@moretea-labs/forge 1.8.0 → 1.8.2

package/src/runtime/evidence/output-handle-index.ts

@@ -0,0 +1,225 @@
+import { deleteControlPlaneRecord, mutateControlPlaneRecord, readControlPlaneRecord } from '../control-plane/persistence/sqlite-store';
+
+export const OUTPUT_HANDLE_INDEX_NAMESPACE = 'output_handle_index';
+const OUTPUT_HANDLE_INDEX_SCOPE = 'instance';
+const OUTPUT_HANDLE_INDEX_SCHEMA_VERSION = 1;
+
+export type OutputHandleKind = 'result' | 'artifact' | 'evidence';
+export type OutputHandleStorage =
+  | { scope: 'instance' }
+  | { scope: 'legacy_repository'; repositoryId: string };
+
+export interface OutputHandleIndexEntry {
+  schemaVersion: 1;
+  handleId: string;
+  kind: OutputHandleKind;
+  storage: OutputHandleStorage;
+  /** Repository provenance is descriptive context, never the locator namespace. */
+  repositoryId?: string;
+  /** Opaque ids locate this record; authorization is bound separately. */
+  principalId?: string;
+  sessionId?: string;
+  workId?: string;
+  operationId?: string;
+  fingerprint: string;
+  recordedAt: string;
+  updatedAt: string;
+}
+
+function bounded(value: string | undefined): string | undefined {
+  const normalized = value?.trim();
+  return normalized ? normalized.slice(0, 512) : undefined;
+}
+
+function normalizedStorage(storage: OutputHandleStorage): OutputHandleStorage {
+  if (storage.scope === 'instance') return { scope: 'instance' };
+  const repositoryId = bounded(storage.repositoryId);
+  if (!repositoryId) throw new Error('OUTPUT_HANDLE_LEGACY_REPOSITORY_REQUIRED');
+  return { scope: 'legacy_repository', repositoryId };
+}
+
+function bindingsConflict(current: OutputHandleIndexEntry, input: {
+  principalId?: string;
+  sessionId?: string;
+  workId?: string;
+  operationId?: string;
+}): boolean {
+  for (const key of ['principalId', 'sessionId', 'workId', 'operationId'] as const) {
+    const left = bounded(current[key]);
+    const right = bounded(input[key]);
+    if (left && right && left !== right) return true;
+  }
+  return false;
+}
+
+export function recordOutputHandleIndexEntry(
+  controllerHome: string,
+  input: {
+    handleId: string;
+    kind: OutputHandleKind;
+    storage: OutputHandleStorage;
+    repositoryId?: string;
+    principalId?: string;
+    sessionId?: string;
+    workId?: string;
+    operationId?: string;
+    fingerprint: string;
+    now?: string;
+  },
+): OutputHandleIndexEntry {
+  const handleId = bounded(input.handleId);
+  const fingerprint = bounded(input.fingerprint);
+  if (!handleId || !fingerprint) throw new Error('OUTPUT_HANDLE_IDENTITY_REQUIRED');
+  const storage = normalizedStorage(input.storage);
+  const now = input.now ?? new Date().toISOString();
+  const repositoryId = bounded(input.repositoryId);
+  const principalId = bounded(input.principalId);
+  const sessionId = bounded(input.sessionId);
+  const workId = bounded(input.workId);
+  const operationId = bounded(input.operationId);
+
+  const record = mutateControlPlaneRecord<OutputHandleIndexEntry>(controllerHome, {
+    namespace: OUTPUT_HANDLE_INDEX_NAMESPACE,
+    scope: OUTPUT_HANDLE_INDEX_SCOPE,
+    key: handleId,
+    schemaVersion: OUTPUT_HANDLE_INDEX_SCHEMA_VERSION,
+    action: 'output_handle_index_record',
+    mutate: (currentRecord) => {
+      const current = currentRecord?.value;
+      if (current) {
+        if (current.schemaVersion !== OUTPUT_HANDLE_INDEX_SCHEMA_VERSION
+          || current.handleId !== handleId
+          || current.kind !== input.kind
+          || current.fingerprint !== fingerprint
+          || bindingsConflict(current, { principalId, sessionId, workId, operationId })) {
+          throw new Error(`OUTPUT_HANDLE_ID_COLLISION: ${handleId}`);
+        }
+        // Identical historical duplicates collapse to one locator. Canonical
+        // instance storage always outranks a legacy repository location.
+        const nextStorage = current.storage.scope === 'instance' || storage.scope !== 'instance'
+          ? current.storage
+          : storage;
+        return {
+          ...current,
+          storage: nextStorage,
+          ...(current.repositoryId || repositoryId ? { repositoryId: current.repositoryId ?? repositoryId } : {}),
+          ...(current.principalId || principalId ? { principalId: current.principalId ?? principalId } : {}),
