@moretea-labs/forge 1.8.0 → 1.8.1

package/src/runtime/control-plane/cleanup-artifact-retention.ts

@@ -1,4 +1,4 @@
-import { existsSync, readdirSync, rmSync, statSync } from 'fs';
+import { existsSync, lstatSync, readdirSync, rmdirSync, rmSync, statSync } from 'fs';
 import { spawnSync } from 'child_process';
 import { join, relative, resolve } from 'path';
 import { repositoryControllerRoot } from '../../cli/repositories/controller-home';
@@ -37,6 +37,8 @@ export interface CleanupArtifactRetentionOptions {
   graceMs?: number;
   maxEntries?: number;
   maxRemovals?: number;
+  scanSequence?: number;
+  repositoryIds?: readonly string[];
 }
 
 export interface CleanupArtifactRetentionReport {
@@ -190,6 +192,48 @@ function retentionTimestamp(receipt: WorkCleanupReceipt, bundlePath: string): nu
   }
 }
 
+function bundleProtectedRevision(repositoryRoot: string, bundlePath: string): string | undefined {
+  if (!git(repositoryRoot, ['bundle', 'verify', bundlePath]).ok) return undefined;
+  const heads = git(repositoryRoot, ['bundle', 'list-heads', bundlePath]);
+  if (!heads.ok) return undefined;
+  const revisions = [...new Set(heads.stdout.split('\n').map((line) => line.trim().split(/\s+/, 1)[0]).filter((value) => /^[a-f0-9]{40,64}$/i.test(value ?? '')))];
+  return revisions.length === 1 ? revisions[0] : undefined;
+}
+
+function proveOrphanBundleContained(
+  repositoryRoot: string,
+  bundlePath: string,
+  targetBranch: string,
+): { contained: boolean; reason: string } {
+  const protectedRevision = bundleProtectedRevision(repositoryRoot, bundlePath);
+  if (!protectedRevision) return { contained: false, reason: 'orphan_bundle_invalid_or_ambiguous' };
+  if (!revision(repositoryRoot, protectedRevision)) {
+    return { contained: false, reason: 'orphan_protected_revision_unavailable' };
+  }
+  const targetRevision = revision(repositoryRoot, `refs/heads/${targetBranch}`);
+  if (!targetRevision) return { contained: false, reason: 'orphan_target_revision_unavailable' };
+  const remoteRevision = revision(repositoryRoot, `refs/remotes/origin/${targetBranch}`);
+  if (!remoteRevision) return { contained: false, reason: 'orphan_remote_revision_unavailable' };
+  // Anchor the inferred delta against the durable remote target. Using the
+  // local target here could collapse the delta to empty when only the local
+  // branch contains the preserved tip, falsely treating an undelivered bundle
+  // as redundant.
+  const base = git(repositoryRoot, ['merge-base', protectedRevision, remoteRevision]);
+  if (!base.ok || !base.stdout) return { contained: false, reason: 'orphan_merge_base_unavailable' };
+  const paths = changedPaths(repositoryRoot, base.stdout, protectedRevision);
+  if (!paths) return { contained: false, reason: 'orphan_diff_unavailable' };
+  for (const path of paths) {
+    const protectedEntry = treeEntry(repositoryRoot, protectedRevision, path);
+    const targetEntry = treeEntry(repositoryRoot, targetRevision, path);
+    const remoteEntry = treeEntry(repositoryRoot, remoteRevision, path);
+    if (protectedEntry === undefined || targetEntry === undefined || remoteEntry === undefined
+      || protectedEntry !== targetEntry || protectedEntry !== remoteEntry) {
+      return { contained: false, reason: 'orphan_content_mismatch' };
+    }
+  }
+  return { contained: true, reason: paths.length === 0 ? 'orphan_no_source_delta' : 'orphan_target_and_remote_content_contained' };
+}
+
 function retirementFromProof(
   proof: WorkPreservationContainmentProof,
   status: 'eligible' | 'removed' | 'not_needed',
@@ -232,27 +276,36 @@ export function cleanupWorkPreservationArtifacts(
   const repositoriesRoot = join(controllerHome, 'repositories');
   let repositoryIds: string[] = [];
   try {
+    const repositoryFilter = options.repositoryIds ? new Set(options.repositoryIds.map((id) => id.trim()).filter(Boolean)) : undefined;
     repositoryIds = readdirSync(repositoriesRoot, { withFileTypes: true })
-      .filter((entry) => entry.isDirectory())
+      .filter((entry) => entry.isDirectory() && (!repositoryFilter || repositoryFilter.has(entry.name)))
       .map((entry) => entry.name)
       .sort();
   } catch {
     return report;
   }
+  const scanSequence = Math.trunc(options.scanSequence ?? Math.floor(nowMs / 60_000));
+  if (repositoryIds.length > 1) {
+    const offset = ((scanSequence % repositoryIds.length) + repositoryIds.length) % repositoryIds.length;
+    repositoryIds.push(...repositoryIds.splice(0, offset));
+  }
+  let handleInspected = 0;
+  let physicalInspected = 0;
 
