@moretea-labs/forge 1.5.1 → 1.7.0

package/scripts/check-runtime-architecture.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { readFileSync, existsSync, readdirSync } from 'node:fs';
+import { readFileSync, existsSync, lstatSync, readdirSync } from 'node:fs';
 import { resolve } from 'node:path';
 
 const root = resolve(new URL('..', import.meta.url).pathname);
@@ -15,8 +15,16 @@ function text(path) {
 function requireText(path, needle) {
   if (!text(path).includes(needle)) failures.push(`${path} must contain ${JSON.stringify(needle)}`);
 }
+function hasFilesystemContent(path) {
+  const absolute = resolve(root, path);
+  if (!existsSync(absolute)) return false;
+  if (!lstatSync(absolute).isDirectory()) return true;
+  return readdirSync(absolute, { withFileTypes: true }).some((entry) =>
+    entry.isDirectory() ? hasFilesystemContent(`${path}/${entry.name}`) : true,
+  );
+}
 function requireMissing(path) {
-  if (existsSync(resolve(root, path))) failures.push(`${path} must be deleted`);
+  if (hasFilesystemContent(path)) failures.push(`${path} must be deleted`);
 }
 function requireMatch(path, expression, description) {
   if (!expression.test(text(path))) failures.push(`${path} must ${description}`);
@@ -44,10 +52,42 @@ function sourceFiles(directory) {
   return files;
 }
 
