSHOT_CHANGED: registered check changed before Process Runtime execution');
+  try {
+    const snapshot = snapshotControllerCheck(root, args.checkId);
+    const actualFingerprint = createHash('sha256').update(JSON.stringify(snapshot)).digest('hex');
+    if (actualFingerprint !== args.expectedCheckFingerprint) {
+      throw new Error('CHECK_SNAPSHOT_CHANGED: registered check changed before Process Runtime execution');
+    }
+    const identity = controllerCheckExecutionIdentity(root, args.checkId, args.timeoutMs, snapshot);
+    const result = await runControllerCheckAsync(root, args.checkId, { requestedTimeoutMs: args.timeoutMs, snapshot });
+    if (args.resultReceiptPath) {
+      writePersistedCheckResultReceipt(args.resultReceiptPath, {
+        checkId: args.checkId,
+        cacheKey: identity.cacheKey,
+        ok: result.ok,
+        status: result.status,
+        timedOut: result.timedOut,
+        failureClass: result.failureClass,
+        validatedRevision: result.validatedRevision,
+        executedAt: result.executedAt,
+        originalExecutedAt: result.originalExecutedAt,
+        cacheHit: result.cacheHit,
+      });
+    }
+    if (result.stdout) process.stdout.write(result.stdout);
+    if (result.stderr) process.stderr.write(result.stderr.endsWith('\n') ? result.stderr : `${result.stderr}\n`);
+    return result.ok ? 0 : Math.max(1, result.status || 1);
+  } finally {
+    if (args.cleanupRoot) rmSync(resolve(args.cleanupRoot), { recursive: true, force: true });
   }
-  const result = runControllerCheck(root, args.checkId, args.timeoutMs, snapshot);
-  if (result.stdout) process.stdout.write(result.stdout);
-  if (result.stderr) process.stderr.write(result.stderr.endsWith('\n') ? result.stderr : `${result.stderr}\n`);
-  return result.ok ? 0 : Math.max(1, result.status || 1);
 }
 
 const direct = typeof process.argv[1] === 'string'
   && (process.argv[1].includes('check-runner-sidecar') || process.argv[1].endsWith('/forge-check-runner'));
 if (direct) {
-  try {
-    process.exitCode = runPersistedCheckSidecar();
-  } catch (error) {
-    console.error(error instanceof Error ? error.message : String(error));
-    process.exitCode = 1;
-  }
+  void runPersistedCheckSidecar()
+    .then((code) => { process.exitCode = code; })
+    .catch((error) => {
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exitCode = 1;
+    });
 }