@moretea-labs/forge 1.6.0 → 1.7.1

package/src/runtime/execution/process-runtime/persisted-check.ts

@@ -24,9 +24,18 @@ import {
   type RunCheckFacadeResult,
 } from './check-facade';
 import { claimsForCheck, toProcessClaims } from './resource-claims';
-import { spawnManagedProcess } from './runtime';
+import { getProcessHandle, spawnManagedProcess } from './runtime';
+import { getProcessRecord, getProcessRequestBinding } from './store';
 import { allocatePersistedCheckResultReceiptPath } from './check-result';
 import { durationAwareInteractiveWaitMs } from './interactive-admission';
+
+/**
+ * Work verification may overlap another Work's repository-wide build cache.
+ * Wait through one ordinary sibling check, but never past Process Runtime's
+ * bounded lease-admission ceiling; explicit callers may still choose less.
+ */
+export const DEFAULT_WORK_CHECK_LEASE_WAIT_MS = 30_000;
+
 const PERSISTED_CHECK_SOURCE_ENTRY = 'src/runtime/execution/process-runtime/check-runner-sidecar.ts';
 
 export function resolvePersistedCheckCliInvocation(
@@ -82,7 +91,7 @@ export function resolvePersistedCheckRuntimeExecutable(
   entryExists: (path: string) => boolean = existsSync,
 ): string {
   if (cliTarget.runtimeKind !== 'compiled_bun_release') return runtimeExecutable;
-  const checkRunner = resolve(dirname(runtimeExecutable), 'forge-check-runner');
+  const checkRunner = resolve(cliTarget.cwd, 'forge-check-runner');
   if (!entryExists(checkRunner)) {
     throw new Error(`PERSISTED_CHECK_RUNNER_MISSING: ${checkRunner}`);
   }
@@ -128,6 +137,38 @@ export async function runPersistedCheckViaProcessRuntime(
     workerSpawnCount: 0,
     projectionUpdateCount: 0,
   };
+  const requestId = input.requestId?.trim();
+  const requestSemanticFingerprint = input.requestSemanticFingerprint?.trim();
+  if (requestId && requestSemanticFingerprint) {
+    const binding = getProcessRequestBinding(input.controllerHome, input.repoId, input.checkoutId, requestId);
+    if (binding) {
+      const record = getProcessRecord(input.controllerHome, input.repoId, binding.processId);
+      const exactIdentity = Boolean(
+        record
+        && record.repoId === input.repoId
+        && (record.checkoutId?.trim() || undefined) === (input.checkoutId?.trim() || undefined)
+        && (record.workId?.trim() || undefined) === (input.workId?.trim() || undefined)
+        && record.origin?.surface === 'check'
+        && record.origin.requestId === requestId
+        && record.origin.checkId === input.checkId
+        && record.origin.requestSemanticFingerprint === requestSemanticFingerprint,
+      );
+      if (!exactIdentity) throw new Error(`PROCESS_REQUEST_ID_CONFLICT: ${requestId}`);
+      const existing = getProcessHandle(input.controllerHome, input.repoId, binding.processId);
+      if (!existing) {
+        throw new Error(`PROCESS_REQUEST_INCOMPLETE: request ${requestId} is bound to missing process ${binding.processId}; refusing re-execution`);
+      }
+      const check = listControllerChecks(input.repoRoot).find((entry) => entry.id === input.checkId);
+      return {
+        mode: existing.completed ? 'direct' : 'managed',
+        checkId: input.checkId,
+        check,
+        process: { ...existing, deduplicated: true, requestId },
+        ok: existing.completed ? existing.ok : undefined,
+        durableSideEffects: emptyEffects,
+      };
+    }
+  }
   const verificationSnapshot = input.verificationSnapshot
     ? materializeWorkVerificationSnapshot({
         controllerHome: input.controllerHome,
@@ -153,7 +194,7 @@ export async function runPersistedCheckViaProcessRuntime(
       durableSideEffects: emptyEffects,
     };
   }
-  if (input.forceDurable || checkRequiresDurableWorkflow(input.checkId, check)) {
+  if (input.forceDurable || (checkRequiresDurableWorkflow(input.checkId, check) && input.allowDurableCheckExecution !== true)) {
     cleanupVerificationSnapshot();
     return {
       mode: 'durable',
@@ -168,7 +209,8 @@ export async function runPersistedCheckViaProcessRuntime(
   }
 
