@moretea-labs/forge 1.8.0 → 1.8.2

package/src/runtime/recovery/lifecycle-inventory.ts

@@ -44,31 +44,31 @@ export const RUNTIME_LIFECYCLE_INVENTORY: readonly RuntimeLifecycleClassDefiniti
   lifecycle({
     id: 'requirement', owner: 'Goal / Requirement authority', scope: 'controller', dataClass: 'semantic_authority',
     storage: 'Controller Home SQLite requirement namespace',
-    terminalCondition: 'Requirement reaches done or cancelled through canonical semantic transition.',
-    activeProtection: 'The canonical transition table never returns done/cancelled Requirements to active authority, and optimistic revision fencing serializes every mutation.',
+    terminalCondition: 'Requirement semantic state reaches completed or cancelled through revisioned Requirement CAS.',
+    activeProtection: 'Stable Requirement identity plus expected-revision CAS serializes authored semantic updates; execution evidence and Controller dispositions cannot mutate Requirement state.',
     retentionCapacity: 'Permanent semantic/audit retention is the explicit policy: SQLite stores exactly one current row per requirementId and revisions update that row in place. Cardinality grows only when a new Requirement identity is deliberately admitted, never from retry/recovery cycles.',
     cleanupAuthority: 'Requirement authority owns semantic retention. Runtime GC does not delete Requirement rows; replaceable execution evidence is reclaimed by its own lifecycle classes.',
-    recoverySemantics: 'done may only remain done or become cancelled; cancelled may only remain cancelled. Recovery consumes the retained identity instead of reconstructing or reopening it.',
+    recoverySemantics: 'Recovery reads the retained Requirement identity/revision and never infers completion, continuation or reopening from Work, Plan, Controller or provider state.',
     closureStatus: 'existing_bounded', evidencePaths: ['src/runtime/control-plane/persistence/requirement-store.ts','packages/kernel/goal/api/index.ts','tests/runtime/requirement-portfolio-migration.test.ts'],
   }),
   lifecycle({
     id: 'plan', owner: 'Goal / Plan authority', scope: 'repository', dataClass: 'semantic_authority',
     storage: 'Controller Home SQLite plan namespace',
-    terminalCondition: 'Plan is finalized, superseded, cancelled or invalidated by drift.',
-    activeProtection: 'Current-plan queries exclude terminal/superseded authority, successor obligation continuity is fenced explicitly, and every same-plan mutation is revision-CAS protected.',
-    retentionCapacity: 'Permanent semantic/audit retention is the explicit policy: SQLite stores one current row per planId and revisions update that row in place. Only an explicit successor creates another Plan identity, so retries do not multiply Plan rows.',
-    cleanupAuthority: 'Plan authority owns semantic retention. Runtime GC does not delete Plan rows; predecessor/successor lineage remains queryable while disposable validation/process evidence is reclaimed elsewhere.',
-    recoverySemantics: 'Recovery preserves predecessor/successor and obligation disposition facts and cannot make a terminal predecessor current.',
-    closureStatus: 'existing_bounded', evidencePaths: ['src/runtime/control-plane/facade/plan-contract-store.ts','packages/kernel/goal/api/index.ts','tests/runtime/plan-contract-store.test.ts'],
+    terminalCondition: 'Plan has no Runtime-owned terminal lifecycle; it remains model-authored revisioned working memory until the model/user revises or stops referencing it.',
+    activeProtection: 'Stable Plan identity plus expected-revision CAS protects each authored revision. Approval, PlanStep acceptance, supersession and predecessor obligations are not execution authority.',
+    retentionCapacity: 'Permanent semantic/audit retention stores one current semantic row per planId plus bounded revision history; retries/recovery do not create replacement Plan identities.',
+    cleanupAuthority: 'Plan semantic retention is independent from disposable execution/process evidence; Runtime cleanup never rewrites Plan progress.',
+    recoverySemantics: 'Recovery re-reads the same Plan identity/revision and never derives Plan progress or execution admission from receipts, Work lifecycle, ControllerRound or compatibility fields.',