-  outer: for (const repositoryId of repositoryIds) {
+  for (const repositoryId of repositoryIds) {
     let repository;
     try {
       repository = getRepository(repositoryId, controllerHome, { includeRemoved: true });
     } catch {
       continue;
     }
-    for (let handle of listWorkHandles(controllerHome, repositoryId)) {
-      if (report.inspected >= maxEntries) {
-        report.budgetExhausted = true;
-        break outer;
-      }
-      report.inspected += 1;
+    const repositoryHandles = listWorkHandles(controllerHome, repositoryId)
+      .sort((left, right) => left.workId.localeCompare(right.workId));
+    if (repositoryHandles.length > 1) {
+      const offset = ((scanSequence % repositoryHandles.length) + repositoryHandles.length) % repositoryHandles.length;
+      repositoryHandles.push(...repositoryHandles.splice(0, offset));
+    }
+    for (let handle of repositoryHandles) {
       const receipt = handle.cleanupReceipt;
       const bundlePath = receipt?.preservation.bundlePath;
       const retirement = receipt?.preservation.bundleRetirement;
@@ -265,6 +318,12 @@ export function cleanupWorkPreservationArtifacts(
         }
       }
       if (!receipt || !bundlePath) continue;
+      if (handleInspected >= maxEntries) {
+        report.budgetExhausted = true;
+        break;
+      }
+      handleInspected += 1;
+      report.inspected += 1;
       const expectedPath = resolve(expectedBundlePath(controllerHome, handle));
       if (resolve(bundlePath) !== expectedPath) {
         report.retained += 1;
@@ -303,6 +362,7 @@ export function cleanupWorkPreservationArtifacts(
         handle = writeWorkHandle(controllerHome, { ...handle, cleanupReceipt: eligibleReceipt, updatedAt: nowIso });
         const measurement = existsSync(bundlePath) ? measureReclaimablePath(bundlePath) : { bytes: 0, entries: 0, complete: true };
         if (existsSync(bundlePath)) rmSync(bundlePath, { force: true });
+        try { rmdirSync(join(bundlePath, '..')); } catch { /* Preserve non-empty or concurrently changed directories. */ }
         if (measurement.complete) report.reclaimedBytes += measurement.bytes;
         else report.unknownReclaimedByteCount += 1;
         const currentReceipt = handle.cleanupReceipt!;
@@ -323,6 +383,149 @@ export function cleanupWorkPreservationArtifacts(
         report.errors.push(`${handle.workId}: ${error instanceof Error ? error.message : String(error)}`);
       }
     }
+
+    // WorkHandle metadata is not physical-retention authority. Discover direct
+    // preservation directories as well so a missing or drifted handle cannot
+    // make an owned bundle immortal. This pass remains fail-closed: only the
+    // canonical direct child containing exactly branch.bundle is considered;
+    // symlinks and extra content are retained, and source containment still
+    // requires proof.
+    const artifactRoot = join(repositoryControllerRoot(controllerHome, repositoryId), 'cleanup-artifacts');
+    let artifactEntries;
+    try {
+      if (!lstatSync(artifactRoot).isDirectory()) continue;
+      artifactEntries = readdirSync(artifactRoot, { withFileTypes: true })
+        .sort((left, right) => left.name.localeCompare(right.name));
+      if (artifactEntries.length > 1) {
+        const offset = ((scanSequence % artifactEntries.length) + artifactEntries.length) % artifactEntries.length;
+        artifactEntries.push(...artifactEntries.splice(0, offset));
+      }
+    } catch {
+      continue;
+    }
+    const physicalHandles = repositoryHandles;
+    const handles = new Map(physicalHandles.map((handle) => [handle.workId, handle]));
+    const referencedBundlePaths = new Set(physicalHandles.flatMap((handle) => {
+      const path = handle.cleanupReceipt?.preservation.bundlePath;
+      return path ? [resolve(path)] : [];
+    }));
+    for (const entry of artifactEntries) {
+      if (!entry.isDirectory()) continue;
+      const directoryPath = join(artifactRoot, entry.name);
+      const handle = handles.get(entry.name);
+      const canonicalBundlePath = resolve(join(directoryPath, 'branch.bundle'));
+      if (referencedBundlePaths.has(canonicalBundlePath)) continue;
+      if (physicalInspected >= maxEntries) {
+        report.budgetExhausted = true;
+        break;
+      }
+      physicalInspected += 1;
+      report.inspected += 1;
+      let contents: string[];
+      let bundlePath: string;
+      try {
+        contents = readdirSync(directoryPath).sort();
+        if (contents.length !== 1 || contents[0] !== 'branch.bundle') {
+          report.retained += 1;