   const interactiveWaitMs = durationAwareInteractiveWaitMs(check.command, input.interactiveWaitMs);
-  const leaseWaitMs = input.leaseWaitMs;
+  const leaseWaitMs = input.leaseWaitMs
+    ?? (input.workId?.trim() ? DEFAULT_WORK_CHECK_LEASE_WAIT_MS : undefined);
   const timeoutMs = Math.min(
     check.timeoutMs,
     typeof input.timeoutMs === 'number' && Number.isFinite(input.timeoutMs)
@@ -234,7 +276,10 @@ export async function runPersistedCheckViaProcessRuntime(
     checkFingerprint,
     '--result-receipt',
     checkResultReceiptPath,
-    ...(verificationSnapshot ? ['--cleanup-root', verificationSnapshot.root] : []),
+    ...(verificationSnapshot ? [
+      '--isolated-controller-home', verificationSnapshot.isolatedControllerHome,
+      '--cleanup-root', verificationSnapshot.root,
+    ] : []),
   ];
   const invocation = resolvePersistedCheckProcessInvocation(cliTarget, checkArgs);
   let handle;
@@ -262,6 +307,7 @@ export async function runPersistedCheckViaProcessRuntime(
       toolName: 'run_check',
       checkId: input.checkId,
       requestId: input.requestId,
+      requestSemanticFingerprint: input.requestSemanticFingerprint,
       correlationId: input.workId,
       executionSessionId: input.verificationBinding?.executionSessionId,
       editSessionId: input.verificationBinding?.editSessionId,

package/src/runtime/execution/process-runtime/resource-claims.ts

@@ -511,12 +511,16 @@ export function claimsForCheck(
 ): ResourceClaimSpec[] {
   const heavy = /(?:^|:)(?:test(?::coverage)?|check:(?:ci|forge-runtime|public-export|release(?:-[a-z0-9-]+)?))$/.test(checkId)
     || /release|migration|integrate/i.test(checkId);
-  if (heavy) return [claimHeavyCheck(repoId)];
-  if (effects) return claimsForDeclaredCheckEffects(checkId, effects, repoId, checkoutId);
-  if (staticAnalysisCheckId(checkId)) return [claimWorkspaceRead(checkoutId), claimBuildCacheWrite(repoId)];
-  if (command && command.length > 0) return claimsForRepositoryCommand(command, repoId, checkoutId);
-  // Unknown named checks without a command/effects contract remain conservative.
-  return [claimWorkspaceWrite(checkoutId)];
+  const baseClaims = effects
+    ? claimsForDeclaredCheckEffects(checkId, effects, repoId, checkoutId)
+    : staticAnalysisCheckId(checkId)
+      ? [claimWorkspaceRead(checkoutId), claimBuildCacheWrite(repoId)]
+      : command && command.length > 0
+        ? claimsForRepositoryCommand(command, repoId, checkoutId)
+        : [claimWorkspaceWrite(checkoutId)];
+  // Heavy-check is an additional cross-check serialization fence, not a
+  // substitute for the resources the check actually reads or writes.
+  return heavy ? normalizeClaims([claimHeavyCheck(repoId), ...baseClaims]) : baseClaims;
 }
 
