@moretea-labs/forge 1.8.0 → 1.8.1

package/src/runtime/control-plane/execution/work-verification-service.ts

@@ -1,4 +1,5 @@
 import { createHash } from 'crypto';
+import { resolve } from 'path';
 import { controllerCheckExecutionIdentity, listControllerChecks, readLatestControllerCheckEvidence } from '../../../cli/controller/check-runner';
 import { repositoryGitStatus } from '../../../cli/repositories/structured-git';
 import type { RepositoryRecord } from '../../../cli/repositories/types';
@@ -6,20 +7,26 @@ import {
   DEFAULT_WORK_CHECK_LEASE_WAIT_MS,
   checkRequiresDurableWorkflow,
   getProcessRecord,
+  isManagedProcessActive,
+  listProcessRecords,
   processCheckCompletionReceipt,
   readPersistedCheckResultReceipt,
   runPersistedCheckViaProcessRuntime,
 } from '../../execution/process-runtime';
-import { classifyPersistedCheckTerminalEvidence } from '../../execution/process-runtime/check-result';
+import { projectTerminalCheckVerification } from '../../execution/process-runtime/check-result';
 import { buildCheckExecutionSchedule } from '../../execution/process-runtime/check-scheduling';
 import { ingestCheckCompletionGraceProcess } from '../persistence/operational-prior-store';
 import { buildFacadeResult } from '../facade/facade-result';
 import { classifyVerificationOutcome, normalizeCheckIds } from '../facade/check-normalization';
-import { verifyGoalWorkloop } from '../facade/goal-workloop';
+import { recordWorkCheckEvidence } from './work-check-evidence';
 import type { FacadeResult, VerificationRecord, WorkContract } from '../facade/types';
+
 import { executionIdentityForRepository } from './execution-identity';
 import { commandFingerprint, effectiveVerificationEvidence, verificationInputFingerprint, workspaceValidationFingerprint } from './verification-evidence';
 import { resolveWorkVerificationContext } from './work-verification-context';
+import { listWorkBoundRepositoryProcessEvidence } from './work-process-evidence';
+import { changedPaths as workChangedPaths, changedPathsFromUnbornBase } from './work-revision-diff';
+import { readWorkHandle, workDeliveryBaseRevision } from './work-handle-store';
 
 export interface ExecuteWorkVerificationInput {
   controllerHome: string;
@@ -30,13 +37,13 @@ export interface ExecuteWorkVerificationInput {
   timeoutMs?: number;
   interactiveWaitMs?: number;
   leaseWaitMs?: number;
+  /** Exact terminal generic Check Processes to reconcile into this Work. */
+  reconcileProcessIds?: readonly string[];
   simulate?: {
     infrastructureFailed?: boolean;
     checkFailed?: boolean;
     skipped?: boolean;
   };
-  /** Caller-supplied exact ownership proof for durable-class checks. */
-  allowDurableCheckExecution?: (input: { work: WorkContract; checkId: string }) => boolean;
 }
 
 export interface ExecuteWorkVerificationResult {
@@ -48,6 +55,94 @@ function result(facade: FacadeResult, isError = false): ExecuteWorkVerificationR
   return { facade, isError };
 }
 
