@moretea-labs/forge 1.8.0 → 1.8.2

package/packages/kernel/work/application/work-service.ts

@@ -1,11 +1,8 @@
 import {
   appendWorkEvidence as persistWorkEvidence,
   getWorkContract as readWorkContract,
-  recordWorkCompletionReceipt as persistWorkCompletionReceipt,
+  recordWorkCompletionReceipt as persistWorkDeliveryReceipt,
   canonicalizeWorkContractForAuthority,
-  rebindPlanBoundWorkContract as buildPlanBoundWorkRebind,
-  refreshPlanBoundWorkRevision as buildPlanBoundWorkRevisionRefresh,
-  retirePlanBoundWorkContract as buildPlanBoundWorkRetirement,
 } from '../infrastructure/work-contract-store';
 import type { WorkContract } from '../domain/types';
 import type { WorkContractStoreOptions } from '../ports/work-contract-store';
@@ -20,11 +17,10 @@ export interface CompleteRemoteEffectProcessInput {
 }
 
 /**
- * Application command for terminalizing a Work from one trusted repository
- * remote-effect Process receipt. Gateway supplies evidence identity only; Work
- * kind checks, evidence append, and terminal lifecycle mutation stay here.
+ * Record one trusted repository remote-effect Process receipt as Work evidence.
+ * This never changes semantic Work state; the model/user decides completion via complete.
  */
-export function completeRemoteEffectWorkFromProcessReceipt(
+export function recordRemoteEffectWorkProcessReceipt(
   options: WorkContractStoreOptions,
   workId: string,
   input: CompleteRemoteEffectProcessInput,
@@ -34,7 +30,7 @@ export function completeRemoteEffectWorkFromProcessReceipt(
   if (work.workKind !== 'remote_effect') {
     throw new Error(`WORK_REMOTE_EFFECT_PROCESS_KIND_MISMATCH: ${workId} is ${work.workKind}, expected remote_effect`);
   }
-  if (work.status === 'completed' && work.completionReceipt?.source === 'remote_effect') return work;
+  if (work.completionReceipt?.source === 'remote_effect') return work;
   if (!work.evidenceRefs.some((candidate) => candidate.evidenceId === input.processId)) {
     persistWorkEvidence(options, workId, {
       evidenceId: input.processId,
@@ -43,7 +39,7 @@ export function completeRemoteEffectWorkFromProcessReceipt(
       detailLevel: 'summary',
     });
   }
-  return persistWorkCompletionReceipt(
+  return persistWorkDeliveryReceipt(
     options,
     workId,
     {
@@ -77,29 +73,33 @@ export {
   emptyWorkContractStore,
   readWorkContractStore,
   writeWorkContractStore,
+  createWorkSemanticContext,
   createWorkContract,
   getWorkContractByRequestId,
   acceptSubmittedWorkContract,
   listWorkContracts,
   readActiveWorkCandidates,
+  readWorkContractLineageSnapshot,
   initializeWorkCandidateIndex,
   isCurrentWorkContract,
   supersedeWorkContract,
   getWorkContract,
+  semanticWorkState,
+  workSemanticView,
+  listWorkSemanticRevisionRecords,
+  reviseWorkSemanticContext,
   summarizeWorkContract,
   updateWorkContract,
+  updateWorkContractPlacementAtomically,
   promoteWorkToRepositoryChange,
   recordWorkEvidenceState,
   activateWorkContract,
   failWorkContract,
   cancelWorkContract,
-  resumeRetainedCancelledWorkContract,
+  recordCancelledWorkCleanupCompleted,
   recordWorkScopeEvidence,
   transitionWorkContractPhase,
-  requestWorkImplementationReview,
   recordWorkImplementationReview,
-  recordContentEquivalentCommitAuthorityTransfer,
-  reconcileApprovedWorkImplementationReviewProjection,
   appendWorkEvidence,
   appendWorkHandoffRef,
   appendVerificationRecord,
@@ -107,42 +107,18 @@ export {
   canonicalizeWorkContractForAuthority,
 } from '../infrastructure/work-contract-store';
 export type {
+  CreateWorkSemanticInput,
   CreateWorkContractInput,
   ListWorkContractOptions,
   InvalidActiveWorkCandidate,
   ActiveWorkCandidateSnapshot,
+  WorkContractLineageSnapshot,
   SupersedeWorkContractInput,
   WorkContractSummary,
+  WorkSemanticRevisionRecord,
+  ReviseWorkSemanticInput,
   AcceptSubmittedWorkInput,
   WorkContractStoreLocation,
   WorkContractStoreOptions,
   WorkContractMetadataPatch,
 } from '../infrastructure/work-contract-store';
-
-/**
- * Public Work application command for constructing a validated scope-only
- * successor-Plan binding. Persistence remains with the caller so a higher-level
- * control-plane transaction can atomically update Plan + Work authority.
- */
-export function rebindPlanBoundWorkContract(
-  current: WorkContract,
-  input: Parameters<typeof buildPlanBoundWorkRebind>[1],
-): WorkContract {
-  return buildPlanBoundWorkRebind(current, input);
-}
-
-/** Build a validated terminal authority-retirement transition for a Work whose Plan is no longer current. */
-/** Refresh a Work against a newer revision of the same stable Plan identity. */
-export function refreshPlanBoundWorkRevision(
-  current: WorkContract,
-  input: Parameters<typeof buildPlanBoundWorkRevisionRefresh>[1],
-): WorkContract {
-  return buildPlanBoundWorkRevisionRefresh(current, input);
-}
-
-export function retirePlanBoundWorkContract(
-  current: WorkContract,
-  input: Parameters<typeof buildPlanBoundWorkRetirement>[1],
-): WorkContract {
-  return buildPlanBoundWorkRetirement(current, input);
-}

