@moretea-labs/forge 1.8.0 → 1.8.1

package/src/runtime/control-plane/execution/work-lifecycle-audit.ts

@@ -4,12 +4,10 @@ import { resolve } from 'path';
 import type { RepositoryRecord } from '../../../cli/repositories/types';
 import {
   getWorkContract,
-  listWorkContracts,
   readActiveWorkCandidates,
   type WorkContract,
 } from '../../../../packages/kernel/work/api/index';
-import { isTerminalWorkContractStatus } from '../facade/types';
-import { listControlPlaneRecords } from '../persistence/sqlite-store';
+import { isTerminalSemanticWorkState } from '../facade/types';
 import { listWorkHandles } from './work-handle-store';
 
 export interface WorkLifecycleAttention {
@@ -18,6 +16,31 @@ export interface WorkLifecycleAttention {
   message: string;
 }
 
+const CURRENT_READINESS_LIFECYCLE_STATUSES = new Set([
+  'work_contract_invalid',
+  'active_checkout_missing',
+  'cleaned_worktree_still_present',
+  'dirty_linked_worktree_unregistered',
+  'linked_worktree_unregistered',
+]);
+
+/**
+ * Full lifecycle attention is durable audit evidence. Runtime readiness is narrower:
+ * only source-integrity contradictions that can affect the canonical checkout or
+ * release identity may block current execution. Active semantic Work and missing or
+ * retained isolated Work resources and orphaned historical branches remain visible in
+ * the audit and maintenance projections, but are not shared Runtime execution blockers.
+ * Legacy Work finalization stages are historical maintenance evidence after the Thin
+ * cutover; only independently observable contradictions that affect an active checkout
+ * or canonical source identity may block shared readiness.
+ * Isolated concurrent Work must not make an unrelated clean main release appear unhealthy.
+ */
+export function workLifecycleAttentionBlocksReadiness(
+  finding: Pick<WorkLifecycleAttention, 'status'>,
+): boolean {
+  return CURRENT_READINESS_LIFECYCLE_STATUSES.has(finding.status);
+}
+
 interface LinkedWorktree {
   path: string;
   head?: string;
@@ -147,31 +170,31 @@ interface LifecycleWorkSnapshot {
 }
 
 /**
- * Keep lifecycle diagnostics available when one historical active Work row is malformed.
- * Active Work semantics come only from the Kernel row-isolated projection. When that
- * projection reports corruption, enumerate bounded durable identities and re-read each
- * remaining row through exact Kernel authority so terminal receipt/cleanup diagnostics
- * are preserved without reimplementing Work normalization here.
+ * Lifecycle attention is a projection consumer, not a historical Work scanner.
+ * Active authority comes from the row-isolated Kernel candidate projection.
+ * Terminal diagnostics are bounded to Work that still has a WorkHandle because
+ * that handle owns the physical delivery/cleanup state inspected below. Orphaned
+ * terminal Work is reconstructed by terminal-cleanup reconciliation before it
+ * becomes projection-owned cleanup state.
  */
-function readLifecycleWorkSnapshot(controllerHome: string, repoId: string): LifecycleWorkSnapshot {
+function readLifecycleWorkSnapshot(
+  controllerHome: string,
+  repoId: string,
+  handles: ReturnType<typeof listWorkHandles>,
+): LifecycleWorkSnapshot {
   const store = { controllerHome, repoId };
   const active = readActiveWorkCandidates({ ...store, limit: 100 });
-  if (active.invalid.length === 0) {
-    return { contracts: listWorkContracts({ ...store, status: 'all', limit: 100 }), invalid: [] };
-  }
-
   const contractsById = new Map(active.contracts.map((contract) => [contract.workId, contract]));
   const invalidById = new Map(active.invalid.map((entry) => [entry.workId, { workId: entry.workId, error: entry.error }]));
-  const identities = listControlPlaneRecords<WorkContract>(controllerHome, {
-    namespace: 'work_contract',
-    scope: repoId,
-    limit: 5_000,
-  })
-    .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt))
-    .slice(0, 100);
 
