@moretea-labs/forge 1.6.0 → 1.7.0

package/src/runtime/context/typescript-navigation.ts

@@ -0,0 +1,226 @@
+import { statSync } from 'fs';
+import { dirname, relative, resolve } from 'path';
+import * as ts from 'typescript';
+
+export type TypeScriptNavigationKind = 'definition' | 'references' | 'implementations';
+
+export interface TypeScriptNavigationRequest {
+  navigation: TypeScriptNavigationKind;
+  path: string;
+  line: number;
+  column: number;
+  tsconfigPath?: string;
+}
+
+export interface TypeScriptNavigationLocation {
+  path: string;
+  line: number;
+  column: number;
+  name?: string;
+  kind?: string;
+}
+
+export interface TypeScriptNavigationResult {
+  navigation: TypeScriptNavigationKind;
+  target: { path: string; line: number; column: number };
+  locations: TypeScriptNavigationLocation[];
+}
+
+export interface TypeScriptNavigationAccess {
+  /** Stable identity for one read-policy scope. Restricted and unrestricted projects must never share a Language Service. */
+  cacheScope: string;
+  /** Source identity observed by the caller. A different identity must not reuse project membership. */
+  sourceIdentity?: string;
+  /** Return true only for repository-relative paths that this navigation call may read. */
+  allowRepositoryPath(relativePath: string): boolean;
+}
+
+interface CachedProject {
+  repoRoot: string;
+  configPath: string;
+  service: ts.LanguageService;
+}
+
+const projects = new Map<string, CachedProject>();
+const MAX_CACHED_TYPESCRIPT_PROJECTS = 32;
+
+function normalizePath(path: string): string {
+  return path.replace(/\\/g, '/');
+}
+
+function scriptVersion(path: string): string {
+  try {
+    const stat = statSync(path);
+    return `${stat.mtimeMs}:${stat.size}`;
+  } catch {
+    return 'missing';
+  }
+}
+
+function repositoryRelativePath(repoRoot: string, fileName: string): string | undefined {
+  const normalized = normalizePath(relative(repoRoot, resolve(fileName)));
+  if (!normalized || normalized === '.' || normalized === '..' || normalized.startsWith('../')) return undefined;
+  return normalized;
+}
+
+function loadProject(repoRoot: string, tsconfigPath = 'tsconfig.json', access?: TypeScriptNavigationAccess): CachedProject {
+  const root = resolve(repoRoot);
+  const configPath = resolve(root, tsconfigPath);
+  const configRelative = repositoryRelativePath(root, configPath);
+  if (!configRelative) throw new Error('TypeScript navigation tsconfig must be inside the repository.');
+  if (access && !access.allowRepositoryPath(configRelative)) {
+    throw new Error(`TypeScript navigation tsconfig is denied by read policy: ${configRelative}.`);
+  }
+  const cacheKey = `${root}\0${configPath}\0${scriptVersion(configPath)}\0${access?.cacheScope ?? 'unrestricted'}\0${access?.sourceIdentity ?? 'unbound-source'}`;
+  const cached = projects.get(cacheKey);
+  if (cached) {
+    projects.delete(cacheKey);
+    projects.set(cacheKey, cached);
+    return cached;
+  }
+
+  const canReadAbsolute = (fileName: string): boolean => {
+    if (!access) return true;
+    const repoRelative = repositoryRelativePath(root, fileName);
+    return repoRelative === undefined || access.allowRepositoryPath(repoRelative);
+  };
+  const readAllowedFile = (fileName: string): string | undefined => canReadAbsolute(fileName) ? ts.sys.readFile(fileName) : undefined;
+  const fileExistsAllowed = (fileName: string): boolean => canReadAbsolute(fileName) && ts.sys.fileExists(fileName);
+  const readDirectoryAllowed: typeof ts.sys.readDirectory = (path, extensions, exclude, include, depth) =>
+    ts.sys.readDirectory(path, extensions, exclude, include, depth).filter(canReadAbsolute);
+
+  const config = ts.readConfigFile(configPath, readAllowedFile);
+  if (config.error) {
+    throw new Error(ts.flattenDiagnosticMessageText(config.error.messageText, '\n'));
+  }
+  const parseHost: ts.ParseConfigHost = {
+    useCaseSensitiveFileNames: ts.sys.useCaseSensitiveFileNames,
+    readDirectory: readDirectoryAllowed,
+    fileExists: fileExistsAllowed,
+    readFile: readAllowedFile,
+  };
+  const parsed = ts.parseJsonConfigFileContent(config.config, parseHost, dirname(configPath), undefined, configPath);
+  if (parsed.errors.length > 0) {
+    throw new Error(parsed.errors.map((entry) => ts.flattenDiagnosticMessageText(entry.messageText, '\n')).join('\n'));
+  }
+  const scriptFileNames = parsed.fileNames.filter(canReadAbsolute);
+
+  const host: ts.LanguageServiceHost = {
+    getCompilationSettings: () => parsed.options,
+    getScriptFileNames: () => scriptFileNames,
+    getScriptVersion: scriptVersion,
+    getScriptSnapshot: (fileName) => {
+      if (!fileExistsAllowed(fileName)) return undefined;
+      const content = readAllowedFile(fileName);
