@moretea-labs/forge 1.7.2 → 1.8.0

package/src/runtime/control-plane/execution/work-lifecycle-audit.ts

@@ -2,8 +2,14 @@ import { spawnSync } from 'child_process';
 import { existsSync, realpathSync } from 'fs';
 import { resolve } from 'path';
 import type { RepositoryRecord } from '../../../cli/repositories/types';
-import { listWorkContracts } from '../facade/work-contract-store';
+import {
+  getWorkContract,
+  listWorkContracts,
+  readActiveWorkCandidates,
+  type WorkContract,
+} from '../../../../packages/kernel/work/api/index';
 import { isTerminalWorkContractStatus } from '../facade/types';
+import { listControlPlaneRecords } from '../persistence/sqlite-store';
 import { listWorkHandles } from './work-handle-store';
 
 export interface WorkLifecycleAttention {
@@ -14,6 +20,7 @@ export interface WorkLifecycleAttention {
 
 interface LinkedWorktree {
   path: string;
+  head?: string;
   branch?: string;
 }
 
@@ -55,6 +62,8 @@ function linkedWorktrees(repositoryRoot: string): LinkedWorktree[] {
     if (line.startsWith('worktree ')) {
       if (current) worktrees.push(current);
       current = { path: line.slice('worktree '.length) };
+    } else if (current && line.startsWith('HEAD ')) {
+      current.head = line.slice('HEAD '.length).trim() || undefined;
     } else if (current && line.startsWith('branch refs/heads/')) {
       current.branch = line.slice('branch refs/heads/'.length);
     }
@@ -84,9 +93,37 @@ function refReachableFromTarget(repositoryRoot: string, ref: string, targetBranc
   return undefined;
 }
 
-function branchIntegrated(repositoryRoot: string, branch: string, targetBranch: string): boolean | undefined {
-  const reachable = refReachableFromTarget(repositoryRoot, branch, targetBranch);
-  if (reachable !== false) return reachable;
+const EXACT_COMMIT_REVISION = /^[0-9a-f]{40}$/i;
+
+function reachableCommitSet(repositoryRoot: string, targetBranch: string): ReadonlySet<string> | undefined {
+  const output = git(repositoryRoot, ['rev-list', targetBranch]);
+  if (output === undefined) return undefined;
+  return new Set(output.split('\n').map((revision) => revision.trim()).filter(Boolean));
+}
+
+function exactCommitReachableFromTarget(
+  repositoryRoot: string,
+  ref: string,
+  targetBranch: string,
+  reachableCommits: ReadonlySet<string> | undefined,
+): boolean | undefined {
+  if (reachableCommits && EXACT_COMMIT_REVISION.test(ref)) return reachableCommits.has(ref);
+  return refReachableFromTarget(repositoryRoot, ref, targetBranch);
+}
+
+function branchIntegrated(
+  repositoryRoot: string,
+  branch: string,
+  targetBranch: string,
+  reachableCommits?: ReadonlySet<string>,
+  branchHead?: string,
+): boolean | undefined {
+  if (reachableCommits && branchHead && EXACT_COMMIT_REVISION.test(branchHead)) {
+    if (reachableCommits.has(branchHead)) return true;
+  } else {
+    const reachable = refReachableFromTarget(repositoryRoot, branch, targetBranch);
+    if (reachable !== false) return reachable;
+  }
 
   // Rebase/cherry-pick delivery can preserve every patch while changing ancestry.
   // Treat the branch as integrated only when Git proves it has no unique patches.
@@ -104,6 +141,59 @@ function attention(code: string, identity: string, message: string): WorkLifecyc
   return { jobId: `lifecycle:${code}:${identity}`, status: code, message };
 }
 
