@moretea-labs/forge 1.8.0 → 1.8.1

package/src/runtime/evidence/output-handle-index.ts

@@ -0,0 +1,225 @@
+import { deleteControlPlaneRecord, mutateControlPlaneRecord, readControlPlaneRecord } from '../control-plane/persistence/sqlite-store';
+
+export const OUTPUT_HANDLE_INDEX_NAMESPACE = 'output_handle_index';
+const OUTPUT_HANDLE_INDEX_SCOPE = 'instance';
+const OUTPUT_HANDLE_INDEX_SCHEMA_VERSION = 1;
+
+export type OutputHandleKind = 'result' | 'artifact' | 'evidence';
+export type OutputHandleStorage =
+  | { scope: 'instance' }
+  | { scope: 'legacy_repository'; repositoryId: string };
+
+export interface OutputHandleIndexEntry {
+  schemaVersion: 1;
+  handleId: string;
+  kind: OutputHandleKind;
+  storage: OutputHandleStorage;
+  /** Repository provenance is descriptive context, never the locator namespace. */
+  repositoryId?: string;
+  /** Opaque ids locate this record; authorization is bound separately. */
+  principalId?: string;
+  sessionId?: string;
+  workId?: string;
+  operationId?: string;
+  fingerprint: string;
+  recordedAt: string;
+  updatedAt: string;
+}
+
+function bounded(value: string | undefined): string | undefined {
+  const normalized = value?.trim();
+  return normalized ? normalized.slice(0, 512) : undefined;
+}
+
+function normalizedStorage(storage: OutputHandleStorage): OutputHandleStorage {
+  if (storage.scope === 'instance') return { scope: 'instance' };
+  const repositoryId = bounded(storage.repositoryId);
+  if (!repositoryId) throw new Error('OUTPUT_HANDLE_LEGACY_REPOSITORY_REQUIRED');
+  return { scope: 'legacy_repository', repositoryId };
+}
+
+function bindingsConflict(current: OutputHandleIndexEntry, input: {
+  principalId?: string;
+  sessionId?: string;
+  workId?: string;
+  operationId?: string;
+}): boolean {
+  for (const key of ['principalId', 'sessionId', 'workId', 'operationId'] as const) {
+    const left = bounded(current[key]);
+    const right = bounded(input[key]);
+    if (left && right && left !== right) return true;
+  }
+  return false;
+}
+
+export function recordOutputHandleIndexEntry(
+  controllerHome: string,
+  input: {
+    handleId: string;
+    kind: OutputHandleKind;
+    storage: OutputHandleStorage;
+    repositoryId?: string;
+    principalId?: string;
+    sessionId?: string;
+    workId?: string;
+    operationId?: string;
+    fingerprint: string;
+    now?: string;
+  },
+): OutputHandleIndexEntry {
+  const handleId = bounded(input.handleId);
+  const fingerprint = bounded(input.fingerprint);
+  if (!handleId || !fingerprint) throw new Error('OUTPUT_HANDLE_IDENTITY_REQUIRED');
+  const storage = normalizedStorage(input.storage);
+  const now = input.now ?? new Date().toISOString();
+  const repositoryId = bounded(input.repositoryId);
+  const principalId = bounded(input.principalId);
+  const sessionId = bounded(input.sessionId);
+  const workId = bounded(input.workId);
+  const operationId = bounded(input.operationId);
+
+  const record = mutateControlPlaneRecord<OutputHandleIndexEntry>(controllerHome, {
+    namespace: OUTPUT_HANDLE_INDEX_NAMESPACE,
+    scope: OUTPUT_HANDLE_INDEX_SCOPE,
+    key: handleId,
+    schemaVersion: OUTPUT_HANDLE_INDEX_SCHEMA_VERSION,
+    action: 'output_handle_index_record',
+    mutate: (currentRecord) => {
+      const current = currentRecord?.value;
+      if (current) {
+        if (current.schemaVersion !== OUTPUT_HANDLE_INDEX_SCHEMA_VERSION
+          || current.handleId !== handleId
+          || current.kind !== input.kind
+          || current.fingerprint !== fingerprint
+          || bindingsConflict(current, { principalId, sessionId, workId, operationId })) {
+          throw new Error(`OUTPUT_HANDLE_ID_COLLISION: ${handleId}`);
+        }
+        // Identical historical duplicates collapse to one locator. Canonical
+        // instance storage always outranks a legacy repository location.
+        const nextStorage = current.storage.scope === 'instance' || storage.scope !== 'instance'
+          ? current.storage
+          : storage;
+        return {
+          ...current,
+          storage: nextStorage,
+          ...(current.repositoryId || repositoryId ? { repositoryId: current.repositoryId ?? repositoryId } : {}),
+          ...(current.principalId || principalId ? { principalId: current.principalId ?? principalId } : {}),