 export function scopeResourceClaims(

package/src/runtime/execution/process-runtime/runtime.ts

@@ -306,8 +306,9 @@ function identityStillMatches(identity: ManagedProcessRecord['identity'] | undef
   }
   if (!isProcessAlive(identity.pid)) return false;
   const probe = defaultProcessIdentityProbe;
-  const startTime = probe.startTime(identity.pid);
-  const command = probe.command(identity.pid);
+  const inspected = probe.inspect?.(identity.pid);
+  const startTime = inspected?.startTime ?? probe.startTime(identity.pid);
+  const command = inspected?.command ?? probe.command(identity.pid);
   if (!startTime || !command) return false;
   if (startTime !== identity.processStartTime) return false;
   if (executableFingerprint(command) !== identity.executableFingerprint) return false;
@@ -541,7 +542,7 @@ export function completeProcessFromEvidence(
     stdoutTail?: string;
     stderrTail?: string;
   },
-  options: { authority?: 'runtime_writer' | 'durable_exit_receipt' | 'durable_pre_spawn_abandonment' } = {},
+  options: { authority?: 'runtime_writer' | 'durable_exit_receipt' | 'durable_pre_spawn_abandonment' | 'durable_stale_active_reconciliation' } = {},
 ): ManagedProcessRecord | undefined {
   // Validated independent evidence may only perform the monotonic,
   // fence-token-bound terminal CAS below. It does not grant general writer
@@ -627,6 +628,45 @@ export function reconcileAbandonedPreSpawnProcess(
   }, { authority: 'durable_pre_spawn_abandonment' });
 }
 
+/**
+ * Bounded maintenance reconciliation for stale active Process records that are
+ * no longer reachable through the v2 recovery index. This never deletes an
+ * active record and never re-executes a command: it first consumes any durable
+ * Runner receipt, preserves live monitors / matching process identities, and
+ * only then commits a monotonic terminal state for a provably dead identity.
+ */
+export function reconcileStaleManagedProcessForMaintenance(
+  controllerHome: string,
+  repoId: string,
+  processId: string,
+  options: { nowMs?: number; minAgeMs?: number } = {},
+): ManagedProcessRecord | undefined {
+  let record = getProcessRecord(controllerHome, repoId, processId);
+  if (!record || !isManagedProcessActive(record)) return record;
+
+  const nowMs = options.nowMs ?? Date.now();
+  const minAgeMs = Math.max(1_000, options.minAgeMs ?? DEFAULT_PRE_SPAWN_ABANDONMENT_MS);
+  const updatedAtMs = Date.parse(record.updatedAt || record.startedAt);
+  if (!Number.isFinite(updatedAtMs) || nowMs - updatedAtMs < minAgeMs) return record;
+
+  const fromReceipt = applyReceiptIfPresent(controllerHome, repoId, processId, record);
+  if (fromReceipt) return fromReceipt;
+
+  if (record.status === 'starting' && !record.identity) {
+    return reconcileAbandonedPreSpawnProcess(controllerHome, repoId, processId, { nowMs, minAgeMs });
+  }
+
+  record = getProcessRecord(controllerHome, repoId, processId) ?? record;
+  if (!isManagedProcessActive(record) || liveMonitors.has(processId)) return record;
+  if (identityStillMatches(record.identity, record.identityUntrusted)) return record;
+
+  return completeProcessFromEvidence(controllerHome, repoId, processId, record.terminalFenceToken, {
+    status: 'completed_unknown',
+    finishedAt: new Date(nowMs).toISOString(),
+    errorMessage: 'PROCESS_STALE_ACTIVE_RECONCILED: stale active record has no live matching process identity or durable exit receipt',
+  }, { authority: 'durable_stale_active_reconciliation' });
+}
+
 async function killTree(child: ChildProcess): Promise<void> {
   const pid = child.pid;
   if (!pid) return;
@@ -654,6 +694,16 @@ export function resolveProcessRunnerEntryPath(
   const configured = env.FORGE_PROCESS_RUNNER_ENTRY?.trim();
   if (configured && existsSync(configured)) return configured;
 