+const allowedArchitectureRootMarkdown = new Set(['CURRENT.md', 'EVOLUTION.md', 'history.md', 'index.md']);
+const architectureRootMarkdown = readdirSync(resolve(root, 'docs/architecture'), { withFileTypes: true })
+  .filter((entry) => entry.isFile() && entry.name.endsWith('.md'))
+  .map((entry) => entry.name)
+  .sort();
+for (const name of architectureRootMarkdown) {
+  if (!allowedArchitectureRootMarkdown.has(name)) {
+    failures.push(`docs/architecture/${name} must be archived under docs/architecture/history/ instead of acting as parallel root architecture authority`);
+  }
+}
+
+for (const path of ['README.md', 'docs/ROADMAP.md', 'docs/architecture/CURRENT.md', 'docs/architecture/index.md']) {
+  forbid(path, /\/Users\//, 'maintained documentation must not contain personal absolute macOS paths');
+  forbid(path, /\bRepo Harness\b/i, 'maintained documentation must use the current Forge product identity');
+  forbid(path, /(?:^|\n)\s*(?:>\s*)?(?:\*\*)?Status(?:\*\*)?\s*:\s*[^\n]*(?:implementation in progress|Phase\s+\d+)/i, 'maintained documentation must not carry transient execution status; use Plan/Work/evidence or history');
+}
+
 const required = [
   'src/runtime/gateway/mcp/router.ts',
   'src/cli/agent-jobs/executable-resolver.ts',
   'src/runtime/control-plane/global-scheduler/scheduler.ts',
+  'src/runtime/control-plane/global-scheduler/config.ts',
+  'src/runtime/control-plane/global-scheduler/state.ts',
+  'src/runtime/control-plane/global-scheduler/worker-launch.ts',
+  'src/runtime/control-plane/global-scheduler/dispatch-capacity.ts',
+  'src/runtime/control-plane/global-scheduler/projection-refresh.ts',
+  'src/runtime/control-plane/global-scheduler/worker-lifecycle.ts',
+  'src/runtime/control-plane/global-scheduler/worker-stderr.ts',
+  'src/runtime/control-plane/global-scheduler/worker-attachment.ts',
+  'src/runtime/control-plane/global-scheduler/worker-lifecycle-store.ts',
+  'src/runtime/control-plane/global-scheduler/maintenance.ts',
+  'src/runtime/control-plane/global-scheduler/source-scan.ts',
+  'src/runtime/control-plane/global-scheduler/durable-admission.ts',
+  'src/runtime/control-plane/global-scheduler/worker-exit-decision.ts',
+  'src/runtime/control-plane/global-scheduler/worker-exit-reconciler.ts',
+  'src/runtime/control-plane/global-scheduler/worker-process.ts',
   'src/runtime/control-plane/repo-actor/actor.ts',
   'src/runtime/execution/jobs/store.ts',
   'src/runtime/execution/jobs/timeouts.ts',
@@ -56,8 +96,7 @@ const required = [
   'src/runtime/execution/thin-harness/index.ts',
   'src/runtime/execution/thin-harness/execution-router.ts',
   'src/runtime/control-plane/routing/route-policy.ts',
-  'docs/architecture/current/route-policy.md',
-  'docs/architecture/current/thin-harness-v1.md',
+  'docs/architecture/CURRENT.md',
   'src/runtime/resources/leases/store.ts',
   'src/runtime/evidence/event-ledger.ts',
   'src/runtime/evidence/evidence-store.ts',
@@ -70,8 +109,6 @@ const required = [
   'src/runtime/workflow/schedules/work-continuation.ts',
   'scripts/smoke-runtime-recovery.ts',
   'scripts/smoke-schedule-engine.ts',
-  'src/runtime/workflow/portfolio/engine.ts',
-  'src/runtime/workflow/findings/store.ts',
   'src/runtime/release/release-gate.ts',
   'src/runtime/root/runtime.ts',
   'src/runtime/root/readiness.ts',
@@ -85,12 +122,6 @@ const required = [
   'src/cli/commands/init-hook.ts',
   'src/cli/commands/runtime.ts',
   'src/cli/index.ts',
-  'docs/architecture/current/runtime-architecture-simplification.md',
-  'docs/architecture/current/implementation-status.md',
-  'docs/architecture/current/runtime-directory-map.md',
-  'docs/architecture/current/operations-runbook.md',
-  'docs/architecture/current/target-requirements-traceability.md',