+          ...(current.sessionId || sessionId ? { sessionId: current.sessionId ?? sessionId } : {}),
+          ...(current.workId || workId ? { workId: current.workId ?? workId } : {}),
+          ...(current.operationId || operationId ? { operationId: current.operationId ?? operationId } : {}),
+          updatedAt: now,
+        };
+      }
+      return {
+        schemaVersion: OUTPUT_HANDLE_INDEX_SCHEMA_VERSION,
+        handleId,
+        kind: input.kind,
+        storage,
+        ...(repositoryId ? { repositoryId } : {}),
+        ...(principalId ? { principalId } : {}),
+        ...(sessionId ? { sessionId } : {}),
+        ...(workId ? { workId } : {}),
+        ...(operationId ? { operationId } : {}),
+        fingerprint,
+        recordedAt: now,
+        updatedAt: now,
+      };
+    },
+  });
+  return record.value;
+}
+
+export function refreshOutputHandleFingerprint(
+  controllerHome: string,
+  input: {
+    handleId: string;
+    kind: OutputHandleKind;
+    expectedFingerprint: string;
+    nextFingerprint: string;
+    now?: string;
+  },
+): OutputHandleIndexEntry {
+  const handleId = bounded(input.handleId);
+  const expectedFingerprint = bounded(input.expectedFingerprint);
+  const nextFingerprint = bounded(input.nextFingerprint);
+  if (!handleId || !expectedFingerprint || !nextFingerprint) throw new Error('OUTPUT_HANDLE_FINGERPRINT_REFRESH_REQUIRED');
+  const now = input.now ?? new Date().toISOString();
+  const record = mutateControlPlaneRecord<OutputHandleIndexEntry>(controllerHome, {
+    namespace: OUTPUT_HANDLE_INDEX_NAMESPACE,
+    scope: OUTPUT_HANDLE_INDEX_SCOPE,
+    key: handleId,
+    schemaVersion: OUTPUT_HANDLE_INDEX_SCHEMA_VERSION,
+    action: 'output_handle_index_fingerprint_refresh',
+    mutate: (currentRecord) => {
+      const current = currentRecord?.value;
+      if (!current
+        || current.schemaVersion !== OUTPUT_HANDLE_INDEX_SCHEMA_VERSION
+        || current.handleId !== handleId
+        || current.kind !== input.kind
+        || current.storage.scope !== 'instance') {
+        throw new Error(`OUTPUT_HANDLE_FINGERPRINT_REFRESH_SCOPE_MISMATCH: ${handleId}`);
+      }
+      if (current.fingerprint !== expectedFingerprint) {
+        throw new Error(`OUTPUT_HANDLE_FINGERPRINT_REFRESH_CONFLICT: ${handleId}`);
+      }
+      return { ...current, fingerprint: nextFingerprint, updatedAt: now };
+    },
+  });
+  return record.value;
+}
+
+export function deleteOutputHandleIndexEntry(
+  controllerHome: string,
+  input: { handleId: string; kind: OutputHandleKind; expectedFingerprint?: string },
+): boolean {
+  const handleId = bounded(input.handleId);
+  if (!handleId) return false;
+  const record = readControlPlaneRecord<OutputHandleIndexEntry>(
+    controllerHome,
+    OUTPUT_HANDLE_INDEX_NAMESPACE,
+    OUTPUT_HANDLE_INDEX_SCOPE,
+    handleId,
+  );
+  if (!record) return false;
+  const current = record.value;
+  if (current.schemaVersion !== OUTPUT_HANDLE_INDEX_SCHEMA_VERSION
+    || current.handleId !== handleId
+    || current.kind !== input.kind
+    || current.storage.scope !== 'instance') {
+    throw new Error(`OUTPUT_HANDLE_INDEX_DELETE_SCOPE_MISMATCH: ${handleId}`);
+  }
+  const expectedFingerprint = bounded(input.expectedFingerprint);
+  if (expectedFingerprint && current.fingerprint !== expectedFingerprint) {
+    throw new Error(`OUTPUT_HANDLE_INDEX_DELETE_CONFLICT: ${handleId}`);
+  }
+  return deleteControlPlaneRecord(controllerHome, {
+    namespace: OUTPUT_HANDLE_INDEX_NAMESPACE,
+    scope: OUTPUT_HANDLE_INDEX_SCOPE,
+    key: handleId,
+    action: 'output_handle_index_delete',
+    expectedRevision: record.revision,
+  });
+}
+
+export function readOutputHandleIndexEntry(
+  controllerHome: string,
+  handleId: string,
+): OutputHandleIndexEntry | undefined {
+  const key = bounded(handleId);
+  if (!key) return undefined;
+  const record = readControlPlaneRecord<OutputHandleIndexEntry>(
+    controllerHome,
+    OUTPUT_HANDLE_INDEX_NAMESPACE,
+    OUTPUT_HANDLE_INDEX_SCOPE,
+    key,
+  );
+  const value = record?.value;
+  if (!value) return undefined;
+  if (value.schemaVersion !== OUTPUT_HANDLE_INDEX_SCHEMA_VERSION || value.handleId !== key) {
+    throw new Error(`OUTPUT_HANDLE_INDEX_CORRUPT: ${key}`);
+  }
+  if (!value.fingerprint || !value.kind || !value.storage) {
+    throw new Error(`OUTPUT_HANDLE_INDEX_CORRUPT: ${key}`);
+  }
+  return value;
+}

