@moretea-labs/forge 1.7.0 → 1.7.2

package/src/runtime/control-plane/execution/work-task-receipt.ts

@@ -3,8 +3,8 @@ import { spawnSync } from 'child_process';
 import { getIssue, listIssues, recordTaskVerification, acceptVerifiedTask, projectTaskFromWork } from '../../../cli/controller/issue-store';
 import { resolveCompletionTargetBranch } from '../../../cli/controller/completion-target';
 import type { CompletionReceipt, ControllerIssue } from '../../../cli/controller/types';
-import { completeRequirementFromWork } from '../persistence/requirement-store';
-import { appendWorkEvidence, getWorkContract, recordWorkCompletionReceipt, updateWorkContract } from '../facade/work-contract-store';
+import { getWorkContract, updateWorkContract } from '../facade/work-contract-store';
+import { completeWorkWithReceipt } from './work-completion-authority';
 import { isRepositoryCompletionReceipt, WORK_RECONCILIATION_METHODS, WORK_RECONCILIATION_OUTCOMES } from '../facade/types';
 import type {
   WorkReconciliationMethod,
@@ -289,32 +289,13 @@ export function acceptVerifiedTaskFromReviewedWorkReconciliation(input: Controll
     recordedAt,
   };
   const completionOutcome = noChange ? 'completed_no_change' : contract.workKind === 'remote_effect' ? 'completed_remote' : 'completed_changed';
-  const recorded = recordWorkCompletionReceipt(
+  const recorded = completeWorkWithReceipt(
     { controllerHome: input.controllerHome, repoId: input.repoId },
     input.workId,
     receipt,
     completionOutcome,
     contract.workKind,
   );
-  if (recorded.requirementId) {
-    try {
-      completeRequirementFromWork(
-        { controllerHome: input.controllerHome },
-        { requirementId: recorded.requirementId, work: recorded },
-      );
-    } catch (error) {
-      try {
-        appendWorkEvidence({ controllerHome: input.controllerHome, repoId: input.repoId }, input.workId, {
-          title: 'requirement completion projection pending',
-          summary: `Work completion remains authoritative; Requirement projection could not be applied: ${error instanceof Error ? error.message : String(error)}`.slice(0, 2_000),
-          detailLevel: 'summary',
-        });
-      } catch {
-        // The completion receipt was already persisted; legacy Task projection
-        // remains retryable even if this diagnostic cannot be stored.
-      }
-    }
-  }
   const recordedReceipt = recorded.completionReceipt;
   const projectedReceipt = recordedReceipt && isRepositoryCompletionReceipt(recordedReceipt) ? recordedReceipt : receipt;
   const projectedVerification = { ...task.verification!, completionReceipt: projectedReceipt };
@@ -438,32 +419,12 @@ export function acceptVerifiedTaskFromControllerWork(input: ControllerWorkTaskRe
   // historical Task write is interrupted, the Work authority is still
   // durable and a retry can safely rebuild the projection.
   const completionOutcome = noChange ? 'completed_no_change' : contract.workKind === 'remote_effect' ? 'completed_remote' : 'completed_changed';
-  const recorded = recordWorkCompletionReceipt(
+  const recorded = completeWorkWithReceipt(
     { controllerHome: input.controllerHome, repoId: input.repoId },
     input.workId,
     receipt,
     completionOutcome,
   );
-  if (recorded.requirementId) {
-    try {
-      completeRequirementFromWork(
-        { controllerHome: input.controllerHome },
-        { requirementId: recorded.requirementId, work: recorded },
-      );
-    } catch (error) {
-      try {
-        appendWorkEvidence({ controllerHome: input.controllerHome, repoId: input.repoId }, input.workId, {
-          title: 'requirement completion projection pending',
-          summary: `Work completion remains authoritative; Requirement projection could not be applied: ${error instanceof Error ? error.message : String(error)}`.slice(0, 2_000),
-          detailLevel: 'summary',
-        });
-      } catch {
-        // The Work receipt is canonical and already durable. Keep historical
-        // reconciliation/task projection retryable instead of surfacing a false
-        // completion failure from this downstream diagnostic path.