-  'docs/architecture/current/approved-target-architecture.zh-CN.md',
 ];
 for (const path of required) text(path);
 requireText('src/runtime/control-plane/routing/route-policy.ts', "export function decideRoute");
@@ -110,7 +141,6 @@ forbidBetween(
 for (const adapter of [
   'src/cli/controller/work-mode.ts',
   'src/runtime/control-plane/facade/types.ts',
-  'src/runtime/control-plane/goal-loop/executor-router.ts',
 ]) {
   requireText(adapter, '@deprecated Compatibility adapter');
   requireText(adapter, 'decideRoute(');
@@ -126,6 +156,16 @@ requireMissing('src/runtime/control-plane/daemon-entry.ts');
 requireMissing('scripts/smoke-runtime-control-plane.ts');
 requireMissing('src/cli/controller/lifecycle.ts');
 requireMissing('src/cli/commands/supervisor.ts');
+requireMissing('src/runtime/control-plane/goal-loop');
+requireMissing('src/cli/repositories/goal-registry.ts');
+requireMissing('src/runtime/assistant');
+requireMissing('src/runtime/personal-assistant');
+requireMissing('src/runtime/workflow/findings');
+forbid(
+  'src/runtime/control-plane/global-scheduler/scheduler.ts',
+  /tickGoalLoopsForController|lastGoalLoopTick/,
+  'Scheduler must not restore autonomous Goal Loop polling',
+);
 requireMissing('src/cli/controller/restart-coordinator-entry.ts');
 requireMissing('scripts/controller-runtime.sh');
 requireMissing('scripts/activate-source-baseline.command');
@@ -145,6 +185,13 @@ requireMissing('OPTIMIZATION_REPORT.md');
 requireMissing('docs/architecture/RELIABILITY-PROGRAM.md');
 requireMissing('docs/architecture/p0-canonical-single-runtime-plan.md');
 requireMissing('docs/architecture/transactional-adoption-planner.md');
+requireMissing('docs/architecture/global-hook-runtime.md');
+requireMissing('docs/architecture/ios-semantic-automation-provider-v2.md');
+requireMissing('docs/architecture/chatgpt-handoff-facade.md');
+requireText('docs/architecture/history/global-hook-runtime.md', 'Status: **Historical Evidence — Not Runtime Authority**');
+requireText('docs/architecture/history/ios-semantic-automation-provider-v2.md', 'Status: **Historical Design Evidence — Not Runtime Authority**');
+requireText('docs/architecture/history/chatgpt-handoff-facade.md', 'Status: **Historical Design Rationale — Not Runtime Authority**');
+requireText('docs/architecture/history/README.md', 'Status: **Historical Evidence — Not Runtime Authority**');
 requireMissing('docs/operations/20260802-requirement-portfolio-migration.md');
 requireMissing('docs/runbooks/RELIABILITY-SESSION-PROTOCOL.md');
 requireMissing('docs/architecture/decisions/20260718-mcp-session-lifecycle-and-ingress-isolation.md');
@@ -156,6 +203,7 @@ requireMissing('bin/repo-harness-hook.mjs');
 requireMissing('bin/repo-harness-runtime.mjs');
 requireMissing('src/runtime/control-plane/daemon-client.ts');
 requireMissing('src/runtime/control-plane/daemon-ownership.ts');
+requireMissing('src/runtime/workflow/portfolio');
 for (const path of sourceFiles('src')) {
   const source = text(path);
   for (const retiredAuthority of [
@@ -209,24 +257,16 @@ for (const projectionPath of [
 }
 requireText('src/runtime/projections/invalidation.ts', 'runtimeInstanceId?: string');
 requireText('src/runtime/projections/materialized-view.ts', 'currentOwner.runtimeInstanceId !== owner.runtimeInstanceId');
-requireText('src/runtime/control-plane/global-scheduler/scheduler.ts', 'getRuntimeWriteClaim()?.runtimeInstanceId');
+requireText('src/runtime/control-plane/global-scheduler/projection-refresh.ts', 'getRuntimeWriteClaim()?.runtimeInstanceId');
 forbid(
   'src/runtime/execution/jobs/receipt-store.ts',
   /ownerEpoch|releaseFencingToken/,
   'persist only non-secret Canonical Runtime/release identity in OperationReceipt ownership evidence',
 );
 