+interface LifecycleWorkSnapshot {
+  contracts: WorkContract[];
+  invalid: Array<{ workId: string; error: string }>;
+}
+
+/**
+ * Keep lifecycle diagnostics available when one historical active Work row is malformed.
+ * Active Work semantics come only from the Kernel row-isolated projection. When that
+ * projection reports corruption, enumerate bounded durable identities and re-read each
+ * remaining row through exact Kernel authority so terminal receipt/cleanup diagnostics
+ * are preserved without reimplementing Work normalization here.
+ */
+function readLifecycleWorkSnapshot(controllerHome: string, repoId: string): LifecycleWorkSnapshot {
+  const store = { controllerHome, repoId };
+  const active = readActiveWorkCandidates({ ...store, limit: 100 });
+  if (active.invalid.length === 0) {
+    return { contracts: listWorkContracts({ ...store, status: 'all', limit: 100 }), invalid: [] };
+  }
+
+  const contractsById = new Map(active.contracts.map((contract) => [contract.workId, contract]));
+  const invalidById = new Map(active.invalid.map((entry) => [entry.workId, { workId: entry.workId, error: entry.error }]));
+  const identities = listControlPlaneRecords<WorkContract>(controllerHome, {
+    namespace: 'work_contract',
+    scope: repoId,
+    limit: 5_000,
+  })
+    .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt))
+    .slice(0, 100);
+
+  for (const record of identities) {
+    const workId = record.key;
+    if (contractsById.has(workId) || invalidById.has(workId)) continue;
+    try {
+      const contract = getWorkContract(store, workId);
+      if (contract) contractsById.set(workId, contract);
+    } catch (error) {
+      invalidById.set(workId, {
+        workId,
+        error: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }
+
+  return {
+    contracts: [...contractsById.values()]
+      .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt))
+      .slice(0, 100),
+    invalid: [...invalidById.values()]
+      .sort((left, right) => left.workId.localeCompare(right.workId))
+      .slice(0, 100),
+  };
+}
+
 /**
  * Read-only reconciliation across canonical Work, WorkHandle, registry, and Git.
  * It reports contradictions and live Work through the existing Runtime projection;
@@ -113,27 +203,42 @@ export function collectWorkLifecycleAttention(
   controllerHome: string,
   repository: RepositoryRecord,
 ): WorkLifecycleAttention[] {
-  const contracts = listWorkContracts({
-    controllerHome,
-    repoId: repository.repoId,
-    status: 'all',
-    limit: 100,
-  });
+  const workSnapshot = readLifecycleWorkSnapshot(controllerHome, repository.repoId);
+  const contracts = workSnapshot.contracts;
   const handles = listWorkHandles(controllerHome, repository.repoId, 5_000);
   const contractsByWork = new Map(contracts.map((contract) => [contract.workId, contract]));
   const handlesByWork = new Map(handles.map((handle) => [handle.workContractId ?? handle.workId, handle]));
-  const findings: WorkLifecycleAttention[] = [];
-  const targetBranch = repository.defaultBranch || 'main';
+  const findings: WorkLifecycleAttention[] = workSnapshot.invalid.map((entry) => attention(
+    'work_contract_invalid',
+    entry.workId,
+    `Work ${entry.workId} is unreadable by Kernel semantics and is excluded from valid lifecycle authority: ${entry.error.slice(0, 180)}`,
+  ));
+  const canonicalBranch = git(repository.canonicalRoot, ['branch', '--show-current'])?.trim();
+  const targetBranch = canonicalBranch || repository.defaultBranch || 'main';
+  const targetReachability = new Map<string, ReadonlySet<string> | undefined>();
+  const reachableFrom = (branch: string): ReadonlySet<string> | undefined => {
+    if (!targetReachability.has(branch)) {
+      targetReachability.set(branch, reachableCommitSet(repository.canonicalRoot, branch));
+    }
+    return targetReachability.get(branch);
+  };
 