-  for (const record of identities) {
-    const workId = record.key;
+  const handledWorkIds = [...new Set(
+    [...handles]
+      .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt))
+      .map((handle) => handle.workContractId ?? handle.workId),
+  )];
+
+  for (const workId of handledWorkIds) {
+    if (contractsById.size >= 100) break;
     if (contractsById.has(workId) || invalidById.has(workId)) continue;
     try {
       const contract = getWorkContract(store, workId);
@@ -203,9 +226,9 @@ export function collectWorkLifecycleAttention(
   controllerHome: string,
   repository: RepositoryRecord,
 ): WorkLifecycleAttention[] {
-  const workSnapshot = readLifecycleWorkSnapshot(controllerHome, repository.repoId);
-  const contracts = workSnapshot.contracts;
   const handles = listWorkHandles(controllerHome, repository.repoId, 5_000);
+  const workSnapshot = readLifecycleWorkSnapshot(controllerHome, repository.repoId, handles);
+  const contracts = workSnapshot.contracts;
   const contractsByWork = new Map(contracts.map((contract) => [contract.workId, contract]));
   const handlesByWork = new Map(handles.map((handle) => [handle.workContractId ?? handle.workId, handle]));
   const findings: WorkLifecycleAttention[] = workSnapshot.invalid.map((entry) => attention(
@@ -225,7 +248,7 @@ export function collectWorkLifecycleAttention(
 
   for (const contract of contracts) {
     const handle = handlesByWork.get(contract.workId);
-    const terminal = isTerminalWorkContractStatus(contract.status);
+    const terminal = isTerminalSemanticWorkState(contract.semanticState);
     if (!terminal) {
       // Repository lifecycle attention is release-facing. A source-neutral Work
       // (for example local UI automation) may legitimately remain active while
@@ -236,7 +259,7 @@ export function collectWorkLifecycleAttention(
         findings.push(attention(
           'work_active',
           contract.workId,
-          `Work ${contract.workId} is ${contract.status} in ${contract.phase}; continue, block with a handoff, or finalize it explicitly.`,
+          `Work ${contract.workId} is ${contract.semanticState} in ${contract.phase}; continue, block with a handoff, or finalize it explicitly.`,
         ));
       }
       if (contract.workKind === 'repository_change' && !handle) {
@@ -256,14 +279,14 @@ export function collectWorkLifecycleAttention(
       continue;
     }
 
-    if (contract.status === 'completed' && !contract.completionReceipt) {
+    if (contract.semanticState === 'completed' && !contract.completionReceipt) {
       findings.push(attention(
         'completed_work_receipt_missing',
         contract.workId,
         `Completed Work ${contract.workId} has no Completion Receipt.`,
       ));
     }
-    if (contract.status === 'completed' && contract.completionReceipt?.source === 'controller_work') {
+    if (contract.semanticState === 'completed' && contract.completionReceipt?.source === 'controller_work') {
       const receiptTargetRevision = contract.completionReceipt.targetRevision?.trim();
       const receiptTargetBranch = contract.completionReceipt.targetBranch?.trim() || targetBranch;
       if (!receiptTargetRevision || exactCommitReachableFromTarget(
@@ -308,7 +331,7 @@ export function collectWorkLifecycleAttention(
     handles
       .filter((handle) => {
         const contract = contractsByWork.get(handle.workContractId ?? handle.workId);
-        return contract ? !isTerminalWorkContractStatus(contract.status) : false;
+        return contract ? !isTerminalSemanticWorkState(contract.semanticState) : false;
       })
       .map((handle) => handle.branch),
   );