-      }
-    }
-  }
   const recordedReceipt = recorded.completionReceipt;
   const projectedReceipt = recordedReceipt && isRepositoryCompletionReceipt(recordedReceipt) ? recordedReceipt : receipt;
   const projectedVerification = {

package/src/runtime/control-plane/execution/work-terminal-cleanup.ts

@@ -19,7 +19,7 @@ import { managedPathInside, managedWorktreeStorageRoot } from '../../../cli/repo
 import { markRepositoryProjectionDirty } from '../../projections/invalidation';
 import { listControlPlaneRecords } from '../persistence/sqlite-store';
 import { getWorkContract } from '../facade/work-contract-store';
-import { getControllerSession, releaseControllerSession } from '../facade/controller-session-store';
+import { getControllerSession, releaseObservedControllerSession } from '../facade/controller-session-store';
 import { isRepositoryCompletionReceipt, isTerminalWorkContractStatus, type WorkContract } from '../facade/types';
 import {
   cancelProcess,
@@ -968,8 +968,18 @@ export async function reconcileTerminalWorkCleanups(
         const workId = cleaned.handle.workContractId ?? cleaned.handle.workId;
         const controllerSession = getControllerSession({ controllerHome, repoId: repository.repoId }, workId);
         if (controllerSession) {
-          releaseControllerSession({ controllerHome, repoId: repository.repoId }, workId, controllerSession.controllerId);
-          cleaned.receipt.ownership.controllerLease = 'released';
+          const released = releaseObservedControllerSession(
+            { controllerHome, repoId: repository.repoId },
+            { workId, actor: `terminal-cleanup:${originalHandle.workId}`, owner: controllerSession },
+          );
+          if (released.allowed) {
+            cleaned.receipt.ownership.controllerLease = 'released';
+          } else {
+            cleaned.receipt.complete = false;
+            cleaned.receipt.partial = true;
+            cleaned.receipt.completedAt = undefined;
+            cleaned.receipt.blockers = appendUnique(cleaned.receipt.blockers, `controller lease release fenced: ${released.reason}`);
+          }
         } else {
           cleaned.receipt.ownership.controllerLease = 'already_released';
         }

package/src/runtime/control-plane/execution/work-verification-context.ts

@@ -0,0 +1,56 @@
+import { listControllerChecks, type ControllerCheck } from '../../../cli/controller/check-runner';
+import { selectRepositoryCheckout } from '../../../cli/repositories/registry';
+import type { RepositoryRecord } from '../../../cli/repositories/types';
+import { getWorkContract } from '../facade/work-contract-store';
+import type { WorkContract } from '../facade/types';
+
+export interface WorkVerificationContext {
+  store: { controllerHome: string; repoId: string };
+  repository: RepositoryRecord;
+  workContract?: WorkContract;
+  checks: ControllerCheck[];
+}
+
+export type WorkVerificationContextResolution =
+  | { ok: true; context: WorkVerificationContext }
+  | { ok: false; code: 'WORK_VERIFICATION_CHECKOUT_UNAVAILABLE'; detail: string; workContract?: WorkContract };
+
+/**
+ * Resolve the only repository/check-registry context that may be used to verify
+ * a Work. A Work-bound checkout is semantic verification authority: if it can no
+ * longer be resolved, verification must fail closed instead of silently reading
+ * the canonical/main registry.