-requireText('docs/architecture/current/runtime-architecture-simplification.md', 'one local MCP application');
-requireText('docs/architecture/current/runtime-architecture-simplification.md', 'one active Runtime');
-requireText('docs/architecture/current/runtime-architecture-simplification.md', 'one whole-Runtime readiness result');
-requireText('docs/architecture/current/runtime-architecture-simplification.md', 'Legacy code may receive only deletion-enabling or safety-fencing changes.');
-forbidBetween(
-  'docs/architecture/current/runtime-architecture-simplification.md',
-  '## 2. Target Runtime',
-  '## 3. Seven phases',
-  /Stable Supervisor|Stable Ingress|blue\/green|candidate\/current\/previous/i,
-  'define the target Runtime without Supervisor, ingress, slots, or component rollback',
-);
+requireText('docs/architecture/CURRENT.md', 'Canonical Runtime is activated as one immutable whole release');
+requireText('docs/architecture/CURRENT.md', 'Runtime availability/recovery keeps Forge itself healthy');
+requireText('docs/architecture/CURRENT.md', 'Historical Issue/Task/Local Job and compatibility projections must not become second mutable authorities.');
 requireText('src/runtime/root/runtime.ts', 'export class CanonicalForgeRuntime');
 forbid('src/runtime/control-plane/runtime-status-client.ts', /ensureControllerDaemon|child_process|daemon-entry|StableSupervisor|ownerEpoch|slot\?:/, 'keep Forge Runtime status observation read-only and free of legacy lifecycle authority');
 requireText('src/runtime/root/runtime.ts', "startInProcessScheduler");
@@ -354,21 +394,11 @@ forbid(
   /\bcreateExecutionJob\b/,
   'Runtime MCP tools must not retain dormant ExecutionJob creation paths',
 );
-forbid(
-  'src/runtime/assistant/intent.ts',
-  /\bcreateExecutionJob\b/,
-  'Assistant intent and routine triggers must use direct plugin actions or external-Controller handoffs',
-);
 forbid(
   'src/runtime/execution/jobs/legacy-adapter.ts',
   /\bcreateExecutionJob\b|\bdispatchLegacyLocalJob\b/,
   'Legacy Local Bridge compatibility must be read-only and must not dispatch new ExecutionJobs',
 );
-forbid(
-  'src/runtime/workflow/portfolio/engine.ts',
-  /\bcreateExecutionJob\b|\bfindExecutionJob\b/,
-  'Portfolio definitions are planning records; Kernel-owned Portfolio execution is retired',
-);
 forbid(
   'src/cli/local-bridge/server.ts',
   /\bsubmitLocalBridgeJob\b|\bdispatchLocalBridgeJob\b|\basyncExecute\b/,
@@ -425,16 +455,6 @@ forbid(
   /\bretryAgentJob\b/,
   'Legacy MCP must not call Agent Run retry',
 );
-forbid(
-  'src/runtime/workflow/portfolio/engine.ts',
-  /\bacceptTaskJob\b|\bstartTaskJob\b|\bretryAgentJob\b/,
-  'Portfolio Engine must not start or retry Kernel-managed Agent Runs',
-);
-forbid(
-  'src/runtime/control-plane/goal-loop/goal-loop-engine.ts',
-  /\bcreateExecutionJob\b|\bsubmitLocalBridgeJob\b|\bacceptTaskJob\b|\bstartTaskJob\b|\bdispatchProvider\b/,
-  'Goal Loop must not create Jobs, Agent Runs, or invoke Kernel Provider dispatch',
-);
 forbid('src/runtime/gateway/mcp/router.ts', /Use process_get \/ process_wait \/ process_logs/, 'Gateway follow-up instructions must use an always-exposed neutral Work facade');
 requireMatch(
   'src/runtime/gateway/mcp/router.ts',
@@ -446,12 +466,6 @@ requireText('src/runtime/gateway/mcp/runtime-tools.ts', "case 'local_bridge_stat
 requireText('src/runtime/gateway/mcp/runtime-tools.ts', 'readAgentExecutableReadinessSnapshot');
 requireText('src/runtime/gateway/mcp/runtime-tools.ts', 'connectorExposedTools');
 requireText('src/runtime/gateway/mcp/runtime-tools.ts', 'currentCallableTools');
-forbid(
-  'docs/architecture/current/implementation-status.md',
-  /Stable external lifecycle Supervisor \| Implemented|Stable ingress event-loop isolation \| Implemented/,
-  'legacy Supervisor or Stable Ingress must not be reported as the target implementation',