+      return content === undefined ? undefined : ts.ScriptSnapshot.fromString(content);
+    },
+    getCurrentDirectory: () => root,
+    getDefaultLibFileName: (options) => ts.getDefaultLibFilePath(options),
+    fileExists: fileExistsAllowed,
+    readFile: readAllowedFile,
+    readDirectory: readDirectoryAllowed,
+    directoryExists: ts.sys.directoryExists,
+    getDirectories: ts.sys.getDirectories,
+    realpath: ts.sys.realpath,
+    useCaseSensitiveFileNames: () => ts.sys.useCaseSensitiveFileNames,
+    getNewLine: () => ts.sys.newLine,
+  };
+
+  const project = {
+    repoRoot: root,
+    configPath,
+    service: ts.createLanguageService(host, ts.createDocumentRegistry()),
+  };
+  projects.set(cacheKey, project);
+  while (projects.size > MAX_CACHED_TYPESCRIPT_PROJECTS) {
+    const oldestKey = projects.keys().next().value as string | undefined;
+    if (!oldestKey) break;
+    const oldest = projects.get(oldestKey);
+    projects.delete(oldestKey);
+    oldest?.service.dispose();
+  }
+  return project;
+}
+
+function sourcePosition(project: CachedProject, program: ts.Program, fileName: string, line: number, column: number): number {
+  if (!Number.isInteger(line) || line < 1 || !Number.isInteger(column) || column < 1) {
+    throw new Error('TypeScript navigation line and column must be positive 1-based integers.');
+  }
+  const source = program.getSourceFile(fileName);
+  if (!source) throw new Error(`TypeScript project does not include ${normalizePath(relative(project.repoRoot, fileName))}.`);
+  if (line > source.getLineAndCharacterOfPosition(source.getEnd()).line + 1) {
+    throw new Error(`TypeScript navigation line ${line} is outside ${normalizePath(relative(project.repoRoot, fileName))}.`);
+  }
+  return source.getPositionOfLineAndCharacter(line - 1, column - 1);
+}
+
+function location(
+  project: CachedProject,
+  program: ts.Program,
+  fileName: string,
+  textSpan: ts.TextSpan,
+  name?: string,
+  kind?: ts.ScriptElementKind,
+): TypeScriptNavigationLocation {
+  const source = program.getSourceFile(fileName);
+  if (!source) {
+    return { path: normalizePath(relative(project.repoRoot, fileName)), line: 1, column: 1, ...(name ? { name } : {}), ...(kind ? { kind } : {}) };
+  }
+  const point = source.getLineAndCharacterOfPosition(textSpan.start);
+  return {
+    path: normalizePath(relative(project.repoRoot, fileName)),
+    line: point.line + 1,
+    column: point.character + 1,
+    ...(name ? { name } : {}),
+    ...(kind ? { kind } : {}),
+  };
+}
+
+function dedupe(locations: TypeScriptNavigationLocation[]): TypeScriptNavigationLocation[] {
+  const seen = new Set<string>();
+  return locations.filter((entry) => {
+    const key = `${entry.path}:${entry.line}:${entry.column}:${entry.name ?? ''}:${entry.kind ?? ''}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+
+export function navigateTypeScriptSymbol(
+  repoRoot: string,
+  request: TypeScriptNavigationRequest,
+  access?: TypeScriptNavigationAccess,
+): TypeScriptNavigationResult {
+  const project = loadProject(repoRoot, request.tsconfigPath, access);
+  const fileName = resolve(project.repoRoot, request.path);
+  // A references response may materialize hundreds of locations. Acquire the
+  // Language Service Program once per navigation so that location formatting
+  // does not repeatedly re-enter the service while the result is built.
+  const program = project.service.getProgram();
+  if (!program) throw new Error('TypeScript Language Service did not produce a Program.');
+  const position = sourcePosition(project, program, fileName, request.line, request.column);
+  let locations: TypeScriptNavigationLocation[] = [];
+
+  if (request.navigation === 'definition') {
+    locations = (project.service.getDefinitionAtPosition(fileName, position) ?? [])
+      .map((entry) => location(project, program, entry.fileName, entry.textSpan, entry.name, entry.kind));
+  } else if (request.navigation === 'implementations') {
+    locations = (project.service.getImplementationAtPosition(fileName, position) ?? [])
+      .map((entry) => location(project, program, entry.fileName, entry.textSpan, undefined, entry.kind));
+  } else {
+    locations = (project.service.findReferences(fileName, position) ?? []).flatMap((group) =>
+      group.references.map((entry) => location(project, program, entry.fileName, entry.textSpan, group.definition.name, group.definition.kind)),
+    );
+  }
+
+  return {
+    navigation: request.navigation,
+    target: { path: normalizePath(request.path), line: request.line, column: request.column },
+    locations: dedupe(locations),
+  };
+}
+
+export function clearTypeScriptNavigationCache(): void {
+  for (const project of projects.values()) project.service.dispose();
+  projects.clear();
+}