   for (const contract of contracts) {
     const handle = handlesByWork.get(contract.workId);
     const terminal = isTerminalWorkContractStatus(contract.status);
     if (!terminal) {
-      findings.push(attention(
-        'work_active',
-        contract.workId,
-        `Work ${contract.workId} is ${contract.status} in ${contract.phase}; continue, block with a handoff, or finalize it explicitly.`,
-      ));
+      // Repository lifecycle attention is release-facing. A source-neutral Work
+      // (for example local UI automation) may legitimately remain active while
+      // an unrelated clean source candidate is released. Only source-mutating
+      // repository Work should make its mere liveness a release blocker; real
+      // structural contradictions below remain attention regardless of kind.
+      if (contract.workKind === 'repository_change') {
+        findings.push(attention(
+          'work_active',
+          contract.workId,
+          `Work ${contract.workId} is ${contract.status} in ${contract.phase}; continue, block with a handoff, or finalize it explicitly.`,
+        ));
+      }
       if (contract.workKind === 'repository_change' && !handle) {
         findings.push(attention(
           'active_work_handle_missing',
@@ -161,7 +266,12 @@ export function collectWorkLifecycleAttention(
     if (contract.status === 'completed' && contract.completionReceipt?.source === 'controller_work') {
       const receiptTargetRevision = contract.completionReceipt.targetRevision?.trim();
       const receiptTargetBranch = contract.completionReceipt.targetBranch?.trim() || targetBranch;
-      if (!receiptTargetRevision || refReachableFromTarget(repository.canonicalRoot, receiptTargetRevision, receiptTargetBranch) !== true) {
+      if (!receiptTargetRevision || exactCommitReachableFromTarget(
+        repository.canonicalRoot,
+        receiptTargetRevision,
+        receiptTargetBranch,
+        reachableFrom(receiptTargetBranch),
+      ) !== true) {
         findings.push(attention(
           'completion_receipt_target_not_integrated',
           contract.workId,
@@ -230,6 +340,14 @@ export function collectWorkLifecycleAttention(
     if (activeRegistryRoots.has(root)) continue;
     const isDirty = dirty(root);
     const handle = handleRoots.get(root);
+    if (isDirty === false) {
+      const integrated = worktree.branch
+        ? branchIntegrated(repository.canonicalRoot, worktree.branch, targetBranch, reachableFrom(targetBranch), worktree.head)
+        : worktree.head
+          ? exactCommitReachableFromTarget(repository.canonicalRoot, worktree.head, targetBranch, reachableFrom(targetBranch))
+          : undefined;
+      if (integrated === true) continue;
+    }
     const code = isDirty === true ? 'dirty_linked_worktree_unregistered' : 'linked_worktree_unregistered';
     findings.push(attention(
       code,
@@ -238,13 +356,17 @@ export function collectWorkLifecycleAttention(
     ));
   }
 
-  const branches = git(repository.canonicalRoot, ['for-each-ref', '--format=%(refname:short)', 'refs/heads/work', 'refs/heads/codex'])
+  const branches = git(repository.canonicalRoot, ['for-each-ref', '--format=%(refname:short)%09%(objectname)', 'refs/heads/work', 'refs/heads/codex'])
     ?.split('\n')
-    .map((branch) => branch.trim())
-    .filter(Boolean) ?? [];
-  for (const branch of branches) {
+    .map((line) => {
+      const [branch, head] = line.split('\t');
+      return { branch: branch?.trim() ?? '', head: head?.trim() };
+    })
+    .filter((entry) => Boolean(entry.branch)) ?? [];
+  const targetReachableCommits = reachableFrom(targetBranch);
+  for (const { branch, head } of branches) {
     if (activeBranches.has(branch) || retainedBranches.has(branch)) continue;
-    if (branchIntegrated(repository.canonicalRoot, branch, targetBranch) !== false) continue;
+    if (branchIntegrated(repository.canonicalRoot, branch, targetBranch, targetReachableCommits, head) !== false) continue;
     findings.push(attention(
       'work_branch_not_integrated',
       branch,

