@moretea-labs/forge 1.7.2 → 1.8.1

package/src/runtime/control-plane/execution/work-head-settlement.ts

@@ -0,0 +1,108 @@
+import { commandExecutionScopeKey, type RepositoryCommandScopeTarget } from '../../../cli/repositories/command-scope';
+import type { RepositoryRecord } from '../../../cli/repositories/types';
+import { repositoryGitStatus } from '../../../cli/repositories/structured-git';
+import type { ResolvedExecutionIdentity } from './execution-identity';
+import { readWorkHandle, transitionWorkHandle } from './work-handle-store';
+
+export type WorkHeadSettlementReason =
+  | 'settled'
+  | 'no_work'
+  | 'command_not_successful'
+  | 'work_handle_missing'
+  | 'identity_mismatch'
+  | 'terminal_handle'
+  | 'branch_changed'
+  | 'head_unavailable'
+  | 'head_unchanged'
+  | 'concurrent_lifecycle_write';
+
+export interface WorkHeadSettlementResult {
+  settled: boolean;
+  reason: WorkHeadSettlementReason;
+  previousHead?: string;
+  currentHead?: string;
+}
+
+/**
+ * Settle the one legitimate post-command Work HEAD transition without weakening
+ * the pre-command execution identity fence. The immutable execution identity is
+ * the authority captured before spawn; a concurrent lifecycle writer or branch
+ * drift must not be adopted after the command returns.
+ */
+export function settleWorkHandleExpectedHeadAfterRepositoryCommand(input: {
+  controllerHome: string;
+  repository: RepositoryCommandScopeTarget;
+  executionIdentity: ResolvedExecutionIdentity;
+  workId?: string;
+  ok?: boolean;
+  cancelled?: boolean;
+  timedOut?: boolean;
+}): WorkHeadSettlementResult {
+  const workId = input.workId?.trim();
+  if (!workId) return { settled: false, reason: 'no_work' };
+  if (input.ok !== true || input.cancelled === true || input.timedOut === true) {
+    return { settled: false, reason: 'command_not_successful' };
+  }
+  const originalHandle = readWorkHandle(input.controllerHome, commandExecutionScopeKey(input.repository), workId);
+  if (!originalHandle) return { settled: false, reason: 'work_handle_missing' };
+  const sameStaticExecutionIdentity = (handle: typeof originalHandle): boolean => (
+    handle.repositoryId === input.executionIdentity.repositoryId
+    && handle.checkoutId === input.executionIdentity.checkoutId
+    && handle.workId === input.executionIdentity.workId
+    && handle.branch === input.executionIdentity.branch
+  );
+  if (!sameStaticExecutionIdentity(originalHandle)) return { settled: false, reason: 'identity_mismatch' };
+  if (originalHandle.state === 'merged' || originalHandle.state === 'cleaned' || originalHandle.state === 'failed_terminal_cleanup') {
+    return { settled: false, reason: 'terminal_handle' };
+  }
+  // A Work head settlement only runs for a Work-bound (repository) command, so
+  // the scope target is a registered repository record at this point.
+  const status = repositoryGitStatus(input.repository as RepositoryRecord);
+  if (!status.branch || status.branch !== originalHandle.branch) {
+    return { settled: false, reason: 'branch_changed', previousHead: originalHandle.expectedHead, currentHead: status.head ?? undefined };
+  }
+  const currentHead = status.head?.trim();
+  if (!currentHead) return { settled: false, reason: 'head_unavailable', previousHead: originalHandle.expectedHead };
+  const originalAuthorityHead = input.executionIdentity.expectedHead;
+  if (originalHandle.expectedHead === currentHead) {
+    if (originalAuthorityHead !== undefined && originalAuthorityHead !== currentHead) {
+      return { settled: true, reason: 'settled', previousHead: originalAuthorityHead, currentHead };
+    }
+    return { settled: false, reason: 'head_unchanged', previousHead: originalHandle.expectedHead, currentHead };
+  }
+  if (originalAuthorityHead !== undefined && originalHandle.expectedHead !== originalAuthorityHead) {
+    return { settled: false, reason: 'identity_mismatch', previousHead: originalHandle.expectedHead, currentHead };
+  }
+  try {
+    transitionWorkHandle(input.controllerHome, originalHandle, originalHandle.state, { expectedHead: currentHead });
+    return { settled: true, reason: 'settled', previousHead: originalHandle.expectedHead, currentHead };
+  } catch (error) {
+    if (!(error instanceof Error) || !error.message.includes('CONTROL_PLANE_REVISION_CONFLICT')) throw error;
+  }
+
+  // One concurrent lifecycle write is allowed to win the first CAS. Re-read the
+  // exact Work authority and converge only when identity/branch are unchanged.
+  const refreshedHandle = readWorkHandle(input.controllerHome, commandExecutionScopeKey(input.repository), workId);
+  if (!refreshedHandle) return { settled: false, reason: 'work_handle_missing', previousHead: originalHandle.expectedHead, currentHead };
+  if (!sameStaticExecutionIdentity(refreshedHandle)) {
+    return { settled: false, reason: 'identity_mismatch', previousHead: refreshedHandle.expectedHead, currentHead };
+  }
+  if (refreshedHandle.expectedHead !== currentHead && originalAuthorityHead !== undefined && refreshedHandle.expectedHead !== originalAuthorityHead) {
+    return { settled: false, reason: 'identity_mismatch', previousHead: refreshedHandle.expectedHead, currentHead };
+  }
+  if (refreshedHandle.state === 'merged' || refreshedHandle.state === 'cleaned' || refreshedHandle.state === 'failed_terminal_cleanup') {
+    return { settled: false, reason: 'terminal_handle', previousHead: refreshedHandle.expectedHead, currentHead };
+  }
+  if (refreshedHandle.expectedHead === currentHead) {
+    return { settled: true, reason: 'settled', previousHead: originalHandle.expectedHead, currentHead };
+  }
+  try {
+    transitionWorkHandle(input.controllerHome, refreshedHandle, refreshedHandle.state, { expectedHead: currentHead });
+    return { settled: true, reason: 'settled', previousHead: refreshedHandle.expectedHead, currentHead };
+  } catch (error) {
+    if (error instanceof Error && error.message.includes('CONTROL_PLANE_REVISION_CONFLICT')) {
+      return { settled: false, reason: 'concurrent_lifecycle_write', previousHead: refreshedHandle.expectedHead, currentHead };
+    }
+    throw error;
+  }
+}