+    closureStatus: 'existing_bounded', evidencePaths: ['src/runtime/control-plane/facade/plan-contract-store.ts','tests/runtime/goal-authority-convergence.test.ts'],
   }),
   lifecycle({
-    id: 'work', owner: 'Kernel Work authority', scope: 'work', dataClass: 'execution_authority',
-    storage: 'Controller Home SQLite / Work authority records plus WorkHandle placement state',
-    terminalCondition: 'Work reaches completed, failed or cancelled with delivery/cleanup evidence as required.',
-    activeProtection: 'Work state machine, controller ownership, leases, delivery containment, active Plan bindings and revision-CAS updates protect live or explicitly resumable Work.',
-    retentionCapacity: 'Permanent semantic/audit retention is the explicit policy: SQLite stores one current row per workId and lifecycle mutations update that row in place. New rows correspond only to deliberately admitted Work identities; Process/log/check-result/artifact growth is bounded by separate lifecycle classes.',
-    cleanupAuthority: 'Work finalization/terminal cleanup releases owned execution resources, but Runtime GC does not delete the durable Work row or its completion identity.',
-    recoverySemantics: 'A retained cancelled Work can resume only through the explicit canonical resume contract; completed delivery identity and successor lineage remain durable and are never synthesized from deleted detail.',
+    id: 'work', owner: 'Kernel Work semantic authority', scope: 'work', dataClass: 'semantic_authority',
+    storage: 'Controller Home SQLite Work semantic records; concrete checkout/process/resource placement is owned by its domain stores',
+    terminalCondition: 'Work semantic state is exactly open, completed or cancelled; only revisioned work_revise/work_complete CAS changes that semantic state.',
+    activeProtection: 'Stable Work identity plus expected-revision CAS protects model-authored objective/state/result refs. Controller claims, delivery receipts, verification/review evidence and Plan provenance cannot complete Work.',
+    retentionCapacity: 'SQLite stores one current semantic row per workId plus bounded revision history. Retry, delivery, provider recovery and resource cleanup do not manufacture successor Work identities.',
+    cleanupAuthority: 'OwnedResource/process/worktree domains clean up their own physical resources. Cleanup and delivery never rewrite semantic Work completion.',
+    recoverySemantics: 'Recovery resumes mechanical operations around the same retained Work when appropriate; it never infers semantic completion/cancellation/reopen from physical evidence.',
     closureStatus: 'existing_bounded', evidencePaths: ['packages/kernel/work/api/index.ts','src/runtime/control-plane/execution/work-terminal-cleanup.ts','tests/runtime/repository-work-admission.test.ts'],
   }),
   lifecycle({
@@ -95,20 +95,20 @@ export const RUNTIME_LIFECYCLE_INVENTORY: readonly RuntimeLifecycleClassDefiniti
     id: 'check_receipt', owner: 'Verification / Process evidence authority', scope: 'work', dataClass: 'evidence',
     storage: 'Controller Home Process/check receipt evidence',
     terminalCondition: 'Check Process reaches terminal outcome and receipt is bound to exact input/source identity.',
-    activeProtection: 'Receipts required by active validation, completion, review or Operational Memory support evidence are protected.',
+    activeProtection: 'Receipts referenced by active Work evidence or Operational Memory are protected; they are evidence only and never completion/review authority.',
     retentionCapacity: 'A Process check receipt has no separate mutable authority: it is derived from one terminal Process record and copied into Work VerificationRecord when consumed. Process records are bounded by the 7-day/500 policy; persisted check-result sidecars use 30-day/500 retention, a 5000-entry scan bound and at most 50 removals per selected-repository cleanup pass.',
     cleanupAuthority: 'Process GC owns terminal Process/log source, Scheduler maintenance owns replaceable check-result sidecars, and Work lifecycle owns accepted VerificationRecord copies; none becomes a second receipt authority.',