package/packages/kernel/work/domain/current-task-lineage.ts

@@ -0,0 +1,104 @@
+import type { ScopeRef } from '../../identity/api/index';
+import { semanticScopeRefForWork, type WorkContract } from './types';
+
+export interface CurrentTaskSemanticProjection {
+  schemaVersion: 1;
+  workId: string;
+  objective: string;
+  semanticScope: ScopeRef;
+  lifecycleRole: 'primary' | 'execution_child';
+  requirementId?: string;
+  planId?: string;
+  planStepId?: string;
+  parentWorkId?: string;
+  /** Objective graph metadata is projected for clients but never expands exact current-task authority. */
+  semanticParentWorkId?: string;
+  dependsOnWorkIds: string[];
+  predecessorWorkId?: string;
+  supersedes: string[];
+  supersededBy?: string;
+}
+
+/**
+ * Exact semantic identity for the task currently being executed.
+ * Broader Requirement/Plan membership is descriptive lineage metadata only.
+ */
+export function currentTaskSemanticProjectionForWork(work: WorkContract): CurrentTaskSemanticProjection {
+  return {
+    schemaVersion: 1,
+    workId: work.workId,
+    objective: work.objective,
+    semanticScope: semanticScopeRefForWork(work),
+    lifecycleRole: work.lifecycleRole ?? 'primary',
+    ...(work.requirementId?.trim() ? { requirementId: work.requirementId.trim() } : {}),
+    ...(work.planId?.trim() ? { planId: work.planId.trim() } : {}),
+    ...(work.planStepId?.trim() ? { planStepId: work.planStepId.trim() } : {}),
+    ...(work.parentWorkId?.trim() ? { parentWorkId: work.parentWorkId.trim() } : {}),
+    ...(work.semanticParentWorkId?.trim() ? { semanticParentWorkId: work.semanticParentWorkId.trim() } : {}),
+    dependsOnWorkIds: [...new Set((work.dependsOnWorkIds ?? []).map((id) => id.trim()).filter(Boolean))].sort(),
+    ...(work.predecessorWorkId?.trim() ? { predecessorWorkId: work.predecessorWorkId.trim() } : {}),
+    supersedes: [...new Set((work.supersedes ?? []).map((id) => id.trim()).filter(Boolean))].sort(),
+    ...(work.supersededBy?.trim() ? { supersededBy: work.supersededBy.trim() } : {}),
+  };
+}
+
+/**
+ * Derive only explicit Work lineage. Broad Requirement/Plan membership is
+ * deliberately ignored because it is Goal scope, not current-task authority.
+ */
+export function currentTaskLineageWorkIds(
+  originWorkIds: readonly string[],
+  contracts: readonly WorkContract[],
+): Set<string> {
+  const byId = new Map(contracts.map((contract) => [contract.workId, contract] as const));
+  const forward = new Set(originWorkIds.map((id) => id.trim()).filter((id) => id && byId.has(id)));
+
+  // Expand only *forward* from the exact origin(s). A child may include its
+  // parent as ancestry later, but that parent must never become a new forward
+  // seed that pulls sibling children into the current task.
+  let expanded = true;
+  while (expanded) {
+    expanded = false;
+    for (const work of contracts) {
+      if (forward.has(work.workId)) {
+        const explicitSuccessor = work.supersededBy?.trim();
+        if (explicitSuccessor && byId.has(explicitSuccessor) && !forward.has(explicitSuccessor)) {
+          forward.add(explicitSuccessor);
+          expanded = true;
+        }
+        continue;
+      }
+      const parentWorkId = work.parentWorkId?.trim();
+      const predecessorWorkId = work.predecessorWorkId?.trim();
+      const supersedes = (work.supersedes ?? []).map((id) => id.trim()).filter(Boolean);
+      if (
+        (parentWorkId && forward.has(parentWorkId))
+        || (predecessorWorkId && forward.has(predecessorWorkId))
+        || supersedes.some((id) => forward.has(id))
+      ) {
+        forward.add(work.workId);
+        expanded = true;
+      }
+    }
+  }
+
+  // Preserve explicit ancestry for audit/fencing, but never use ancestors as
+  // descendant-expansion seeds. That keeps fork siblings independent.
+  const linked = new Set(forward);
+  const upstream = [...forward];
+  while (upstream.length > 0) {
+    const work = byId.get(upstream.pop()!);
+    if (!work) continue;
+    const ancestors = [
+      work.parentWorkId,
+      work.predecessorWorkId,
+      ...(work.supersedes ?? []),
+    ].map((id) => id?.trim()).filter((id): id is string => Boolean(id));
+    for (const id of ancestors) {
+      if (!byId.has(id) || linked.has(id)) continue;
+      linked.add(id);
+      upstream.push(id);
+    }
+  }
+  return linked;
+}