-);
-requireText('docs/architecture/current/implementation-status.md', 'Canonical Single Runtime vertical slice');
 forbid('src/runtime/gateway/mcp/runtime-tools.ts', /inspectAgentExecutableReadiness|resolveAgentExecutable|writeAgentExecutableReadinessSnapshot/, 'Gateway readiness must only read the Daemon-produced Agent executable snapshot');
 forbidBetween(
   'src/runtime/gateway/mcp/runtime-tools.ts',
@@ -491,15 +505,50 @@ requireText('src/runtime/execution/jobs/receipt-store.ts', "state: 'started' | '
 requireText('src/runtime/execution/thin-harness/execution-router.ts', "mode: 'fast'");
 requireText('src/runtime/execution/thin-harness/execution-router.ts', 'routeExecution');
 requireText('src/runtime/execution/thin-harness/types.ts', 'FastExecutionReceipt');
-requireText('docs/architecture/current/thin-harness-v1.md', 'Default to direct Fast Path execution');
+requireText('docs/architecture/CURRENT.md', '### Ephemeral Direct — default');
 requireText('src/runtime/resources/leases/types.ts', 'fencingToken: number');
 requireText('src/runtime/resources/leases/store.ts', 'assertFencingToken');
 requireText('src/runtime/resources/leases/store.ts', 'expectedLeaseMap');
 requireText('src/runtime/resources/claims/conflicts.ts', "'repo-content:*'");
 requireText('src/runtime/control-plane/repo-actor/actor.ts', 'repo-actor-mailbox');
 requireText('src/runtime/control-plane/global-scheduler/scheduler.ts', 'maxConcurrentRepositories');
-requireText('src/runtime/control-plane/global-scheduler/scheduler.ts', 'maxHeavyChecks');
-requireText('src/runtime/control-plane/global-scheduler/scheduler.ts', 'maxAgentProcesses');
+requireText('src/runtime/control-plane/global-scheduler/scheduler.ts', 'createSchedulerDispatchCapacity');
+requireText('src/runtime/control-plane/global-scheduler/dispatch-capacity.ts', 'maxHeavyChecks');
+requireText('src/runtime/control-plane/global-scheduler/dispatch-capacity.ts', 'maxAgentProcesses');
+requireText('src/runtime/control-plane/global-scheduler/scheduler.ts', 'normalizeSchedulerConfig');
+requireText('src/runtime/control-plane/global-scheduler/config.ts', 'normalizeSchedulerConfig');
+requireText('src/runtime/control-plane/global-scheduler/scheduler.ts', 'writeSchedulerHealthSnapshot');
+requireText('src/runtime/control-plane/global-scheduler/state.ts', 'writeSchedulerHealthSnapshot');
+requireText('src/runtime/control-plane/global-scheduler/scheduler.ts', 'buildSchedulerWorkerLaunchDescriptor');
+requireText('src/runtime/control-plane/global-scheduler/worker-launch.ts', 'buildSchedulerWorkerLaunchDescriptor');
+requireText('src/runtime/control-plane/global-scheduler/scheduler.ts', 'refreshSchedulerRepositoryProjections');
+requireText('src/runtime/control-plane/global-scheduler/projection-refresh.ts', 'refreshRepositoryProjectionForRepository');
+requireText('src/runtime/control-plane/global-scheduler/scheduler.ts', 'buildSchedulerWorkerSpawnedLifecycle');
+requireText('src/runtime/control-plane/global-scheduler/worker-lifecycle.ts', 'buildSchedulerWorkerExitFailure');
+requireText('src/runtime/control-plane/global-scheduler/scheduler.ts', 'createSchedulerWorkerStderrCapture');
+requireText('src/runtime/control-plane/global-scheduler/worker-stderr.ts', 'MAX_SCHEDULER_WORKER_STDERR_BYTES');
+requireText('src/runtime/control-plane/global-scheduler/scheduler.ts', 'persistSchedulerWorkerAttachment');
+requireText('src/runtime/control-plane/global-scheduler/worker-attachment.ts', 'attachExecutionWorker');
+requireText('src/runtime/control-plane/global-scheduler/scheduler.ts', 'runSchedulerPeriodicCleanup');
+requireText('src/runtime/control-plane/global-scheduler/maintenance.ts', 'runSchedulerValidationReconciliation');
+requireText('src/runtime/control-plane/global-scheduler/scheduler.ts', 'planSchedulerSourceSampling');