+ */
+export function resolveWorkVerificationContext(input: {
+  controllerHome: string;
+  repository: RepositoryRecord;
+  workId?: string;
+}): WorkVerificationContextResolution {
+  const store = { controllerHome: input.controllerHome, repoId: input.repository.repoId };
+  const workId = input.workId?.trim();
+  const workContract = workId ? getWorkContract(store, workId) : undefined;
+  let repository = input.repository;
+
+  if (workContract?.checkoutId) {
+    try {
+      repository = selectRepositoryCheckout(input.repository, workContract.checkoutId, { allowArchived: true });
+    } catch (error) {
+      return {
+        ok: false,
+        code: 'WORK_VERIFICATION_CHECKOUT_UNAVAILABLE',
+        detail: error instanceof Error ? error.message : 'Work checkout could not be resolved',
+        workContract,
+      };
+    }
+  }
+
+  return {
+    ok: true,
+    context: {
+      store,
+      repository,
+      workContract,
+      checks: listControllerChecks(repository.canonicalRoot),
+    },
+  };
+}

package/src/runtime/control-plane/execution/work-verification-service.ts

@@ -0,0 +1,388 @@
+import { readLatestControllerCheckEvidence } from '../../../cli/controller/check-runner';
+import { repositoryGitStatus } from '../../../cli/repositories/structured-git';
+import type { RepositoryRecord } from '../../../cli/repositories/types';
+import {
+  DEFAULT_WORK_CHECK_LEASE_WAIT_MS,
+  checkRequiresDurableWorkflow,
+  getProcessRecord,
+  processCheckCompletionReceipt,
+  readPersistedCheckResultReceipt,
+  runPersistedCheckViaProcessRuntime,
+} from '../../execution/process-runtime';
+import { classifyPersistedCheckTerminalEvidence } from '../../execution/process-runtime/check-result';
+import { buildFacadeResult } from '../facade/facade-result';
+import { classifyVerificationOutcome, normalizeCheckIds } from '../facade/check-normalization';
+import { verifyGoalWorkloop } from '../facade/goal-workloop';
+import type { FacadeResult, WorkContract } from '../facade/types';
+import { executionIdentityForRepository } from './execution-identity';
+import { commandFingerprint, verificationInputFingerprint, workspaceValidationFingerprint } from './verification-evidence';
+import { resolveWorkVerificationContext } from './work-verification-context';
+
+export interface ExecuteWorkVerificationInput {
+  controllerHome: string;
+  repository: RepositoryRecord;
+  workId?: string;
+  checkId?: string;
+  requestId?: string;
+  timeoutMs?: number;
+  interactiveWaitMs?: number;
+  leaseWaitMs?: number;
+  simulate?: {
+    infrastructureFailed?: boolean;
+    checkFailed?: boolean;
+    skipped?: boolean;
+  };
+  /** Caller-supplied exact ownership proof for durable-class checks. */
+  allowDurableCheckExecution?: (input: { work: WorkContract; checkId: string }) => boolean;
+}
+
+export interface ExecuteWorkVerificationResult {
+  facade: FacadeResult;
+  isError: boolean;
+}
+
+function result(facade: FacadeResult, isError = false): ExecuteWorkVerificationResult {
+  return { facade, isError };
+}
+
+/**
+ * Canonical Work verification application service.
+ *
+ * Transports supply authenticated ownership proof when they want to execute a
+ * durable-class check, but they never choose the Work checkout, check registry,
+ * Process evidence identity, or acceptance/infrastructure classification.