package/src/runtime/control-plane/execution/work-operation-service.ts

@@ -1,11 +1,11 @@
 import { createHash, randomUUID } from 'crypto';
 import { isAbsolute, relative, resolve } from 'path';
-import type { MultiRepositoryMcpToolContext } from '../../../cli/mcp/multi-repository';
+import type { McpExecutionContext } from '../../../../packages/protocols/mcp/execution-context';
 import { repositoryGitStatus, repositoryGitDiff } from '../../../cli/repositories/structured-git';
 import { classifyRepositoryCommand } from '../../../cli/repositories/command-classifier';
 import { listControllerChecks } from '../../../cli/controller/check-runner';
 import { readRepositoryAccessPolicy } from '../governance/access-policy';
-import { appendVerificationRecord } from '../facade/work-contract-store';
+import { appendVerificationRecord } from '../../../../packages/kernel/work/api/index';
 import { validateWorkHandle } from './validation';
 import { commandFingerprint, effectiveVerificationEvidence, verificationInputFingerprint, workspaceValidationFingerprint, workValidationInputFingerprint } from './verification-evidence';
 import { executionIdentityForWork } from './execution-identity';
@@ -19,7 +19,7 @@ import { processCheckCompletionReceipt } from '../../execution/process-runtime/c
 import { classifyPersistedCheckTerminalEvidence } from '../../execution/process-runtime/check-result';
 import { claimProcessInvocation, getProcessRecord } from '../../execution/process-runtime/store';
 import { runPersistedCheckViaProcessRuntime } from '../../execution/process-runtime/persisted-check';
-import { markWorkValidationPending, projectWorkValidationOutcome } from './work-validation-reconciler';
+import { markWorkValidationCurrentFromReusedEvidence, markWorkValidationPending, projectWorkValidationOutcome } from './work-validation-reconciler';
 import { assertWorkControllerOwnership, compactHandle, contractFor, gitHead, identityFor, makeBoundedWorkResult, reconcileTerminalCleanup, requireSession, terminalCleanupOutcome, workForSession } from './work-execution-support';
 
 function commandInputs(args: Record<string, unknown>): Array<Record<string, unknown>> {
@@ -38,7 +38,7 @@ function authorizationRisk(command: RepositoryCommandValue, classification: Retu
   return 'workspace_write';
 }
 
-export async function executeWork(ctx: MultiRepositoryMcpToolContext, args: Record<string, unknown>): Promise<Record<string, unknown>> {
+export async function executeWork(ctx: McpExecutionContext, args: Record<string, unknown>): Promise<Record<string, unknown>> {
   const session = requireSession(ctx, args);
   const handle = workForSession(ctx, session, args);
   assertWorkControllerOwnership(ctx, session, handle, args);
@@ -213,7 +213,20 @@ export function selectDefaultWorkValidationChecks(
   });
 }
 