     recoverySemantics: 'Active Work cache identities protect required sidecars; truncated/malformed scans fail closed, and missing or changed evidence becomes stale/replay-gap rather than synthetic success.',
     closureStatus: 'existing_bounded', evidencePaths: ['src/runtime/execution/process-runtime/check-receipt.ts','src/runtime/execution/process-runtime/gc.ts','src/runtime/execution/process-runtime/check-result-retention.ts','packages/kernel/work/api/index.ts','tests/runtime/check-result-retention.test.ts'],
   }),
   lifecycle({
-    id: 'controller_round', owner: 'Kernel ControllerRound authority', scope: 'work', dataClass: 'semantic_authority',
+    id: 'controller_round', owner: 'Kernel autonomous-continuation mechanics', scope: 'work', dataClass: 'execution_authority',
     storage: 'Controller Home SQLite controller-round relay records',
-    terminalCondition: 'Exactly one semantic disposition settles the round: continue_immediately, wait, wait_for_user or goal_complete; failed/blocked are explicit recovery states.',
-    activeProtection: 'Relay scope, claim generation and opaque authority fence each live semantic round.',
-    retentionCapacity: 'Permanent semantic/audit retention is the explicit policy: controller_round_relay uses workId as its stable key and each round/recovery transition revision-updates that row. Round history lives in durable audit, so retries and additional semantic rounds do not create parallel current relay authority.',
-    cleanupAuthority: 'ControllerRound authority owns relay retention. Runtime GC does not delete relay rows; ControllerSession/lease and provider/browser artifacts are separate bounded lifecycle classes.',
-    recoverySemantics: 'failed and blocked remain explicit recoverable states, so their relay identity is retained. Transport/session replacement and ambiguous provider effect reconcile against the same fenced relay instead of fabricating a new semantic round.',
+    terminalCondition: 'One explicit continuation attempt reaches a mechanical disposition/dispatch boundary; no disposition changes Requirement, Plan or Work semantic state.',
+    activeProtection: 'Relay scope, claim generation, stable provider-effect identity and opaque authority fence only continuation dispatch/recovery mechanics.',
+    retentionCapacity: 'controller_round_relay uses one current row per continuation scope/work and revision-updates it; audit/effect evidence records history without creating a parallel semantic authority.',
+    cleanupAuthority: 'Controller continuation mechanics own relay retention; session leases and provider/browser artifacts remain separate concrete-resource/effect domains.',
+    recoverySemantics: 'Transport/session replacement and ambiguous provider effect reconcile against the same fenced continuation/effect identity; outcome_unknown is never blind-replayed and recovery never fabricates semantic progress.',
     closureStatus: 'existing_bounded', evidencePaths: ['packages/kernel/controller/api/index.ts','tests/runtime/autonomous-continuation-lifecycle.test.ts'],
   }),
   lifecycle({
@@ -169,7 +169,7 @@ export const RUNTIME_LIFECYCLE_INVENTORY: readonly RuntimeLifecycleClassDefiniti
     retentionCapacity: 'Global maximum, lease expiry and absolute lifetime bound stream-only sessions.',
     cleanupAuthority: 'MCP transport registry lifecycle.',
     recoverySemantics: 'Closing transport state never cancels or completes a durably accepted Job.',
-    closureStatus: 'existing_bounded', evidencePaths: ['docs/architecture/modules/controller-runtime/transport-lifecycle.md','src/cli/mcp/transports'],
+    closureStatus: 'existing_bounded', evidencePaths: ['docs/architecture/modules/controller-runtime/transport-lifecycle.md','adapters/mcp/transports'],
   }),
   lifecycle({
     id: 'browser_session_profile', owner: 'Browser session/provider authority', scope: 'provider', dataClass: 'provider_artifact',
@@ -241,16 +241,6 @@ export const RUNTIME_LIFECYCLE_INVENTORY: readonly RuntimeLifecycleClassDefiniti
     recoverySemantics: 'Quarantine remains diagnostic evidence, never a shadow active authority; legacy symlinks are relocated without traversal, and repeated maintenance is idempotent and fail-closed on unreadable evidence.',