package/src/runtime/control-plane/dispatch-priority.ts

@@ -65,3 +65,31 @@ export function compareExecutionJobDispatchRanks(
     || left.queuedAtMs - right.queuedAtMs
     || left.jobId.localeCompare(right.jobId);
 }
+
+export function selectExecutionJobDispatchRepositories(
+  activeJobs: readonly ExecutionJob[],
+  scheduleNow: number,
+  lastRepoDispatch: ReadonlyMap<string, number>,
+): string[] {
+  const waiting = activeJobs.filter(isExecutionJobDispatchCandidate);
+  const rankByJobId = new Map(
+    waiting.map((job) => [job.jobId, rankExecutionJobForDispatch(job, scheduleNow)] as const),
+  );
+  const compareWaiting = (left: ExecutionJob, right: ExecutionJob): number =>
+    compareExecutionJobDispatchRanks(rankByJobId.get(left.jobId)!, rankByJobId.get(right.jobId)!);
+  const topByRepo = new Map<string, ExecutionJob>();
+  for (const job of waiting.slice().sort(compareWaiting)) {
+    if (!topByRepo.has(job.repoId)) topByRepo.set(job.repoId, job);
+  }
+  return [...topByRepo.keys()].sort((left, right) => {
+    const leftRank = rankByJobId.get(topByRepo.get(left)!.jobId)!;
+    const rightRank = rankByJobId.get(topByRepo.get(right)!.jobId)!;
+    const priority = leftRank.effectivePriority - rightRank.effectivePriority;
+    if (priority !== 0) return priority;
+    const fairness = (lastRepoDispatch.get(left) ?? 0) - (lastRepoDispatch.get(right) ?? 0);
+    return fairness
+      || leftRank.queuedAtMs - rightRank.queuedAtMs
+      || leftRank.jobId.localeCompare(rightRank.jobId)
+      || left.localeCompare(right);
+  });
+}