-export async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Record<string, unknown>): Promise<Record<string, unknown>> {
+export function workValidationCheckSemanticIdentity(input: {
+  sourceRevision: string;
+  workspaceFingerprint: string;
+  checkId: string;
+  requestedChecks: string[];
+}): { requestSemanticFingerprint: string; verificationInputFingerprint: string } {
+  const fingerprint = verificationInputFingerprint(input);
+  return {
+    requestSemanticFingerprint: fingerprint,
+    verificationInputFingerprint: fingerprint,
+  };
+}
+
+export async function validateWork(ctx: McpExecutionContext, args: Record<string, unknown>): Promise<Record<string, unknown>> {
   const session = requireSession(ctx, args);
   const handle = workForSession(ctx, session, args, {
     reconcileValidation: false,
@@ -258,14 +271,29 @@ export async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Rec
     resumeState: handle.state === 'committed' || handle.state === 'merged' ? handle.state : 'editing',
     processes: {},
   };
+  const available = new Set(listControllerChecks(validated.worktreeRepository.canonicalRoot).map((check) => check.id));
+  const hasReusableExactPass = (checkId: string): boolean => Boolean(contract
+    && available.has(checkId)
+    && [...effectiveVerificationEvidence(contract.checkRefs, {
+      sourceRevision: validationHead,
+      workspaceFingerprint,
+      checkId,
+      requestedChecks,
+    })].reverse().some((entry) => entry.current && entry.record.outcome === 'valid_pass' && Boolean(entry.record.receipt)));
+  const allRequestedChecksReusable = Boolean(contract) && requestedChecks.every(hasReusableExactPass);
   let current = transitionWorkHandle(ctx.controllerHome, handle, 'validating', {
     finalization: { ...handle.finalization, validation: 'pending', lastError: undefined },
     validationRun,
   });
-  markWorkValidationPending(ctx.controllerHome, current);
-  const available = new Set(listControllerChecks(validated.worktreeRepository.canonicalRoot).map((check) => check.id));
+  if (!allRequestedChecksReusable) markWorkValidationPending(ctx.controllerHome, current);
   const checks: Array<Record<string, unknown>> = [];
   for (const [index, checkId] of requestedChecks.entries()) {
+    const checkSemanticIdentity = workValidationCheckSemanticIdentity({
+      sourceRevision: validationHead,
+      workspaceFingerprint,
+      checkId,
+      requestedChecks,
+    });
     if (!available.has(checkId)) {
       checks.push({ checkId, ok: false, status: 'missing', summary: `Check not found: ${checkId}` });
       break;
@@ -301,6 +329,14 @@ export async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Rec
       });
       break;
     }
+    if (process?.completed) {
+      // A completed Process may have been executed against an older Work
+      // verification snapshot even when the live checkout looks equivalent.
+      // Re-resolve the current snapshot through Process Runtime so its
+      // content-bound checkExecution authority decides whether the existing
+      // Process is reusable or a distinct execution is required.
+      process = undefined;
+    }
     if (!process) {
       const processRequestId = `${validationInvocationId}:check:${index + 1}`;
       const executed = await runPersistedCheckViaProcessRuntime({
@@ -314,6 +350,7 @@ export async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Rec
         }),
         checkId,
         requestId: processRequestId,
+        requestSemanticFingerprint: checkSemanticIdentity.requestSemanticFingerprint,
         workId: handle.workId,
         commandId: processRequestId,
         verificationBinding: { executionSessionId: session.sessionId },
@@ -381,12 +418,7 @@ export async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Rec
       recordedAt: receipt.finishedAt,
       sourceRevision: validationHead,
       workspaceFingerprint,
-      verificationInputFingerprint: verificationInputFingerprint({
-        sourceRevision: validationHead,
-        workspaceFingerprint,
-        checkId,
-        requestedChecks,
-      }),
+      verificationInputFingerprint: checkSemanticIdentity.verificationInputFingerprint,
       commandFingerprint: commandFingerprint(checkId, receipt.commandId),
       resultArtifactId: receipt.receiptId,
       startedAt: receipt.startedAt,
@@ -438,11 +470,15 @@ export async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Rec
     ...(failureSummary ? { failureReason: failureSummary } : { failureReason: undefined }),
   });
   if (completed) {
+    if (passed && allRequestedChecksReusable) {
+      markWorkValidationCurrentFromReusedEvidence(ctx.controllerHome, next);
+    }
     projectWorkValidationOutcome(
       ctx.controllerHome,
       next,
       infrastructureFailure ? 'infrastructure_failure' : passed ? 'passed' : 'failed',
       failureSummary,
+      passed ? { sourceRevision: validationHead, workspaceFingerprint } : undefined,
     );
   }
   if (completed && acceptedFailure) {