     closureStatus: 'existing_bounded', evidencePaths: ['src/runtime/recovery/quarantine-retention.ts','src/runtime/recovery/maintenance-executor.ts','src/runtime/recovery/local-jobs-repair.ts','tests/runtime/capability-recovery.test.ts'],
   }),
-  lifecycle({
-    id: 'codegraph_cache', owner: 'Context / CodeGraph cache lifecycle', scope: 'repository', dataClass: 'cache',
-    storage: 'Controller Home tool-cache/codegraph or explicit external cache root',
-    terminalCondition: 'Index is stale, superseded, repository-retired or evicted as rebuildable cache.',
-    activeProtection: 'Only a live process-scoped Forge locator fences Controller Home cache deletion; unreadable, truncated, or ambiguous locator evidence fails closed. Raw source remains authority when cache is missing/stale.',
-    retentionCapacity: 'Forge-owned Controller Home indexes use a 7-day default idle grace, 512 MiB per-repository cap, 2 GiB Controller aggregate cap, and bounded oldest-first scan/removal budgets. Inactive caches may be rebuilt and evicted under age or capacity pressure; explicit external cache roots remain outside Forge cleanup authority.',
-    cleanupAuthority: 'Central Runtime cleanup owns rebuildable Controller Home CodeGraph eviction; no semantic authority is deleted and non-owned/symlink entries fail closed.',
-    recoverySemantics: 'Missing/stale cache degrades explicitly to lexical/raw-source evidence and rebuilds on demand; removal is idempotent and bounded by the shared cleanup budget.',
-    closureStatus: 'existing_bounded', evidencePaths: ['src/runtime/context/codegraph-cache-boundary.ts','src/runtime/control-plane/codegraph-cache-retention.ts','src/runtime/control-plane/runtime-cleanup.ts','tests/runtime/codegraph-cache-retention.test.ts'],
-  }),
   lifecycle({
     id: 'operational_memory', owner: 'Kernel Memory shadow reducer', scope: 'controller', dataClass: 'derived',
     storage: 'Controller Home derived operational Memory records backed by retained Process evidence',
@@ -313,12 +303,12 @@ export const RUNTIME_LIFECYCLE_INVENTORY: readonly RuntimeLifecycleClassDefiniti
   }),
   lifecycle({
     id: 'runtime_temp', owner: 'Runtime diagnostics/process scratch lifecycle', scope: 'process', dataClass: 'temporary',
-    storage: 'OS temporary roots / Controller-observed Runtime temp entries',
-    terminalCondition: 'Owning live Process is gone and entry exceeds the runtime temp retention threshold.',
-    activeProtection: 'collectRuntimeProcesses protects scratch still owned by a live Runtime process.',
-    retentionCapacity: 'RUNTIME_TEMP_RETENTION_MINUTES age threshold and bounded maintenance candidate scan.',
-    cleanupAuthority: 'Central Runtime maintenance removeRuntimeTempEntry.',
-    recoverySemantics: 'Temp cleanup is disposable and never participates in semantic completion or effect replay.',
+    storage: 'OS temporary roots / Controller-observed Runtime temp entries, including forge-runtime-release-source-* detached release snapshot containers.',
+    terminalCondition: 'Normal release snapshot scope removes its worktree/container immediately; orphaned Runtime temp is terminal after the owning live Process is gone and the retention threshold is exceeded.',
+    activeProtection: 'Release snapshot callbacks own their temp container until finally cleanup; collectRuntimeProcesses protects longer-lived scratch still attributable to a live Runtime process.',
+    retentionCapacity: 'Immediate release-snapshot finally cleanup plus RUNTIME_TEMP_RETENTION_MINUTES age threshold and bounded maintenance candidate scan for crash leftovers.',
+    cleanupAuthority: 'Release materialization owns immediate snapshot cleanup; Central Runtime maintenance removeRuntimeTempEntry owns stale crash-leftover cleanup.',
+    recoverySemantics: 'Release snapshot/temp cleanup is disposable, lives outside repository workspace authority, prunes stale Git worktree metadata after failed materialization/removal, and never participates in semantic completion or effect replay.',
     closureStatus: 'existing_bounded', evidencePaths: ['src/runtime/diagnostics/performance.ts','src/runtime/recovery/maintenance-executor.ts'],
   }),
 ]);