+requireText('src/runtime/control-plane/global-scheduler/source-scan.ts', 'selectSchedulerSourceScanRepositories');
+requireText('src/runtime/control-plane/global-scheduler/scheduler.ts', 'runSchedulerDurableAdmission');
+requireText('src/runtime/control-plane/global-scheduler/durable-admission.ts', 'markExecutionJobSchedulerObserved');
+requireText('src/runtime/control-plane/global-scheduler/worker-exit-reconciler.ts', 'persistSchedulerTerminalWorkerLifecycle');
+requireText('src/runtime/control-plane/global-scheduler/worker-lifecycle-store.ts', 'TERMINAL_JOB_STATUSES');
+requireText('src/runtime/control-plane/global-scheduler/worker-exit-reconciler.ts', 'evaluateSchedulerWorkerExitCandidate');
+requireText('src/runtime/control-plane/global-scheduler/worker-exit-decision.ts', 'TERMINAL_JOB_STATUSES');
+requireText('src/runtime/control-plane/global-scheduler/scheduler.ts', 'reconcileSchedulerWorkerExit');
+requireText('src/runtime/control-plane/global-scheduler/worker-exit-reconciler.ts', 'releaseExecutionLeases');
+requireText('src/runtime/control-plane/global-scheduler/scheduler.ts', 'cleanupSchedulerWorkerProcesses');
+requireText('src/runtime/control-plane/global-scheduler/scheduler.ts', 'registerSchedulerWorkerProcess');
+requireText('src/runtime/control-plane/global-scheduler/scheduler.ts', 'spawnSchedulerWorkerProcess');
+requireText('src/runtime/control-plane/global-scheduler/scheduler.ts', 'wireSchedulerWorkerProcess');
+requireText('src/runtime/control-plane/global-scheduler/worker-process.ts', 'cleanupSchedulerWorkerProcesses');
+requireText('src/runtime/control-plane/global-scheduler/worker-process.ts', 'dependencies.spawnProcess');
+requireText('src/runtime/control-plane/global-scheduler/worker-process.ts', 'terminateProcessTree');
+requireText('src/runtime/control-plane/global-scheduler/worker-process.ts', "child.once('close'");
 requireText('src/runtime/control-plane/global-scheduler/scheduler.ts', 'writeAgentExecutableReadinessSnapshot');
 requireText('src/runtime/control-plane/global-scheduler/scheduler.ts', 'sampleRepositoryGitStatusForRepositories');
 requireText('src/cli/agent-jobs/executable-resolver.ts', 'revalidateAgentExecutable');
@@ -533,7 +582,7 @@ forbidBetween(
 requireText('src/runtime/control-plane/execution/session-store.ts', 'lastValidatedAt: now');
 requireText('src/runtime/control-plane/execution/validation.ts', 'warnings.push');
 requireText('src/runtime/control-plane/execution/work-handle-store.ts', "failed: ['validating', 'editing', 'committed', 'merged', 'cleaned', 'failed_terminal_cleanup']");
-requireText('src/runtime/gateway/mcp/execution-tools.ts', 'resetFailedFinalizationStages');
+requireText('src/runtime/gateway/mcp/execution-tools.ts', 'resetFinalizationStagesForRequest');
 requireText('src/runtime/gateway/mcp/execution-tools.ts', 'finalizationComplete');
 forbidBetween(
   'src/runtime/gateway/mcp/execution-tools.ts',
@@ -546,9 +595,6 @@ requireText('src/runtime/workflow/schedules/types.ts', "'repository-event'");
 requireText('src/runtime/workflow/schedules/types.ts', "'dependency-checkpoint'");
 requireText('src/runtime/workflow/schedules/store.ts', 'saveScheduleDecision');
 requireText('src/runtime/workflow/schedules/settlement.ts', 'backoffMinutes');
-requireText('src/runtime/workflow/portfolio/store.ts', "'workflows.json'");
-requireText('src/runtime/workflow/portfolio/store.ts', 'PORTFOLIO_DEPENDENCY_CYCLE');
-requireText('src/runtime/workflow/findings/store.ts', 'observationCount');
 requireText('src/runtime/release/release-gate.ts', 'releaseReady');
 requireText('src/cli/mcp/transports/http.ts', "'/ready'");
 requireText('src/cli/mcp/transports/http.ts', "'/repos/:repoId/health'");
@@ -568,12 +614,9 @@ for (const path of [
   forbid(path, /\b(?:spawnSync|execSync|execFileSync)\s*\(/, 'the non-blocking Gateway/Controller hot-path rule');
 }
 