+/**
+ * Derive the exact current implementation paths for the canonical Work
+ * verifier. Review admission cannot rely on Work scope evidence alone: a
+ * committed candidate in a managed checkout has no dirty-path signal, while
+ * a target-only advance must not become part of the Work candidate.
+ */
+function trustedWorkspaceChangedPaths(input: {
+  controllerHome: string;
+  repository: RepositoryRecord;
+  work: WorkContract;
+  verificationStatus: ReturnType<typeof repositoryGitStatus>;
+}): string[] {
+  const sourceRevision = input.verificationStatus.head;
+  const handle = readWorkHandle(input.controllerHome, input.repository.repoId, input.work.workId);
+  const deliveryBaseRevision = workDeliveryBaseRevision(handle ?? {}) ?? input.work.baseRevision;
+  const committedPaths = deliveryBaseRevision && sourceRevision
+    ? input.work.repositoryBaseState === 'unborn'
+      ? changedPathsFromUnbornBase(input.repository.canonicalRoot, sourceRevision)
+      : workChangedPaths(input.repository.canonicalRoot, deliveryBaseRevision, sourceRevision)
+    : input.work.scopeEvidence?.actualChangedPaths ?? [];
+  return [...new Set([
+    ...committedPaths,
+    ...input.verificationStatus.staged,
+    ...input.verificationStatus.unstaged,
+    ...input.verificationStatus.untracked,
+  ])].map((path) => path.trim()).filter(Boolean).sort();
+}
+
+function currentReusableVerificationRecord(input: {
+  workContract?: WorkContract;
+  checkId: string;
+  sourceRevision?: string;
+  workspaceFingerprint: string;
+  requestedChecks: string[];
+}): VerificationRecord | undefined {
+  if (!input.workContract || !input.sourceRevision) return undefined;
+  return effectiveVerificationEvidence(input.workContract.checkRefs, {
+    sourceRevision: input.sourceRevision,
+    workspaceFingerprint: input.workspaceFingerprint,
+    checkId: input.checkId,
+    requestedChecks: input.requestedChecks,
+  }).find((entry) =>
+    entry.current
+    && (entry.record.outcome === 'valid_pass' || entry.record.outcome === 'valid_fail')
+    && Boolean(entry.record.receipt)
+  )?.record;
+}
+
+function reusedVerificationResult(
+  record: VerificationRecord,
+  input: {
+    workContract?: WorkContract;
+    sourceRevision?: string;
+    workspaceFingerprint: string;
+    workspaceChangedPaths?: readonly string[];
+  } = { workspaceFingerprint: '' },
+  reconciledProcessIds: string[] = [],
+): ExecuteWorkVerificationResult {
+  const receipt = record.receipt!;
+  const passed = record.outcome === 'valid_pass';
+  // Reused verification is durable evidence only. It never derives a Work next step.
+  void input.workContract;
+  void input.sourceRevision;
+  void input.workspaceFingerprint;
+  void input.workspaceChangedPaths;
+  return result(buildFacadeResult({
+    status: passed ? 'ok' : 'failed',
+    summary: `Reused exact current verification receipt for ${record.checkId}; no Process was re-executed.`,
+    data: {
+      verification: {
+        checkId: record.checkId,
+        outcome: record.outcome,
+        isAcceptanceFailure: !passed,
+        isInfrastructureIssue: false,
+        executed: false,
+        completed: true,
+        reused: true,
+        processId: receipt.processId,
+        processStatus: receipt.runtimeStatus,
+        ok: passed,
+        evidenceReceiptId: receipt.receiptId,
+        reconciledProcessIds,
+      },
+    },
+    rawAvailable: false,
+  }), !passed);
+}
+
 export interface ContentEquivalentWorkVerificationTransferPlan {
   transferredRecords: VerificationRecord[];
   reusableCheckIds: string[];
@@ -164,6 +259,204 @@ function boundedCheckSchedulingPayload(schedule: ReturnType<typeof buildCheckExe
  * Every member still executes through executeWorkVerification so Work snapshot,
  * Failure Contract, VerificationRecord, and lifecycle semantics stay singular.
  */
+export interface ReconcileTerminalWorkVerificationsResult {
+  repository?: RepositoryRecord;
+  verificationStatus?: ReturnType<typeof repositoryGitStatus>;
+  sourceRevision?: string;
+  workspaceFingerprint?: string;
+  reconciledProcessIds: string[];
+  workBoundProcessEvidenceIds: string[];
+}
+
+/**
+ * Reconcile terminal Work-bound verification Processes into canonical Work
+ * verification authority. MCP/other adapters may consume the resulting exact
+ * repository/content identity, but Process scanning, semantic fingerprint
+ * matching, receipt construction, terminal projection, and Work verification