package/src/runtime/evidence/result-store.ts

@@ -1,15 +1,17 @@
-import { randomUUID } from 'crypto';
+import { createHash, randomUUID } from 'crypto';
 import { chmodSync, existsSync, mkdirSync, readdirSync, statSync } from 'fs';
 import { join } from 'path';
-import { repositoryControllerRoot } from '../../cli/repositories/controller-home';
+import { controllerSystemRoot, repositoryControllerRoot } from '../../cli/repositories/controller-home';
 import { readJsonFile, sanitizeFileComponent, writeJsonAtomic } from '../shared/json-files';
+import { recordOutputHandleIndexEntry, readOutputHandleIndexEntry, refreshOutputHandleFingerprint, type OutputHandleStorage } from './output-handle-index';
 import { redactSensitiveValue, type SensitiveRedactionCount } from './sensitive-output';
 
 export interface ControllerResultRecord {
   schemaVersion: 1;
   resultId: string;
   resultRef: string;
-  repoId: string;
+  /** Repository provenance only. It is not part of the canonical result locator. */
+  repoId?: string;
   sessionId: string;
   principalId: string;
   workId?: string;
@@ -24,19 +26,29 @@ export interface ControllerResultRecord {
   };
 }
 
-function resultRoot(controllerHome: string, repoId: string): string {
-  const root = join(repositoryControllerRoot(controllerHome, repoId), 'results');
+function canonicalResultRoot(controllerHome: string): string {
+  const root = join(controllerSystemRoot(controllerHome), 'outputs', 'results');
   mkdirSync(join(root, 'records'), { recursive: true, mode: 0o700 });
   mkdirSync(join(root, 'data'), { recursive: true, mode: 0o700 });
   return root;
 }
 
-function recordPath(controllerHome: string, repoId: string, resultId: string): string {
-  return join(resultRoot(controllerHome, repoId), 'records', `${sanitizeFileComponent(resultId)}.json`);
+function legacyResultRoot(controllerHome: string, repoId: string): string {
+  return join(repositoryControllerRoot(controllerHome, repoId), 'results');
 }
 