package/src/runtime/control-plane/execution/work-lifecycle-audit.ts

@@ -2,8 +2,12 @@ import { spawnSync } from 'child_process';
 import { existsSync, realpathSync } from 'fs';
 import { resolve } from 'path';
 import type { RepositoryRecord } from '../../../cli/repositories/types';
-import { listWorkContracts } from '../facade/work-contract-store';
-import { isTerminalWorkContractStatus } from '../facade/types';
+import {
+  getWorkContract,
+  readActiveWorkCandidates,
+  type WorkContract,
+} from '../../../../packages/kernel/work/api/index';
+import { isTerminalSemanticWorkState } from '../facade/types';
 import { listWorkHandles } from './work-handle-store';
 
 export interface WorkLifecycleAttention {
@@ -12,8 +16,34 @@ export interface WorkLifecycleAttention {
   message: string;
 }
 
+const CURRENT_READINESS_LIFECYCLE_STATUSES = new Set([
+  'work_contract_invalid',
+  'active_checkout_missing',
+  'cleaned_worktree_still_present',
+  'dirty_linked_worktree_unregistered',
+  'linked_worktree_unregistered',
+]);
+
+/**
+ * Full lifecycle attention is durable audit evidence. Runtime readiness is narrower:
+ * only source-integrity contradictions that can affect the canonical checkout or
+ * release identity may block current execution. Active semantic Work and missing or
+ * retained isolated Work resources and orphaned historical branches remain visible in
+ * the audit and maintenance projections, but are not shared Runtime execution blockers.
+ * Legacy Work finalization stages are historical maintenance evidence after the Thin
+ * cutover; only independently observable contradictions that affect an active checkout
+ * or canonical source identity may block shared readiness.
+ * Isolated concurrent Work must not make an unrelated clean main release appear unhealthy.
+ */
+export function workLifecycleAttentionBlocksReadiness(
+  finding: Pick<WorkLifecycleAttention, 'status'>,
+): boolean {
+  return CURRENT_READINESS_LIFECYCLE_STATUSES.has(finding.status);
+}
+
 interface LinkedWorktree {
   path: string;
+  head?: string;
   branch?: string;
 }
 