+          skip(report, 'physical_bundle_unrecognized_content');
+          continue;
+        }
+        bundlePath = join(directoryPath, 'branch.bundle');
+        const bundleStat = lstatSync(bundlePath);
+        if (!bundleStat.isFile() || bundleStat.isSymbolicLink()) {
+          report.retained += 1;
+          skip(report, 'physical_bundle_unrecognized_content');
+          continue;
+        }
+      } catch (error) {
+        report.retained += 1;
+        skip(report, 'physical_bundle_unreadable');
+        report.errors.push(`${repositoryId}:${entry.name}: ${error instanceof Error ? error.message : String(error)}`);
+        continue;
+      }
+      if (handle?.cleanupReceipt?.preservation.bundlePath
+        && resolve(handle.cleanupReceipt.preservation.bundlePath) !== resolve(bundlePath)) {
+        report.retained += 1;
+        skip(report, 'bundle_metadata_conflict');
+        continue;
+      }
+      let timestamp: number | undefined;
+      try {
+        timestamp = handle?.cleanupReceipt
+          ? retentionTimestamp(handle.cleanupReceipt, bundlePath)
+          : statSync(bundlePath).mtimeMs;
+      } catch (error) {
+        report.retained += 1;
+        skip(report, 'physical_bundle_unreadable');
+        report.errors.push(`${repositoryId}:${entry.name}: ${error instanceof Error ? error.message : String(error)}`);
+        continue;
+      }
+      if (timestamp === undefined || nowMs - timestamp < graceMs) {
+        report.retained += 1;
+        skip(report, 'retention_grace');
+        continue;
+      }
+
+      const receipt = handle?.cleanupReceipt;
+      const handleProof = handle && receipt?.complete
+        ? proveWorkPreservationContained(repository.canonicalRoot, handle, receipt.targetBranch)
+        : undefined;
+      const orphanProof = !handle && repository.defaultBranch
+        ? proveOrphanBundleContained(repository.canonicalRoot, bundlePath, repository.defaultBranch)
+        : undefined;
+      if (handle && (!receipt?.complete || !handleProof?.contained)) {
+        report.retained += 1;
+        skip(report, !receipt?.complete ? 'physical_bundle_incomplete_handle' : `containment_${handleProof!.reason}`);
+        continue;
+      }
+      if (!handle && !orphanProof?.contained) {
+        report.retained += 1;
+        skip(report, orphanProof?.reason ?? (repository.defaultBranch
+          ? 'orphan_source_containment_unproven'
+          : 'orphan_target_branch_unavailable'));
+        continue;
+      }
+      report.eligible += 1;
+      if (remaining <= 0) {
+        report.budgetExhausted = true;
+        skip(report, 'cleanup_budget_exhausted');
+        continue;
+      }
+      report.attempted += 1;
+      remaining -= 1;
+      try {
+        const measurement = measureReclaimablePath(bundlePath);
+        if (handle && receipt && handleProof) {
+          const eligibleReceipt: WorkCleanupReceipt = {
+            ...receipt,
+            preservation: { ...receipt.preservation, bundlePath, bundleRetirement: retirementFromProof(handleProof, 'eligible', nowIso) },
+            updatedAt: nowIso,
+          };
+          const updated = writeWorkHandle(controllerHome, { ...handle, cleanupReceipt: eligibleReceipt, updatedAt: nowIso });
+          rmSync(bundlePath, { force: true });
+          const removedReceipt: WorkCleanupReceipt = {
+            ...updated.cleanupReceipt!,
+            preservation: {
+              ...updated.cleanupReceipt!.preservation,
+              bundlePath: undefined,
+              bundleSha256: undefined,
+              bundleRetirement: retirementFromProof(handleProof, 'removed', nowIso),
+              recoveryInstructions: `Preservation bundle retired after ${handleProof.reason}; exact proof is stored in cleanupReceipt.preservation.bundleRetirement.`,
+            },
+            updatedAt: nowIso,
+          };
+          writeWorkHandle(controllerHome, { ...updated, cleanupReceipt: removedReceipt, updatedAt: nowIso });
+        } else {
+          rmSync(bundlePath, { force: true });
+        }
+        try { rmdirSync(directoryPath); } catch { /* Preserve concurrently populated directories. */ }
+        if (measurement.complete) report.reclaimedBytes += measurement.bytes;
+        else report.unknownReclaimedByteCount += 1;
+        report.removedPaths.push(relative(controllerHome, bundlePath).replace(/\\/g, '/'));
+      } catch (error) {
+        report.errors.push(`${repositoryId}:${entry.name}: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    }
   }
   return report;
 }