+ * mutation remain owned here.
+ */
+export function reconcileTerminalWorkVerifications(input: {
+  controllerHome: string;
+  repository: RepositoryRecord;
+  workId: string;
+  /** Explicit Process ids are required for generic run_check evidence. */
+  reconcileProcessIds?: readonly string[];
+}): ReconcileTerminalWorkVerificationsResult {
+  const resolved = resolveWorkVerificationContext({
+    controllerHome: input.controllerHome,
+    repository: input.repository,
+    workId: input.workId,
+  });
+  if (!resolved.ok) return { reconciledProcessIds: [], workBoundProcessEvidenceIds: [] };
+  const { store, workContract, repository, checks: availableChecks } = resolved.context;
+  if (!workContract || workContract.completionReceipt) return { reconciledProcessIds: [], workBoundProcessEvidenceIds: [] };
+
+  const verificationStatus = repositoryGitStatus(repository);
+  const sourceRevision = verificationStatus.head ?? undefined;
+  if (!sourceRevision) return { repository, verificationStatus, reconciledProcessIds: [], workBoundProcessEvidenceIds: [] };
+  const workspaceFingerprint = workspaceValidationFingerprint(repository.canonicalRoot, verificationStatus);
+  const workspaceChangedPaths = trustedWorkspaceChangedPaths({
+    controllerHome: input.controllerHome,
+    repository,
+    work: workContract,
+    verificationStatus,
+  });
+  const workBoundProcessEvidenceIds = (
+    workContract.workKind === 'local_effect'
+    || (workContract.workKind === 'repository_change' && workContract.checks.length === 0)
+  )
+    ? listWorkBoundRepositoryProcessEvidence({
+        controllerHome: input.controllerHome,
+        repoId: input.repository.repoId,
+        checkoutId: repository.activeCheckoutId,
+        workId: input.workId,
+      }).map((evidence) => evidence.processId)
+    : [];
+  const seenChecks = new Set<string>();
+  const reconciledProcessIds: string[] = [];
+  const explicitProcessIds = new Set(
+    (input.reconcileProcessIds ?? [])
+      .map((processId) => processId.trim())
+      .filter(Boolean)
+      .slice(0, 32),
+  );
+  const recordsById = new Map(
+    listProcessRecords(input.controllerHome, input.repository.repoId, 500).map((record) => [record.processId, record] as const),
+  );
+  // An explicitly named Process may be older than the bounded recent scan.
+  // Fetching that one exact id preserves bounded reads without treating an
+  // arbitrary caller-supplied receipt as authority.
+  for (const processId of explicitProcessIds) {
+    if (!recordsById.has(processId)) {
+      const record = getProcessRecord(input.controllerHome, input.repository.repoId, processId);
+      if (record) recordsById.set(processId, record);
+    }
+  }
+  const candidates = [...recordsById.values()].filter((record) => {
+    const workSnapshot = (
+      record.workId === input.workId
+      && record.checkoutId === repository.activeCheckoutId
+      && !isManagedProcessActive(record)
+      && record.origin?.workVerificationSnapshot === true
+      && typeof record.origin?.checkId === 'string'
+      && typeof record.origin?.requestSemanticFingerprint === 'string'
+    );
+    if (workSnapshot) return true;
+    if (!explicitProcessIds.has(record.processId)) return false;
+
+    // Generic run_check records have no Work owner. They are eligible only
+    // when the caller names the exact terminal Process and the record proves
+    // the same repository/checkout, canonical checkout root, checkout-scoped
+    // Check execution, and check surface. The persisted semantic result is
+    // validated below before any Work mutation.
+    const executionIdentity = record.executionIdentity;
+    return (
+      record.repoId === repository.repoId
+      && record.checkoutId === repository.activeCheckoutId
+      && record.workId == null
+      && !isManagedProcessActive(record)
+      && record.origin?.surface === 'check'
+      && typeof record.origin?.checkId === 'string'
+      && executionIdentity?.repositoryId === repository.repoId
+      && executionIdentity.checkoutId === repository.activeCheckoutId
+      && resolve(executionIdentity.canonicalRoot) === resolve(repository.canonicalRoot)
+      && record.checkExecution?.reuseScope === 'checkout'
+      && record.checkExecution.scopeKey === `checkout:${repository.activeCheckoutId}`
+    );
+  });
+
+  for (const record of candidates) {
+    const checkId = record.origin?.checkId?.trim() ?? '';