+ */
+export async function executeWorkVerification(input: ExecuteWorkVerificationInput): Promise<ExecuteWorkVerificationResult> {
+  const workId = input.workId?.trim() ?? '';
+  const checkId = input.checkId?.trim() ?? '';
+  const resolvedVerification = resolveWorkVerificationContext({
+    controllerHome: input.controllerHome,
+    repository: input.repository,
+    workId,
+  });
+  if (!resolvedVerification.ok) {
+    return result(buildFacadeResult({
+      status: 'blocked',
+      summary: `${resolvedVerification.code}: ${resolvedVerification.detail}`,
+      data: {
+        verification: {
+          checkId: checkId || undefined,
+          outcome: 'infrastructure_failure',
+          isAcceptanceFailure: false,
+          isInfrastructureIssue: true,
+          doesNotRequestTaskChanges: true,
+        },
+      },
+      warnings: ['Work verification never falls back to the canonical/main check registry when the Work-bound checkout is unavailable.'],
+    }), true);
+  }
+
+  const { store, workContract, repository: verificationRepository, checks } = resolvedVerification.context;
+  if (!checkId) {
+    return result(buildFacadeResult({
+      status: 'blocked',
+      summary: 'Work verification requires a registered check_id.',
+      data: {
+        verification: {
+          outcome: 'check_id_required',
+          isAcceptanceFailure: false,
+          isInfrastructureIssue: true,
+          doesNotRequestTaskChanges: true,
+        },
+        registeredCheckCount: checks.length,
+      },
+      warnings: ['CHECK_ID_REQUIRED: pass check_id for one registered repository check.'],
+      suggestedNextActions: normalizeCheckIds(checks.slice(0, 3).map((check) => check.id), checks).suggestedNextActions,
+    }), true);
+  }
+
+  const workloopCtx = {
+    workStore: store,
+    handoffStore: store,
+    repoId: input.repository.repoId,
+    availableChecks: checks,
+  };
+  if (workId && (!workContract || workContract.status === 'completed' || workContract.status === 'cancelled' || workContract.status === 'failed')) {
+    const facade = verifyGoalWorkloop(workloopCtx, { workId, checkId });
+    return result(facade, facade.status === 'failed');
+  }
+
+  const classified = classifyVerificationOutcome({ checkId, available: checks });
+  if (classified.outcome === 'invalid_check_id') {
+    if (workId) return result(verifyGoalWorkloop(workloopCtx, { workId, checkId }));
+    return result(buildFacadeResult({
+      status: 'ok',
+      summary: classified.summary,
+      data: {
+        verification: {
+          checkId,
+          outcome: 'invalid_check_id',
+          isAcceptanceFailure: false,
+          isInfrastructureIssue: true,
+          doesNotRequestTaskChanges: true,
+        },
+        registeredCheckCount: checks.length,
+      },
+      warnings: classified.warnings,
+      suggestedNextActions: normalizeCheckIds(checks.slice(0, 3).map((check) => check.id), checks).suggestedNextActions,
+    }));
+  }
+
+  if (input.simulate) {
+    if (!workId) {
+      return result(buildFacadeResult({
+        status: input.simulate.checkFailed ? 'failed' : 'ok',
+        summary: 'Simulated verification without WorkContract.',
+        data: {
+          verification: {
+            checkId: classified.normalizedCheckId,
+            outcome: input.simulate.skipped ? 'skipped' : input.simulate.infrastructureFailed ? 'infrastructure_failure' : input.simulate.checkFailed ? 'valid_fail' : 'valid_pass',
+            isAcceptanceFailure: input.simulate.checkFailed === true,
+            simulated: true,
+          },
+        },
+      }), input.simulate.checkFailed === true);
+    }
+    const facade = verifyGoalWorkloop(workloopCtx, {
+      workId,
+      checkId: classified.normalizedCheckId ?? checkId,
+      infrastructureFailed: input.simulate.infrastructureFailed === true,
+      checkFailed: input.simulate.checkFailed === true,
+      skipped: input.simulate.skipped === true,
+    });