+          ...(current.sessionId || sessionId ? { sessionId: current.sessionId ?? sessionId } : {}),
+          ...(current.workId || workId ? { workId: current.workId ?? workId } : {}),
+          ...(current.operationId || operationId ? { operationId: current.operationId ?? operationId } : {}),
+          updatedAt: now,
+        };
+      }
+      return {
+        schemaVersion: OUTPUT_HANDLE_INDEX_SCHEMA_VERSION,
+        handleId,
+        kind: input.kind,
+        storage,
+        ...(repositoryId ? { repositoryId } : {}),
+        ...(principalId ? { principalId } : {}),
+        ...(sessionId ? { sessionId } : {}),
+        ...(workId ? { workId } : {}),
+        ...(operationId ? { operationId } : {}),
+        fingerprint,
+        recordedAt: now,
+        updatedAt: now,
+      };
+    },
+  });
+  return record.value;
+}
+
+export function refreshOutputHandleFingerprint(
+  controllerHome: string,
+  input: {
+    handleId: string;
+    kind: OutputHandleKind;
+    expectedFingerprint: string;
+    nextFingerprint: string;
+    now?: string;
+  },
+): OutputHandleIndexEntry {
+  const handleId = bounded(input.handleId);
+  const expectedFingerprint = bounded(input.expectedFingerprint);
+  const nextFingerprint = bounded(input.nextFingerprint);
+  if (!handleId || !expectedFingerprint || !nextFingerprint) throw new Error('OUTPUT_HANDLE_FINGERPRINT_REFRESH_REQUIRED');
+  const now = input.now ?? new Date().toISOString();
+  const record = mutateControlPlaneRecord<OutputHandleIndexEntry>(controllerHome, {
+    namespace: OUTPUT_HANDLE_INDEX_NAMESPACE,
+    scope: OUTPUT_HANDLE_INDEX_SCOPE,
+    key: handleId,
+    schemaVersion: OUTPUT_HANDLE_INDEX_SCHEMA_VERSION,
+    action: 'output_handle_index_fingerprint_refresh',
+    mutate: (currentRecord) => {
+      const current = currentRecord?.value;
+      if (!current
+        || current.schemaVersion !== OUTPUT_HANDLE_INDEX_SCHEMA_VERSION
+        || current.handleId !== handleId
+        || current.kind !== input.kind
+        || current.storage.scope !== 'instance') {
+        throw new Error(`OUTPUT_HANDLE_FINGERPRINT_REFRESH_SCOPE_MISMATCH: ${handleId}`);
+      }
+      if (current.fingerprint !== expectedFingerprint) {
+        throw new Error(`OUTPUT_HANDLE_FINGERPRINT_REFRESH_CONFLICT: ${handleId}`);
+      }
+      return { ...current, fingerprint: nextFingerprint, updatedAt: now };
+    },
+  });
+  return record.value;
+}
+
+export function deleteOutputHandleIndexEntry(
+  controllerHome: string,
+  input: { handleId: string; kind: OutputHandleKind; expectedFingerprint?: string },
+): boolean {
+  const handleId = bounded(input.handleId);
+  if (!handleId) return false;
+  const record = readControlPlaneRecord<OutputHandleIndexEntry>(
+    controllerHome,
+    OUTPUT_HANDLE_INDEX_NAMESPACE,
+    OUTPUT_HANDLE_INDEX_SCOPE,
+    handleId,
+  );
+  if (!record) return false;
+  const current = record.value;
+  if (current.schemaVersion !== OUTPUT_HANDLE_INDEX_SCHEMA_VERSION
+    || current.handleId !== handleId
+    || current.kind !== input.kind
+    || current.storage.scope !== 'instance') {
+    throw new Error(`OUTPUT_HANDLE_INDEX_DELETE_SCOPE_MISMATCH: ${handleId}`);
+  }
+  const expectedFingerprint = bounded(input.expectedFingerprint);
+  if (expectedFingerprint && current.fingerprint !== expectedFingerprint) {
+    throw new Error(`OUTPUT_HANDLE_INDEX_DELETE_CONFLICT: ${handleId}`);
+  }
+  return deleteControlPlaneRecord(controllerHome, {
+    namespace: OUTPUT_HANDLE_INDEX_NAMESPACE,
+    scope: OUTPUT_HANDLE_INDEX_SCOPE,
+    key: handleId,
+    action: 'output_handle_index_delete',
+    expectedRevision: record.revision,
+  });
+}
+
+export function readOutputHandleIndexEntry(
+  controllerHome: string,
+  handleId: string,
+): OutputHandleIndexEntry | undefined {
+  const key = bounded(handleId);
+  if (!key) return undefined;
+  const record = readControlPlaneRecord<OutputHandleIndexEntry>(
+    controllerHome,
+    OUTPUT_HANDLE_INDEX_NAMESPACE,
+    OUTPUT_HANDLE_INDEX_SCOPE,
+    key,
+  );
+  const value = record?.value;
+  if (!value) return undefined;
+  if (value.schemaVersion !== OUTPUT_HANDLE_INDEX_SCHEMA_VERSION || value.handleId !== key) {
+    throw new Error(`OUTPUT_HANDLE_INDEX_CORRUPT: ${key}`);
+  }
+  if (!value.fingerprint || !value.kind || !value.storage) {
+    throw new Error(`OUTPUT_HANDLE_INDEX_CORRUPT: ${key}`);
+  }
+  return value;
+}