package/src/runtime/control-plane/execution/direct-edit-work-completion.ts

@@ -3,9 +3,10 @@ import { getEditSession, listEditSessions, type EditSession } from '../../../cli
 import { globMatches } from '../../../cli/mcp/paths';
 import { runProcess } from '../../../effects/process-runner';
 import { completeRequirementFromWork } from '../persistence/requirement-store';
-import { getWorkContract, recordWorkCompletionReceipt, updateWorkContract } from '../facade/work-contract-store';
+import { appendWorkEvidence, getWorkContract, recordWorkCompletionReceipt, updateWorkContract } from '../facade/work-contract-store';
 import { isDirectEditWorkCompletionReceipt, isTerminalWorkContractStatus, type DirectEditWorkCompletionReceipt, type WorkReconciliationRecord } from '../facade/types';
-import { effectiveVerificationEvidence } from './verification-evidence';
+import { historicalVerificationEvidenceAtRevision } from './verification-evidence';
+import { readWorkHandle } from './work-handle-store';
 
 export interface DirectEditWorkCompletionReconciliation {
   completedWorkIds: string[];
@@ -209,7 +210,16 @@ export function acceptReviewedDirectEditWorkReconciliation(input: ReviewedDirect
     }
     throw new Error(`DIRECT_EDIT_WORK_RECONCILIATION_WORK_TERMINAL: ${input.workId}`);
   }
-  if (isTerminalWorkContractStatus(work.status) || work.workKind !== 'repository_change') {
+  const failedHandle = work.status === 'failed'
+    ? readWorkHandle(input.controllerHome, input.repoId, input.workId)
+    : undefined;
+  const failedReviewedRecovery = work.workKind === 'repository_change'
+    && work.status === 'failed'
+    && failedHandle?.managedWorktree === false
+    && failedHandle.state === 'failed'
+    && failedHandle.finalization.validation === 'failed'
+    && String(failedHandle.finalization.lastError ?? failedHandle.failureReason ?? '').includes('WORK_HANDLE_HEAD_CHANGED');
+  if ((isTerminalWorkContractStatus(work.status) && !failedReviewedRecovery) || work.workKind !== 'repository_change') {
     throw new Error(`DIRECT_EDIT_WORK_RECONCILIATION_WORK_NOT_ELIGIBLE: ${input.workId}`);
   }
   if (!work.baseRevision?.trim()) throw new Error('DIRECT_EDIT_WORK_RECONCILIATION_BASE_REVISION_MISSING');
@@ -226,7 +236,15 @@ export function acceptReviewedDirectEditWorkReconciliation(input: ReviewedDirect
   }
 
   const comparedPaths = normalizedComparedPaths(input.comparedPaths);
-  const actualPaths = comparedRevisionPaths(input.repoRoot, baseRevision, targetRevision);
+  let comparisonBaseRevision = baseRevision;
+  if (failedReviewedRecovery) {
+    const targetParent = exactCommit(input.repoRoot, `${targetRevision}^`, 'TARGET_PARENT_REVISION');
+    if (!git(input.repoRoot, ['merge-base', '--is-ancestor', baseRevision, targetParent]).ok) {
+      throw new Error('DIRECT_EDIT_WORK_RECONCILIATION_TARGET_PARENT_NOT_DESCENDANT');
+    }
+    comparisonBaseRevision = targetParent;
+  }
+  const actualPaths = comparedRevisionPaths(input.repoRoot, comparisonBaseRevision, targetRevision);
   if (comparedPaths.length !== actualPaths.length || comparedPaths.some((path, index) => path !== actualPaths[index])) {
     throw new Error('DIRECT_EDIT_WORK_RECONCILIATION_PATH_COMPARISON_MISMATCH');
   }
@@ -239,12 +257,18 @@ export function acceptReviewedDirectEditWorkReconciliation(input: ReviewedDirect
 
   let verifiedAt = new Date().toISOString();
   for (const checkId of work.checks) {
-    const current = effectiveVerificationEvidence(work.checkRefs, {
+    const candidates = historicalVerificationEvidenceAtRevision(work.checkRefs, {
       sourceRevision: targetRevision,
+      repoId: input.repoId,
+      workId: work.workId,
+      checkoutId: work.checkoutId,
       checkId,
       requestedChecks: work.checks,
-    }).find((entry) => entry.current && entry.record.outcome === 'valid_pass');
-    if (!current) throw new Error(`DIRECT_EDIT_WORK_RECONCILIATION_CHECK_EVIDENCE_STALE: ${checkId}`);
+    }).filter((entry) => entry.current && entry.record.outcome === 'valid_pass');
+    const distinctReceipts = new Map(candidates.map((entry) => [entry.record.receipt!.receiptId, entry]));
+    if (distinctReceipts.size === 0) throw new Error(`DIRECT_EDIT_WORK_RECONCILIATION_CHECK_EVIDENCE_STALE: ${checkId}`);
+    if (distinctReceipts.size > 1) throw new Error(`DIRECT_EDIT_WORK_RECONCILIATION_CHECK_EVIDENCE_AMBIGUOUS: ${checkId}`);
+    const current = [...distinctReceipts.values()][0]!;
     verifiedAt = current.record.completedAt ?? current.record.recordedAt ?? verifiedAt;
   }
 