package/packages/kernel/work/domain/engineering-design.ts

@@ -31,8 +31,8 @@ export const ENGINEERING_DECISION_AREAS = [
 ] as const;
 export type EngineeringDecisionArea = (typeof ENGINEERING_DECISION_AREAS)[number];
 export type EngineeringCritiqueDecision = 'approved' | 'changes_required' | 'blocked';
-export type EngineeringBlockerClassification = 'same_root_cause' | 'unrelated';
-export type EngineeringBlockerAction = 'return_to_design' | 'linked_work';
+export type EngineeringBlockerClassification = 'same_root_cause' | 'same_root_cause_scope_extension' | 'unrelated';
+export type EngineeringBlockerAction = 'return_to_design' | 'extend_candidate' | 'linked_work';
 
 const MAX_ITEMS = 64;
 const MAX_TEXT = 2_000;
@@ -256,15 +256,20 @@ export function buildEngineeringBlockerDispositionReceipt(input: {
   rationale: string;
   recordedAt: string;
 }): EngineeringBlockerDispositionReceipt {
-  if (!['same_root_cause', 'unrelated'].includes(input.classification)) throw new Error('ENGINEERING_BLOCKER_CLASSIFICATION_INVALID');
+  if (!['same_root_cause', 'same_root_cause_scope_extension', 'unrelated'].includes(input.classification)) throw new Error('ENGINEERING_BLOCKER_CLASSIFICATION_INVALID');
   const linkedWorkId = input.linkedWorkId?.trim() || undefined;
+  const sameRootCause = input.classification !== 'unrelated';
   if (input.classification === 'unrelated' && !linkedWorkId) throw new Error('ENGINEERING_BLOCKER_LINKED_WORK_REQUIRED');
-  if (input.classification === 'same_root_cause' && linkedWorkId) throw new Error('ENGINEERING_BLOCKER_LINKED_WORK_FORBIDDEN');
+  if (sameRootCause && linkedWorkId) throw new Error('ENGINEERING_BLOCKER_LINKED_WORK_FORBIDDEN');
   const core = {
     sourceRevision: text(input.sourceRevision, 'ENGINEERING_BLOCKER_SOURCE_REQUIRED'),
     blockerId: text(input.blockerId, 'ENGINEERING_BLOCKER_ID_REQUIRED'),
     classification: input.classification,
-    action: input.classification === 'same_root_cause' ? 'return_to_design' as const : 'linked_work' as const,
+    action: input.classification === 'same_root_cause'
+      ? 'return_to_design' as const
+      : input.classification === 'same_root_cause_scope_extension'
+        ? 'extend_candidate' as const
+        : 'linked_work' as const,
     semanticScopeKeys: list(input.semanticScopeKeys ?? [], 'ENGINEERING_BLOCKER_SCOPE_INVALID', false),
     ...(linkedWorkId ? { linkedWorkId: text(linkedWorkId, 'ENGINEERING_BLOCKER_LINKED_WORK_INVALID') } : {}),
     rationale: text(input.rationale, 'ENGINEERING_BLOCKER_RATIONALE_REQUIRED'),