package/src/runtime/evidence/result-store.ts

@@ -1,15 +1,17 @@
-import { randomUUID } from 'crypto';
+import { createHash, randomUUID } from 'crypto';
 import { chmodSync, existsSync, mkdirSync, readdirSync, statSync } from 'fs';
 import { join } from 'path';
-import { repositoryControllerRoot } from '../../cli/repositories/controller-home';
+import { controllerSystemRoot, repositoryControllerRoot } from '../../cli/repositories/controller-home';
 import { readJsonFile, sanitizeFileComponent, writeJsonAtomic } from '../shared/json-files';
+import { recordOutputHandleIndexEntry, readOutputHandleIndexEntry, refreshOutputHandleFingerprint, type OutputHandleStorage } from './output-handle-index';
 import { redactSensitiveValue, type SensitiveRedactionCount } from './sensitive-output';
 
 export interface ControllerResultRecord {
   schemaVersion: 1;
   resultId: string;
   resultRef: string;
-  repoId: string;
+  /** Repository provenance only. It is not part of the canonical result locator. */
+  repoId?: string;
   sessionId: string;
   principalId: string;
   workId?: string;
@@ -24,19 +26,29 @@ export interface ControllerResultRecord {
   };
 }
 
-function resultRoot(controllerHome: string, repoId: string): string {
-  const root = join(repositoryControllerRoot(controllerHome, repoId), 'results');
+function canonicalResultRoot(controllerHome: string): string {
+  const root = join(controllerSystemRoot(controllerHome), 'outputs', 'results');
   mkdirSync(join(root, 'records'), { recursive: true, mode: 0o700 });
   mkdirSync(join(root, 'data'), { recursive: true, mode: 0o700 });
   return root;
 }
 
-function recordPath(controllerHome: string, repoId: string, resultId: string): string {
-  return join(resultRoot(controllerHome, repoId), 'records', `${sanitizeFileComponent(resultId)}.json`);
+function legacyResultRoot(controllerHome: string, repoId: string): string {
+  return join(repositoryControllerRoot(controllerHome, repoId), 'results');
 }
 