@@ -301,6 +325,21 @@ export function acceptReviewedDirectEditWorkReconciliation(input: ReviewedDirect
     'completed_changed',
     'repository_change',
   );
-  if (recorded.requirementId) completeRequirementFromWork({ controllerHome: input.controllerHome }, { requirementId: recorded.requirementId, work: recorded });
+  if (recorded.requirementId) {
+    try {
+      completeRequirementFromWork({ controllerHome: input.controllerHome }, { requirementId: recorded.requirementId, work: recorded });
+    } catch (error) {
+      try {
+        appendWorkEvidence({ controllerHome: input.controllerHome, repoId: input.repoId }, input.workId, {
+          title: 'requirement completion projection pending',
+          summary: `Work completion remains authoritative; Requirement projection could not be applied: ${error instanceof Error ? error.message : String(error)}`.slice(0, 2_000),
+          detailLevel: 'summary',
+        });
+      } catch {
+        // Reconciliation already recorded the terminal receipt. A diagnostic
+        // write failure cannot make that completed Work non-terminal again.
+      }
+    }
+  }
   return { workId: input.workId, reconciliation, receipt };
 }

package/src/runtime/control-plane/execution/edit-validation-coordinator.ts

@@ -9,6 +9,7 @@ import {
   listControllerChecks,
 } from '../../../cli/controller/check-runner';
 import type { RepositoryRecord } from '../../../cli/repositories/types';
+import { selectRepositoryCheckout } from '../../../cli/repositories/registry';
 import { executionIdentityForRepository } from './execution-identity';
 import {
   claimsForCheck,
@@ -266,6 +267,57 @@ function failedRun(
   return coordinatorResult(controllerHome, failed);
 }
 