-function dataPath(controllerHome: string, repoId: string, resultId: string): string {
-  return join(resultRoot(controllerHome, repoId), 'data', `${sanitizeFileComponent(resultId)}.json`);
+function resultRoot(controllerHome: string, storage: OutputHandleStorage): string {
+  return storage.scope === 'instance'
+    ? canonicalResultRoot(controllerHome)
+    : legacyResultRoot(controllerHome, storage.repositoryId);
+}
+
+function recordPath(controllerHome: string, storage: OutputHandleStorage, resultId: string): string {
+  return join(resultRoot(controllerHome, storage), 'records', `${sanitizeFileComponent(resultId)}.json`);
+}
+
+function dataPath(controllerHome: string, storage: OutputHandleStorage, resultId: string): string {
+  return join(resultRoot(controllerHome, storage), 'data', `${sanitizeFileComponent(resultId)}.json`);
 }
 
 function writePrivateJson(path: string, value: unknown): void {
@@ -53,33 +65,131 @@ function redactionMetadata(redactions: SensitiveRedactionCount[]): NonNullable<C
   };
 }
 
-function sanitizeStoredResult(
+function canonicalResultRef(resultId: string): string {
+  return `result://${resultId}`;
+}
+
+function resultFingerprint(record: ControllerResultRecord, value: unknown): string {
+  return createHash('sha256').update(JSON.stringify({
+    resultId: record.resultId,
+    sessionId: record.sessionId,
+    principalId: record.principalId,
+    workId: record.workId ?? null,
+    kind: record.kind,
+    createdAt: record.createdAt,
+    value,
+  })).digest('hex');
+}
+
+function registerResult(
   controllerHome: string,
   record: ControllerResultRecord,
+  value: unknown,
+  storage: OutputHandleStorage,
+): void {
+  recordOutputHandleIndexEntry(controllerHome, {
+    handleId: record.resultId,
+    kind: 'result',
+    storage,
+    repositoryId: record.repoId,
+    principalId: record.principalId,
+    sessionId: record.sessionId,
+    workId: record.workId,
+    fingerprint: resultFingerprint(record, value),
+  });
+}
+
+function parseRef(resultRef: string): { resultId: string; legacyRepoId?: string } {
+  const normalized = resultRef.trim();
+  const canonical = /^result:\/\/([^/]+)$/.exec(normalized);
+  if (canonical) return { resultId: canonical[1]! };
+  const legacy = /^result:\/\/([^/]+)\/([^/]+)$/.exec(normalized);
+  if (legacy) return { legacyRepoId: legacy[1]!, resultId: legacy[2]! };
+  throw new Error('RESULT_REF_INVALID: expected result://<resultId>');
+}
+
+function loadResultAt(
+  controllerHome: string,
+  resultId: string,
+  storage: OutputHandleStorage,
+): { record: ControllerResultRecord; value: unknown } {
+  const stored = readJsonFile<ControllerResultRecord>(recordPath(controllerHome, storage, resultId));
+  if (stored.resultId !== resultId) throw new Error('RESULT_IDENTITY_MISMATCH');
+  const value = readJsonFile<unknown>(dataPath(controllerHome, storage, resultId));
+  const record: ControllerResultRecord = {
+    ...stored,
+    resultRef: canonicalResultRef(resultId),
+    ...(storage.scope === 'legacy_repository' && !stored.repoId ? { repoId: storage.repositoryId } : {}),
+  };
+  return { record, value };
+}
+
+function resolveStoredResult(
+  controllerHome: string,
+  resultId: string,
+  legacyRepoId?: string,
+): { record: ControllerResultRecord; value: unknown; storage: OutputHandleStorage } {
+  if (legacyRepoId) {
+    const storage: OutputHandleStorage = { scope: 'legacy_repository', repositoryId: legacyRepoId };
+    const loaded = loadResultAt(controllerHome, resultId, storage);
+    registerResult(controllerHome, loaded.record, loaded.value, storage);
+    return { ...loaded, storage };
+  }
+
+  const indexed = readOutputHandleIndexEntry(controllerHome, resultId);
+  if (indexed) {
+    if (indexed.kind !== 'result') throw new Error(`OUTPUT_HANDLE_KIND_MISMATCH: ${resultId}`);
+    const loaded = loadResultAt(controllerHome, resultId, indexed.storage);
+    if (resultFingerprint(loaded.record, loaded.value) !== indexed.fingerprint) {
+      throw new Error(`OUTPUT_HANDLE_FINGERPRINT_MISMATCH: ${resultId}`);
+    }
+    return { ...loaded, storage: indexed.storage };
+  }
+
+  const storage: OutputHandleStorage = { scope: 'instance' };
+  const canonicalRecord = recordPath(controllerHome, storage, resultId);
+  if (!existsSync(canonicalRecord)) {
+    throw new Error(`RESULT_LOCATOR_NOT_FOUND: ${resultId}; legacy results require their historical result://<repoId>/<resultId> reference once`);
+  }
+  const loaded = loadResultAt(controllerHome, resultId, storage);
+  registerResult(controllerHome, loaded.record, loaded.value, storage);
+  return { ...loaded, storage };
+}
+
+function sanitizeResolvedResult(
+  controllerHome: string,
+  record: ControllerResultRecord,
+  value: unknown,
+  storage: OutputHandleStorage,
 ): { record: ControllerResultRecord; value: unknown; changed: boolean } {
-  const path = dataPath(controllerHome, record.repoId, record.resultId);
-  const raw = readJsonFile<unknown>(path);
-  const sanitized = redactSensitiveValue(raw);
-  if (!sanitized.changed) return { record, value: raw, changed: false };
-  writePrivateJson(path, sanitized.value);
+  const sanitized = redactSensitiveValue(value);
+  if (!sanitized.changed) return { record, value, changed: false };
   const next: ControllerResultRecord = {
     ...record,
-    byteLength: statSync(path).size,
     redaction: redactionMetadata(sanitized.redactions),
   };
-  writePrivateJson(recordPath(controllerHome, record.repoId, record.resultId), next);
+  if (storage.scope === 'instance') {
+    const previousFingerprint = resultFingerprint(record, value);
+    const nextFingerprint = resultFingerprint(next, sanitized.value);
+    const path = dataPath(controllerHome, storage, record.resultId);
+    writePrivateJson(path, sanitized.value);
+    next.byteLength = statSync(path).size;
+    writePrivateJson(recordPath(controllerHome, storage, record.resultId), next);
+    refreshOutputHandleFingerprint(controllerHome, {
+      handleId: record.resultId,
+      kind: 'result',
+      expectedFingerprint: previousFingerprint,
+      nextFingerprint,
+    });
+  }
+  // Historical repository partitions are immutable after the cutover. Apply
+  // current redaction in-memory without rewriting legacy bytes.
   return { record: next, value: sanitized.value, changed: true };
 }
 