-function dataPath(controllerHome: string, repoId: string, resultId: string): string {
-  return join(resultRoot(controllerHome, repoId), 'data', `${sanitizeFileComponent(resultId)}.json`);
+function resultRoot(controllerHome: string, storage: OutputHandleStorage): string {
+  return storage.scope === 'instance'
+    ? canonicalResultRoot(controllerHome)
+    : legacyResultRoot(controllerHome, storage.repositoryId);
+}
+
+function recordPath(controllerHome: string, storage: OutputHandleStorage, resultId: string): string {
+  return join(resultRoot(controllerHome, storage), 'records', `${sanitizeFileComponent(resultId)}.json`);
+}
+
+function dataPath(controllerHome: string, storage: OutputHandleStorage, resultId: string): string {
+  return join(resultRoot(controllerHome, storage), 'data', `${sanitizeFileComponent(resultId)}.json`);
 }
 
 function writePrivateJson(path: string, value: unknown): void {
@@ -53,33 +65,131 @@ function redactionMetadata(redactions: SensitiveRedactionCount[]): NonNullable<C
   };
 }
 
-function sanitizeStoredResult(
+function canonicalResultRef(resultId: string): string {
+  return `result://${resultId}`;
+}
+
+function resultFingerprint(record: ControllerResultRecord, value: unknown): string {
+  return createHash('sha256').update(JSON.stringify({
+    resultId: record.resultId,
+    sessionId: record.sessionId,
+    principalId: record.principalId,
+    workId: record.workId ?? null,
+    kind: record.kind,
+    createdAt: record.createdAt,
+    value,
+  })).digest('hex');
+}
+
+function registerResult(
   controllerHome: string,
   record: ControllerResultRecord,
+  value: unknown,
+  storage: OutputHandleStorage,
+): void {
+  recordOutputHandleIndexEntry(controllerHome, {
+    handleId: record.resultId,
+    kind: 'result',
+    storage,
+    repositoryId: record.repoId,
+    principalId: record.principalId,
+    sessionId: record.sessionId,
+    workId: record.workId,
+    fingerprint: resultFingerprint(record, value),
+  });
+}
+
+function parseRef(resultRef: string): { resultId: string; legacyRepoId?: string } {
+  const normalized = resultRef.trim();
+  const canonical = /^result:\/\/([^/]+)$/.exec(normalized);
+  if (canonical) return { resultId: canonical[1]! };
+  const legacy = /^result:\/\/([^/]+)\/([^/]+)$/.exec(normalized);
+  if (legacy) return { legacyRepoId: legacy[1]!, resultId: legacy[2]! };
+  throw new Error('RESULT_REF_INVALID: expected result://<resultId>');
+}
+
+function loadResultAt(
+  controllerHome: string,
+  resultId: string,
+  storage: OutputHandleStorage,
+): { record: ControllerResultRecord; value: unknown } {
+  const stored = readJsonFile<ControllerResultRecord>(recordPath(controllerHome, storage, resultId));
+  if (stored.resultId !== resultId) throw new Error('RESULT_IDENTITY_MISMATCH');
+  const value = readJsonFile<unknown>(dataPath(controllerHome, storage, resultId));
+  const record: ControllerResultRecord = {
+    ...stored,
+    resultRef: canonicalResultRef(resultId),
+    ...(storage.scope === 'legacy_repository' && !stored.repoId ? { repoId: storage.repositoryId } : {}),
+  };
+  return { record, value };
+}
+
+function resolveStoredResult(
+  controllerHome: string,
+  resultId: string,
+  legacyRepoId?: string,
+): { record: ControllerResultRecord; value: unknown; storage: OutputHandleStorage } {
+  if (legacyRepoId) {
+    const storage: OutputHandleStorage = { scope: 'legacy_repository', repositoryId: legacyRepoId };
+    const loaded = loadResultAt(controllerHome, resultId, storage);
+    registerResult(controllerHome, loaded.record, loaded.value, storage);
+    return { ...loaded, storage };
+  }
+
+  const indexed = readOutputHandleIndexEntry(controllerHome, resultId);
+  if (indexed) {
+    if (indexed.kind !== 'result') throw new Error(`OUTPUT_HANDLE_KIND_MISMATCH: ${resultId}`);
+    const loaded = loadResultAt(controllerHome, resultId, indexed.storage);
+    if (resultFingerprint(loaded.record, loaded.value) !== indexed.fingerprint) {
+      throw new Error(`OUTPUT_HANDLE_FINGERPRINT_MISMATCH: ${resultId}`);
+    }
+    return { ...loaded, storage: indexed.storage };
+  }
+
+  const storage: OutputHandleStorage = { scope: 'instance' };
+  const canonicalRecord = recordPath(controllerHome, storage, resultId);
+  if (!existsSync(canonicalRecord)) {
+    throw new Error(`RESULT_LOCATOR_NOT_FOUND: ${resultId}; legacy results require their historical result://<repoId>/<resultId> reference once`);
+  }
+  const loaded = loadResultAt(controllerHome, resultId, storage);
+  registerResult(controllerHome, loaded.record, loaded.value, storage);
+  return { ...loaded, storage };
+}
+
+function sanitizeResolvedResult(
+  controllerHome: string,
+  record: ControllerResultRecord,
+  value: unknown,
+  storage: OutputHandleStorage,
 ): { record: ControllerResultRecord; value: unknown; changed: boolean } {
-  const path = dataPath(controllerHome, record.repoId, record.resultId);
-  const raw = readJsonFile<unknown>(path);
-  const sanitized = redactSensitiveValue(raw);
-  if (!sanitized.changed) return { record, value: raw, changed: false };
-  writePrivateJson(path, sanitized.value);
+  const sanitized = redactSensitiveValue(value);
+  if (!sanitized.changed) return { record, value, changed: false };
   const next: ControllerResultRecord = {
     ...record,
-    byteLength: statSync(path).size,
     redaction: redactionMetadata(sanitized.redactions),
   };
-  writePrivateJson(recordPath(controllerHome, record.repoId, record.resultId), next);
+  if (storage.scope === 'instance') {
+    const previousFingerprint = resultFingerprint(record, value);
+    const nextFingerprint = resultFingerprint(next, sanitized.value);
+    const path = dataPath(controllerHome, storage, record.resultId);
+    writePrivateJson(path, sanitized.value);
+    next.byteLength = statSync(path).size;
+    writePrivateJson(recordPath(controllerHome, storage, record.resultId), next);
+    refreshOutputHandleFingerprint(controllerHome, {
+      handleId: record.resultId,
+      kind: 'result',
+      expectedFingerprint: previousFingerprint,
+      nextFingerprint,
+    });
+  }
+  // Historical repository partitions are immutable after the cutover. Apply
+  // current redaction in-memory without rewriting legacy bytes.
   return { record: next, value: sanitized.value, changed: true };
 }
 
