@moretea-labs/forge 1.8.0 → 1.8.2

package/packages/kernel/work/domain/implementation-review.ts

@@ -21,9 +21,9 @@ export interface WorkImplementationReviewEvidenceIdentity {
 }
 
 /**
- * Durable Controller review authority for one exact Work delivery candidate.
- * Historical records are immutable. The latest exact source-bound record is the
- * only current review authority; a gateway string or passing check is never one.
+ * Historical implementation-review evidence captured before the Thin cutover.
+ * Records remain immutable/readable for audit, but never authorize or block
+ * execution, Git delivery, checks, or semantic Work completion.
  */
 export interface WorkImplementationReviewRecord {
   schemaVersion: 1;
@@ -50,104 +50,17 @@ export interface WorkImplementationReviewRecord {
   derivation?: 'content_equivalent_commit';
 }
 
-export interface ImplementationReviewVerificationReceipt {
-  receiptId: string;
-  resultDigest: string;
-  repoId: string;
-  workId?: string;
-  checkId: string;
-  status: string;
-  runtimeStatus: string;
-  ok: boolean;
-  timedOut: boolean;
-  cancelled: boolean;
-}
-
-export interface ImplementationReviewVerificationRecord {
-  checkId: string;
-  outcome: string;
-  recordedAt: string;
-  sourceRevision?: string;
-  workspaceFingerprint?: string;
-  resultArtifactId?: string;
-  verificationInputFingerprint?: string;
-  receipt?: ImplementationReviewVerificationReceipt;
-}
-
-/**
- * Return the exact current verification receipt identities required by review.
- * Legacy/weak pass text is intentionally insufficient: every declared check
- * must have a current Work-bound successful Process receipt.
- */
-export function authoritativeImplementationReviewVerificationEvidence(input: {
-  repoId: string;
-  workId: string;
-  requiredCheckIds: readonly string[];
-  records: readonly ImplementationReviewVerificationRecord[];
-  sourceRevision: string;
-  workspaceFingerprint: string;
-}): { evidence: WorkImplementationReviewEvidenceIdentity[]; missingCheckIds: string[] } {
-  const evidence: WorkImplementationReviewEvidenceIdentity[] = [];
-  const missingCheckIds: string[] = [];
-  for (const checkId of normalizedStrings(input.requiredCheckIds)) {
-    // Work checkRefs are durable newest-first history. Select the newest exact
-    // source/input record regardless of outcome; a newer fail/infrastructure
-    // result must invalidate an older pass rather than being filtered away.
-    const current = input.records.find((record) =>
-      record.checkId === checkId
-      && record.sourceRevision === input.sourceRevision
-      && record.workspaceFingerprint === input.workspaceFingerprint);
-    const receipt = current?.receipt;
-    const authoritativePass = Boolean(
-      current?.outcome === 'valid_pass'
-      && receipt
-      && receipt.repoId === input.repoId
-      && receipt.workId === input.workId
-      && receipt.checkId === checkId
-      && receipt.ok === true
-      && receipt.timedOut === false
-      && receipt.cancelled === false
-      && receipt.status === 'passed'
-      && receipt.runtimeStatus === 'succeeded',
-    );
-    const evidenceId = authoritativePass ? receipt!.receiptId : undefined;
-    const digest = authoritativePass ? receipt!.resultDigest : undefined;
-    if (!evidenceId?.trim() || !digest?.trim()) missingCheckIds.push(checkId);
-    else evidence.push({ evidenceId: evidenceId.trim(), digest: digest.trim() });
-  }
-  return { evidence: normalizeImplementationReviewEvidence(evidence), missingCheckIds };
-}
-
-export interface ImplementationReviewCandidateIdentity {
-  sourceRevision: string;
-  /** Stage-insensitive identity of the exact reviewed filesystem content. */
-  workspaceFingerprint: string;
-  /** Existing verification-input identity; may change when Git representation changes. */
-  verificationWorkspaceFingerprint: string;
-  changedPaths: readonly string[];
-  verificationEvidence: readonly WorkImplementationReviewEvidenceIdentity[];
-  architectureEvidence?: readonly WorkImplementationReviewEvidenceIdentity[];
-}
-
-export type ImplementationReviewGateCode =
-  | 'WORK_IMPLEMENTATION_REVIEW_REQUIRED'
-  | 'WORK_IMPLEMENTATION_REVIEW_STALE'
-  | 'WORK_IMPLEMENTATION_REVIEW_CHANGES_REQUIRED'
-  | 'WORK_IMPLEMENTATION_REVIEW_BLOCKED';
-
-export interface ImplementationReviewGateResult {
-  required: boolean;
-  approved: boolean;
-  code?: ImplementationReviewGateCode;
-  reason: string;
-  review?: WorkImplementationReviewRecord;
-}
-
 function normalizedStrings(values: readonly string[]): string[] {
   return [...new Set(values.map((value) => value.trim()).filter(Boolean))]
     .sort((left, right) => left.localeCompare(right));
 }
 