package/src/runtime/control-plane/concurrency/work-execution-concurrency.ts

@@ -2,7 +2,7 @@ import {
   buildWorkExecutionConcurrencyContract,
   evaluateWorkExecutionCompatibility,
   getWorkContract,
-  isTerminalWorkContractStatus,
+  semanticWorkState,
   readActiveWorkCandidates,
   workExecutionLaneMutates,
   updateWorkContract,
@@ -16,7 +16,6 @@ import type { ResourceClaimSpec } from '../../execution/jobs/types';
 import { listProcessRecords } from '../../execution/process-runtime/store';
 import { listActiveLeases } from '../../resources/leases/store';
 import { claimsConflict } from '../../resources/claims/conflicts';
-import { getControllerSession } from '../../../../packages/kernel/controller/api/index';
 import {
   isManagedProcessActive,
   type ExecutionConcurrencyWaitProjection,
@@ -101,34 +100,6 @@ export interface RuntimeWorkCompatibilityDecision {
   wait?: ExecutionConcurrencyWaitProjection;
 }
 
-function invalidActiveWorkCompatibility(
-  candidate: WorkExecutionConcurrencyContract,
-  invalid: ReturnType<typeof readActiveWorkCandidates>['invalid'],
-): ExecutionConcurrencyWaitProjection | undefined {
-  if (!workExecutionLaneMutates(candidate.lane)) return undefined;
-  for (const current of invalid) {
-    if (current.workId === candidate.workId) continue;
-    const currentScope = new Set(current.semanticScopeKeys);
-    const overlap = candidate.semanticScopeKeys.filter((key) => currentScope.has(key));
-    if (overlap.length === 0
-      && candidate.lane === 'isolated_write'
-      && candidate.isolation === 'isolated'
-      && current.isolation === 'isolated') continue;
-    return executionConcurrencyWaitProjection({
-      source: 'work_compatibility',
-      blockerCode: 'work_contract_invalid',
-      disposition: 'invalid',
-      blockingWorkId: current.workId,
-      semanticScopeKeys: overlap.length > 0 ? overlap : current.semanticScopeKeys,
-      resourceKeys: candidate.resourceIntents
-        .filter((intent) => intent.mode !== 'read')
-        .map((intent) => intent.resourceKey),
-      wakeTrigger: { kind: 'work_contract_change', workId: current.workId },
-    });
-  }
-  return undefined;
-}
-
 function contractForProcess(
   controllerHome: string,
   repoId: string,
@@ -181,18 +152,12 @@ export function evaluateManagedProcessWorkCompatibility(input: {
     .filter((record) => record.processId !== input.processId && record.workId && isManagedProcessActive(record))
     .map((record) => contractForProcess(input.controllerHome, input.repoId, record))
     .filter((value): value is WorkExecutionConcurrencyContract => Boolean(value));
-  const worksWithActiveProcesses = new Set(activeProcessContracts.map((contract) => contract.workId));
-  const activeSnapshot = readActiveWorkCandidates({
-    controllerHome: input.controllerHome,
-    repoId: input.repoId,
-    limit: 1_000,
-  });
-  const invalidWait = invalidActiveWorkCompatibility(candidate, activeSnapshot.invalid);
-  if (invalidWait) return { compatible: false, hardBlocked: true, wait: invalidWait };