@@ -55,6 +85,8 @@ function linkedWorktrees(repositoryRoot: string): LinkedWorktree[] {
     if (line.startsWith('worktree ')) {
       if (current) worktrees.push(current);
       current = { path: line.slice('worktree '.length) };
+    } else if (current && line.startsWith('HEAD ')) {
+      current.head = line.slice('HEAD '.length).trim() || undefined;
     } else if (current && line.startsWith('branch refs/heads/')) {
       current.branch = line.slice('branch refs/heads/'.length);
     }
@@ -84,9 +116,37 @@ function refReachableFromTarget(repositoryRoot: string, ref: string, targetBranc
   return undefined;
 }
 
-function branchIntegrated(repositoryRoot: string, branch: string, targetBranch: string): boolean | undefined {
-  const reachable = refReachableFromTarget(repositoryRoot, branch, targetBranch);
-  if (reachable !== false) return reachable;
+const EXACT_COMMIT_REVISION = /^[0-9a-f]{40}$/i;
+
+function reachableCommitSet(repositoryRoot: string, targetBranch: string): ReadonlySet<string> | undefined {
+  const output = git(repositoryRoot, ['rev-list', targetBranch]);
+  if (output === undefined) return undefined;
+  return new Set(output.split('\n').map((revision) => revision.trim()).filter(Boolean));
+}
+
+function exactCommitReachableFromTarget(
+  repositoryRoot: string,
+  ref: string,
+  targetBranch: string,
+  reachableCommits: ReadonlySet<string> | undefined,
+): boolean | undefined {
+  if (reachableCommits && EXACT_COMMIT_REVISION.test(ref)) return reachableCommits.has(ref);
+  return refReachableFromTarget(repositoryRoot, ref, targetBranch);
+}
+
+function branchIntegrated(
+  repositoryRoot: string,
+  branch: string,
+  targetBranch: string,
+  reachableCommits?: ReadonlySet<string>,
+  branchHead?: string,
+): boolean | undefined {
+  if (reachableCommits && branchHead && EXACT_COMMIT_REVISION.test(branchHead)) {
+    if (reachableCommits.has(branchHead)) return true;
+  } else {
+    const reachable = refReachableFromTarget(repositoryRoot, branch, targetBranch);
+    if (reachable !== false) return reachable;
+  }
 
   // Rebase/cherry-pick delivery can preserve every patch while changing ancestry.
   // Treat the branch as integrated only when Git proves it has no unique patches.
@@ -104,6 +164,59 @@ function attention(code: string, identity: string, message: string): WorkLifecyc
   return { jobId: `lifecycle:${code}:${identity}`, status: code, message };
 }
 