package/packages/kernel/work/domain/engineering-profile.ts

@@ -73,7 +73,9 @@ const PROFILES: Record<EngineeringRiskClass, EngineeringWorkProfile> = {
     schemaVersion: 1,
     profileVersion: ENGINEERING_WORK_PROFILE_VERSION,
     riskClass: 'high',
-    admissionEnforcement: 'enforce',
+    // Engineering evidence is useful model/project guidance, never a Kernel
+    // mutation-admission authority. Safety/resource admission lives elsewhere.
+    admissionEnforcement: 'observe',
     evidenceRequirements: requirement('required', 'required', 'required', 'required', 'required', 'conditional', 'required', 'conditional', 'required'),
     admissionEvidence: ['project_contract', 'context_closure', 'product_dod', 'design_decision', 'independent_critique'],
     completionEvidence: ['focused_validation', 'fresh_review'],
@@ -82,7 +84,7 @@ const PROFILES: Record<EngineeringRiskClass, EngineeringWorkProfile> = {
     schemaVersion: 1,
     profileVersion: ENGINEERING_WORK_PROFILE_VERSION,
     riskClass: 'critical',
-    admissionEnforcement: 'enforce',
+    admissionEnforcement: 'observe',
     evidenceRequirements: requirement('required', 'required', 'required', 'required', 'required', 'required', 'required', 'required', 'required'),
     admissionEvidence: ['project_contract', 'context_closure', 'product_dod', 'design_decision', 'independent_critique', 'semantic_tools'],
     completionEvidence: ['focused_validation', 'real_journey', 'fresh_review'],
@@ -208,16 +210,10 @@ export function evaluateEngineeringAdmission(input: {
   receipt: EngineeringContextReceipt;
   mutation: boolean;
 }): { allowed: true } | { allowed: false; code: string; missing: EngineeringEvidenceKind[] } {
-  if (!input.mutation || input.profile.admissionEnforcement === 'observe') return { allowed: true };
-  if (input.receipt.sourceIdentity.kind === 'unknown') {
-    return { allowed: false, code: 'ENGINEERING_SOURCE_IDENTITY_REQUIRED', missing: input.receipt.missingAdmissionEvidence };
-  }
-  if (input.receipt.designState === 'revisit_required') {
-    return { allowed: false, code: 'ENGINEERING_DESIGN_REVISIT_REQUIRED', missing: ['design_decision', 'independent_critique'] };
-  }
-  if (input.receipt.missingAdmissionEvidence.length > 0) {
-    return { allowed: false, code: 'ENGINEERING_ADMISSION_EVIDENCE_REQUIRED', missing: input.receipt.missingAdmissionEvidence };
-  }
+  // Forge records these receipts for model judgment, audit, and project-level
+  // acceptance. It must not prescribe an engineering methodology before a
+  // mutation. Source/CAS/security/resource safety is enforced by capabilities.
+  void input;
   return { allowed: true };
 }
 