-  const activeWorkContracts = activeSnapshot.contracts
-    .filter((activeWork) => activeWork.workId !== input.workId && !worksWithActiveProcesses.has(activeWork.workId))
-    .map((activeWork) => buildWorkExecutionConcurrencyContract(activeWork));
-  const decision = evaluateWorkExecutionCompatibility(candidate, [...activeProcessContracts, ...activeWorkContracts]);
+  // Thin Work is semantic context, not a physical execution lease. An open Work
+  // with no running Process must not reserve the shared checkout or make another
+  // Process wait for semantic terminalization. Concrete Process contracts own
+  // in-flight compatibility here; durable WorkHandle and resource-lease fences
+  // separately protect repository mutation across Process lifetimes.
+  const decision = evaluateWorkExecutionCompatibility(candidate, activeProcessContracts);
   const blocker = decision.blockers[0];
   return blocker
     ? { compatible: false, hardBlocked: blocker.disposition === 'invalid', wait: blockerProjection(blocker) }
@@ -225,7 +190,7 @@ export function recordWorkExecutionConcurrencyWait(input: {
   const workId = input.workId?.trim();
   if (!workId) return undefined;
   const work = getWorkContract({ controllerHome: input.controllerHome, repoId: input.repoId }, workId);
-  if (!work || isTerminalWorkContractStatus(work.status)) return undefined;
+  if (!work || semanticWorkState(work) !== 'open') return undefined;
   const projection: WorkExecutionConcurrencyProjection = {
     schemaVersion: 1,
     status: input.wait.disposition === 'invalid' ? 'invalid' : 'waiting',
@@ -275,10 +240,7 @@ function workConcurrencyWakeResolved(input: {
   if (input.projection.status === 'invalid' || wake.kind === 'work_contract_change' || wake.kind === 'scheduler_capacity') return false;
   if (wake.kind === 'work_terminal') {
     const blocking = getWorkContract({ controllerHome: input.controllerHome, repoId: input.repoId }, wake.workId);
-    return Boolean(blocking && isTerminalWorkContractStatus(blocking.status));
-  }
-  if (wake.kind === 'controller_release') {
-    return !getControllerSession({ controllerHome: input.controllerHome, repoId: input.repoId }, wake.workId);
+    return Boolean(blocking && semanticWorkState(blocking) !== 'open');
   }
   const activeLeases = listActiveLeases(input.controllerHome, input.projection.leaseRepoId?.trim() || input.repoId);
   return !input.projection.resourceIntents.some((claim) => activeLeases.some((lease) => claimsConflict(claim, lease)));

package/src/runtime/control-plane/execution/controller-authority-recovery.ts

@@ -12,7 +12,7 @@ import {
   type ControllerTerminalizationAuthority,
   type ControllerType,
 } from '../../../../packages/kernel/controller/api/index';
-import { getWorkContract } from '../../../../packages/kernel/work/api/index';
+import { getWorkContract, semanticWorkState } from '../../../../packages/kernel/work/api/index';
 import { currentPermissionSnapshotVersion } from './validation';
 import { startExecutionSession, updateExecutionSession } from './session-store';
 