+interface LifecycleWorkSnapshot {
+  contracts: WorkContract[];
+  invalid: Array<{ workId: string; error: string }>;
+}
+
+/**
+ * Lifecycle attention is a projection consumer, not a historical Work scanner.
+ * Active authority comes from the row-isolated Kernel candidate projection.
+ * Terminal diagnostics are bounded to Work that still has a WorkHandle because
+ * that handle owns the physical delivery/cleanup state inspected below. Orphaned
+ * terminal Work is reconstructed by terminal-cleanup reconciliation before it
+ * becomes projection-owned cleanup state.
+ */
+function readLifecycleWorkSnapshot(
+  controllerHome: string,
+  repoId: string,
+  handles: ReturnType<typeof listWorkHandles>,
+): LifecycleWorkSnapshot {
+  const store = { controllerHome, repoId };
+  const active = readActiveWorkCandidates({ ...store, limit: 100 });
+  const contractsById = new Map(active.contracts.map((contract) => [contract.workId, contract]));
+  const invalidById = new Map(active.invalid.map((entry) => [entry.workId, { workId: entry.workId, error: entry.error }]));
+
+  const handledWorkIds = [...new Set(
+    [...handles]
+      .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt))
+      .map((handle) => handle.workContractId ?? handle.workId),
+  )];
+
+  for (const workId of handledWorkIds) {
+    if (contractsById.size >= 100) break;
+    if (contractsById.has(workId) || invalidById.has(workId)) continue;
+    try {
+      const contract = getWorkContract(store, workId);
+      if (contract) contractsById.set(workId, contract);
+    } catch (error) {
+      invalidById.set(workId, {
+        workId,
+        error: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }
+
+  return {
+    contracts: [...contractsById.values()]
+      .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt))
+      .slice(0, 100),
+    invalid: [...invalidById.values()]
+      .sort((left, right) => left.workId.localeCompare(right.workId))
+      .slice(0, 100),
+  };
+}
+
 /**
  * Read-only reconciliation across canonical Work, WorkHandle, registry, and Git.
  * It reports contradictions and live Work through the existing Runtime projection;
@@ -113,27 +226,42 @@ export function collectWorkLifecycleAttention(
   controllerHome: string,
   repository: RepositoryRecord,
 ): WorkLifecycleAttention[] {
-  const contracts = listWorkContracts({
-    controllerHome,
-    repoId: repository.repoId,
-    status: 'all',
-    limit: 100,
-  });
   const handles = listWorkHandles(controllerHome, repository.repoId, 5_000);
+  const workSnapshot = readLifecycleWorkSnapshot(controllerHome, repository.repoId, handles);
+  const contracts = workSnapshot.contracts;
   const contractsByWork = new Map(contracts.map((contract) => [contract.workId, contract]));
   const handlesByWork = new Map(handles.map((handle) => [handle.workContractId ?? handle.workId, handle]));
-  const findings: WorkLifecycleAttention[] = [];
-  const targetBranch = repository.defaultBranch || 'main';
+  const findings: WorkLifecycleAttention[] = workSnapshot.invalid.map((entry) => attention(
+    'work_contract_invalid',
+    entry.workId,
+    `Work ${entry.workId} is unreadable by Kernel semantics and is excluded from valid lifecycle authority: ${entry.error.slice(0, 180)}`,
+  ));
+  const canonicalBranch = git(repository.canonicalRoot, ['branch', '--show-current'])?.trim();
+  const targetBranch = canonicalBranch || repository.defaultBranch || 'main';
+  const targetReachability = new Map<string, ReadonlySet<string> | undefined>();
+  const reachableFrom = (branch: string): ReadonlySet<string> | undefined => {
+    if (!targetReachability.has(branch)) {
+      targetReachability.set(branch, reachableCommitSet(repository.canonicalRoot, branch));
+    }
+    return targetReachability.get(branch);
+  };
 
   for (const contract of contracts) {
     const handle = handlesByWork.get(contract.workId);
-    const terminal = isTerminalWorkContractStatus(contract.status);
+    const terminal = isTerminalSemanticWorkState(contract.semanticState);
     if (!terminal) {
-      findings.push(attention(
-        'work_active',
-        contract.workId,
-        `Work ${contract.workId} is ${contract.status} in ${contract.phase}; continue, block with a handoff, or finalize it explicitly.`,
-      ));
+      // Repository lifecycle attention is release-facing. A source-neutral Work
+      // (for example local UI automation) may legitimately remain active while
+      // an unrelated clean source candidate is released. Only source-mutating
+      // repository Work should make its mere liveness a release blocker; real
+      // structural contradictions below remain attention regardless of kind.
+      if (contract.workKind === 'repository_change') {
+        findings.push(attention(
+          'work_active',
+          contract.workId,
+          `Work ${contract.workId} is ${contract.semanticState} in ${contract.phase}; continue, block with a handoff, or finalize it explicitly.`,
+        ));
+      }
       if (contract.workKind === 'repository_change' && !handle) {
         findings.push(attention(
           'active_work_handle_missing',
@@ -151,17 +279,22 @@ export function collectWorkLifecycleAttention(
       continue;
     }
 