+export function resolveEditValidationRepository(
+  repository: RepositoryRecord,
+  editSessionId: string,
+): { repository: RepositoryRecord; session: EditSession } {
+  const checkoutIds = [...new Set([
+    repository.activeCheckoutId,
+    ...repository.checkouts.map((checkout) => checkout.checkoutId),
+  ].filter(Boolean))];
+  for (const checkoutId of checkoutIds) {
+    let candidate: RepositoryRecord;
+    try {
+      candidate = selectRepositoryCheckout(repository, checkoutId);
+    } catch {
+      continue;
+    }
+    let session: EditSession;
+    try {
+      session = getEditSession(candidate.canonicalRoot, editSessionId);
+    } catch (error) {
+      if (error instanceof Error && error.message === `edit session not found: ${editSessionId}`) continue;
+      throw error;
+    }
+    if (session.repoId && session.repoId !== candidate.repoId) {
+      throw new Error(`EDIT_VALIDATION_SESSION_IDENTITY_MISMATCH: repoId ${session.repoId} != ${candidate.repoId}`);
+    }
+    if (session.checkoutId && session.checkoutId !== candidate.activeCheckoutId) {
+      throw new Error(`EDIT_VALIDATION_SESSION_IDENTITY_MISMATCH: checkoutId ${session.checkoutId} != ${candidate.activeCheckoutId}`);
+    }
+    return { repository: candidate, session };
+  }
+  throw new Error(`edit session not found: ${editSessionId}`);
+}
+
+function validationRunRepository(
+  repository: RepositoryRecord,
+  run: EditValidationRunState,
+): RepositoryRecord {
+  if (run.repositoryId !== repository.repoId) {
+    throw new Error(`EDIT_VALIDATION_REPOSITORY_MISMATCH: ${run.repositoryId} != ${repository.repoId}`);
+  }
+  const candidate = selectRepositoryCheckout(repository, run.checkoutId);
+  const session = getEditSession(candidate.canonicalRoot, run.editSessionId);
+  if (session.repoId && session.repoId !== run.repositoryId) {
+    throw new Error(`EDIT_VALIDATION_SESSION_IDENTITY_MISMATCH: repoId ${session.repoId} != ${run.repositoryId}`);
+  }
+  if (session.checkoutId && session.checkoutId !== run.checkoutId) {
+    throw new Error(`EDIT_VALIDATION_SESSION_IDENTITY_MISMATCH: checkoutId ${session.checkoutId} != ${run.checkoutId}`);
+  }
+  return candidate;
+}
+
 function receiptFor(
   controllerHome: string,
   repository: RepositoryRecord,
@@ -312,10 +364,18 @@ export async function reconcileEditValidationRun(
 ): Promise<EditValidationCoordinatorResult> {
   let run = readRun(controllerHome, repository.repoId, runInput.validationId) ?? runInput;
   if (run.status !== 'running') return coordinatorResult(controllerHome, run);
-  if (run.checkoutId !== repository.activeCheckoutId) {
-    return failedRun(controllerHome, run, 'EDIT_VALIDATION_CHECKOUT_CHANGED', `Validation checkout ${run.checkoutId} no longer matches ${repository.activeCheckoutId}.`);
+  let validationRepository: RepositoryRecord;
+  try {
+    validationRepository = validationRunRepository(repository, run);
+  } catch (error) {
+    return failedRun(
+      controllerHome,
+      run,
+      'EDIT_VALIDATION_CHECKOUT_UNAVAILABLE',
+      error instanceof Error ? error.message : String(error),
+    );
   }
-  const session = getEditSession(repository.canonicalRoot, run.editSessionId);
+  const session = getEditSession(validationRepository.canonicalRoot, run.editSessionId);
   if (session.currentRevision !== run.editRevision) {
     return failedRun(controllerHome, run, 'EDIT_VALIDATION_STALE_REVISION', `Validation targets revision ${run.editRevision}, current edit revision is ${session.currentRevision}.`);
   }
@@ -334,10 +394,10 @@ export async function reconcileEditValidationRun(
       const checkRequestId = `${run.requestId}:check:${index + 1}:${createHash('sha256').update(checkId).digest('hex').slice(0, 12)}`;
       const facade = await runPersistedCheckViaProcessRuntime({
         controllerHome,
-        repoId: repository.repoId,
-        checkoutId: repository.activeCheckoutId,
-        repoRoot: repository.canonicalRoot,
-        executionIdentity: executionIdentityForRepository(repository),
+        repoId: validationRepository.repoId,
+        checkoutId: validationRepository.activeCheckoutId,
+        repoRoot: validationRepository.canonicalRoot,
+        executionIdentity: executionIdentityForRepository(validationRepository),
         checkId,
         timeoutMs: run.timeoutMs,
         interactiveWaitMs: 0,
@@ -384,10 +444,10 @@ export async function reconcileEditValidationRun(
   }
 
   try {
-    const receipts = run.checkIds.map((checkId) => receiptFor(controllerHome, repository, run, checkId));
-    const checked = recordEditSessionProcessCheckReceipts(repository.canonicalRoot, run.editSessionId, {
-      repoId: repository.repoId,
-      checkoutId: repository.activeCheckoutId,
+    const receipts = run.checkIds.map((checkId) => receiptFor(controllerHome, validationRepository, run, checkId));
+    const checked = recordEditSessionProcessCheckReceipts(validationRepository.canonicalRoot, run.editSessionId, {
+      repoId: validationRepository.repoId,
+      checkoutId: validationRepository.activeCheckoutId,
       receipts,
       reviewer: run.reviewer,
       note: run.note,
@@ -415,7 +475,9 @@ export async function startOrJoinEditValidation(
   repository: RepositoryRecord,
   input: EditValidationStartInput,
 ): Promise<EditValidationCoordinatorResult> {
-  const session = getEditSession(repository.canonicalRoot, input.editSessionId);
+  const resolved = resolveEditValidationRepository(repository, input.editSessionId);
+  const validationRepository = resolved.repository;
+  const session = resolved.session;
   const checkIds = normalized(input.checkIds ?? session.requestedChecks);
   const requestId = input.validationRequestId?.trim()
     || input.requestId?.trim()
@@ -426,14 +488,14 @@ export async function startOrJoinEditValidation(
     if (existing.checkIds.join('\n') !== checkIds.join('\n')) {
       return failedRun(controllerHome, existing, 'EDIT_VALIDATION_REQUEST_CONFLICT', 'The validation request id is already bound to a different check set.');
     }
-    return reconcileEditValidationRun(controllerHome, repository, existing);
+    return reconcileEditValidationRun(controllerHome, validationRepository, existing);
   }
 