package/packages/kernel/work/domain/evaluation-promotion-receipt.ts

@@ -0,0 +1,186 @@
+import { createHash } from 'crypto';
+import type { WorkImplementationReviewEvidenceIdentity } from './implementation-review';
+
+export const EVALUATION_PROMOTION_RECEIPT_SCHEMA = 'forge-evaluation-promotion-receipt/v1' as const;
+export const EVALUATION_PROMOTION_RECEIPT_AUTHORITY = 'evaluation_evidence_only' as const;
+export const EVALUATION_CANDIDATE_IDENTITY_SCHEMA = 'forge-candidate-identity/v1' as const;
+
+export interface EvaluationPromotionCandidateIdentity {
+  schemaVersion: typeof EVALUATION_CANDIDATE_IDENTITY_SCHEMA;
+  candidateId: string;
+  versionLabel: string;
+  artifactDigest: string;
+  sourceRevision?: string;
+  executionSurface: 'public_cli' | 'public_mcp';
+}
+
+export interface EvaluationPromotionReceipt {
+  schemaVersion: typeof EVALUATION_PROMOTION_RECEIPT_SCHEMA;
+  authority: typeof EVALUATION_PROMOTION_RECEIPT_AUTHORITY;
+  receiptId: string;
+  baseline: EvaluationPromotionCandidateIdentity;
+  candidate: EvaluationPromotionCandidateIdentity;
+  evidence: {
+    paired: {
+      protocolDigest: string;
+      environmentFingerprint: string;
+      pairCount: number;
+      evidenceDigest: string;
+    };
+    shadow: {
+      protocolDigest: string;
+      pairedScenarioCount: number;
+      evidenceDigest: string;
+    };
+    certification?: {
+      manifestDigest: string;
+    };
+  };
+}
+
+export type EvaluationPromotionReceiptCore = Omit<EvaluationPromotionReceipt, 'receiptId'>;
+
+function requiredText(value: unknown, field: string): string {
+  const normalized = typeof value === 'string' ? value.trim() : '';
+  if (!normalized) throw new Error(`EVALUATION_PROMOTION_RECEIPT_${field.toUpperCase()}_REQUIRED`);
+  return normalized;
+}
+
+function nonNegativeInteger(value: unknown, field: string): number {
+  if (!Number.isInteger(value) || Number(value) < 0) {
+    throw new Error(`EVALUATION_PROMOTION_RECEIPT_${field.toUpperCase()}_INVALID`);
+  }
+  return Number(value);
+}
+
+function candidateIdentity(value: unknown, field: 'baseline' | 'candidate'): EvaluationPromotionCandidateIdentity {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error(`EVALUATION_PROMOTION_RECEIPT_${field.toUpperCase()}_REQUIRED`);
+  }
+  const input = value as Record<string, unknown>;
+  if (input.schemaVersion !== EVALUATION_CANDIDATE_IDENTITY_SCHEMA) {
+    throw new Error(`EVALUATION_PROMOTION_RECEIPT_${field.toUpperCase()}_SCHEMA_INVALID`);
+  }
+  if (input.executionSurface !== 'public_cli' && input.executionSurface !== 'public_mcp') {
+    throw new Error(`EVALUATION_PROMOTION_RECEIPT_${field.toUpperCase()}_SURFACE_INVALID`);
+  }
+  const sourceRevision = typeof input.sourceRevision === 'string' && input.sourceRevision.trim()
+    ? input.sourceRevision.trim()
+    : undefined;
+  return {
+    schemaVersion: EVALUATION_CANDIDATE_IDENTITY_SCHEMA,
+    candidateId: requiredText(input.candidateId, `${field}_candidate_id`),
+    versionLabel: requiredText(input.versionLabel, `${field}_version_label`),
+    artifactDigest: requiredText(input.artifactDigest, `${field}_artifact_digest`),
+    ...(sourceRevision ? { sourceRevision } : {}),
+    executionSurface: input.executionSurface,
+  };
+}
+
+function receiptCore(value: unknown): EvaluationPromotionReceiptCore {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error('EVALUATION_PROMOTION_RECEIPT_INVALID');
+  }
+  const input = value as Record<string, unknown>;
+  if (input.schemaVersion !== EVALUATION_PROMOTION_RECEIPT_SCHEMA) {
+    throw new Error('EVALUATION_PROMOTION_RECEIPT_SCHEMA_INVALID');
+  }
+  if (input.authority !== EVALUATION_PROMOTION_RECEIPT_AUTHORITY) {
+    throw new Error('EVALUATION_PROMOTION_RECEIPT_AUTHORITY_INVALID');
+  }
+  if (!input.evidence || typeof input.evidence !== 'object' || Array.isArray(input.evidence)) {
+    throw new Error('EVALUATION_PROMOTION_RECEIPT_EVIDENCE_REQUIRED');
+  }
+  const evidence = input.evidence as Record<string, unknown>;
+  if (!evidence.paired || typeof evidence.paired !== 'object' || Array.isArray(evidence.paired)) {