-    if (contract.status === 'completed' && !contract.completionReceipt) {
+    if (contract.semanticState === 'completed' && !contract.completionReceipt) {
       findings.push(attention(
         'completed_work_receipt_missing',
         contract.workId,
         `Completed Work ${contract.workId} has no Completion Receipt.`,
       ));
     }
-    if (contract.status === 'completed' && contract.completionReceipt?.source === 'controller_work') {
+    if (contract.semanticState === 'completed' && contract.completionReceipt?.source === 'controller_work') {
       const receiptTargetRevision = contract.completionReceipt.targetRevision?.trim();
       const receiptTargetBranch = contract.completionReceipt.targetBranch?.trim() || targetBranch;
-      if (!receiptTargetRevision || refReachableFromTarget(repository.canonicalRoot, receiptTargetRevision, receiptTargetBranch) !== true) {
+      if (!receiptTargetRevision || exactCommitReachableFromTarget(
+        repository.canonicalRoot,
+        receiptTargetRevision,
+        receiptTargetBranch,
+        reachableFrom(receiptTargetBranch),
+      ) !== true) {
         findings.push(attention(
           'completion_receipt_target_not_integrated',
           contract.workId,
@@ -198,7 +331,7 @@ export function collectWorkLifecycleAttention(
     handles
       .filter((handle) => {
         const contract = contractsByWork.get(handle.workContractId ?? handle.workId);
-        return contract ? !isTerminalWorkContractStatus(contract.status) : false;
+        return contract ? !isTerminalSemanticWorkState(contract.semanticState) : false;
       })
       .map((handle) => handle.branch),
   );
@@ -230,6 +363,14 @@ export function collectWorkLifecycleAttention(
     if (activeRegistryRoots.has(root)) continue;
     const isDirty = dirty(root);
     const handle = handleRoots.get(root);
+    if (isDirty === false) {
+      const integrated = worktree.branch
+        ? branchIntegrated(repository.canonicalRoot, worktree.branch, targetBranch, reachableFrom(targetBranch), worktree.head)
+        : worktree.head
+          ? exactCommitReachableFromTarget(repository.canonicalRoot, worktree.head, targetBranch, reachableFrom(targetBranch))
+          : undefined;
+      if (integrated === true) continue;
+    }
     const code = isDirty === true ? 'dirty_linked_worktree_unregistered' : 'linked_worktree_unregistered';
     findings.push(attention(
       code,
@@ -238,13 +379,17 @@ export function collectWorkLifecycleAttention(
     ));
   }
 
-  const branches = git(repository.canonicalRoot, ['for-each-ref', '--format=%(refname:short)', 'refs/heads/work', 'refs/heads/codex'])
+  const branches = git(repository.canonicalRoot, ['for-each-ref', '--format=%(refname:short)%09%(objectname)', 'refs/heads/work', 'refs/heads/codex'])
     ?.split('\n')
-    .map((branch) => branch.trim())
-    .filter(Boolean) ?? [];
-  for (const branch of branches) {
+    .map((line) => {
+      const [branch, head] = line.split('\t');
+      return { branch: branch?.trim() ?? '', head: head?.trim() };
+    })
+    .filter((entry) => Boolean(entry.branch)) ?? [];
+  const targetReachableCommits = reachableFrom(targetBranch);
+  for (const { branch, head } of branches) {
     if (activeBranches.has(branch) || retainedBranches.has(branch)) continue;
-    if (branchIntegrated(repository.canonicalRoot, branch, targetBranch) !== false) continue;
+    if (branchIntegrated(repository.canonicalRoot, branch, targetBranch, targetReachableCommits, head) !== false) continue;
     findings.push(attention(
       'work_branch_not_integrated',
       branch,

package/src/runtime/control-plane/execution/work-operation-service.ts

@@ -1,12 +1,13 @@
 import { createHash, randomUUID } from 'crypto';
 import { isAbsolute, relative, resolve } from 'path';
-import type { MultiRepositoryMcpToolContext } from '../../../cli/mcp/multi-repository';
+import type { McpExecutionContext } from '../../../../packages/protocols/mcp/execution-context';
 import { repositoryGitStatus, repositoryGitDiff } from '../../../cli/repositories/structured-git';
 import { classifyRepositoryCommand } from '../../../cli/repositories/command-classifier';
-import { listControllerChecks } from '../../../cli/controller/check-runner';
+import { listControllerChecks, readLatestControllerCheckEvidence } from '../../../cli/controller/check-runner';
 import { readRepositoryAccessPolicy } from '../governance/access-policy';
-import { appendVerificationRecord } from '../facade/work-contract-store';
+import { appendVerificationRecord } from '../../../../packages/kernel/work/api/index';
 import { validateWorkHandle } from './validation';
+import { changedPaths as revisionChangedPaths } from './work-revision-diff';
 import { commandFingerprint, effectiveVerificationEvidence, verificationInputFingerprint, workspaceValidationFingerprint, workValidationInputFingerprint } from './verification-evidence';
 import { executionIdentityForWork } from './execution-identity';
 import { markWorkHandleFailed, transitionWorkHandle, type WorkHandleState } from './work-handle-store';
@@ -14,13 +15,13 @@ import { assertResolvedAuthorization, decideAuthorization, type AuthorizationDec
 import { recordMcpTiming } from '../../diagnostics/mcp-timing';
 import { commandValue, normalizeRepositoryCommand, type RepositoryCommandValue } from '../../../cli/repositories/command-normalization';
 import { executeRepositoryCommandViaProcessRuntime } from '../../execution/process-runtime/command-facade';
-import { getCheckProcessHandle } from '../../execution/process-runtime/check-facade';
+import { getCheckProcessHandle, waitForCheckProcess } from '../../execution/process-runtime/check-facade';
 import { processCheckCompletionReceipt } from '../../execution/process-runtime/check-receipt';
-import { classifyPersistedCheckTerminalEvidence } from '../../execution/process-runtime/check-result';
+import { projectTerminalCheckVerification } from '../../execution/process-runtime/check-result';
 import { claimProcessInvocation, getProcessRecord } from '../../execution/process-runtime/store';
 import { runPersistedCheckViaProcessRuntime } from '../../execution/process-runtime/persisted-check';
-import { markWorkValidationPending, projectWorkValidationOutcome } from './work-validation-reconciler';
-import { assertWorkControllerOwnership, compactHandle, contractFor, gitHead, identityFor, makeBoundedWorkResult, reconcileTerminalCleanup, requireSession, terminalCleanupOutcome, workForSession } from './work-execution-support';
+import { markWorkValidationCurrentFromReusedEvidence, markWorkValidationPending, projectWorkValidationOutcome } from './work-validation-reconciler';
+import { compactHandle, contractFor, gitHead, identityFor, makeBoundedWorkResult, reconcileTerminalCleanup, requireSession, terminalCleanupOutcome, workForSession } from './work-execution-support';
 