package/src/runtime/control-plane/execution/work-preparation-service.ts

@@ -1,15 +1,15 @@
 import { createHash } from 'crypto';
 import { spawnSync } from 'child_process';
-import type { MultiRepositoryMcpToolContext } from '../../../cli/mcp/multi-repository';
+import type { McpExecutionContext } from '../../../../packages/protocols/mcp/execution-context';
 import type { RepositoryRecord } from '../../../cli/repositories/types';
 import { getRepository, resolveRepositorySelection, selectRepositoryCheckout } from '../../../cli/repositories/registry';
 import { repositoryGitStatus } from '../../../cli/repositories/structured-git';
 import { ensureManagedWorkspace } from '../../execution/managed-workspace';
 import { readRepositoryAccessPolicy } from '../governance/access-policy';
-import { appendWorkEvidence, getWorkContract, updateWorkContract } from '../facade/work-contract-store';
+import { activateWorkContract, appendWorkEvidence, failWorkContract, getWorkContract, recordWorkEvidenceState, updateWorkContract } from '../../../../packages/kernel/work/api/index';
 import { admitPreparedRepositoryWorkContract } from '../facade/repository-work-admission';
 import { isTerminalWorkContractStatus, type WorkReconciliationRecord } from '../facade/types';
-import { claimControllerSession, getControllerSession, resumeControllerSession } from '../facade/controller-session-store';
+import { claimControllerSession, getControllerSession, resumeControllerSession } from '../../../../packages/kernel/controller/api/index';
 import { updateExecutionSession, type ExecutionSessionContext } from './session-store';
 import { currentPermissionSnapshotVersion, validateWorkHandle } from './validation';
 import { assertExecutionIdentity, executionIdentityFromCoordinates } from './execution-identity';
@@ -25,7 +25,7 @@ function requireExplicitRepoId(args: Record<string, unknown>): string {
   return value;
 }
 
-function selectedRepository(ctx: MultiRepositoryMcpToolContext, session: ExecutionSessionContext, args: Record<string, unknown>, allowSession = true) {
+function selectedRepository(ctx: McpExecutionContext, session: ExecutionSessionContext, args: Record<string, unknown>, allowSession = true) {
   const requested = typeof args.repo_id === 'string' && args.repo_id.trim() ? args.repo_id.trim() : undefined;
   const selectedRepoId = requested ?? (allowSession ? session.activeRepositoryId : undefined);
   if (!selectedRepoId) throw new Error('SESSION_REPOSITORY_REQUIRED: bind a repository before using this work tool');
@@ -75,7 +75,7 @@ function workPrepareFingerprint(input: {
 }
 
 function claimPreparedWorkOwnership(
-  ctx: MultiRepositoryMcpToolContext,
+  ctx: McpExecutionContext,
   session: ExecutionSessionContext,
   handle: WorkHandleState,
   args: Record<string, unknown>,
@@ -96,7 +96,7 @@ function claimPreparedWorkOwnership(
 }
 
 function claimHeadAdoptionOwnership(
-  ctx: MultiRepositoryMcpToolContext,
+  ctx: McpExecutionContext,
   session: ExecutionSessionContext,
   handle: WorkHandleState,
   args: Record<string, unknown>,
@@ -133,7 +133,7 @@ function claimHeadAdoptionOwnership(
 }
 
 function adoptExistingWorkHead(
-  ctx: MultiRepositoryMcpToolContext,
+  ctx: McpExecutionContext,
   session: ExecutionSessionContext,
   repository: RepositoryRecord,
   handle: WorkHandleState,
@@ -251,12 +251,16 @@ function adoptExistingWorkHead(
     validatedInputFingerprint: undefined,
   });
   try {
-    updateWorkContract({ controllerHome: ctx.controllerHome, repoId: handle.repositoryId }, contract.workId, {
-      evidenceState: contract.checkRefs.length === 0
+    recordWorkEvidenceState(
+      { controllerHome: ctx.controllerHome, repoId: handle.repositoryId },
+      contract.workId,
+      contract.checkRefs.length === 0
         ? contract.evidenceState
         : contract.evidenceState === 'valid' || contract.evidenceState === 'stale'
           ? 'stale'
           : 'partial',
+    );
+    updateWorkContract({ controllerHome: ctx.controllerHome, repoId: handle.repositoryId }, contract.workId, {
       reconciliations: [reconciliation, ...contract.reconciliations.filter((entry) => entry.reconciliationId !== reconciliationId)],
     });
     appendWorkEvidence({ controllerHome: ctx.controllerHome, repoId: handle.repositoryId }, contract.workId, {
@@ -289,7 +293,7 @@ function adoptExistingWorkHead(
   };
 }
 