+    throw new Error('EVALUATION_PROMOTION_RECEIPT_PAIRED_REQUIRED');
+  }
+  if (!evidence.shadow || typeof evidence.shadow !== 'object' || Array.isArray(evidence.shadow)) {
+    throw new Error('EVALUATION_PROMOTION_RECEIPT_SHADOW_REQUIRED');
+  }
+  const paired = evidence.paired as Record<string, unknown>;
+  const shadow = evidence.shadow as Record<string, unknown>;
+  let certification: EvaluationPromotionReceipt['evidence']['certification'];
+  if (evidence.certification !== undefined) {
+    if (!evidence.certification || typeof evidence.certification !== 'object' || Array.isArray(evidence.certification)) {
+      throw new Error('EVALUATION_PROMOTION_RECEIPT_CERTIFICATION_INVALID');
+    }
+    certification = {
+      manifestDigest: requiredText(
+        (evidence.certification as Record<string, unknown>).manifestDigest,
+        'certification_manifest_digest',
+      ),
+    };
+  }
+  return {
+    schemaVersion: EVALUATION_PROMOTION_RECEIPT_SCHEMA,
+    authority: EVALUATION_PROMOTION_RECEIPT_AUTHORITY,
+    baseline: candidateIdentity(input.baseline, 'baseline'),
+    candidate: candidateIdentity(input.candidate, 'candidate'),
+    evidence: {
+      paired: {
+        protocolDigest: requiredText(paired.protocolDigest, 'paired_protocol_digest'),
+        environmentFingerprint: requiredText(paired.environmentFingerprint, 'paired_environment_fingerprint'),
+        pairCount: nonNegativeInteger(paired.pairCount, 'paired_pair_count'),
+        evidenceDigest: requiredText(paired.evidenceDigest, 'paired_evidence_digest'),
+      },
+      shadow: {
+        protocolDigest: requiredText(shadow.protocolDigest, 'shadow_protocol_digest'),
+        pairedScenarioCount: nonNegativeInteger(shadow.pairedScenarioCount, 'shadow_paired_scenario_count'),
+        evidenceDigest: requiredText(shadow.evidenceDigest, 'shadow_evidence_digest'),
+      },
+      ...(certification ? { certification } : {}),
+    },
+  };
+}
+
+function receiptIdentity(core: EvaluationPromotionReceiptCore): string {
+  const digest = createHash('sha256')
+    .update(EVALUATION_PROMOTION_RECEIPT_SCHEMA)
+    .update('\0')
+    .update(JSON.stringify(core))
+    .digest('hex');
+  return `evaluation-promotion:sha256:${digest}`;
+}
+
+function deepFreeze<T>(value: T): T {
+  if (value && typeof value === 'object' && !Object.isFrozen(value)) {
+    for (const nested of Object.values(value as Record<string, unknown>)) deepFreeze(nested);
+    Object.freeze(value);
+  }
+  return value;
+}
+
+/**
+ * Identity constructor only. Eligibility authority remains in evaluation/.
+ * Callers outside the evaluator must not treat this helper as proof that A/B,
+ * shadow, or certification gates ran.
+ */
+export function buildEvaluationPromotionReceipt(coreInput: EvaluationPromotionReceiptCore): EvaluationPromotionReceipt {
+  const core = receiptCore(coreInput);
+  return deepFreeze({ ...core, receiptId: receiptIdentity(core) });
+}
+
+export function validateEvaluationPromotionReceipt(value: unknown): EvaluationPromotionReceipt {
+  const core = receiptCore(value);
+  const receiptId = requiredText((value as Record<string, unknown>).receiptId, 'receipt_id');
+  const expected = receiptIdentity(core);
+  if (receiptId !== expected) throw new Error('EVALUATION_PROMOTION_RECEIPT_ID_INVALID');
+  return deepFreeze({ ...core, receiptId });
+}
+
+export function evaluationPromotionReceiptArchitectureEvidence(
+  value: unknown,
+  expectedSourceRevision: string,
+): WorkImplementationReviewEvidenceIdentity {
+  const receipt = validateEvaluationPromotionReceipt(value);
+  const sourceRevision = receipt.candidate.sourceRevision?.trim() ?? '';
+  const expected = expectedSourceRevision.trim();
+  if (!expected || !sourceRevision || sourceRevision !== expected) {
+    throw new Error(`EVALUATION_PROMOTION_RECEIPT_CANDIDATE_SOURCE_MISMATCH: expected=${expected || 'missing'} actual=${sourceRevision || 'missing'}`);
+  }
+  return {
+    evidenceId: receipt.receiptId,
+    digest: receipt.receiptId.slice('evaluation-promotion:'.length),
+  };
+}