-function parseRef(resultRef: string): { repoId: string; resultId: string } {
-  const match = /^result:\/\/([^/]+)\/([^/]+)$/.exec(resultRef.trim());
-  if (!match) throw new Error('RESULT_REF_INVALID: expected result://<repoId>/<resultId>');
-  return { repoId: match[1]!, resultId: match[2]! };
-}
-
 export function writeControllerResult(input: {
   controllerHome: string;
-  repoId: string;
+  repoId?: string;
   sessionId: string;
   principalId: string;
   workId?: string;
@@ -87,15 +197,16 @@ export function writeControllerResult(input: {
   value: unknown;
 }): ControllerResultRecord {
   const resultId = `res_${randomUUID().replace(/-/g, '')}`;
-  const resultRef = `result://${input.repoId}/${resultId}`;
-  const path = dataPath(input.controllerHome, input.repoId, resultId);
+  const resultRef = canonicalResultRef(resultId);
+  const storage: OutputHandleStorage = { scope: 'instance' };
+  const path = dataPath(input.controllerHome, storage, resultId);
   const sanitized = redactSensitiveValue(input.value);
   writePrivateJson(path, sanitized.value);
   const record: ControllerResultRecord = {
     schemaVersion: 1,
     resultId,
     resultRef,
-    repoId: input.repoId,
+    ...(input.repoId?.trim() ? { repoId: input.repoId.trim() } : {}),
     sessionId: input.sessionId,
     principalId: input.principalId,
     ...(input.workId ? { workId: input.workId } : {}),
@@ -104,7 +215,8 @@ export function writeControllerResult(input: {
     createdAt: new Date().toISOString(),
     ...(sanitized.changed ? { redaction: redactionMetadata(sanitized.redactions) } : {}),
   };
-  writePrivateJson(recordPath(input.controllerHome, input.repoId, resultId), record);
+  writePrivateJson(recordPath(input.controllerHome, storage, resultId), record);
+  registerResult(input.controllerHome, record, sanitized.value, storage);
   return record;
 }
 