   if (checkIds.length === 0) {
     try {
-      const checked = recordEditSessionProcessCheckReceipts(repository.canonicalRoot, session.sessionId, {
-        repoId: repository.repoId,
-        checkoutId: repository.activeCheckoutId,
+      const checked = recordEditSessionProcessCheckReceipts(validationRepository.canonicalRoot, session.sessionId, {
+        repoId: validationRepository.repoId,
+        checkoutId: validationRepository.activeCheckoutId,
         receipts: [],
         reviewer: input.reviewer,
         note: input.note,
@@ -441,8 +503,8 @@ export async function startOrJoinEditValidation(
       const completed = saveRun(controllerHome, {
         schemaVersion: 1,
         validationId: id,
-        repositoryId: repository.repoId,
-        checkoutId: repository.activeCheckoutId,
+        repositoryId: validationRepository.repoId,
+        checkoutId: validationRepository.activeCheckoutId,
         editSessionId: session.sessionId,
         editRevision: session.currentRevision,
         requestId,
@@ -464,8 +526,8 @@ export async function startOrJoinEditValidation(
       const run: EditValidationRunState = {
         schemaVersion: 1,
         validationId: id,
-        repositoryId: repository.repoId,
-        checkoutId: repository.activeCheckoutId,
+        repositoryId: validationRepository.repoId,
+        checkoutId: validationRepository.activeCheckoutId,
         editSessionId: session.sessionId,
         editRevision: session.currentRevision,
         requestId,
@@ -487,13 +549,13 @@ export async function startOrJoinEditValidation(
   const run = saveRun(controllerHome, {
     schemaVersion: 1,
     validationId: id,
-    repositoryId: repository.repoId,
-    checkoutId: repository.activeCheckoutId,
+    repositoryId: validationRepository.repoId,
+    checkoutId: validationRepository.activeCheckoutId,
     editSessionId: session.sessionId,
     editRevision: session.currentRevision,
     requestId,
     checkIds,
-    lanes: checkLanes(repository, checkIds),
+    lanes: checkLanes(validationRepository, checkIds),
     processes: {},
     reviewer: input.reviewer,
     note: input.note,
@@ -505,7 +567,7 @@ export async function startOrJoinEditValidation(
     createdAt: now(),
     updatedAt: now(),
   });
-  return reconcileEditValidationRun(controllerHome, repository, run);
+  return reconcileEditValidationRun(controllerHome, validationRepository, run);
 }
 
 export interface PendingEditValidationSummary {

package/src/runtime/control-plane/execution/session-store.ts

@@ -163,6 +163,24 @@ export function updateExecutionSession(
   return updated;
 }
 
+export function invalidateExecutionSession(
+  controllerHome: string,
+  sessionId: string,
+  reason: string,
+): ExecutionSessionContext | undefined {
+  const current = peekExecutionSession(controllerHome, sessionId);
+  if (!current || current.invalidatedAt) return current;
+  const at = now();
+  const invalidated: ExecutionSessionContext = {
+    ...current,
+    updatedAt: at,
+    invalidatedAt: at,
+    invalidationReason: reason.trim().slice(0, 512) || 'transport session closed',
+  };
+  writeExecutionSession(controllerHome, invalidated, 'session_invalidated');
+  return invalidated;
+}
+
 function writeExecutionSession(controllerHome: string, session: ExecutionSessionContext, action: string): void {
   writeControlPlaneRecord(controllerHome, {
     namespace: 'execution_session',

package/src/runtime/control-plane/execution/verification-evidence.ts

@@ -14,7 +14,6 @@ export interface VerificationEvidenceIdentity {
   workspaceFingerprint?: string;
   checkId: string;
   requestedChecks: string[];
-  commandId?: string;
 }
 
 export interface EffectiveVerificationEvidence {
@@ -23,6 +22,12 @@ export interface EffectiveVerificationEvidence {
   staleReason?: string;
 }
 