-function parseRef(resultRef: string): { repoId: string; resultId: string } {
-  const match = /^result:\/\/([^/]+)\/([^/]+)$/.exec(resultRef.trim());
-  if (!match) throw new Error('RESULT_REF_INVALID: expected result://<repoId>/<resultId>');
-  return { repoId: match[1]!, resultId: match[2]! };
-}
-
 export function writeControllerResult(input: {
   controllerHome: string;
-  repoId: string;
+  repoId?: string;
   sessionId: string;
   principalId: string;
   workId?: string;
@@ -87,15 +197,16 @@ export function writeControllerResult(input: {
   value: unknown;
 }): ControllerResultRecord {
   const resultId = `res_${randomUUID().replace(/-/g, '')}`;
-  const resultRef = `result://${input.repoId}/${resultId}`;
-  const path = dataPath(input.controllerHome, input.repoId, resultId);
+  const resultRef = canonicalResultRef(resultId);
+  const storage: OutputHandleStorage = { scope: 'instance' };
+  const path = dataPath(input.controllerHome, storage, resultId);
   const sanitized = redactSensitiveValue(input.value);
   writePrivateJson(path, sanitized.value);
   const record: ControllerResultRecord = {
     schemaVersion: 1,
     resultId,
     resultRef,
-    repoId: input.repoId,
+    ...(input.repoId?.trim() ? { repoId: input.repoId.trim() } : {}),
     sessionId: input.sessionId,
     principalId: input.principalId,
     ...(input.workId ? { workId: input.workId } : {}),
@@ -104,7 +215,8 @@ export function writeControllerResult(input: {
     createdAt: new Date().toISOString(),
     ...(sanitized.changed ? { redaction: redactionMetadata(sanitized.redactions) } : {}),
   };
-  writePrivateJson(recordPath(input.controllerHome, input.repoId, resultId), record);
+  writePrivateJson(recordPath(input.controllerHome, storage, resultId), record);
+  registerResult(input.controllerHome, record, sanitized.value, storage);
   return record;
 }
 