+    return result(facade, facade.status === 'failed');
+  }
+
+  try {
+    const normalizedCheckId = classified.normalizedCheckId!;
+    const verificationStatus = repositoryGitStatus(verificationRepository);
+    const observedGitHead = verificationStatus.head;
+    const workspaceFingerprint = workspaceValidationFingerprint(verificationRepository.canonicalRoot, verificationStatus);
+    const requestedChecks = workContract?.checks.length ? workContract.checks : [normalizedCheckId];
+    const verificationRequestFingerprint = observedGitHead ? verificationInputFingerprint({
+      sourceRevision: observedGitHead,
+      workspaceFingerprint,
+      checkId: normalizedCheckId,
+      requestedChecks,
+    }) : undefined;
+    const registeredCheck = checks.find((entry) => entry.id === normalizedCheckId);
+    const durableClassCheck = checkRequiresDurableWorkflow(normalizedCheckId, registeredCheck);
+    const allowDurableCheckExecution = Boolean(
+      durableClassCheck
+      && workContract
+      && workContract.checks.includes(normalizedCheckId)
+      && !workContract.completionReceipt
+      && workContract.status === 'running'
+      && input.allowDurableCheckExecution?.({ work: workContract, checkId: normalizedCheckId }),
+    );
+
+    const executed = await runPersistedCheckViaProcessRuntime({
+      controllerHome: input.controllerHome,
+      repoId: verificationRepository.repoId,
+      checkoutId: verificationRepository.activeCheckoutId,
+      repoRoot: verificationRepository.canonicalRoot,
+      executionIdentity: executionIdentityForRepository(verificationRepository, workId ? { workId } : {}),
+      checkId: normalizedCheckId,
+      timeoutMs: input.timeoutMs,
+      interactiveWaitMs: input.interactiveWaitMs ?? 0,
+      leaseWaitMs: input.leaseWaitMs ?? (workId ? DEFAULT_WORK_CHECK_LEASE_WAIT_MS : undefined),
+      requestId: input.requestId,
+      requestSemanticFingerprint: verificationRequestFingerprint,
+      workId: workId || undefined,
+      commandId: input.requestId,
+      verificationSnapshot: workContract ? {
+        workId: workContract.workId,
+        allowedPaths: workContract.allowedPaths,
+        forbiddenPaths: workContract.forbiddenPaths,
+      } : undefined,
+      allowDurableCheckExecution,
+    });
+
+    if (executed.mode === 'durable') {
+      return result(buildFacadeResult({
+        status: 'blocked',
+        summary: `Check ${normalizedCheckId} requires an explicit durable workflow; no acceptance result was recorded.`,
+        data: {
+          verification: {
+            checkId: normalizedCheckId,
+            outcome: 'deferred',
+            isAcceptanceFailure: false,
+            isInfrastructureIssue: false,
+            durable: executed.durable,
+            observedGitHead,
+          },
+        },
+        suggestedNextActions: workId ? [{
+          label: 'Continue Work with the durable check requirement',
+          tool: 'rh_work',
+          operation: 'continue',
+          payload: { work_id: workId },
+          risk: 'workspace_write',
+          confidence: 'high',
+        }] : [],
+      }), true);
+    }
+
+    const handle = executed.process;
+    if (!handle) throw new Error(`PROCESS_CHECK_HANDLE_MISSING: ${normalizedCheckId}`);
+    const record = getProcessRecord(input.controllerHome, verificationRepository.repoId, handle.processId);
+    const checkContentRevision = record?.checkExecution?.revision;
+    if (!handle.completed) {
+      return result(buildFacadeResult({
+        status: 'ok',
+        summary: `Check ${normalizedCheckId} is running through Process Runtime; continue other work and reattach to ${handle.processId}.`,
+        data: {
+          verification: {
+            checkId: normalizedCheckId,
+            outcome: 'running',
+            isAcceptanceFailure: false,
+            isInfrastructureIssue: false,
+            executed: true,
+            completed: false,
+            processId: handle.processId,