+    if (!checkId || seenChecks.has(checkId)) continue;
+    seenChecks.add(checkId);
+    const classified = classifyVerificationOutcome({ checkId, available: availableChecks });
+    if (classified.outcome === 'invalid_check_id' || !classified.normalizedCheckId) continue;
+    const normalizedCheckId = classified.normalizedCheckId;
+    const requestedChecks = workContract.checks.length ? workContract.checks : [normalizedCheckId];
+    const currentFingerprint = verificationInputFingerprint({
+      sourceRevision,
+      workspaceFingerprint,
+      checkId: normalizedCheckId,
+      requestedChecks,
+    });
+    const workSnapshot = record.workId === input.workId && record.origin?.workVerificationSnapshot === true;
+    if (workSnapshot && (record.origin?.requestSemanticFingerprint !== currentFingerprint || !record.checkExecution)) continue;
+    if (!workSnapshot) {
+      const recordedExecution = record.checkExecution;
+      if (!recordedExecution) continue;
+      const currentExecution = controllerCheckExecutionIdentity(repository.canonicalRoot, normalizedCheckId);
+      if (
+        currentExecution.cacheKey !== recordedExecution.cacheKey
+        || currentExecution.revision !== recordedExecution.revision
+        || currentExecution.definitionDigest !== recordedExecution.definitionDigest
+        || currentExecution.environmentFingerprint !== recordedExecution.environmentFingerprint
+        || currentExecution.timeoutMs !== recordedExecution.timeoutMs
+        || currentExecution.reuseScope !== recordedExecution.reuseScope
+      ) continue;
+      const structuredReceipt = readPersistedCheckResultReceipt(record.origin?.checkResultReceiptPath);
+      if (
+        !structuredReceipt
+        || structuredReceipt.checkId !== normalizedCheckId
+        || structuredReceipt.cacheKey !== recordedExecution.cacheKey
+        || structuredReceipt.validatedRevision !== recordedExecution.revision
+      ) continue;
+    }
+    const checkExecution = record.checkExecution;
+    if (!checkExecution) continue;
+
+    try {
+      const receipt = processCheckCompletionReceipt(record, {
+        repoId: repository.repoId,
+        checkoutId: repository.activeCheckoutId,
+        workId: input.workId,
+        checkId: normalizedCheckId,
+        processId: record.processId,
+        requestId: record.origin?.requestId,
+        checkExecution: {
+          cacheKey: checkExecution.cacheKey,
+          revision: checkExecution.revision,
+          definitionDigest: checkExecution.definitionDigest,
+          environmentFingerprint: checkExecution.environmentFingerprint,
+          timeoutMs: checkExecution.timeoutMs,
+          scopeKey: checkExecution.scopeKey,
+        },
+      });
+      if (workContract.checkRefs.some((entry) => entry.receipt?.receiptId === receipt.receiptId)) continue;
+
+      const legacyEvidence = record.origin?.checkResultReceiptPath
+        ? undefined
+        : readLatestControllerCheckEvidence(repository.canonicalRoot, normalizedCheckId);
+      const projection = projectTerminalCheckVerification(record, normalizedCheckId, receipt, { legacyEvidence });
+      recordWorkCheckEvidence({
+        store,
+        workId: input.workId,
+        checkId: normalizedCheckId,
+        availableChecks,
+        sourceRevision,
+        workspaceFingerprint,
+        verificationInputFingerprint: currentFingerprint,
+        commandFingerprint: commandFingerprint(normalizedCheckId, receipt.commandId),
+        receipt,
+        infrastructureFailed: projection.isInfrastructureIssue,
+        checkFailed: projection.isAcceptanceFailure,
+      });
+      reconciledProcessIds.push(record.processId);
+    } catch {
+      // Exact receipt/process identity is mandatory. Any malformed, stale, or
+      // mismatched terminal Process remains non-authoritative and is ignored.
+    }
+  }
+
+  return {
+    repository,
+    verificationStatus,
+    sourceRevision,
+    workspaceFingerprint,
+    reconciledProcessIds,
+    workBoundProcessEvidenceIds,
+  };
+}
+
 export async function executeWorkVerificationBatch(input: ExecuteWorkVerificationBatchInput): Promise<ExecuteWorkVerificationResult> {
   const workId = input.workId?.trim() ?? '';
   const requestedCheckIds = [...new Set(input.checkIds.map((value) => value.trim()).filter(Boolean))];
@@ -337,20 +630,14 @@ export async function executeWorkVerification(input: ExecuteWorkVerificationInpu
     }), true);
   }
 