@@ -55,8 +55,8 @@ export function recoverDirectControllerAuthority(input: {
   const store = { controllerHome: input.controllerHome, repoId: input.repoId };
   const work = getWorkContract(store, workId);
   if (!work) throw new Error(`WORK_NOT_FOUND: ${workId}`);
-  if (['completed', 'failed', 'cancelled'].includes(work.status)) {
-    throw new Error(`WORK_CONTROLLER_AUTHORITY_RECOVERY_TERMINAL: ${workId}:${work.status}`);
+  if (semanticWorkState(work) !== 'open') {
+    throw new Error(`WORK_CONTROLLER_AUTHORITY_RECOVERY_TERMINAL: ${workId}:${semanticWorkState(work)}`);
   }
   if (getControllerRoundRelay(store, workId)) {
     throw new Error(`WORK_CONTROLLER_AUTHORITY_RECOVERY_RELAY_CONFLICT: ${workId}; relay-bound Work must recover through its exact per-round authority.`);
@@ -130,6 +130,7 @@ export function recoverControllerAuthority(input: {
   repositoryActiveCheckoutId?: string;
   workId: string;
   requestedBy?: string;
+  recoveryReason?: string;
   identity: DirectControllerAuthorityRecoveryIdentity;
   runtime: { running?: boolean; runtimeInstanceId?: string };
   leaseMs?: number;
@@ -142,6 +143,8 @@ export function recoverControllerAuthority(input: {
   const relay = recoverControllerRoundRelayAuthority(store, {
     workId: input.workId,
     requestedBy: input.requestedBy,
+    recoveryReason: input.recoveryReason,
+    allowCanonicalRuntimeMigration: true,
     identity: {
       controllerId: input.identity.controllerId,
       controllerType: input.identity.controllerType,
@@ -258,6 +261,31 @@ function assertControllerLifecycleInvocationAuthority(
   return undefined;
 }
 
+/**
+ * Modern sessionless MCP replaces its request binding on every call. For a
+ * direct Work, omission of an opaque capability is not a semantic ownership
+ * change when the exact Work, authenticated controller/principal/type and live
+ * canonical Runtime still agree. Relay-bound rounds remain capability-scoped,
+ * and an explicitly supplied wrong capability never uses this path.
+ */
+export function controllerInvocationCanMechanicallyRebindDirectOwnership(
+  input: ControllerInvocationAuthorityContext & { runtime: { running?: boolean; runtimeInstanceId?: string } },
+  owner: ControllerSession | undefined = getControllerSession(
+    { controllerHome: input.controllerHome, repoId: input.repoId },
+    input.workId.trim(),
+  ),
+): boolean {
+  const workId = input.workId.trim();
+  const store = { controllerHome: input.controllerHome, repoId: input.repoId };
+  if (!owner || getControllerRoundRelay(store, workId)) return false;
+  if (input.identity.transportSessionId || input.identity.controllerAuthorityId) return false;
+  if (owner.controllerId !== input.identity.controllerId || owner.controllerType !== input.identity.controllerType) return false;
+  if (controllerSessionPrincipalId(owner) !== input.identity.principalId) return false;
+  const requestedInstanceId = input.identity.controllerInstanceId.trim();
+  const canonicalRuntimeInstanceId = input.runtime.running ? input.runtime.runtimeInstanceId?.trim() || '' : '';
+  return Boolean(requestedInstanceId && canonicalRuntimeInstanceId === requestedInstanceId);
+}
+
 /** Bind one exact Work owner to the current transport/runtime without changing semantic ownership. */
 export function bindControllerOwnershipForInvocation(input: ControllerInvocationAuthorityContext & {
   runtime: { running?: boolean; runtimeInstanceId?: string };
@@ -267,7 +295,9 @@ export function bindControllerOwnershipForInvocation(input: ControllerInvocation
   const store = { controllerHome: input.controllerHome, repoId: input.repoId };
   const workId = input.workId.trim();
   const existingOwner = getControllerSession(store, workId);
-  assertControllerLifecycleInvocationAuthority(input, existingOwner);
+  if (!controllerInvocationCanMechanicallyRebindDirectOwnership(input, existingOwner)) {
+    assertControllerLifecycleInvocationAuthority(input, existingOwner);
+  }
   return bindControllerSessionToCurrentRuntime(store, {
     workId,
     controllerId: input.identity.controllerId,