package/src/runtime/control-plane/execution/work-operation-service.ts

@@ -3,10 +3,11 @@ import { isAbsolute, relative, resolve } from 'path';
 import type { McpExecutionContext } from '../../../../packages/protocols/mcp/execution-context';
 import { repositoryGitStatus, repositoryGitDiff } from '../../../cli/repositories/structured-git';
 import { classifyRepositoryCommand } from '../../../cli/repositories/command-classifier';
-import { listControllerChecks } from '../../../cli/controller/check-runner';
+import { listControllerChecks, readLatestControllerCheckEvidence } from '../../../cli/controller/check-runner';
 import { readRepositoryAccessPolicy } from '../governance/access-policy';
 import { appendVerificationRecord } from '../../../../packages/kernel/work/api/index';
 import { validateWorkHandle } from './validation';
+import { changedPaths as revisionChangedPaths } from './work-revision-diff';
 import { commandFingerprint, effectiveVerificationEvidence, verificationInputFingerprint, workspaceValidationFingerprint, workValidationInputFingerprint } from './verification-evidence';
 import { executionIdentityForWork } from './execution-identity';
 import { markWorkHandleFailed, transitionWorkHandle, type WorkHandleState } from './work-handle-store';
@@ -14,13 +15,13 @@ import { assertResolvedAuthorization, decideAuthorization, type AuthorizationDec
 import { recordMcpTiming } from '../../diagnostics/mcp-timing';
 import { commandValue, normalizeRepositoryCommand, type RepositoryCommandValue } from '../../../cli/repositories/command-normalization';
 import { executeRepositoryCommandViaProcessRuntime } from '../../execution/process-runtime/command-facade';
-import { getCheckProcessHandle } from '../../execution/process-runtime/check-facade';
+import { getCheckProcessHandle, waitForCheckProcess } from '../../execution/process-runtime/check-facade';
 import { processCheckCompletionReceipt } from '../../execution/process-runtime/check-receipt';
-import { classifyPersistedCheckTerminalEvidence } from '../../execution/process-runtime/check-result';
+import { projectTerminalCheckVerification } from '../../execution/process-runtime/check-result';
 import { claimProcessInvocation, getProcessRecord } from '../../execution/process-runtime/store';
 import { runPersistedCheckViaProcessRuntime } from '../../execution/process-runtime/persisted-check';
 import { markWorkValidationCurrentFromReusedEvidence, markWorkValidationPending, projectWorkValidationOutcome } from './work-validation-reconciler';
-import { assertWorkControllerOwnership, compactHandle, contractFor, gitHead, identityFor, makeBoundedWorkResult, reconcileTerminalCleanup, requireSession, terminalCleanupOutcome, workForSession } from './work-execution-support';
+import { compactHandle, contractFor, gitHead, identityFor, makeBoundedWorkResult, reconcileTerminalCleanup, requireSession, terminalCleanupOutcome, workForSession } from './work-execution-support';
 