-  const workloopCtx = {
-    workStore: store,
-    handoffStore: store,
-    repoId: input.repository.repoId,
-    availableChecks: checks,
-  };
-  if (workId && (!workContract || workContract.status === 'completed' || workContract.status === 'cancelled' || workContract.status === 'failed')) {
-    const facade = verifyGoalWorkloop(workloopCtx, { workId, checkId });
+  if (workId && (!workContract || workContract.semanticState !== 'open')) {
+    const facade = recordWorkCheckEvidence({ store, workId, checkId, availableChecks: checks });
     return result(facade, facade.status === 'failed');
   }
 
   const classified = classifyVerificationOutcome({ checkId, available: checks });
   if (classified.outcome === 'invalid_check_id') {
-    if (workId) return result(verifyGoalWorkloop(workloopCtx, { workId, checkId }));
+    if (workId) return result(recordWorkCheckEvidence({ store, workId, checkId, availableChecks: checks }));
     return result(buildFacadeResult({
       status: 'ok',
       summary: classified.summary,
@@ -384,9 +671,11 @@ export async function executeWorkVerification(input: ExecuteWorkVerificationInpu
         },
       }), input.simulate.checkFailed === true);
     }
-    const facade = verifyGoalWorkloop(workloopCtx, {
+    const facade = recordWorkCheckEvidence({
+      store,
       workId,
       checkId: classified.normalizedCheckId ?? checkId,
+      availableChecks: checks,
       infrastructureFailed: input.simulate.infrastructureFailed === true,
       checkFailed: input.simulate.checkFailed === true,
       skipped: input.simulate.skipped === true,
@@ -399,6 +688,14 @@ export async function executeWorkVerification(input: ExecuteWorkVerificationInpu
     const verificationStatus = repositoryGitStatus(verificationRepository);
     const observedGitHead = verificationStatus.head;
     const workspaceFingerprint = workspaceValidationFingerprint(verificationRepository.canonicalRoot, verificationStatus);
+    const workspaceChangedPaths = workContract
+      ? trustedWorkspaceChangedPaths({
+          controllerHome: input.controllerHome,
+          repository: verificationRepository,
+          work: workContract,
+          verificationStatus,
+        })
+      : undefined;
     const requestedChecks = workContract?.checks.length ? workContract.checks : [normalizedCheckId];
     const verificationRequestFingerprint = observedGitHead ? verificationInputFingerprint({
       sourceRevision: observedGitHead,
@@ -406,6 +703,75 @@ export async function executeWorkVerification(input: ExecuteWorkVerificationInpu
       checkId: normalizedCheckId,
       requestedChecks,
     }) : undefined;
+
+    const explicitReconciliationRequested = (input.reconcileProcessIds?.length ?? 0) > 0;
+    const currentReceipt = currentReusableVerificationRecord({
+      workContract: explicitReconciliationRequested ? undefined : workContract,
+      checkId: normalizedCheckId,
+      sourceRevision: observedGitHead ?? undefined,
+      workspaceFingerprint,
+      requestedChecks,
+    });
+    if (currentReceipt) {
+      return reusedVerificationResult(currentReceipt, {
+        workContract,
+        sourceRevision: observedGitHead ?? undefined,
+        workspaceFingerprint,
+        workspaceChangedPaths,
+      });
+    }
+
+    let reconciledProcessIds: string[] = [];
+    if (workContract && observedGitHead) {
+      const reconciled = reconcileTerminalWorkVerifications({
+        controllerHome: input.controllerHome,
+        repository: input.repository,
+        workId: workContract.workId,
+        reconcileProcessIds: input.reconcileProcessIds,
+      });
+      reconciledProcessIds = reconciled.reconciledProcessIds;
+      if (reconciled.reconciledProcessIds.length > 0) {
+        const refreshed = resolveWorkVerificationContext({
+          controllerHome: input.controllerHome,
+          repository: input.repository,
+          workId: workContract.workId,
+        });
+        if (refreshed.ok) {
+          const reconciledReceipt = currentReusableVerificationRecord({
+            workContract: refreshed.context.workContract,
+            checkId: normalizedCheckId,
+            sourceRevision: observedGitHead,
+            workspaceFingerprint,
+            requestedChecks,
+          });
+          if (reconciledReceipt) {
+            return reusedVerificationResult(reconciledReceipt, {
+              workContract: refreshed.context.workContract,
+              sourceRevision: observedGitHead,
+              workspaceFingerprint,
+              workspaceChangedPaths,
+            }, reconciled.reconciledProcessIds);
+          }
+        }
+      }
+    }
+    if (explicitReconciliationRequested) {
+      return result(buildFacadeResult({
+        status: 'blocked',
+        summary: 'No explicitly requested terminal Process could be reconciled into the exact Work verification authority.',
+        data: {
+          verification: {
+            checkId: normalizedCheckId,
+            outcome: 'reconciliation_not_authoritative',
+            isAcceptanceFailure: false,
+            isInfrastructureIssue: true,
+            reconciledProcessIds,
+          },
+        },
+        warnings: ['WORK_VERIFY_RECONCILIATION_NOT_AUTHORIZED: Forge did not re-execute the Check after explicit reconciliation failed.'],
+      }), true);
+    }
+
     const registeredCheck = checks.find((entry) => entry.id === normalizedCheckId);
     const durableClassCheck = checkRequiresDurableWorkflow(registeredCheck);
     const allowDurableCheckExecution = Boolean(
@@ -413,8 +779,7 @@ export async function executeWorkVerification(input: ExecuteWorkVerificationInpu
       && workContract
       && workContract.checks.includes(normalizedCheckId)
       && !workContract.completionReceipt
-      && workContract.status === 'running'
-      && input.allowDurableCheckExecution?.({ work: workContract, checkId: normalizedCheckId }),
+      && workContract.dispatchState === 'running',
     );
 