 function commandInputs(args: Record<string, unknown>): Array<Record<string, unknown>> {
   if (Array.isArray(args.commands)) return args.commands.filter((value): value is Record<string, unknown> => Boolean(value && typeof value === 'object' && !Array.isArray(value)));
@@ -38,10 +39,9 @@ function authorizationRisk(command: RepositoryCommandValue, classification: Retu
   return 'workspace_write';
 }
 
-export async function executeWork(ctx: MultiRepositoryMcpToolContext, args: Record<string, unknown>): Promise<Record<string, unknown>> {
+export async function executeWork(ctx: McpExecutionContext, args: Record<string, unknown>): Promise<Record<string, unknown>> {
   const session = requireSession(ctx, args);
   const handle = workForSession(ctx, session, args);
-  assertWorkControllerOwnership(ctx, session, handle, args);
   const commands = commandInputs(args);
   if (commands.length > 16) throw new Error('COMMAND_BATCH_TOO_LARGE: at most 16 commands per work_execute');
   const cheap = validateWorkHandle(ctx.controllerHome, handle, identityFor(ctx, args), 'cheap', 'execute');
@@ -213,11 +213,23 @@ export function selectDefaultWorkValidationChecks(
   });
 }
 
-export async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Record<string, unknown>): Promise<Record<string, unknown>> {
+export function workValidationCheckSemanticIdentity(input: {
+  sourceRevision: string;
+  workspaceFingerprint: string;
+  checkId: string;
+  requestedChecks: string[];
+}): { requestSemanticFingerprint: string; verificationInputFingerprint: string } {
+  const fingerprint = verificationInputFingerprint(input);
+  return {
+    requestSemanticFingerprint: fingerprint,
+    verificationInputFingerprint: fingerprint,
+  };
+}
+
+export async function validateWork(ctx: McpExecutionContext, args: Record<string, unknown>): Promise<Record<string, unknown>> {
   const session = requireSession(ctx, args);
   const handle = workForSession(ctx, session, args, {
     reconcileValidation: false,
-    allowClaimedTerminalCleanup: args.cleanup !== false,
   });
   const terminalOutcome = terminalCleanupOutcome(ctx, handle);
   if (terminalOutcome && args.cleanup !== false) {
@@ -226,18 +238,27 @@ export async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Rec
   const validated = validateWorkHandle(ctx.controllerHome, handle, identityFor(ctx, args), 'full', 'validate');
   const contract = contractFor(ctx, handle);
   const changed = repositoryGitDiff(validated.worktreeRepository, { maxBytes: 64 * 1024 });
-  const changedPaths = Array.isArray(changed.nameOnly) ? changed.nameOnly.map(String) : [];
+  const workspaceChangedPaths = Array.isArray(changed.nameOnly) ? changed.nameOnly.map(String) : [];
+  const validationStatus = repositoryGitStatus(validated.worktreeRepository);
+  const validationHead = validationStatus.head
+    ?? handle.expectedHead
+    ?? handle.baseCommit
+    ?? 'unknown';
+  const baseRevision = handle.deliveryBaseCommit ?? handle.baseCommit;
+  const committedChangedPaths = baseRevision && validationHead !== 'unknown'
+    ? revisionChangedPaths(validated.worktreeRepository.canonicalRoot, baseRevision, validationHead)
+    : [];
+  const changedPaths = [...new Set([...committedChangedPaths, ...workspaceChangedPaths])].sort();
   const requestedChecks = Array.isArray(args.check_ids)
     ? args.check_ids.map(String).filter(Boolean)
     : selectDefaultWorkValidationChecks(contract, changedPaths);
+  const interactiveWaitBudgetMs = typeof args.interactive_wait_ms === 'number' && Number.isFinite(args.interactive_wait_ms)
+    ? Math.max(0, Math.min(30_000, Math.floor(args.interactive_wait_ms)))
+    : 0;
+  const interactiveWaitDeadline = interactiveWaitBudgetMs > 0 ? Date.now() + interactiveWaitBudgetMs : 0;
   const validationInvocationId = typeof args.request_id === 'string' && args.request_id.trim()
     ? args.request_id.trim()