+function sameStringSet(left: readonly string[], right: readonly string[]): boolean {
+  const a = normalizedStrings(left);
+  const b = normalizedStrings(right);
+  return a.length === b.length && a.every((value, index) => value === b[index]);
+}
+
 export function normalizeImplementationReviewEvidence(
   values: readonly WorkImplementationReviewEvidenceIdentity[],
 ): WorkImplementationReviewEvidenceIdentity[] {
@@ -203,21 +116,12 @@ export function latestImplementationReview(
 }
 
 /**
- * Work-kind gate. Source-free effect/investigation/reconciliation Work may skip
- * code review only while they truly have no repository source delta.
+ * Candidate review gate. Low engineering-risk delivery relies on exact durable
+ * completion evidence and may skip a separate Controller review round; normal,
+ * high, and critical repository candidates retain the exact review authority.
+ * Source-free effect/investigation/reconciliation Work may also skip review only
+ * while they truly have no repository source delta.
  */
-export function workRequiresImplementationReview(workKind: string, changedPaths: readonly string[]): boolean {
-  if (workKind === 'read_only_review' || workKind === 'superseded') return false;
-  if (workKind === 'repository_change' || workKind === 'completed_no_change') return true;
-  return normalizeImplementationReviewChangedPaths(changedPaths).length > 0;
-}
-
-function sameStringSet(left: readonly string[], right: readonly string[]): boolean {
-  const a = normalizedStrings(left);
-  const b = normalizedStrings(right);
-  return a.length === b.length && a.every((value, index) => value === b[index]);
-}
-
 export function validateImplementationReviewRecord(review: WorkImplementationReviewRecord): void {
   if (!review.reviewId.trim() || !review.workId.trim() || !review.reviewerPrincipalId.trim() || !review.recordedAt.trim()) {
     throw new Error('WORK_IMPLEMENTATION_REVIEW_IDENTITY_REQUIRED');
@@ -264,108 +168,6 @@ export function validateImplementationReviewRecord(review: WorkImplementationRev
   }
 }
 