@@ -123,10 +235,9 @@ export function readControllerResult(input: {
   limit?: number;
 }): { record: ControllerResultRecord; items: unknown; cursor: number; nextCursor?: number; truncated: boolean } {
   const parsed = parseRef(input.resultRef);
-  const record = readJsonFile<ControllerResultRecord>(recordPath(input.controllerHome, parsed.repoId, parsed.resultId));
-  if (record.resultRef !== input.resultRef || record.repoId !== parsed.repoId) throw new Error('RESULT_IDENTITY_MISMATCH');
-  authorizeRecord(record, input.sessionId, input.principalId, input.workId);
-  const sanitized = sanitizeStoredResult(input.controllerHome, record);
+  const resolved = resolveStoredResult(input.controllerHome, parsed.resultId, parsed.legacyRepoId);
+  authorizeRecord(resolved.record, input.sessionId, input.principalId, input.workId);
+  const sanitized = sanitizeResolvedResult(input.controllerHome, resolved.record, resolved.value, resolved.storage);
   const value = sanitized.value;
   const cursor = Math.max(0, Math.trunc(input.cursor ?? 0));
   const limit = Math.max(1, Math.min(500, Math.trunc(input.limit ?? 100)));
@@ -143,6 +254,11 @@ export function readControllerResult(input: {
     const items = source.slice(cursor, cursor + limit);
     return { record: sanitized.record, items, cursor, ...(cursor + items.length < source.length ? { nextCursor: cursor + items.length } : {}), truncated: cursor + items.length < source.length };
   }
+  if (value && typeof value === 'object') {
+    const source = JSON.stringify(value, null, 2);
+    const items = source.slice(cursor, cursor + limit * 4_096);
+    return { record: sanitized.record, items, cursor, ...(cursor + items.length < source.length ? { nextCursor: cursor + items.length } : {}), truncated: cursor + items.length < source.length };
+  }
   return { record: sanitized.record, items: value, cursor, truncated: false };
 }
 
@@ -156,10 +272,9 @@ export function searchControllerResult(input: {
   limit?: number;
 }): { record: ControllerResultRecord; matches: Array<{ line: number; text: string }>; truncated: boolean } {
   const parsed = parseRef(input.resultRef);
-  const record = readJsonFile<ControllerResultRecord>(recordPath(input.controllerHome, parsed.repoId, parsed.resultId));
-  if (record.resultRef !== input.resultRef || record.repoId !== parsed.repoId) throw new Error('RESULT_IDENTITY_MISMATCH');
-  authorizeRecord(record, input.sessionId, input.principalId, input.workId);
-  const sanitized = sanitizeStoredResult(input.controllerHome, record);
+  const resolved = resolveStoredResult(input.controllerHome, parsed.resultId, parsed.legacyRepoId);
+  authorizeRecord(resolved.record, input.sessionId, input.principalId, input.workId);
+  const sanitized = sanitizeResolvedResult(input.controllerHome, resolved.record, resolved.value, resolved.storage);
   const value = sanitized.value;
   const query = input.query.trim().toLowerCase();
   if (!query) throw new Error('RESULT_QUERY_REQUIRED');
@@ -169,17 +284,15 @@ export function searchControllerResult(input: {
   return { record: sanitized.record, matches, truncated: lines.filter((text) => text.toLowerCase().includes(query)).length > matches.length };
 }
 