     const executed = await runPersistedCheckViaProcessRuntime({
@@ -431,11 +796,8 @@ export async function executeWorkVerification(input: ExecuteWorkVerificationInpu
       requestSemanticFingerprint: verificationRequestFingerprint,
       workId: workId || undefined,
       commandId: input.requestId,
-      verificationSnapshot: workContract ? {
-        workId: workContract.workId,
-        allowedPaths: workContract.allowedPaths,
-        forbiddenPaths: workContract.forbiddenPaths,
-      } : undefined,
+      // A Work has semantic scope and evidence, not a mutable path fence.
+      // Candidate snapshot ownership is supplied only by a bound EditSession.
       allowDurableCheckExecution,
     });
 
@@ -453,14 +815,7 @@ export async function executeWorkVerification(input: ExecuteWorkVerificationInpu
             observedGitHead,
           },
         },
-        suggestedNextActions: workId ? [{
-          label: 'Continue Work with the durable check requirement',
-          tool: 'rh_work',
-          operation: 'continue',
-          payload: { work_id: workId },
-          risk: 'workspace_write',
-          confidence: 'high',
-        }] : [],
+        suggestedNextActions: [],
       }), true);
     }
 
@@ -517,14 +872,10 @@ export async function executeWorkVerification(input: ExecuteWorkVerificationInpu
     const legacyEvidence = record.origin?.checkResultReceiptPath
       ? undefined
       : readLatestControllerCheckEvidence(verificationRepository.canonicalRoot, normalizedCheckId);
-    const evidenceState = classifyPersistedCheckTerminalEvidence(record, normalizedCheckId, { legacyEvidence });
-    const failureClass = evidenceState.failureClass;
-    const infrastructureFailed = receipt.timedOut
-      || receipt.cancelled
-      || evidenceState.state !== 'matched'
-      || (!receipt.ok && failureClass !== 'acceptance_failure');
-    const checkFailed = !receipt.ok && !infrastructureFailed;
-    if (receipt.ok && evidenceState.state === 'matched') {
+    const projection = projectTerminalCheckVerification(record, normalizedCheckId, receipt, { legacyEvidence });
+    const infrastructureFailed = projection.isInfrastructureIssue;
+    const checkFailed = projection.isAcceptanceFailure;
+    if (projection.outcome === 'valid_pass') {
       try {
         ingestCheckCompletionGraceProcess({
           controllerHome: input.controllerHome,
@@ -538,17 +889,18 @@ export async function executeWorkVerification(input: ExecuteWorkVerificationInpu
     }
     const commonVerification = {
       checkId: normalizedCheckId,
-      outcome: infrastructureFailed ? 'infrastructure_failure' : receipt.ok ? 'valid_pass' : 'valid_fail',
-      isAcceptanceFailure: checkFailed,
-      isInfrastructureIssue: infrastructureFailed,
+      outcome: projection.outcome,
+      isAcceptanceFailure: projection.isAcceptanceFailure,
+      isInfrastructureIssue: projection.isInfrastructureIssue,
       executed: true,
       completed: true,
       processId: receipt.processId,
       processStatus: receipt.runtimeStatus,
-      ok: receipt.ok,
+      ok: projection.outcome === 'valid_pass',
+      processOk: receipt.ok,
       timedOut: receipt.timedOut,
       cancelled: receipt.cancelled,
-      failureClass: infrastructureFailed ? 'infrastructure_failure' : failureClass,
+      failureClass: projection.failureClass,
       deduplicated: handle.deduplicated === true,
       semanticDeduplicated: handle.semanticDeduplicated === true,
       checkContentRevision: receipt.checkRevision,
@@ -557,19 +909,21 @@ export async function executeWorkVerification(input: ExecuteWorkVerificationInpu
       evidenceArtifactPath: record.origin?.workVerificationSnapshot ? undefined : receipt.artifactPath,
       evidenceReceiptId: receipt.receiptId,
       checkResultReceiptId: structuredCheckResult?.receiptId,
-      ...(evidenceState.failureEvidence ? { failureEvidence: evidenceState.failureEvidence } : {}),
+      ...(projection.evidence.failureEvidence ? { failureEvidence: projection.evidence.failureEvidence } : {}),
       verificationIsolation: record.origin?.workVerificationSnapshot ? 'work_snapshot' : 'shared_checkout',
-      boundedStatus: receipt.ok ? 'pass' : infrastructureFailed ? 'infrastructure_failure' : 'fail',
-      evidenceState: evidenceState.state,
-      ...(evidenceState.infrastructureReason ? { infrastructureReason: evidenceState.infrastructureReason } : {}),
+      boundedStatus: projection.boundedStatus,
+      evidenceState: projection.evidence.state,
+      ...(projection.infrastructureReason ? { infrastructureReason: projection.infrastructureReason } : {}),
       ...(record.error?.code ? { processErrorCode: record.error.code } : {}),
     };
 