package/src/runtime/control-plane/execution/edit-validation-coordinator.ts

@@ -4,13 +4,13 @@ import {
   recordEditSessionProcessCheckReceipts,
   type EditSession,
 } from '../../../cli/editing/edit-session';
-import { listControllerChecks } from '../../../cli/controller/check-runner';
+import { listControllerChecks, readLatestControllerCheckEvidence } from '../../../cli/controller/check-runner';
 import type { RepositoryRecord } from '../../../cli/repositories/types';
 import { repositoryGitStatus } from '../../../cli/repositories/structured-git';
 import { selectRepositoryCheckout } from '../../../cli/repositories/registry';
 import { executionIdentityForRepository } from './execution-identity';
 import { getWorkContract } from '../../../../packages/kernel/work/api/index';
-import { verifyGoalWorkloop } from '../facade/goal-workloop';
+import { recordWorkCheckEvidence } from './work-check-evidence';
 import { commandFingerprint, verificationInputFingerprint, workspaceValidationFingerprint } from './verification-evidence';
 import {
   claimsForCheck,
@@ -20,6 +20,7 @@ import {
   runPersistedCheckViaProcessRuntime,
   type ProcessCheckCompletionReceipt,
 } from '../../execution/process-runtime';
+import { projectTerminalCheckVerification } from '../../execution/process-runtime/check-result';
 import { resourceClaimsConflict } from '../../resources/claims/conflicts';
 import {
   mutateControlPlaneRecord,
@@ -451,10 +452,10 @@ export async function reconcileEditValidationRun(
           issueId: session.issueId,
           taskId: session.taskId,
         },
-        verificationSnapshot: work ? {
-          workId: work.workId,
-          allowedPaths: work.allowedPaths,
-          forbiddenPaths: work.forbiddenPaths,
+        verificationSnapshot: session.workId ? {
+          workId: session.workId,
+          allowedPaths: session.allowedPaths,
+          forbiddenPaths: [],
         } : undefined,
         leaseWaitMs: run.leaseWaitMs,
       });
@@ -492,36 +493,44 @@ export async function reconcileEditValidationRun(
 
   try {
     const receipts = run.checkIds.map((checkId) => receiptFor(controllerHome, validationRepository, run, checkId));
+    const projections = receipts.map((receipt, index) => {
+      const record = records[index]!;
+      const legacyEvidence = record.origin?.checkResultReceiptPath
+        ? undefined
+        : readLatestControllerCheckEvidence(validationRepository.canonicalRoot, receipt.checkId);
+      return projectTerminalCheckVerification(record, receipt.checkId, receipt, { legacyEvidence });
+    });
+    const infrastructureProjectionIndex = projections.findIndex((projection) => projection.outcome === 'infrastructure_failure');
+    if (infrastructureProjectionIndex >= 0) {
+      const receipt = receipts[infrastructureProjectionIndex]!;
+      const projection = projections[infrastructureProjectionIndex]!;
+      throw new Error(`EDIT_VALIDATION_CHECK_INFRASTRUCTURE_FAILURE: ${receipt.checkId}: ${projection.infrastructureReason ?? projection.evidence.warning ?? receipt.summary}`);
+    }
     if (session.workId && work) {
       if (!run.sourceRevision || !run.workspaceFingerprint) throw new Error('EDIT_VALIDATION_WORK_IDENTITY_REQUIRED');
       const availableChecks = listControllerChecks(validationRepository.canonicalRoot);
-      const workloopCtx = {
-        workStore: { controllerHome, repoId: validationRepository.repoId },
-        handoffStore: { controllerHome, repoId: validationRepository.repoId },
-        repoId: validationRepository.repoId,
-        availableChecks,
-        sourceRevision: run.sourceRevision,
-        workspaceFingerprint: run.workspaceFingerprint,
-      };
-      for (const receipt of receipts) {
+      const workStore = { controllerHome, repoId: validationRepository.repoId };
+      for (const [index, receipt] of receipts.entries()) {
         const checkId = receipt.checkId;
+        const projection = projections[index]!;
         const inputFingerprint = verificationInputFingerprint({
           sourceRevision: run.sourceRevision,
           workspaceFingerprint: run.workspaceFingerprint,
           checkId,
           requestedChecks: work.checks.length ? work.checks : run.checkIds,
         });
-        const infrastructureFailed = receipt.timedOut || receipt.cancelled || (!receipt.ok && receipt.status !== 'failed');
-        verifyGoalWorkloop(workloopCtx, {
+        recordWorkCheckEvidence({
+          store: workStore,
           workId: session.workId,
           checkId,
+          availableChecks,
           sourceRevision: run.sourceRevision,
           workspaceFingerprint: run.workspaceFingerprint,
           verificationInputFingerprint: inputFingerprint,
           commandFingerprint: commandFingerprint(checkId, receipt.commandId),
           receipt,
-          infrastructureFailed,
-          checkFailed: !receipt.ok && !infrastructureFailed,
+          infrastructureFailed: projection.isInfrastructureIssue,
+          checkFailed: projection.isAcceptanceFailure,
         });
       }
     }
@@ -535,7 +544,7 @@ export async function reconcileEditValidationRun(
     run = saveRun(controllerHome, {
       ...run,
       status: 'completed',
-      ok: receipts.every((receipt) => receipt.ok),
+      ok: projections.every((projection) => projection.outcome === 'valid_pass'),
       receipts,
       error: undefined,
     });