@@ -123,10 +235,9 @@ export function readControllerResult(input: {
   limit?: number;
 }): { record: ControllerResultRecord; items: unknown; cursor: number; nextCursor?: number; truncated: boolean } {
   const parsed = parseRef(input.resultRef);
-  const record = readJsonFile<ControllerResultRecord>(recordPath(input.controllerHome, parsed.repoId, parsed.resultId));
-  if (record.resultRef !== input.resultRef || record.repoId !== parsed.repoId) throw new Error('RESULT_IDENTITY_MISMATCH');
-  authorizeRecord(record, input.sessionId, input.principalId, input.workId);
-  const sanitized = sanitizeStoredResult(input.controllerHome, record);
+  const resolved = resolveStoredResult(input.controllerHome, parsed.resultId, parsed.legacyRepoId);
+  authorizeRecord(resolved.record, input.sessionId, input.principalId, input.workId);
+  const sanitized = sanitizeResolvedResult(input.controllerHome, resolved.record, resolved.value, resolved.storage);
   const value = sanitized.value;
   const cursor = Math.max(0, Math.trunc(input.cursor ?? 0));
   const limit = Math.max(1, Math.min(500, Math.trunc(input.limit ?? 100)));
@@ -143,6 +254,11 @@ export function readControllerResult(input: {
     const items = source.slice(cursor, cursor + limit);
     return { record: sanitized.record, items, cursor, ...(cursor + items.length < source.length ? { nextCursor: cursor + items.length } : {}), truncated: cursor + items.length < source.length };
   }
+  if (value && typeof value === 'object') {
+    const source = JSON.stringify(value, null, 2);
+    const items = source.slice(cursor, cursor + limit * 4_096);
+    return { record: sanitized.record, items, cursor, ...(cursor + items.length < source.length ? { nextCursor: cursor + items.length } : {}), truncated: cursor + items.length < source.length };
+  }
   return { record: sanitized.record, items: value, cursor, truncated: false };
 }
 
@@ -156,10 +272,9 @@ export function searchControllerResult(input: {
   limit?: number;
 }): { record: ControllerResultRecord; matches: Array<{ line: number; text: string }>; truncated: boolean } {
   const parsed = parseRef(input.resultRef);
-  const record = readJsonFile<ControllerResultRecord>(recordPath(input.controllerHome, parsed.repoId, parsed.resultId));
-  if (record.resultRef !== input.resultRef || record.repoId !== parsed.repoId) throw new Error('RESULT_IDENTITY_MISMATCH');
-  authorizeRecord(record, input.sessionId, input.principalId, input.workId);
-  const sanitized = sanitizeStoredResult(input.controllerHome, record);
+  const resolved = resolveStoredResult(input.controllerHome, parsed.resultId, parsed.legacyRepoId);
+  authorizeRecord(resolved.record, input.sessionId, input.principalId, input.workId);
+  const sanitized = sanitizeResolvedResult(input.controllerHome, resolved.record, resolved.value, resolved.storage);
   const value = sanitized.value;
   const query = input.query.trim().toLowerCase();
   if (!query) throw new Error('RESULT_QUERY_REQUIRED');
@@ -169,17 +284,15 @@ export function searchControllerResult(input: {
   return { record: sanitized.record, matches, truncated: lines.filter((text) => text.toLowerCase().includes(query)).length > matches.length };
 }
 
-/**
- * Bounded maintenance entry point for historical result artifacts. It returns
- * only counts and ids; sensitive contents are never included in the report.
- */
-export function sanitizeControllerResultStore(controllerHome: string, repoId: string, limit = 10_000): {
+/** Bounded maintenance of the canonical instance Result store only. */
+export function sanitizeControllerResultStore(controllerHome: string, _repoId: string, limit = 10_000): {
   scanned: number;
   changed: number;
   failed: number;
   resultIds: string[];
 } {
-  const root = resultRoot(controllerHome, repoId);
+  const storage: OutputHandleStorage = { scope: 'instance' };
+  const root = canonicalResultRoot(controllerHome);
   const recordsDir = join(root, 'records');
   let scanned = 0;
   let changed = 0;
@@ -192,11 +305,12 @@ export function sanitizeControllerResultStore(controllerHome: string, repoId: st
     scanned += 1;
     try {
       const record = readJsonFile<ControllerResultRecord>(join(recordsDir, entry));
-      if (!record?.resultId || record.repoId !== repoId || !existsSync(dataPath(controllerHome, repoId, record.resultId))) {
+      if (!record?.resultId || !existsSync(dataPath(controllerHome, storage, record.resultId))) {
         failed += 1;
         continue;
       }
-      const sanitized = sanitizeStoredResult(controllerHome, record);
+      const raw = readJsonFile<unknown>(dataPath(controllerHome, storage, record.resultId));
+      const sanitized = sanitizeResolvedResult(controllerHome, record, raw, storage);
       if (sanitized.changed) {
         changed += 1;
         resultIds.push(record.resultId);