     if (workId) {
       const sourceRevision = observedGitHead ?? undefined;
-      const facade = verifyGoalWorkloop(workloopCtx, {
+      const facade = recordWorkCheckEvidence({
+        store,
         workId,
         checkId: normalizedCheckId,
+        availableChecks: checks,
         sourceRevision,
         workspaceFingerprint,
         verificationInputFingerprint: sourceRevision ? verificationRequestFingerprint : undefined,
@@ -588,7 +942,7 @@ export async function executeWorkVerification(input: ExecuteWorkVerificationInpu
           },
         },
         warnings: infrastructureFailed
-          ? [...facade.warnings, evidenceState.warning ?? 'infrastructure_failure is distinct from acceptance failure']
+          ? [...facade.warnings, projection.evidence.warning ?? 'infrastructure_failure is distinct from acceptance failure']
           : facade.warnings,
       }, facade.status === 'failed');
     }
@@ -601,15 +955,17 @@ export async function executeWorkVerification(input: ExecuteWorkVerificationInpu
           ? `Check ${normalizedCheckId} passed with persisted Process evidence.`
           : `Check ${normalizedCheckId} failed acceptance.`,
       data: { verification: commonVerification },
-      warnings: infrastructureFailed ? [evidenceState.warning ?? 'infrastructure_failure is distinct from acceptance failure'] : [],
+      warnings: infrastructureFailed ? [projection.evidence.warning ?? 'infrastructure_failure is distinct from acceptance failure'] : [],
       rawAvailable: false,
     }), checkFailed);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     if (workId) {
-      const facade = verifyGoalWorkloop(workloopCtx, {
+      const facade = recordWorkCheckEvidence({
+        store,
         workId,
         checkId: classified.normalizedCheckId ?? checkId,
+        availableChecks: checks,
         infrastructureFailed: true,
       });
       return result({

package/src/runtime/control-plane/execution/work-verification-snapshot.ts

@@ -138,7 +138,11 @@ export function cleanupStaleWorkVerificationSnapshots(
     return report;
   }
   for (const entry of entries) {
-    if (!entry.isDirectory() || !entry.name.startsWith('snapshot-')) continue;
+    // The canonical root is the ownership boundary. Historical producers did
+    // not all use the snapshot-* prefix, so name shape must not make stale
+    // physical evidence invisible. Dirent.isDirectory() deliberately excludes
+    // symlinks before any recursive removal is considered.
+    if (!entry.isDirectory()) continue;
     if (report.inspected >= maxEntries) { report.truncated = true; skip('scan_budget_exhausted'); break; }
     report.inspected += 1;
     const path = join(root, entry.name);