+  // macOS launchd runs the immutable Runtime through a stable mirrored
+  // executable path for TCC identity. In that mode process.execPath is not a
+  // sibling of the active release sidecars, so use the release authority path
+  // exported by the launch contract before any executable/source fallback.
+  const releaseRoot = env.FORGE_RELEASE_PATH?.trim();
+  if (releaseRoot) {
+    const releaseRunner = join(releaseRoot, 'process-runner.js');
+    if (existsSync(releaseRunner)) return releaseRunner;
+  }
+
   // Compiled daemon/Gateway entrypoints and process-runner.js are siblings in
   // every immutable release. Prefer that closed release surface before looking
   // at source paths recorded only for diagnostics and development fallback.

package/src/runtime/execution/process-runtime/store.ts

@@ -299,6 +299,7 @@ function sanitizeProcessRecord(record: ManagedProcessRecord): { record: ManagedP
       toolName: safeText(record.origin.toolName),
       requestId: safeText(record.origin.requestId),
       checkId: safeText(record.origin.checkId),
+      requestSemanticFingerprint: safeText(record.origin.requestSemanticFingerprint),
       correlationId: safeText(record.origin.correlationId),
     } : undefined,
   };

package/src/runtime/execution/process-runtime/types.ts

@@ -140,18 +140,8 @@ export interface ProcessRequestBinding {
   createdAt: string;
 }
 
-/** Content-bound Check identity used only to index/reuse Process Runtime evidence. */
-export interface ProcessCheckExecutionIdentity {
-  schemaVersion: 1;
-  checkId: string;
-  cacheKey: string;
-  revision: string;
-  definitionDigest: string;
-  environmentFingerprint: string;
-  timeoutMs: number;
-  reuseScope: 'repository' | 'checkout';
-  scopeKey: string;
-}
+export type { ProcessCheckExecutionIdentity } from '../../evidence/process-check-execution';
+import type { ProcessCheckExecutionIdentity } from '../../evidence/process-check-execution';
 
 /** Persistent semantic Check binding to one physical Process record. */
 export interface ProcessCheckExecutionBinding {
@@ -239,6 +229,8 @@ export interface ManagedProcessRecord {
     toolName?: string;
     requestId?: string;
     checkId?: string;
+    /** Stable semantic identity supplied by a facade for exact request reattachment. */
+    requestSemanticFingerprint?: string;
     correlationId?: string;
     /** Controller MCP session that initiated this check, when applicable. */
     executionSessionId?: string;

package/src/runtime/execution/thin-harness/async-process.ts

@@ -10,6 +10,9 @@ export interface BoundedProcessOptions {
   signal?: AbortSignal;
   /** When true (default on non-Windows), create a new process group for tree kill. */
   processGroup?: boolean;
+  onSpawn?: (pid: number) => void;
+  onStdout?: (chunk: string) => void;
+  onStderr?: (chunk: string) => void;
 }
 
 export interface BoundedProcessResult {
@@ -114,6 +117,7 @@ export async function runBoundedProcess(
       stdio: ['ignore', 'pipe', 'pipe'],
       detached: useProcessGroup,
     });
+    if (child.pid) options.onSpawn?.(child.pid);
 
     const finish = (exitCode: number) => {
       if (settled) return;
@@ -150,8 +154,14 @@ export async function runBoundedProcess(
 
     options.signal?.addEventListener('abort', onAbort, { once: true });
 
-    child.stdout?.on('data', (chunk: Buffer) => stdout.write(chunk));
-    child.stderr?.on('data', (chunk: Buffer) => stderr.write(chunk));
+    child.stdout?.on('data', (chunk: Buffer) => {
+      stdout.write(chunk);
+      options.onStdout?.(chunk.toString('utf8'));
+    });
+    child.stderr?.on('data', (chunk: Buffer) => {
+      stderr.write(chunk);
+      options.onStderr?.(chunk.toString('utf8'));
+    });
     child.on('error', (error) => {
       spawnError = error.message;
     });