package/src/runtime/control-plane/execution/execution-identity.ts

@@ -25,12 +25,15 @@ export type ExecutionIdentityErrorCode =
   | 'REPOSITORY_NOT_EXECUTABLE'
   | 'LEGACY_WORK_IDENTITY_AMBIGUOUS'
   | 'LEGACY_WORK_IDENTITY_REJECTED'
-  | 'WORKSPACE_SCOPE_MISMATCH';
+  | 'WORKSPACE_SCOPE_MISMATCH'
+  | 'FORGE_INSTANCE_SCOPE_MISMATCH';
 
 export interface ResolvedExecutionIdentity {
   readonly schemaVersion: 1;
-  readonly authority?: 'repository' | 'ephemeral_workspace';
+  readonly authority?: 'repository' | 'ephemeral_workspace' | 'forge_instance';
+  /** Legacy storage coordinate. For forge_instance authority this is the reserved Process scope key `instance`, not a Repository id. */
   readonly repositoryId: string;
+  /** Legacy storage coordinate. For forge_instance authority this is `instance`, not a checkout. */
   readonly checkoutId: string;
   readonly canonicalRoot: string;
   readonly workId?: string;
@@ -253,7 +256,7 @@ export function executionIdentityFromCoordinates(input: {
   branch?: string;
   expectedHead?: string;
   allowArchived?: boolean;
-  authority?: 'repository' | 'ephemeral_workspace';
+  authority?: 'repository' | 'ephemeral_workspace' | 'forge_instance';
 }): ResolvedExecutionIdentity {
   if (!input.repositoryId.trim() || !input.checkoutId.trim() || !input.canonicalRoot.trim()) {
     fail('EXECUTION_IDENTITY_REQUIRED', 'repositoryId, checkoutId, and canonicalRoot are required');
@@ -331,6 +334,23 @@ export function assertExecutionIdentity(input: {
     });
   }
 
+  if (identity.authority === 'forge_instance') {
+    const instanceRoot = realpathOrFail(identity.canonicalRoot, 'WORKTREE_MISSING', 'ForgeInstance execution root');
+    const requestedCwd = isAbsolute(input.cwd) ? input.cwd : resolve(instanceRoot, input.cwd);
+    const resolvedCwd = realpathOrFail(requestedCwd, 'WORKTREE_MISSING', 'process cwd');
+    if (!statSync(resolvedCwd).isDirectory()) {
+      fail('FORGE_INSTANCE_SCOPE_MISMATCH', 'process cwd is not a directory', { actual: resolvedCwd });
+    }
+    const cwdRelative = relative(instanceRoot, resolvedCwd);
+    if (cwdRelative === '..' || cwdRelative.startsWith('../') || cwdRelative.startsWith('..\\')) {
+      fail('FORGE_INSTANCE_SCOPE_MISMATCH', 'process cwd escapes ForgeInstance execution root', {
+        expected: instanceRoot,
+        actual: resolvedCwd,
+      });
+    }
+    return Object.freeze({ ...identity, canonicalRoot: instanceRoot, resolvedCwd });
+  }
+
   if (identity.authority === 'ephemeral_workspace') {
     const workspaceRoot = realpathOrFail(identity.canonicalRoot, 'WORKTREE_MISSING', 'ephemeral workspace root');
     const requestedCwd = isAbsolute(input.cwd) ? input.cwd : resolve(workspaceRoot, input.cwd);