package/packages/kernel/work/domain/execution-concurrency.ts

@@ -3,7 +3,6 @@ import type { WorkContract } from './types';
 
 export type WorkExecutionLane = 'read' | 'review' | 'isolated_write' | 'integration_write' | 'external_effect';
 export type WorkExecutionIsolation = 'shared' | 'isolated';
-export type WorkExecutionControllerRole = 'mutable_owner' | 'reviewer';
 export type WorkExecutionResourceMode = 'read' | 'write' | 'exclusive';
 
 export interface WorkExecutionResourceIntent {
@@ -14,13 +13,11 @@ export interface WorkExecutionResourceIntent {
 export type WorkExecutionWakeTrigger =
   | { kind: 'work_terminal'; workId: string }
   | { kind: 'resource_release'; resourceKeys: string[] }
-  | { kind: 'controller_release'; workId: string }
   | { kind: 'scheduler_capacity'; capacityKey: string }
   | { kind: 'work_contract_change'; workId: string };
 
 export interface WorkExecutionConcurrencyBlocker {
   code:
-    | 'reviewer_mutation_forbidden'
     | 'same_semantic_scope_mutation'
     | 'shared_mutation_lane_conflict'
     | 'integration_target_conflict'
@@ -44,7 +41,6 @@ export interface WorkExecutionConcurrencyContract {
   resourceIntents: WorkExecutionResourceIntent[];
   blockers: WorkExecutionConcurrencyBlocker[];
   isolation: WorkExecutionIsolation;
-  controllerRole: WorkExecutionControllerRole;
 }
 
 export interface WorkExecutionConcurrencyInput {
@@ -81,7 +77,7 @@ function fallbackMutationClass(work: WorkContract): EngineeringMutationClass {
     || work.workKind === 'reconciliation'
     || work.workKind === 'superseded') return 'readonly';
   if (work.workKind === 'local_effect' || work.workKind === 'remote_effect') return 'external_effect';
-  if (work.worktreePolicy.required || work.constraints.workspaceMode === 'isolated' || work.constraints.requireWorktree === true) {
+  if (work.worktreePolicy.required || work.constraints.workspaceMode === 'isolated') {
     return 'isolated_write';
   }
   return 'integration_write';
@@ -94,7 +90,20 @@ function semanticScopeKeys(work: WorkContract): string[] {
   return [`work:${work.workId}`];
 }
 
-function defaultLane(work: WorkContract, mutationClass: EngineeringMutationClass): WorkExecutionLane {
+function defaultLane(
+  work: WorkContract,
+  mutationClass: EngineeringMutationClass,
+  resourceIntents: readonly WorkExecutionResourceIntent[],
+  requestedLane?: WorkExecutionLane,
+): WorkExecutionLane {
+  const hasMutableResourceIntent = resourceIntents.some((intent) => intent.mode !== 'read');
+  if (hasMutableResourceIntent && (!requestedLane || !workExecutionLaneMutates(requestedLane))) {
+    if (mutationClass === 'external_effect') return 'external_effect';
+    return work.worktreePolicy.required || work.constraints.workspaceMode === 'isolated'
+      ? 'isolated_write'
+      : 'integration_write';
+  }
+  if (requestedLane) return requestedLane;
   if (work.workKind === 'read_only_review') return 'review';
   if (mutationClass === 'readonly') return 'read';
   return mutationClass;
@@ -105,6 +114,7 @@ export function buildWorkExecutionConcurrencyContract(
   input: WorkExecutionConcurrencyInput = {},
 ): WorkExecutionConcurrencyContract {
   const mutationClass = work.engineeringContext?.semanticScope?.mutationClass ?? fallbackMutationClass(work);
+  const resourceIntents = normalizedResourceIntents(input.resourceIntents ?? []);
   return {
     schemaVersion: 1,
     workId: work.workId,
@@ -112,13 +122,12 @@ export function buildWorkExecutionConcurrencyContract(
     observedWorkUpdatedAt: work.updatedAt,
     semanticScopeKeys: semanticScopeKeys(work),
     mutationClass,
-    lane: input.lane ?? defaultLane(work, mutationClass),
-    resourceIntents: normalizedResourceIntents(input.resourceIntents ?? []),
+    lane: defaultLane(work, mutationClass, resourceIntents, input.lane),
+    resourceIntents,
     blockers: [...(input.blockers ?? [])],
-    isolation: work.worktreePolicy.required || work.constraints.workspaceMode === 'isolated' || work.constraints.requireWorktree === true
+    isolation: work.worktreePolicy.required || work.constraints.workspaceMode === 'isolated'
       ? 'isolated'
       : 'shared',
-    controllerRole: work.workKind === 'read_only_review' ? 'reviewer' : 'mutable_owner',
   };
 }
 