-function invalidateActiveWork(ctx: MultiRepositoryMcpToolContext, session: ExecutionSessionContext, reason: string): void {
+function invalidateActiveWork(ctx: McpExecutionContext, session: ExecutionSessionContext, reason: string): void {
   if (!session.activeRepositoryId || !session.activeWorkId) return;
   const handle = readWorkHandle(ctx.controllerHome, session.activeRepositoryId, session.activeWorkId);
   if (!handle || handle.state === 'cleaned') return;
@@ -298,7 +302,7 @@ function invalidateActiveWork(ctx: MultiRepositoryMcpToolContext, session: Execu
   markWorkHandleFailed(ctx.controllerHome, handle, reason);
 }
 
-export function bindSessionRepository(ctx: MultiRepositoryMcpToolContext, args: Record<string, unknown>): Record<string, unknown> {
+export function bindSessionRepository(ctx: McpExecutionContext, args: Record<string, unknown>): Record<string, unknown> {
   const session = requireSession(ctx, args);
   const repository = resolveRepositorySelection({ repoId: requireExplicitRepoId(args), checkoutId: typeof args.checkout_id === 'string' ? args.checkout_id : undefined, controllerHome: ctx.controllerHome, allowSoleRepository: false });
   const switching = session.activeRepositoryId !== undefined && (session.activeRepositoryId !== repository.repoId || session.activeCheckoutId !== repository.activeCheckoutId);
@@ -314,7 +318,7 @@ export function bindSessionRepository(ctx: MultiRepositoryMcpToolContext, args:
   return { session: next, repository: { repoId: repository.repoId, checkoutId: repository.activeCheckoutId, canonicalRoot: repository.canonicalRoot, branch: repository.checkouts.find((entry) => entry.checkoutId === repository.activeCheckoutId)?.branch ?? null }, switched: switching };
 }
 
-export function prepareWork(ctx: MultiRepositoryMcpToolContext, args: Record<string, unknown>): Record<string, unknown> {
+export function prepareWork(ctx: McpExecutionContext, args: Record<string, unknown>): Record<string, unknown> {
   const session = requireSession(ctx, args);
   const repository = selectedRepository(ctx, session, args, true);
   if (!session.activeRepositoryId) {
@@ -392,7 +396,11 @@ export function prepareWork(ctx: MultiRepositoryMcpToolContext, args: Record<str
         };
       }
       if (existingContract.status === 'open' || existingContract.status === 'failed') {
-        updateWorkContract({ controllerHome: ctx.controllerHome, repoId: repository.repoId }, createdWorkId, { status: 'running', worktreeRef: existingHandle.worktreePath });
+        activateWorkContract(
+          { controllerHome: ctx.controllerHome, repoId: repository.repoId },
+          createdWorkId,
+          { phase: 'implementation', summary: 'Prepared Work ownership resumed on the existing WorkHandle.', worktreeRef: existingHandle.worktreePath },
+        );
       }
       const delegation = createGoalDelegation({
         sessionId: session.sessionId,
@@ -467,12 +475,20 @@ export function prepareWork(ctx: MultiRepositoryMcpToolContext, args: Record<str
         cleanupResponsibility: { owner: 'work_finalizer', registeredAt: new Date().toISOString() },
       };
       writeWorkHandle(ctx.controllerHome, handle);
-      updateWorkContract({ controllerHome: ctx.controllerHome, repoId: repository.repoId }, contract.workId, { status: 'running', worktreeRef: checkout.canonicalRoot });
+      activateWorkContract(
+        { controllerHome: ctx.controllerHome, repoId: repository.repoId },
+        contract.workId,
+        { phase: 'implementation', summary: 'Repository Work preparation completed and execution ownership is active.', worktreeRef: checkout.canonicalRoot },
+      );
       const nextSession = updateExecutionSession(ctx.controllerHome, identityFor(ctx, args), { activeRepositoryId: repository.repoId, activeCheckoutId: checkout.activeCheckoutId, activeWorkId: createdWorkId, permissionSnapshotVersion: policy.revision, goalDelegation: delegation, lastValidatedAt: new Date().toISOString() });
       claimPreparedWorkOwnership(ctx, nextSession, handle, args);
       return { session: nextSession, work: compactHandle(handle), reused: requestReused, isolation: workspace.mode, controllerClaimed: true };
     } catch (error) {
-      updateWorkContract({ controllerHome: ctx.controllerHome, repoId: repository.repoId }, contract.workId, { status: 'failed' });
+      failWorkContract(
+        { controllerHome: ctx.controllerHome, repoId: repository.repoId },
+        contract.workId,
+        { phase: 'implementation', summary: `Repository Work preparation failed: ${error instanceof Error ? error.message : String(error)}` },
+      );
       throw error;
     }
   });