-/**
- * Bounded maintenance entry point for historical result artifacts. It returns
- * only counts and ids; sensitive contents are never included in the report.
- */
-export function sanitizeControllerResultStore(controllerHome: string, repoId: string, limit = 10_000): {
+/** Bounded maintenance of the canonical instance Result store only. */
+export function sanitizeControllerResultStore(controllerHome: string, _repoId: string, limit = 10_000): {
   scanned: number;
   changed: number;
   failed: number;
   resultIds: string[];
 } {
-  const root = resultRoot(controllerHome, repoId);
+  const storage: OutputHandleStorage = { scope: 'instance' };
+  const root = canonicalResultRoot(controllerHome);
   const recordsDir = join(root, 'records');
   let scanned = 0;
   let changed = 0;
@@ -192,11 +305,12 @@ export function sanitizeControllerResultStore(controllerHome: string, repoId: st
     scanned += 1;
     try {
       const record = readJsonFile<ControllerResultRecord>(join(recordsDir, entry));
-      if (!record?.resultId || record.repoId !== repoId || !existsSync(dataPath(controllerHome, repoId, record.resultId))) {
+      if (!record?.resultId || !existsSync(dataPath(controllerHome, storage, record.resultId))) {
         failed += 1;
         continue;
       }
-      const sanitized = sanitizeStoredResult(controllerHome, record);
+      const raw = readJsonFile<unknown>(dataPath(controllerHome, storage, record.resultId));
+      const sanitized = sanitizeResolvedResult(controllerHome, record, raw, storage);
       if (sanitized.changed) {
         changed += 1;
         resultIds.push(record.resultId);

package/src/runtime/evidence/sensitive-output.ts

@@ -59,8 +59,8 @@ const SENSITIVE_PATTERNS: readonly SensitivePattern[] = [
   },
   {
     type: 'secret_assignment',
-    pattern: /((?:^|[^\w]))(["']?)([A-Za-z0-9_.-]*(?:api[_-]?key|access[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|private[_-]?key|password|passwd|secret|credentials?|auth[_-]?token|token|cookie)[A-Za-z0-9_.-]*)\2(\s*(?:=>|:=|=|:)\s*)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\s,}\r\n]+)/gim,
-    replacement: '$1$2$3$2$4[REDACTED]',
+    pattern: /((?:^|[^\w]))(["']?)([A-Za-z0-9_.-]*(?:api[_-]?key|access[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|private[_-]?key|password|passwd|secret|credentials?|auth[_-]?token|token|cookie)[A-Za-z0-9_.-]*)\2(\s*(?:=>|:=|=|:)\s*)((?:[A-Z][A-Za-z0-9_]*(?:[?!])?\s*=\s*)?)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\s,}\r\n]+)/gim,
+    replacement: '$1$2$3$2$4$5[REDACTED]',
   },
   {
     type: 'database_url_assignment',
@@ -136,6 +136,26 @@ export function redactSensitiveText(input: string): SensitiveTextRedactionResult
   let text = input;
   const counts = new Map<string, number>();
   for (const entry of SENSITIVE_PATTERNS) {
+    if (entry.type === 'secret_assignment') {
+      let redactions = 0;
+      text = text.replace(entry.pattern, (matched, boundary: string, quote: string, key: string, separator: string, typeDefault: string) => {
+        // Preserve non-credential data flow even when a source symbol ends in "Token".
+        // An unquoted floating-point counter or a reference to the local token
+        // variable is not a secret literal. Keep unknown opaque/quoted token values
+        // redacted, including compound token keys, rather than whitelisting names.
+        const prefix = `${boundary}${quote}${key}${quote}${separator}${typeDefault}`;
+        const rhs = matched.slice(prefix.length);
+        const genericToken = /token$/i.test(key) && !/^(?:token|(?:api|access|refresh|auth|session|bearer|csrf|id|jwt|oauth)[_-]?token)$/i.test(key);
+        const sourceCounter = /^[+-]?(?:\d+\.\d*|\.\d+)(?:e[+-]?\d+)?[;)]?$/i.test(rhs);
+        const sourceReference = /^token[;)]?$/.test(rhs);
+        const sourceType = separator.trim() === ':' && !typeDefault && /^(?:Double|Float|Int|Int8|Int16|Int32|Int64|Bool|String|Character|CGFloat|Date|UUID)[?!]?[),{;]?$/.test(rhs);
+        if (genericToken && (sourceCounter || sourceReference || sourceType)) return matched;
+        redactions += 1;
+        return `${prefix}[REDACTED]`;
+      });
+      if (redactions) counts.set(entry.type, (counts.get(entry.type) ?? 0) + redactions);
+      continue;
+    }
     const matches = text.match(entry.pattern);
     if (!matches?.length) continue;
     counts.set(entry.type, (counts.get(entry.type) ?? 0) + matches.length);

package/src/runtime/execution/jobs/child-reference.ts

@@ -38,6 +38,17 @@ export function isAgentDelegationLocalAction(action: string | undefined): boolea
   return AGENT_DELEGATION_LOCAL_ACTIONS.has(action);
 }
 