package/src/runtime/execution/thin-harness/search-worker.ts

@@ -5,7 +5,12 @@
 import { isMainThread, parentPort, workerData, Worker } from 'worker_threads';
 import { fileURLToPath } from 'url';
 import { getMcpPolicy } from '../../../cli/mcp/policy';
-import { searchRepository } from '../../../cli/repository/inspector';
+import type { McpPolicy } from '../../../cli/mcp/types';
+import {
+  searchRepository,
+  searchRepositoryMany,
+  type SearchRepositoryManyResult,
+} from '../../../cli/repository/inspector';
 
 export interface SearchWorkerInput {
   repoRoot: string;
@@ -14,14 +19,44 @@ export interface SearchWorkerInput {
   maxFiles: number;
 }
 
+export interface SearchManyWorkerInput {
+  repoRoot: string;
+  policy: McpPolicy;
+  queries: string[];
+  files?: string[];
+  includeGlobs?: string[];
+  excludeGlobs?: string[];
+  maxResultsPerQuery?: number;
+  maxFiles?: number;
+  caseSensitive?: boolean;
+  cacheKey?: string;
+}
+
 export interface SearchWorkerResult {
   ok: boolean;
   payload?: Record<string, unknown>;
   error?: string;
 }
 
-function runSearchSync(input: SearchWorkerInput): SearchWorkerResult {
+function isManySearch(input: SearchWorkerInput | SearchManyWorkerInput): input is SearchManyWorkerInput {
+  return Array.isArray((input as SearchManyWorkerInput).queries);
+}
+
+function runSearchSync(input: SearchWorkerInput | SearchManyWorkerInput): SearchWorkerResult {
   try {
+    if (isManySearch(input)) {
+      const result = searchRepositoryMany(input.repoRoot, input.policy, {
+        queries: input.queries,
+        files: input.files,
+        includeGlobs: input.includeGlobs,
+        excludeGlobs: input.excludeGlobs,
+        maxResultsPerQuery: input.maxResultsPerQuery,
+        maxFiles: input.maxFiles,
+        caseSensitive: input.caseSensitive,
+        cacheKey: input.cacheKey,
+      }) as unknown as Record<string, unknown>;
+      return { ok: true, payload: result };
+    }
     const result = searchRepository(input.repoRoot, getMcpPolicy('controller', { repoRoot: input.repoRoot }), {
       query: input.query,
       maxResults: input.maxResults,
@@ -36,8 +71,8 @@ function runSearchSync(input: SearchWorkerInput): SearchWorkerResult {
   }
 }
 
-export async function runInspectorSearchInWorker(
-  input: SearchWorkerInput,
+async function runSearchWorker(
+  input: SearchWorkerInput | SearchManyWorkerInput,
   options: { timeoutMs?: number; signal?: AbortSignal } = {},
 ): Promise<Record<string, unknown>> {
   if (options.signal?.aborted) throw new Error('CANCELLED: search aborted');
@@ -108,7 +143,21 @@ export async function runInspectorSearchInWorker(
   });
 }
 
+export async function runInspectorSearchInWorker(
+  input: SearchWorkerInput,
+  options: { timeoutMs?: number; signal?: AbortSignal } = {},
+): Promise<Record<string, unknown>> {
+  return await runSearchWorker(input, options);
+}
+
+export async function runInspectorSearchManyInWorker(
+  input: SearchManyWorkerInput,
+  options: { timeoutMs?: number; signal?: AbortSignal } = {},
+): Promise<SearchRepositoryManyResult> {
+  return await runSearchWorker(input, options) as unknown as SearchRepositoryManyResult;
+}
+
 if (!isMainThread && parentPort) {
-  const input = workerData as SearchWorkerInput;
+  const input = workerData as SearchWorkerInput | SearchManyWorkerInput;
   parentPort.postMessage(runSearchSync(input));
 }