+export interface HistoricalVerificationEvidenceIdentity extends Omit<VerificationEvidenceIdentity, 'workspaceFingerprint'> {
+  repoId: string;
+  workId: string;
+  checkoutId?: string;
+}
+
 function decodeGitQuotedPath(rawPath: string): string {
   if (!rawPath.startsWith('"') && !rawPath.endsWith('"')) return rawPath;
   if (!rawPath.startsWith('"') || !rawPath.endsWith('"')) {
@@ -146,14 +151,13 @@ export function workValidationInputFingerprint(
   })).digest('hex');
 }
 
-/** Stable identity for inputs that make a check result reusable. */
+/** Stable identity for semantic inputs that make a check result reusable. Invocation ids are audited separately. */
 export function verificationInputFingerprint(input: VerificationEvidenceIdentity): string {
   return createHash('sha256').update(JSON.stringify({
     sourceRevision: input.sourceRevision,
     workspaceFingerprint: input.workspaceFingerprint ?? null,
     checkId: input.checkId,
     requestedChecks: [...input.requestedChecks].sort(),
-    commandId: input.commandId ?? null,
   })).digest('hex');
 }
 
@@ -161,6 +165,57 @@ export function commandFingerprint(checkId: string, commandId: string | undefine
   return createHash('sha256').update(JSON.stringify({ checkId, commandId: commandId ?? null })).digest('hex');
 }
 
+/**
+ * Selects immutable Work-bound verification evidence for an explicit historical
+ * revision. Unlike current-workspace reuse, the historical workspace identity
+ * comes from each durable receipt record and is verified against the record's
+ * persisted semantic and command fingerprints.
+ */
+export function historicalVerificationEvidenceAtRevision(
+  records: VerificationRecord[],
+  expected: HistoricalVerificationEvidenceIdentity,
+): EffectiveVerificationEvidence[] {
+  return records
+    .filter((record) => record.checkId === expected.checkId)
+    .map((record) => {
+      if (record.supersedes || record.outcome === 'superseded') {
+        return { record, current: false, staleReason: 'superseded' };
+      }
+      if (!record.sourceRevision || !record.workspaceFingerprint || !record.verificationInputFingerprint || !record.commandFingerprint) {
+        return { record, current: false, staleReason: 'historical evidence has no exact input identity' };
+      }
+      if (record.sourceRevision !== expected.sourceRevision) {
+        return { record, current: false, staleReason: `source revision changed: ${record.sourceRevision} -> ${expected.sourceRevision}` };
+      }
+      const receipt = record.receipt;
+      if (
+        !receipt
+        || receipt.repoId !== expected.repoId
+        || receipt.workId !== expected.workId
+        || receipt.checkId !== expected.checkId
+        || (expected.checkoutId !== undefined && receipt.checkoutId !== expected.checkoutId)
+      ) {
+        return { record, current: false, staleReason: 'historical receipt identity changed' };
+      }
+      if (receipt.status !== 'passed' || receipt.runtimeStatus !== 'succeeded' || !receipt.ok || receipt.timedOut || receipt.cancelled) {
+        return { record, current: false, staleReason: 'historical receipt is not a valid pass' };
+      }
+      const expectedFingerprint = verificationInputFingerprint({
+        sourceRevision: expected.sourceRevision,
+        workspaceFingerprint: record.workspaceFingerprint,
+        checkId: expected.checkId,
+        requestedChecks: expected.requestedChecks,
+      });
+      if (record.verificationInputFingerprint !== expectedFingerprint) {
+        return { record, current: false, staleReason: 'verification inputs changed' };
+      }
+      if (record.commandFingerprint !== commandFingerprint(record.checkId, receipt.commandId)) {
+        return { record, current: false, staleReason: 'check command identity changed' };
+      }
+      return { record, current: true };
+    });
+}
+
 /**
  * Keeps historical evidence auditable while preventing a previous revision or
  * changed check inputs from being selected as proof for the current Work.