-requireText('docs/architecture/current/implementation-status.md', 'Thin MCP Gateway | Implemented');
-requireText('docs/architecture/current/implementation-status.md', 'Per-Repository Actor | Implemented');
-requireText('docs/architecture/current/implementation-status.md', 'Schedule, Trigger, Decision and Occurrence | Implemented');
-requireText('docs/architecture/current/implementation-status.md', 'Release Freeze and Gate | Implemented');
-requireText('docs/architecture/current/target-requirements-traceability.md', '## 4. Architecture constitution');
-requireText('docs/architecture/current/target-requirements-traceability.md', '## 16. Standard execution flow');
+requireText('docs/architecture/CURRENT.md', '## State ownership');
+requireText('docs/architecture/CURRENT.md', '## Runtime and MCP boundary');
+requireText('docs/architecture/CURRENT.md', '## Testing and verification');
 requireText('plans/README.md', 'not the runtime execution queue');
 if (text('src/cli/mcp/tools.ts').split(/\r?\n/).length > 40) failures.push('src/cli/mcp/tools.ts must remain a thin compatibility facade');
 

package/scripts/check-stable-baseline.ts

@@ -0,0 +1,92 @@
+#!/usr/bin/env bun
+import { createHash } from 'crypto';
+import { mkdirSync, renameSync, writeFileSync } from 'fs';
+import { dirname, join } from 'path';
+import { resolveControllerHome } from '../src/cli/repositories/controller-home';
+import { recoveryConnectorDescriptor, verifyRecoveryConnector } from '../src/cli/commands/recovery';
+import { loadRecoveryConfig, verifyStableRuntime } from '../src/runtime/standalone-recovery/core';
+import { observeRuntimeStatus } from '../src/runtime/root/status';
+
+interface BaselineReceipt {
+  schemaVersion: 1;
+  status: 'passed' | 'failed';
+  controllerHome: string;
+  observedAt: string;
+  runtime: ReturnType<typeof observeRuntimeStatus>;
+  recovery: {
+    connector: ReturnType<typeof recoveryConnectorDescriptor>;
+    runtimeVerify: Awaited<ReturnType<typeof verifyStableRuntime>>;
+    connectorVerify: Awaited<ReturnType<typeof verifyRecoveryConnector>>;
+  };
+  blockers: string[];
+  receiptId: string;
+}
+
+function argValue(name: string): string | undefined {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+function atomicJson(path: string, value: unknown): void {
+  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  const temporary = `${path}.${process.pid}.tmp`;
+  writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+  renameSync(temporary, path);
+}
+
+export async function checkStableBaseline(controllerHomeInput?: string): Promise<BaselineReceipt> {
+  const controllerHome = resolveControllerHome(controllerHomeInput);
+  const config = loadRecoveryConfig(controllerHome);
+  const runtime = observeRuntimeStatus(controllerHome);
+  const connector = recoveryConnectorDescriptor(controllerHome);
+  const runtimeVerify = await verifyStableRuntime(config);
+  const connectorVerify = await verifyRecoveryConnector(controllerHome);
+  const blockers: string[] = [];
+
+  if (!runtime.running || !runtime.ready) blockers.push(`runtime_not_ready:${runtime.reasonCodes.join(',') || 'unknown'}`);
+  if (!runtimeVerify.ok) blockers.push('recovery_runtime_verify_failed');
+  if (!runtimeVerify.releases.coherent) blockers.push('runtime_release_not_coherent');
+  if (!connector.readyForChatGPT) blockers.push(...connector.warnings.map((warning) => `recovery_connector:${warning}`));
+  if (!connectorVerify.ok) blockers.push(...connectorVerify.failures.map((failure) => `recovery_connector_verify:${failure}`));
+  if (!connector.currentRelease) blockers.push('recovery_release_missing');
+
+  const observedAt = new Date().toISOString();
+  const identity = {
+    schemaVersion: 1,
+    controllerHome,
+    runtimeInstanceId: runtime.snapshot?.runtimeInstanceId,
+    runtimeRelease: runtimeVerify.releases.active?.revision,
+    runtimeManifest: runtimeVerify.releases.active?.manifestSha256,
+    runtimeToolSurfaceFingerprint: runtime.snapshot?.toolSurfaceFingerprint,
+    runtimeEndpoint: runtime.snapshot?.endpoint,
+    recoveryRelease: connector.currentRelease,
+    recoveryUrl: connector.url,
+    runtimeReady: runtime.ready,
+    runtimeVerifyOk: runtimeVerify.ok,
+    connectorVerifyOk: connectorVerify.ok,
+  };
+  const receiptId = createHash('sha256').update(JSON.stringify(identity)).digest('hex');
+  const receipt: BaselineReceipt = {
+    schemaVersion: 1,
+    status: blockers.length === 0 ? 'passed' : 'failed',
+    controllerHome,
+    observedAt,
+    runtime,
+    recovery: { connector, runtimeVerify, connectorVerify },
+    blockers,
+    receiptId,
+  };
+
+  const root = join(controllerHome, 'recovery', 'stable-baseline');
+  atomicJson(join(root, `${receiptId}.json`), receipt);
+  atomicJson(join(root, 'latest.json'), receipt);
+  return receipt;
+}
+
+if (import.meta.main) {
+  const explicit = argValue('--controller-home');
+  if (process.argv.includes('--controller-home') && !explicit) throw new Error('STABLE_BASELINE_CONTROLLER_HOME_REQUIRED');
+  const receipt = await checkStableBaseline(explicit);
+  process.stdout.write(`${JSON.stringify(receipt, null, 2)}\n`);
+  if (receipt.status !== 'passed') process.exitCode = 1;
+}

package/scripts/check-task-workflow.sh

@@ -161,7 +161,7 @@ plan_evidence_contract_error() {
   fi
 
   local label line value
-  for label in "State/progress path" "Verification evidence" "Evaluator rubric" "Stop condition" "Rollback surface"; do
+  for label in "State/progress path" "Verification evidence" "Impact review|Evaluator rubric" "Stop condition" "Rollback surface"; do
     line="$(printf '%s\n' "$section" | grep -Ei "^[[:space:]]*-[[:space:]]*(\\*\\*)?${label}(\\*\\*)?[[:space:]]*:" | head -1 || true)"
     if [[ -z "$line" ]]; then
       echo "missing field: ${label}"
@@ -189,7 +189,7 @@ check_plan_template_evidence_contract() {
     return
   }
 