+            processStatus: handle.status,
+            deduplicated: handle.deduplicated === true,
+            semanticDeduplicated: handle.semanticDeduplicated === true,
+            checkContentRevision,
+            observedGitHead,
+            verificationIsolation: workContract ? 'work_snapshot' : 'shared_checkout',
+            revisionSemantics: 'checkContentRevision is a content-bound Check identity; observedGitHead is Git HEAD and is not interchangeable.',
+          },
+        },
+        rawAvailable: false,
+      }));
+    }
+
+    if (!record) throw new Error(`PROCESS_CHECK_RECORD_MISSING: ${handle.processId}`);
+    const receipt = processCheckCompletionReceipt(record, {
+      repoId: verificationRepository.repoId,
+      checkId: normalizedCheckId,
+      processId: handle.processId,
+      ...(record.checkExecution ? {
+        checkoutId: verificationRepository.activeCheckoutId,
+        workId: workId || undefined,
+        requestId: input.requestId,
+        checkExecution: {
+          cacheKey: record.checkExecution.cacheKey,
+          revision: record.checkExecution.revision,
+          definitionDigest: record.checkExecution.definitionDigest,
+          environmentFingerprint: record.checkExecution.environmentFingerprint,
+          timeoutMs: record.checkExecution.timeoutMs,
+          scopeKey: record.checkExecution.scopeKey,
+        },
+      } : {}),
+    });
+    const structuredCheckResult = readPersistedCheckResultReceipt(record.origin?.checkResultReceiptPath);
+    const legacyEvidence = record.origin?.checkResultReceiptPath
+      ? undefined
+      : readLatestControllerCheckEvidence(verificationRepository.canonicalRoot, normalizedCheckId);
+    const evidenceState = classifyPersistedCheckTerminalEvidence(record, normalizedCheckId, { legacyEvidence });
+    const failureClass = evidenceState.failureClass;
+    const infrastructureFailed = receipt.timedOut
+      || receipt.cancelled
+      || evidenceState.state !== 'matched'
+      || (!receipt.ok && failureClass !== 'acceptance_failure');
+    const checkFailed = !receipt.ok && !infrastructureFailed;
+    const commonVerification = {
+      checkId: normalizedCheckId,
+      outcome: infrastructureFailed ? 'infrastructure_failure' : receipt.ok ? 'valid_pass' : 'valid_fail',
+      isAcceptanceFailure: checkFailed,
+      isInfrastructureIssue: infrastructureFailed,
+      executed: true,
+      completed: true,
+      processId: receipt.processId,
+      processStatus: receipt.runtimeStatus,
+      ok: receipt.ok,
+      timedOut: receipt.timedOut,
+      cancelled: receipt.cancelled,
+      failureClass: infrastructureFailed ? 'infrastructure_failure' : failureClass,
+      deduplicated: handle.deduplicated === true,
+      semanticDeduplicated: handle.semanticDeduplicated === true,
+      checkContentRevision: receipt.checkRevision,
+      observedGitHead,
+      revisionSemantics: 'checkContentRevision is a content-bound Check identity; observedGitHead is Git HEAD and is not interchangeable.',
+      evidenceArtifactPath: record.origin?.workVerificationSnapshot ? undefined : receipt.artifactPath,
+      evidenceReceiptId: receipt.receiptId,
+      checkResultReceiptId: structuredCheckResult?.receiptId,
+      verificationIsolation: record.origin?.workVerificationSnapshot ? 'work_snapshot' : 'shared_checkout',
+      boundedStatus: receipt.ok ? 'pass' : infrastructureFailed ? 'infrastructure_failure' : 'fail',
+      evidenceState: evidenceState.state,
+      ...(evidenceState.infrastructureReason ? { infrastructureReason: evidenceState.infrastructureReason } : {}),
+      ...(record.error?.code ? { processErrorCode: record.error.code } : {}),
+    };
+
+    if (workId) {
+      const sourceRevision = observedGitHead ?? undefined;
+      const facade = verifyGoalWorkloop(workloopCtx, {
+        workId,
+        checkId: normalizedCheckId,
+        sourceRevision,
+        workspaceFingerprint,