     : `validate-${session.sessionId}-${handle.workId}-${Date.now()}-${randomUUID().slice(0, 8)}`;
-  const validationStatus = repositoryGitStatus(validated.worktreeRepository);
-  const validationHead = validationStatus.head
-    ?? handle.expectedHead
-    ?? handle.baseCommit
-    ?? 'unknown';
   const workspaceFingerprint = workspaceValidationFingerprint(
     validated.worktreeRepository.canonicalRoot,
     validationStatus,
@@ -258,14 +279,29 @@ export async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Rec
     resumeState: handle.state === 'committed' || handle.state === 'merged' ? handle.state : 'editing',
     processes: {},
   };
+  const available = new Set(listControllerChecks(validated.worktreeRepository.canonicalRoot).map((check) => check.id));
+  const hasReusableExactPass = (checkId: string): boolean => Boolean(contract
+    && available.has(checkId)
+    && [...effectiveVerificationEvidence(contract.checkRefs, {
+      sourceRevision: validationHead,
+      workspaceFingerprint,
+      checkId,
+      requestedChecks,
+    })].reverse().some((entry) => entry.current && entry.record.outcome === 'valid_pass' && Boolean(entry.record.receipt)));
+  const allRequestedChecksReusable = Boolean(contract) && requestedChecks.every(hasReusableExactPass);
   let current = transitionWorkHandle(ctx.controllerHome, handle, 'validating', {
     finalization: { ...handle.finalization, validation: 'pending', lastError: undefined },
     validationRun,
   });
-  markWorkValidationPending(ctx.controllerHome, current);
-  const available = new Set(listControllerChecks(validated.worktreeRepository.canonicalRoot).map((check) => check.id));
+  if (!allRequestedChecksReusable) markWorkValidationPending(ctx.controllerHome, current);
   const checks: Array<Record<string, unknown>> = [];
   for (const [index, checkId] of requestedChecks.entries()) {
+    const checkSemanticIdentity = workValidationCheckSemanticIdentity({
+      sourceRevision: validationHead,
+      workspaceFingerprint,
+      checkId,
+      requestedChecks,
+    });
     if (!available.has(checkId)) {
       checks.push({ checkId, ok: false, status: 'missing', summary: `Check not found: ${checkId}` });
       break;
@@ -301,6 +337,14 @@ export async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Rec
       });
       break;
     }
+    if (process?.completed) {
+      // A completed Process may have been executed against an older Work
+      // verification snapshot even when the live checkout looks equivalent.
+      // Re-resolve the current snapshot through Process Runtime so its
+      // content-bound checkExecution authority decides whether the existing
+      // Process is reusable or a distinct execution is required.
+      process = undefined;
+    }
     if (!process) {
       const processRequestId = `${validationInvocationId}:check:${index + 1}`;
       const executed = await runPersistedCheckViaProcessRuntime({
@@ -314,14 +358,12 @@ export async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Rec
         }),
         checkId,
         requestId: processRequestId,
+        requestSemanticFingerprint: checkSemanticIdentity.requestSemanticFingerprint,
         workId: handle.workId,
         commandId: processRequestId,
         verificationBinding: { executionSessionId: session.sessionId },
-        verificationSnapshot: contract && contract.allowedPaths.length > 0 ? {
-          workId: contract.workId,
-          allowedPaths: contract.allowedPaths,
-          forbiddenPaths: contract.forbiddenPaths,
-        } : undefined,
+        // Work is not a path-scope owner. Only an EditSession can bind a
+        // candidate snapshot to concrete mutation scope.
       });
       if (executed.mode === 'durable') {
         checks.push({ checkId, ok: undefined, status: 'deferred', summary: executed.durable?.reason, durable: executed.durable });