+/** Shared delegation classification for Scheduler replay and durable receipt recovery. */
+export function isAgentDelegationJob(job: ExecutionJob): boolean {
+  return isAgentDelegationOperation(job.payload.operation)
+    || job.type === 'agent-run'
+    || job.type === 'dispatch-task'
+    || job.payload.arguments?.agentDelegation === true
+    || (job.payload.operation === 'legacy-local-job'
+      && typeof job.payload.arguments?.localAction === 'string'
+      && isAgentDelegationLocalAction(job.payload.arguments.localAction));
+}
+
 function stringField(value: unknown): string | undefined {
   if (typeof value !== 'string') return undefined;
   const trimmed = value.trim();

package/src/runtime/execution/jobs/receipt-recovery.ts

@@ -4,7 +4,7 @@ import {
   childReferenceFromJob,
   childReferenceFromReceipt,
   hasDurableChildReference,
-  isAgentDelegationOperation,
+  isAgentDelegationJob,
   mergeChildReferences,
 } from './child-reference';
 import { operationReceiptMatchesJobOwnership, readOperationReceipt } from './receipt-store';
@@ -18,16 +18,6 @@ export type RecoveredReceiptOutcome = {
   outcome: 'succeeded' | 'failed' | 'delegated';
 };
 
-function isAgentDelegationJob(job: ExecutionJob): boolean {
-  return isAgentDelegationOperation(job.payload.operation)
-    || job.type === 'agent-run'
-    || job.type === 'dispatch-task'
-    || job.payload.arguments?.agentDelegation === true
-    || (job.payload.operation === 'legacy-local-job'
-      && typeof job.payload.arguments?.localAction === 'string'
-      && ['launch-task', 'quick-agent-session'].includes(String(job.payload.arguments.localAction)));
-}
-
 /**
  * Recover a running Job from a matching completed/delegated Worker receipt.
  *

package/src/runtime/execution/jobs/store.ts

@@ -10,7 +10,7 @@ import { touchSchedulerWakeSignal } from '../../control-plane/global-scheduler/w
 import { readJsonFile, removeFile, sanitizeFileComponent, writeJsonAtomic } from '../../shared/json-files';
 import { terminateProcessTree } from '../../shared/process-tree';
 import { releaseExecutionLeases } from '../../resources/leases/store';
-import { assertRuntimeMayWriteOrThrow } from '../../root/write-fence';
+import { assertRuntimeMayWriteOrThrow, isRuntimeWriteFenceError } from '../../root/write-fence';
 import {
   ACTIVE_JOB_STATUSES,
   TERMINAL_JOB_STATUSES,
@@ -122,11 +122,10 @@ function artifactPointerFor(job: ExecutionJob, artifact: ReturnType<typeof write
     artifactKind: artifact.kind,
     detailPointer: {
       tool: 'get_artifact',
-      repoId: job.repoId,
       artifactId: artifact.artifactId,
       maxBytes: 512 * 1024,
     },
-    next: `Call get_artifact with repo_id=${job.repoId} and artifact_id=${artifact.artifactId}.`,
+    next: `Call get_artifact with artifact_id=${artifact.artifactId}.`,
   };
 }
 
@@ -439,7 +438,7 @@ export function transitionExecutionJob(
     try {
       assertRuntimeMayWriteOrThrow('write_workflow_terminal', controllerHome);
     } catch (error) {
-      if (error instanceof Error && error.message.startsWith('WRITER_FENCED:')) throw error;
+      if (isRuntimeWriteFenceError(error)) throw error;
     }
   }
   return updateExecutionJob(controllerHome, repoId, jobId, (current) => {