package/src/runtime/execution/jobs/store.ts

@@ -10,7 +10,7 @@ import { touchSchedulerWakeSignal } from '../../control-plane/global-scheduler/w
 import { readJsonFile, removeFile, sanitizeFileComponent, writeJsonAtomic } from '../../shared/json-files';
 import { terminateProcessTree } from '../../shared/process-tree';
 import { releaseExecutionLeases } from '../../resources/leases/store';
-import { assertRuntimeMayWriteOrThrow } from '../../root/write-fence';
+import { assertRuntimeMayWriteOrThrow, isRuntimeWriteFenceError } from '../../root/write-fence';
 import {
   ACTIVE_JOB_STATUSES,
   TERMINAL_JOB_STATUSES,
@@ -122,11 +122,10 @@ function artifactPointerFor(job: ExecutionJob, artifact: ReturnType<typeof write
     artifactKind: artifact.kind,
     detailPointer: {
       tool: 'get_artifact',
-      repoId: job.repoId,
       artifactId: artifact.artifactId,
       maxBytes: 512 * 1024,
     },
-    next: `Call get_artifact with repo_id=${job.repoId} and artifact_id=${artifact.artifactId}.`,
+    next: `Call get_artifact with artifact_id=${artifact.artifactId}.`,
   };
 }
 
@@ -439,7 +438,7 @@ export function transitionExecutionJob(
     try {
       assertRuntimeMayWriteOrThrow('write_workflow_terminal', controllerHome);
     } catch (error) {
-      if (error instanceof Error && error.message.startsWith('WRITER_FENCED:')) throw error;
+      if (isRuntimeWriteFenceError(error)) throw error;
     }
   }
   return updateExecutionJob(controllerHome, repoId, jobId, (current) => {

package/src/runtime/execution/managed-workspace.ts

@@ -16,10 +16,13 @@ import { resolveGitExecutable } from '../../effects/git-executable';
 import { runProcess } from '../../effects/process-runner';
 import { repositoryChildProcessEnvironment, resolveBunExecutable } from '../shared/process-environment';
 import { readJsonFile, writeJsonAtomic } from '../shared/json-files';
+import { ensureForgeInstanceIdentity, getOwnedResource, ownedResourceLocatorFingerprint, recordOwnedResource, type OwnedResourceLocator } from '../../../packages/kernel/identity/api/index';
 
 export interface EnsureManagedWorkspaceInput {
   requestId: string;
   title: string;
+  /** Semantic Work provenance for durable ownership; never an execution mutex. */
+  associatedWorkId?: string;
   baseRef?: string;
   branchName?: string;
   /** Explicitly materialize lockfile-backed Node dependencies in this isolated worktree. */
@@ -65,6 +68,21 @@ function suffix(repoId: string, requestId: string): string {
   return createHash('sha256').update(`${repoId}:${requestId}`).digest('hex').slice(0, 12);
 }
 