package/src/runtime/control-plane/execution/work-remote-delivery.ts

@@ -1,6 +1,6 @@
 import { spawnSync } from 'child_process';
 import type { RepositoryRecord } from '../../../cli/repositories/types';
-import { getWorkContract } from '../facade/work-contract-store';
+import { getWorkContract } from '../../../../packages/kernel/work/api/index';
 import { isTerminalWorkContractStatus } from '../facade/types';
 import { executeRepositoryCommandViaProcessRuntime, waitRepositoryCommandProcess } from '../../execution/process-runtime/command-facade';
 import { executionIdentityForRepository } from './execution-identity';

package/src/runtime/control-plane/execution/work-task-receipt.ts

@@ -3,7 +3,7 @@ import { spawnSync } from 'child_process';
 import { getIssue, listIssues, recordTaskVerification, acceptVerifiedTask, projectTaskFromWork } from '../../../cli/controller/issue-store';
 import { resolveCompletionTargetBranch } from '../../../cli/controller/completion-target';
 import type { CompletionReceipt, ControllerIssue } from '../../../cli/controller/types';
-import { getWorkContract, updateWorkContract } from '../facade/work-contract-store';
+import { getWorkContract, updateWorkContract } from '../../../../packages/kernel/work/api/index';
 import { completeWorkWithReceipt } from './work-completion-authority';
 import { isRepositoryCompletionReceipt, WORK_RECONCILIATION_METHODS, WORK_RECONCILIATION_OUTCOMES } from '../facade/types';
 import type {
@@ -39,6 +39,25 @@ export function changedPaths(repoRoot: string, baseRevision: string, targetRevis
   return [...new Set(result.stdout.split('\0').filter(Boolean))].sort();
 }
 
+/**
+ * Net tracked paths for a Work whose authoritative repository baseline was an
+ * unborn HEAD. The baseline is the empty repository, so every tracked path in
+ * the current target tree is a net implementation path. This remains correct
+ * after more than one commit, unlike a single-commit diff-tree comparison.
+ */
+export function changedPathsFromUnbornBase(repoRoot: string, targetRevision: string): string[] {
+  const targetCommit = commitRevision(repoRoot, targetRevision, 'TARGET_REVISION');
+  const result = spawnSync('git', ['ls-tree', '-r', '--name-only', '-z', targetCommit], {
+    cwd: repoRoot,
+    encoding: 'utf-8',
+    maxBuffer: 8 * 1024 * 1024,
+  });
+  if (result.status !== 0 || result.error || typeof result.stdout !== 'string') {
+    throw new Error('CONTROLLER_WORK_RECEIPT_UNBORN_CHANGED_PATHS_UNAVAILABLE');
+  }
+  return [...new Set(result.stdout.split('\0').filter(Boolean))].sort();
+}
+
 
 function completionReceiptChangedPaths(
   contract: NonNullable<ReturnType<typeof getWorkContract>>,