-  for label in "State/progress path" "Verification evidence" "Evaluator rubric" "Stop condition" "Rollback surface"; do
+  for label in "State/progress path" "Verification evidence" "Impact review" "Stop condition" "Rollback surface"; do
     if ! grep -Eiq "^[[:space:]]*-[[:space:]]*(\\*\\*)?${label}(\\*\\*)?[[:space:]]*:" "$file"; then
       report_issue "Plan template Evidence Contract is missing field '${label}': $file"
     fi
@@ -668,11 +668,11 @@ check_helper_runtime_files() {
       new-spec.sh new-sprint.sh new-plan.sh capture-plan.sh plan-to-todo.sh
       contract-run.ts contract-worktree.sh ship-worktrees.sh archive-workflow.sh
       refresh-current-status.sh prepare-handoff.sh verify-contract.sh summarize-failures.sh
-      verify-sprint.sh harness-trace-grade.sh sprint-backlog.sh check-task-sync.sh check-deploy-sql-order.sh
+      verify-sprint.sh sprint-backlog.sh check-task-sync.sh check-deploy-sql-order.sh
       check-architecture-sync.sh check-agent-tooling.sh check-context-files.sh
       check-brain-manifest.sh sync-brain-docs.sh check-skill-version.ts
       select-agent-context-blocks.sh ensure-task-workflow.sh check-task-workflow.sh
-      maintenance-triage.sh heartbeat-triage.sh switch-plan.sh workflow-contract.ts
+      switch-plan.sh workflow-contract.ts
       inspect-project-state.ts migrate-workflow-docs.ts migrate-project-template.sh
       capability-resolver.ts architecture-event.ts capability-config.ts architecture-queue.sh
       archive-architecture-request.sh context-contract-sync.sh workstream-sync.sh

package/scripts/contract-worktree.sh

@@ -456,8 +456,7 @@ finish_worktree() {
     exit 1
   fi
 
-  local current_branch slug active_plan contract_file review_file target_worktree artifact_stem
-  local external_status external_state external_reviewer external_source external_message
+  local current_branch slug active_plan contract_file target_worktree artifact_stem
   current_branch="$(git branch --show-current)"
   [[ -n "$current_branch" ]] || { echo "contract-worktree: detached HEAD is not supported" >&2; exit 1; }
   [[ "$current_branch" != "$target_branch" ]] || { echo "contract-worktree: already on target branch $target_branch" >&2; exit 1; }
@@ -470,7 +469,6 @@ finish_worktree() {
     active_plan="$(get_active_plan || true)"
     if [[ -n "$active_plan" ]]; then
       contract_file="$(workflow_active_contract || true)"
-      review_file="$(workflow_active_review || true)"
     fi
   fi
 
@@ -483,27 +481,9 @@ finish_worktree() {
       contract_file="tasks/contracts/${artifact_stem}.contract.md"
     fi
   fi
-  if [[ -n "${active_plan:-}" && -z "${review_file:-}" ]]; then
-    artifact_stem="${artifact_stem:-$(derive_artifact_stem_from_plan "$active_plan")}"
-    if [[ -f "tasks/reviews/${artifact_stem}.review.md" ]] || [[ ! -f "tasks/reviews/${slug}.review.md" ]]; then
-      review_file="tasks/reviews/${artifact_stem}.review.md"
-    fi
-  fi
   contract_file="${contract_file:-tasks/contracts/${slug}.contract.md}"
-  review_file="${review_file:-tasks/reviews/${slug}.review.md}"
 
   [[ -n "$contract_file" && -f "$contract_file" ]] || { echo "contract-worktree: no active sprint contract found" >&2; exit 1; }
-  [[ -n "$review_file" && -f "$review_file" ]] || { echo "contract-worktree: no active sprint review found" >&2; exit 1; }
-
-  if declare -F workflow_external_acceptance_status >/dev/null 2>&1; then
-    external_status="$(workflow_external_acceptance_status "$review_file")"
-    IFS=$'\t' read -r external_state external_reviewer external_source external_message <<< "$external_status"
-    if [[ "$external_state" != "pass" && "$external_state" != "manual_override" ]]; then
-      echo "contract-worktree: external acceptance gate failed: ${external_message:-missing external acceptance}" >&2
-      echo "contract-worktree: record ## External Acceptance Advice in $review_file via $(workflow_external_acceptance_expected_source) before finish" >&2
-      exit 1
-    fi
-  fi
 
   check_architecture_freshness "$target_branch"
   bash "scripts/verify-sprint.sh"