 function commandInputs(args: Record<string, unknown>): Array<Record<string, unknown>> {
   if (Array.isArray(args.commands)) return args.commands.filter((value): value is Record<string, unknown> => Boolean(value && typeof value === 'object' && !Array.isArray(value)));
@@ -41,7 +42,6 @@ function authorizationRisk(command: RepositoryCommandValue, classification: Retu
 export async function executeWork(ctx: McpExecutionContext, args: Record<string, unknown>): Promise<Record<string, unknown>> {
   const session = requireSession(ctx, args);
   const handle = workForSession(ctx, session, args);
-  assertWorkControllerOwnership(ctx, session, handle, args);
   const commands = commandInputs(args);
   if (commands.length > 16) throw new Error('COMMAND_BATCH_TOO_LARGE: at most 16 commands per work_execute');
   const cheap = validateWorkHandle(ctx.controllerHome, handle, identityFor(ctx, args), 'cheap', 'execute');
@@ -230,7 +230,6 @@ export async function validateWork(ctx: McpExecutionContext, args: Record<string
   const session = requireSession(ctx, args);
   const handle = workForSession(ctx, session, args, {
     reconcileValidation: false,
-    allowClaimedTerminalCleanup: args.cleanup !== false,
   });
   const terminalOutcome = terminalCleanupOutcome(ctx, handle);
   if (terminalOutcome && args.cleanup !== false) {
@@ -239,18 +238,27 @@ export async function validateWork(ctx: McpExecutionContext, args: Record<string
   const validated = validateWorkHandle(ctx.controllerHome, handle, identityFor(ctx, args), 'full', 'validate');
   const contract = contractFor(ctx, handle);
   const changed = repositoryGitDiff(validated.worktreeRepository, { maxBytes: 64 * 1024 });
-  const changedPaths = Array.isArray(changed.nameOnly) ? changed.nameOnly.map(String) : [];
+  const workspaceChangedPaths = Array.isArray(changed.nameOnly) ? changed.nameOnly.map(String) : [];
+  const validationStatus = repositoryGitStatus(validated.worktreeRepository);
+  const validationHead = validationStatus.head
+    ?? handle.expectedHead
+    ?? handle.baseCommit
+    ?? 'unknown';
+  const baseRevision = handle.deliveryBaseCommit ?? handle.baseCommit;
+  const committedChangedPaths = baseRevision && validationHead !== 'unknown'
+    ? revisionChangedPaths(validated.worktreeRepository.canonicalRoot, baseRevision, validationHead)
+    : [];
+  const changedPaths = [...new Set([...committedChangedPaths, ...workspaceChangedPaths])].sort();
   const requestedChecks = Array.isArray(args.check_ids)
     ? args.check_ids.map(String).filter(Boolean)
     : selectDefaultWorkValidationChecks(contract, changedPaths);
+  const interactiveWaitBudgetMs = typeof args.interactive_wait_ms === 'number' && Number.isFinite(args.interactive_wait_ms)
+    ? Math.max(0, Math.min(30_000, Math.floor(args.interactive_wait_ms)))
+    : 0;
+  const interactiveWaitDeadline = interactiveWaitBudgetMs > 0 ? Date.now() + interactiveWaitBudgetMs : 0;
   const validationInvocationId = typeof args.request_id === 'string' && args.request_id.trim()
     ? args.request_id.trim()
     : `validate-${session.sessionId}-${handle.workId}-${Date.now()}-${randomUUID().slice(0, 8)}`;
-  const validationStatus = repositoryGitStatus(validated.worktreeRepository);
-  const validationHead = validationStatus.head
-    ?? handle.expectedHead
-    ?? handle.baseCommit
-    ?? 'unknown';
   const workspaceFingerprint = workspaceValidationFingerprint(
     validated.worktreeRepository.canonicalRoot,
     validationStatus,
@@ -354,11 +362,8 @@ export async function validateWork(ctx: McpExecutionContext, args: Record<string
         workId: handle.workId,
         commandId: processRequestId,
         verificationBinding: { executionSessionId: session.sessionId },
-        verificationSnapshot: contract && contract.allowedPaths.length > 0 ? {
-          workId: contract.workId,
-          allowedPaths: contract.allowedPaths,
-          forbiddenPaths: contract.forbiddenPaths,
-        } : undefined,
+        // Work is not a path-scope owner. Only an EditSession can bind a
+        // candidate snapshot to concrete mutation scope.
       });
       if (executed.mode === 'durable') {
         checks.push({ checkId, ok: undefined, status: 'deferred', summary: executed.durable?.reason, durable: executed.durable });
@@ -379,6 +384,17 @@ export async function validateWork(ctx: McpExecutionContext, args: Record<string
       };
       current = transitionWorkHandle(ctx.controllerHome, current, 'validating', { validationRun });
     }
+    if (!process.completed && interactiveWaitDeadline > 0) {
+      const remainingWaitMs = Math.max(0, interactiveWaitDeadline - Date.now());
+      if (remainingWaitMs > 0) {
+        process = await waitForCheckProcess(
+          ctx.controllerHome,
+          handle.repositoryId,
+          process.processId,
+          remainingWaitMs,
+        );
+      }
+    }
     if (!process.completed) {
       checks.push({ checkId, ok: undefined, status: 'running', process });
       break;
@@ -406,14 +422,13 @@ export async function validateWork(ctx: McpExecutionContext, args: Record<string
         },
       } : {}),
     });
-    const terminalEvidence = classifyPersistedCheckTerminalEvidence(record, checkId);
-    const infrastructureFailed = receipt.timedOut
-      || receipt.cancelled
-      || terminalEvidence.state !== 'matched'
-      || (!receipt.ok && terminalEvidence.failureClass !== 'acceptance_failure');
+    const legacyEvidence = record.origin?.checkResultReceiptPath
+      ? undefined
+      : readLatestControllerCheckEvidence(validated.worktreeRepository.canonicalRoot, checkId);
+    const projection = projectTerminalCheckVerification(record, checkId, receipt, { legacyEvidence });
     appendVerificationRecord({ controllerHome: ctx.controllerHome, repoId: handle.repositoryId }, handle.workId, {
       checkId,
-      outcome: infrastructureFailed ? 'infrastructure_failure' : receipt.ok ? 'valid_pass' : 'valid_fail',
+      outcome: projection.outcome,
       summary: receipt.summary,
       recordedAt: receipt.finishedAt,
       sourceRevision: validationHead,
@@ -428,13 +443,14 @@ export async function validateWork(ctx: McpExecutionContext, args: Record<string
     });
     checks.push({
       checkId,
-      ok: receipt.ok,
-      status: infrastructureFailed ? 'infrastructure_failure' : receipt.ok ? 'passed' : 'failed',
+      ok: projection.outcome === 'valid_pass' ? true : projection.outcome === 'valid_fail' ? false : undefined,
+      status: projection.outcome === 'valid_pass' ? 'passed' : projection.outcome === 'valid_fail' ? 'failed' : 'infrastructure_failure',
       process,
       receipt,
-      ...(terminalEvidence.warning ? { warning: terminalEvidence.warning } : {}),
+      ...(projection.evidence.warning ? { warning: projection.evidence.warning } : {}),
+      ...(projection.infrastructureReason ? { infrastructureReason: projection.infrastructureReason } : {}),
     });
-    if (!receipt.ok) break;
+    if (projection.outcome !== 'valid_pass') break;
   }
   const infrastructureFailure = checks.find((check) => (
     check.status === 'missing'