package/src/runtime/execution/work-activity.ts

@@ -0,0 +1,21 @@
+import { listActiveExecutionJobs } from './jobs/store';
+import type { ExecutionJob } from './jobs/types';
+import { listRecoverableProcessRecords } from './process-runtime/store';
+import { isManagedProcessActive } from './process-runtime/types';
+
+export function executionJobBelongsToWork(job: ExecutionJob, workId: string): boolean {
+  if (job.resourceClaims.some((claim) => claim.workId === workId)) return true;
+  const payload = job.payload as Record<string, unknown>;
+  const args = payload.arguments && typeof payload.arguments === 'object' && !Array.isArray(payload.arguments)
+    ? payload.arguments as Record<string, unknown>
+    : undefined;
+  return [payload.workId, payload.work_id, args?.workId, args?.work_id].some((value) => value === workId);
+}
+
+export function workHasActiveExecution(controllerHome: string, repoId: string, workId: string): boolean {
+  const activeProcess = listRecoverableProcessRecords(controllerHome, repoId)
+    .some((record) => record.workId === workId && isManagedProcessActive(record));
+  if (activeProcess) return true;
+  return listActiveExecutionJobs(controllerHome, repoId)
+    .some((job) => executionJobBelongsToWork(job, workId));
+}

package/src/runtime/execution/workers/executor.ts

@@ -21,7 +21,6 @@ import {
 } from '../jobs/child-reference';
 import { markOperationDelegated } from '../jobs/receipt-store';
 import { assertAutomatedOperationAllowed } from '../../control-plane/governance/external-effects';
-import { recordCandidateFinding, updateCandidateFinding } from '../../workflow/findings/store';
 import { triggerWorkspaceAgent } from '../workspace-agent';
 import { executeAssistantPluginAction } from '../../plugins/store';
 import { CONTROLLER_SCOPE_REPO_ID, controllerSystemRoot, repositoryControllerRoot } from '../../../cli/repositories/controller-home';
@@ -29,7 +28,8 @@ import { writeExecutionArtifact } from '../../evidence/artifact-store';
 import { existsSync } from 'fs';
 import { isAbsolute, relative, resolve, sep } from 'path';
 import { isAssistantPluginError } from '../../plugins/errors';
-import { executeAssistantRoutineRuntime } from '../../assistant/routine-runtime';
+import { executeWork, validateWork } from '../../control-plane/execution/work-operation-service';
+import { finalizeWork } from '../../control-plane/execution/work-finalization-service';
 
 
 function childReferenceFromLocalJob(
@@ -445,20 +445,6 @@ export async function executeExecutionJob(controllerHome: string, job: Execution
     }
     bindRepositoryEntities(repository);
 
-    if (job.payload.target === 'runtime' && job.payload.operation === 'assistant_routine_execute') {
-      const routineId = String(job.payload.arguments?.routineId ?? job.payload.arguments?.routine_id ?? '').trim();
-      if (!routineId) throw new Error('ASSISTANT_ROUTINE_ID_REQUIRED');
-      const routineResult = await executeAssistantRoutineRuntime({
-        controllerHome,
-        repository,
-        routineId,
-        requestId: job.requestId,
-        origin: job.origin,
-        occurrenceId: typeof job.payload.occurrenceId === 'string' ? job.payload.occurrenceId : undefined,
-      });
-      return { ok: true, result: { assistantRoutine: routineResult }, repoRoot };
-    }
-
     if (job.payload.target === 'runtime' && job.payload.operation === 'legacy-local-job') {
       const localJobId = String(job.payload.arguments?.localJobId ?? '').trim();
       if (!localJobId) throw new Error('LEGACY_JOB_ID_REQUIRED');
@@ -511,26 +497,6 @@ export async function executeExecutionJob(controllerHome: string, job: Execution
         : { ok: false, error: { code: 'RELEASE_GATE_BLOCKED', message: 'Release gate has blockers.', retryable: false, details: { gate } }, repoRoot };
     }
 