@@ -342,6 +384,17 @@ export async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Rec
       };
       current = transitionWorkHandle(ctx.controllerHome, current, 'validating', { validationRun });
     }
+    if (!process.completed && interactiveWaitDeadline > 0) {
+      const remainingWaitMs = Math.max(0, interactiveWaitDeadline - Date.now());
+      if (remainingWaitMs > 0) {
+        process = await waitForCheckProcess(
+          ctx.controllerHome,
+          handle.repositoryId,
+          process.processId,
+          remainingWaitMs,
+        );
+      }
+    }
     if (!process.completed) {
       checks.push({ checkId, ok: undefined, status: 'running', process });
       break;
@@ -369,24 +422,18 @@ export async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Rec
         },
       } : {}),
     });
-    const terminalEvidence = classifyPersistedCheckTerminalEvidence(record, checkId);
-    const infrastructureFailed = receipt.timedOut
-      || receipt.cancelled
-      || terminalEvidence.state !== 'matched'
-      || (!receipt.ok && terminalEvidence.failureClass !== 'acceptance_failure');
+    const legacyEvidence = record.origin?.checkResultReceiptPath
+      ? undefined
+      : readLatestControllerCheckEvidence(validated.worktreeRepository.canonicalRoot, checkId);
+    const projection = projectTerminalCheckVerification(record, checkId, receipt, { legacyEvidence });
     appendVerificationRecord({ controllerHome: ctx.controllerHome, repoId: handle.repositoryId }, handle.workId, {
       checkId,
-      outcome: infrastructureFailed ? 'infrastructure_failure' : receipt.ok ? 'valid_pass' : 'valid_fail',
+      outcome: projection.outcome,
       summary: receipt.summary,
       recordedAt: receipt.finishedAt,
       sourceRevision: validationHead,
       workspaceFingerprint,
-      verificationInputFingerprint: verificationInputFingerprint({
-        sourceRevision: validationHead,
-        workspaceFingerprint,
-        checkId,
-        requestedChecks,
-      }),
+      verificationInputFingerprint: checkSemanticIdentity.verificationInputFingerprint,
       commandFingerprint: commandFingerprint(checkId, receipt.commandId),
       resultArtifactId: receipt.receiptId,
       startedAt: receipt.startedAt,
@@ -396,13 +443,14 @@ export async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Rec
     });
     checks.push({
       checkId,
-      ok: receipt.ok,
-      status: infrastructureFailed ? 'infrastructure_failure' : receipt.ok ? 'passed' : 'failed',
+      ok: projection.outcome === 'valid_pass' ? true : projection.outcome === 'valid_fail' ? false : undefined,
+      status: projection.outcome === 'valid_pass' ? 'passed' : projection.outcome === 'valid_fail' ? 'failed' : 'infrastructure_failure',
       process,
       receipt,
-      ...(terminalEvidence.warning ? { warning: terminalEvidence.warning } : {}),
+      ...(projection.evidence.warning ? { warning: projection.evidence.warning } : {}),
+      ...(projection.infrastructureReason ? { infrastructureReason: projection.infrastructureReason } : {}),
     });
-    if (!receipt.ok) break;
+    if (projection.outcome !== 'valid_pass') break;
   }
   const infrastructureFailure = checks.find((check) => (
     check.status === 'missing'
@@ -438,11 +486,15 @@ export async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Rec
     ...(failureSummary ? { failureReason: failureSummary } : { failureReason: undefined }),
   });
   if (completed) {
+    if (passed && allRequestedChecksReusable) {
+      markWorkValidationCurrentFromReusedEvidence(ctx.controllerHome, next);
+    }
     projectWorkValidationOutcome(
       ctx.controllerHome,
       next,
       infrastructureFailure ? 'infrastructure_failure' : passed ? 'passed' : 'failed',
       failureSummary,
+      passed ? { sourceRevision: validationHead, workspaceFingerprint } : undefined,
     );
   }
   if (completed && acceptedFailure) {