@@ -145,25 +154,11 @@ function sharedMutableResourceKeys(
   return mutableResourceKeys(left).filter((key) => rightKeys.has(key));
 }
 
-function invalidReviewerBlocker(contract: WorkExecutionConcurrencyContract): WorkExecutionConcurrencyBlocker | undefined {
-  if (contract.controllerRole !== 'reviewer'
-    || (!workExecutionLaneMutates(contract.lane) && mutableResourceKeys(contract).length === 0)) return undefined;
-  return {
-    code: 'reviewer_mutation_forbidden',
-    disposition: 'invalid',
-    semanticScopeKeys: contract.semanticScopeKeys,
-    resourceKeys: mutableResourceKeys(contract),
-    wakeTrigger: { kind: 'work_contract_change', workId: contract.workId },
-  };
-}
-
 export function evaluateWorkExecutionCompatibility(
   candidate: WorkExecutionConcurrencyContract,
   active: readonly WorkExecutionConcurrencyContract[],
 ): WorkExecutionCompatibilityDecision {
   const blockers: WorkExecutionConcurrencyBlocker[] = [];
-  const reviewerBlocker = invalidReviewerBlocker(candidate);
-  if (reviewerBlocker) blockers.push(reviewerBlocker);
   if (candidate.lane === 'external_effect' && mutableResourceKeys(candidate).length === 0) {
     blockers.push({
       code: 'external_effect_target_unknown',
@@ -178,8 +173,6 @@ export function evaluateWorkExecutionCompatibility(
 
   for (const current of active) {
     if (current.workId === candidate.workId) continue;
-    const currentReviewerBlocker = invalidReviewerBlocker(current);
-    if (currentReviewerBlocker) continue;
     if (!workExecutionLaneMutates(current.lane)) continue;
 
     const overlap = scopesOverlap(candidate, current);

package/packages/kernel/work/domain/execution-snapshot.ts

@@ -1,33 +1,2 @@
 /** Immutable access-policy value captured by a Work contract. */
 export type WorkAccessMode = 'request' | 'full_access';
-
-export type WorkRouteExecutionMode = 'direct_control' | 'goal_workloop' | 'handoff_only';
-export type WorkRouteMode = 'direct_edit' | 'bounded_work' | 'quick_agent' | 'issue_task';
-export type WorkRouteExecutionPath = 'fast' | 'durable';
-export type WorkRouteExecutorKind = 'direct_edit' | 'local_cli' | 'remote_api' | 'cloud_agent' | 'external_controller' | 'handoff_only';
-export type WorkRouteApprovalState = 'approval_not_required' | 'normal_authorization_required' | 'strong_confirmation_required' | 'blocked_by_policy';
-
-export interface WorkRouteReason {
-  code: string;
-  message: string;
-}
-
-/** Persistence-safe snapshot of a routing decision. The routing engine remains outside Kernel. */
-export interface WorkRouteDecisionSnapshot {
-  executionMode: WorkRouteExecutionMode;
-  executorKind: WorkRouteExecutorKind;
-  selectedProviderId: string | null;
-  workMode: WorkRouteMode;
-  executionPath: WorkRouteExecutionPath;
-  requiresWork: boolean;
-  requiresApproval: boolean;
-  requiresIsolation: boolean;
-  requiresRecovery: boolean;
-  createHandoff: boolean;
-  waitForUser: boolean;
-  approvalState: WorkRouteApprovalState;
-  alternatives: string[];
-  reasons: WorkRouteReason[];
-  inputFingerprint: string;
-  policyVersion: string;
-}