+export function managedWorkspaceOwnedResourceId(repoId: string, checkoutId: string): string {
+  return `managed-worktree:${repoId}:${checkoutId}`;
+}
+
+export function managedBranchOwnedResourceId(repoId: string, checkoutId: string): string {
+  return `managed-branch:${repoId}:${checkoutId}`;
+}
+
+export function managedBranchOwnedResourceLocator(repositoryRoot: string, checkoutId: string, branch: string): OwnedResourceLocator {
+  return {
+    kind: 'git_ref',
+    value: `${realpathSync(repositoryRoot)}\0${checkoutId.trim()}\0refs/heads/${branch.trim()}`,
+  };
+}
+
 function git(root: string, args: string[], timeoutMs = 30_000): string {
   const result = runProcess(resolveGitExecutable(), ['-C', root, ...args], {
     timeoutMs,
@@ -385,6 +403,10 @@ export function ensureManagedWorkspace(
         throw new Error(`MANAGED_WORKSPACE_REQUEST_CONFLICT: ${requestId}`);
       }
       const branch = manifest?.branch ?? requestedBranch;
+      // Persisted manifests are Forge provenance. Without one, an already-existing
+      // branch/worktree is never adopted as cleanup-owned merely because its name/path matches.
+      let workspaceOwnedByForge = Boolean(manifest);
+      let branchOwnedByForge = Boolean(manifest);
       // Persisted manifests are authoritative evidence; never move an active worktree in place.
       const path = manifest?.path ? resolve(manifest.path) : requestedPath;
       const baseRevision = manifest?.baseRevision ?? git(sourceRoot, ['rev-parse', '--verify', `${requestedBaseRef}^{commit}`]);
@@ -396,8 +418,11 @@ export function ensureManagedWorkspace(
           // A daemon crash may leave stale worktree administration behind even after the directory is gone.
           git(sourceRoot, ['worktree', 'prune', '--expire', 'now'], 120_000);
           git(sourceRoot, ['worktree', 'add', path, branch], 120_000);
+          workspaceOwnedByForge = true;
         } else {
           git(sourceRoot, ['worktree', 'add', '-b', branch, path, baseRevision], 120_000);
+          workspaceOwnedByForge = true;
+          branchOwnedByForge = true;
         }
       }
       if (!repositoryCheckoutRootMatches(repository, path)) {
@@ -425,6 +450,38 @@ export function ensureManagedWorkspace(
       );
       if (!checkout) throw new Error(`MANAGED_WORKSPACE_CHECKOUT_NOT_REGISTERED: ${path}`);
       const selected = selectRepositoryCheckout(record, checkout.checkoutId);
+      const ownerForgeInstanceId = ensureForgeInstanceIdentity({ controllerHome }).instanceId;
+      const workspaceResourceId = managedWorkspaceOwnedResourceId(repository.repoId, checkout.checkoutId);
+      const branchResourceId = managedBranchOwnedResourceId(repository.repoId, checkout.checkoutId);
+      const existingWorkspaceResource = getOwnedResource(controllerHome, workspaceResourceId);
+      const existingBranchResource = getOwnedResource(controllerHome, branchResourceId);
+      if (existingWorkspaceResource?.cleanupCapable === false) workspaceOwnedByForge = false;
+      if (existingBranchResource?.cleanupCapable === false) branchOwnedByForge = false;
+      recordOwnedResource(controllerHome, {
+        resourceId: workspaceResourceId,
+        kind: 'worktree',
+        targetRef: selected.canonicalRoot,
+        cleanupCapable: workspaceOwnedByForge,
+        creator: 'forge:managed-workspace',
+        ownerForgeInstanceId,
+        associatedWorkId: input.associatedWorkId,
+        repoId: repository.repoId,
+        retentionIntent: 'temporary',
+      });
+      const branchLocator = managedBranchOwnedResourceLocator(repository.canonicalRoot, checkout.checkoutId, branch);
+      recordOwnedResource(controllerHome, {
+        resourceId: branchResourceId,
+        kind: 'git_branch',
+        targetRef: branch,
+        locator: branchLocator,
+        identityFingerprint: ownedResourceLocatorFingerprint(ownerForgeInstanceId, branchLocator),
+        cleanupCapable: branchOwnedByForge,
+        creator: 'forge:managed-workspace',
+        ownerForgeInstanceId,
+        associatedWorkId: input.associatedWorkId,
+        repoId: repository.repoId,
+        retentionIntent: 'retain_on_failure',
+      });
       if (!manifest) {
         writeJsonAtomic(statePath, {
           schemaVersion: 1,

package/src/runtime/execution/process-runtime/check-facade.ts

@@ -153,7 +153,7 @@ export async function runCheckViaProcessRuntime(
       check,
       durable: {
         reason: 'multi_phase_or_release_check_requires_durable_workflow',
-        suggestedOperation: 'Claim the related WorkContract and run this check through an external Controller.',
+        suggestedOperation: 'Run this check through a Work-bound durable verification workflow.',
       },
       durableSideEffects: emptyEffects,
     };