+        verificationInputFingerprint: sourceRevision ? verificationRequestFingerprint : undefined,
+        commandFingerprint: commandFingerprint(normalizedCheckId, receipt.commandId),
+        receipt,
+        infrastructureFailed,
+        checkFailed,
+      });
+      return result({
+        ...facade,
+        data: {
+          ...(facade.data as Record<string, unknown>),
+          verification: {
+            ...(typeof facade.data.verification === 'object' && facade.data.verification ? facade.data.verification as Record<string, unknown> : {}),
+            ...commonVerification,
+          },
+        },
+        warnings: infrastructureFailed
+          ? [...facade.warnings, evidenceState.warning ?? 'infrastructure_failure is distinct from acceptance failure']
+          : facade.warnings,
+      }, facade.status === 'failed');
+    }
+
+    return result(buildFacadeResult({
+      status: checkFailed ? 'failed' : 'ok',
+      summary: infrastructureFailed
+        ? `Infrastructure failure while running ${normalizedCheckId}; not an acceptance failure.`
+        : receipt.ok
+          ? `Check ${normalizedCheckId} passed with persisted Process evidence.`
+          : `Check ${normalizedCheckId} failed acceptance.`,
+      data: { verification: commonVerification },
+      warnings: infrastructureFailed ? [evidenceState.warning ?? 'infrastructure_failure is distinct from acceptance failure'] : [],
+      rawAvailable: false,
+    }), checkFailed);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (workId) {
+      const facade = verifyGoalWorkloop(workloopCtx, {
+        workId,
+        checkId: classified.normalizedCheckId ?? checkId,
+        infrastructureFailed: true,
+      });
+      return result({
+        ...facade,
+        warnings: [...facade.warnings, `check_runner_error: ${message.slice(0, 200)}`],
+        data: { ...(facade.data as Record<string, unknown>), isAcceptanceFailure: false },
+      });
+    }
+    return result(buildFacadeResult({
+      status: 'ok',
+      summary: `Infrastructure failure invoking Process Runtime for ${classified.normalizedCheckId}; not acceptance failure.`,
+      data: {
+        verification: {
+          checkId: classified.normalizedCheckId,
+          outcome: 'infrastructure_failure',
+          isAcceptanceFailure: false,
+          isInfrastructureIssue: true,
+        },
+      },
+      warnings: [`check_runner_error: ${message.slice(0, 200)}`],
+      suggestedNextActions: [{
+        label: 'Diagnose runtime (dry-run)',
+        tool: 'rh_work',
+        operation: 'repair',
+        payload: { repair_operation: 'diagnose', dry_run: true },
+        risk: 'readonly',
+      }],
+    }));
+  }
+}

package/src/runtime/control-plane/execution/work-verification-snapshot.ts

@@ -30,6 +30,8 @@ export interface WorkVerificationSnapshotScope {
 
 export interface WorkVerificationSnapshot {
   root: string;
+  /** Ephemeral Controller Home visible only to Candidate verification children. */
+  isolatedControllerHome: string;
   sourceHead: string;
   includedPaths: string[];
   excludedPaths: string[];
@@ -233,9 +235,11 @@ export function materializeWorkVerificationSnapshot(input: {
       allowedPaths: [...input.scope.allowedPaths].sort(),
       forbiddenPaths: [...input.scope.forbiddenPaths].sort(),
     })).digest('hex');
+    const isolatedControllerHome = join(root, '.git', 'forge-candidate-controller');
+    mkdirSync(isolatedControllerHome, { recursive: true, mode: 0o700 });
     mkdirSync(dirname(join(root, SNAPSHOT_MARKER)), { recursive: true });
     writeFileSync(join(root, SNAPSHOT_MARKER), `${JSON.stringify({ schemaVersion: 1, ...input.scope, sourceHead, includedPaths, excludedPaths, ownershipDigest }, null, 2)}\n`);
-    return { root, sourceHead, includedPaths, excludedPaths, ownershipDigest };
+    return { root, isolatedControllerHome, sourceHead, includedPaths, excludedPaths, ownershipDigest };
   } catch (error) {
     rmSync(root, { recursive: true, force: true });
     throw error;