-    if (job.payload.operation === 'record_candidate_finding') {
-      const args = job.payload.arguments ?? {};
-      const finding = recordCandidateFinding(controllerHome, {
-        repoId: job.repoId,
-        requestId: job.requestId,
-        semanticKey: String(args.semantic_key ?? args.semanticKey ?? '').trim(),
-        title: String(args.title ?? '').trim(),
-        summary: typeof args.summary === 'string' ? args.summary : undefined,
-        severity: ['low', 'medium', 'high', 'critical'].includes(String(args.severity))
-          ? String(args.severity) as 'low' | 'medium' | 'high' | 'critical'
-          : 'medium',
-        evidence: {
-          source: job.origin.surface,
-          reference: typeof args.reference === 'string' ? args.reference : job.origin.correlationId,
-          details: args.evidence && typeof args.evidence === 'object' ? args.evidence as Record<string, unknown> : undefined,
-        },
-      });
-      return { ok: true, result: { finding }, repoRoot };
-    }
-
     const allowedAgents = Array.isArray(job.payload.allowedAgents)
       ? job.payload.allowedAgents.filter((value): value is string => typeof value === 'string')
       : [];
@@ -560,23 +526,26 @@ export async function executeExecutionJob(controllerHome: string, job: Execution
       toolset: job.payload.toolset === 'core' || job.payload.toolset === 'full' ? job.payload.toolset : 'advanced',
       toolsetLocked: true,
     };
-    // Public Work mutations are admitted by the Gateway, then executed exactly
-    // once here. Calling the implementation directly avoids recursive Job
-    // creation while preserving the existing Work validation/authorization path.
+    // Durable Work mutations execute through control-plane application services.
+    // The Worker must never import MCP transport to obtain Work semantics.
     const durableWorkOperation = job.payload.operation === 'work_execute'
       || job.payload.operation === 'work_validate'
       || job.payload.operation === 'work_finalize';
-    // Load the Work implementation only for Work Jobs. A static import here
-    // creates an initialization cycle through repository command and Local Bridge
-    // modules, changing unrelated execution behavior.
     const toolArguments = { ...(job.payload.arguments ?? {}) };
-    const executionResult = durableWorkOperation
-      ? await import('../../gateway/mcp/execution-tools').then(({ callExecutionTool }) =>
-        callExecutionTool(runtimeContext, job.payload.operation, {
-          ...toolArguments,
-          __from_durable_worker: true,
-          __execution_job_id: job.jobId,
-        }))
+    const workArguments = {
+      ...toolArguments,
+      __from_durable_worker: true,
+      __execution_job_id: job.jobId,
+    };
+    const executionRecord = job.payload.operation === 'work_execute'
+      ? await executeWork(runtimeContext, workArguments)
+      : job.payload.operation === 'work_validate'
+        ? await validateWork(runtimeContext, workArguments)
+        : job.payload.operation === 'work_finalize'
+          ? await finalizeWork(runtimeContext, workArguments)
+          : undefined;
+    const executionResult: CallToolResult | undefined = durableWorkOperation && executionRecord
+      ? { structuredContent: executionRecord, content: [] }
       : undefined;
     const runtimeResult = executionResult ?? (policy.profile === 'controller'
       ? await callRuntimeTool(runtimeContext, job.payload.operation, toolArguments)
@@ -651,18 +620,6 @@ export async function executeExecutionJob(controllerHome: string, job: Execution
       );
     }
 
-    if (job.origin.actor === 'promote_candidate_finding' && job.origin.correlationId) {
-      try {
-        updateCandidateFinding(controllerHome, job.repoId, job.origin.correlationId, (current) => ({
-          ...current,
-          status: result.isError ? 'candidate' : 'promoted',
-          promotedJobId: job.jobId,
-        }), job.requestId, result.isError ? 'candidate_promotion_failed' : 'candidate_finding_promoted');
-      } catch {
-        // The Issue result remains authoritative even if the candidate projection needs reconciliation.
-      }
-    }
-
     if (result.isError) {
       return { ok: false, error: { code: 'MCP_TOOL_FAILED', message: JSON.stringify(record), retryable: false }, repoRoot };
     }