-/**
- * Evaluate current review authority without mutating history. Candidate identity
- * is checked before the decision so negative records also become historical when
- * source/evidence changes instead of remaining a permanent blocker.
- */
-export function evaluateImplementationReviewGate(input: {
-  workKind: string;
-  reviews?: readonly WorkImplementationReviewRecord[];
-  candidate: ImplementationReviewCandidateIdentity;
-}): ImplementationReviewGateResult {
-  const required = workRequiresImplementationReview(input.workKind, input.candidate.changedPaths);
-  if (!required) {
-    return { required: false, approved: true, reason: 'Implementation review is not required for this source-free Work candidate.' };
-  }
-
-  const review = latestImplementationReview(input.reviews);
-  if (!review) {
-    return {
-      required: true,
-      approved: false,
-      code: 'WORK_IMPLEMENTATION_REVIEW_REQUIRED',
-      reason: 'No durable implementation review exists for this Work delivery candidate.',
-    };
-  }
-
-  const staleReasons: string[] = [];
-  if (review.sourceRevision !== input.candidate.sourceRevision) staleReasons.push('source revision changed');
-  if (review.workspaceFingerprint !== input.candidate.workspaceFingerprint) staleReasons.push('workspace content fingerprint changed');
-  if (review.verificationWorkspaceFingerprint !== input.candidate.verificationWorkspaceFingerprint) staleReasons.push('verification workspace identity changed');
-  if (review.changedPathDigest !== implementationReviewChangedPathDigest(input.candidate.changedPaths)) staleReasons.push('changed-path identity changed');
-  if (!sameEvidenceIdentity(review.verificationEvidence, input.candidate.verificationEvidence)) staleReasons.push('verification evidence identity changed');
-  if (!sameEvidenceIdentity(review.architectureEvidence, input.candidate.architectureEvidence ?? [])) staleReasons.push('architecture evidence identity changed');
-  if (staleReasons.length > 0) {
-    return {
-      required: true,
-      approved: false,
-      code: 'WORK_IMPLEMENTATION_REVIEW_STALE',
-      reason: `Implementation review ${review.reviewId} is stale: ${staleReasons.join('; ')}.`,
-      review,
-    };
-  }
-
-  if (review.decision === 'changes_required') {
-    return {
-      required: true,
-      approved: false,
-      code: 'WORK_IMPLEMENTATION_REVIEW_CHANGES_REQUIRED',
-      reason: `Implementation review ${review.reviewId} requires changes before delivery.`,
-      review,
-    };
-  }
-  if (review.decision === 'blocked') {
-    return {
-      required: true,
-      approved: false,
-      code: 'WORK_IMPLEMENTATION_REVIEW_BLOCKED',
-      reason: `Implementation review ${review.reviewId} is blocked and cannot authorize delivery.`,
-      review,
-    };
-  }
-  return {
-    required: true,
-    approved: true,
-    reason: `Implementation review ${review.reviewId} approves the exact current delivery candidate.`,
-    review,
-  };
-}
-
-
-/**
- * Canonical semantic/physical pre-delivery gate. It re-selects the newest exact
- * Work-bound check records, so a later fail cannot hide behind review-time ids.
- */
-export function assertImplementationReviewPreDeliveryBoundary(input: {
-  repoId: string;
-  workId: string;
-  workKind: string;
-  reviews?: readonly WorkImplementationReviewRecord[];
-  candidate: ImplementationReviewCandidateIdentity;
-  requiredCheckIds: readonly string[];
-  verificationRecords: readonly ImplementationReviewVerificationRecord[];
-}): WorkImplementationReviewRecord | undefined {
-  const verification = authoritativeImplementationReviewVerificationEvidence({
-    repoId: input.repoId,
-    workId: input.workId,
-    requiredCheckIds: input.requiredCheckIds,
-    records: input.verificationRecords,
-    sourceRevision: input.candidate.sourceRevision,
-    workspaceFingerprint: input.candidate.verificationWorkspaceFingerprint,
-  });
-  if (verification.missingCheckIds.length > 0
-    || !sameEvidenceIdentity(verification.evidence, input.candidate.verificationEvidence)) {
-    throw new Error(`WORK_IMPLEMENTATION_REVIEW_VERIFICATION_REQUIRED: ${verification.missingCheckIds.join(', ')}`);
-  }
-  const gate = evaluateImplementationReviewGate({ workKind: input.workKind, reviews: input.reviews, candidate: input.candidate });
-  if (!gate.approved) throw new Error(`${gate.code ?? 'WORK_IMPLEMENTATION_REVIEW_REQUIRED'}: ${gate.reason}`);
-  if (gate.review && gate.review.workId !== input.workId) throw new Error('WORK_IMPLEMENTATION_REVIEW_WORK_MISMATCH');
-  return gate.review;
-}
-
-
-/** Existing review history is immutable and append-only even for internal Work transitions. */
 export function assertImplementationReviewHistoryAppendOnly(
   current: readonly WorkImplementationReviewRecord[] | undefined,
   next: readonly WorkImplementationReviewRecord[] | undefined,
@@ -389,122 +191,3 @@ export function assertImplementationReviewHistoryAppendOnly(
     }
   }
 }
-
-export function implementationReviewDecisionTarget(
-  decision: ImplementationReviewDecision,
-): { phase: 'implementation' | 'review' | 'delivery'; status: 'running' | 'blocked' } {
-  if (decision === 'approved') return { phase: 'delivery', status: 'running' };
-  if (decision === 'changes_required') return { phase: 'implementation', status: 'running' };
-  return { phase: 'review', status: 'blocked' };
-}
-
-export interface ContentEquivalentCommitTransferProof {
-  preCommitCandidate: ImplementationReviewCandidateIdentity;
-  postCommitCandidate: ImplementationReviewCandidateIdentity;
-  /** Exact dirty Work-owned path set Forge intended to materialize in this commit. */
-  preCommitDirtyPaths: readonly string[];
-  /** Exact path set actually changed by the resulting commit. */
-  committedPaths: readonly string[];
-  /** Digest over the complete reviewed Work changed-path content before/after commit. */
-  preCommitContentDigest: string;
-  postCommitContentDigest: string;
-  /** Exact post-commit verification authority. The derivation re-checks it; callers cannot self-certify with a boolean. */
-  postCommitVerificationAuthority: {
-    repoId: string;
-    workId: string;
-    requiredCheckIds: readonly string[];
-    records: readonly ImplementationReviewVerificationRecord[];
-  };
-}
-
-/**
- * Derive approval across a Forge-owned commit only. The caller must prove that
- * the commit changed representation, not reviewed Work content or scope.
- */
-export function deriveImplementationReviewAcrossCommit(input: {
-  workId: string;
-  reviews: readonly WorkImplementationReviewRecord[];
-  proof: ContentEquivalentCommitTransferProof;
-  derivedReviewId: string;
-  recordedAt: string;
-}): WorkImplementationReviewRecord {
-  const gate = evaluateImplementationReviewGate({
-    workKind: 'repository_change',
-    reviews: input.reviews,
-    candidate: input.proof.preCommitCandidate,
-  });
-  if (!gate.approved || !gate.review) {
-    throw new Error(`${gate.code ?? 'WORK_IMPLEMENTATION_REVIEW_REQUIRED'}: ${gate.reason}`);
-  }
-  if (gate.review.workId !== input.workId) {
-    throw new Error('WORK_IMPLEMENTATION_REVIEW_TRANSFER_WORK_MISMATCH');
-  }
-  const postVerification = authoritativeImplementationReviewVerificationEvidence({
-    repoId: input.proof.postCommitVerificationAuthority.repoId,
-    workId: input.proof.postCommitVerificationAuthority.workId,
-    requiredCheckIds: input.proof.postCommitVerificationAuthority.requiredCheckIds,
-    records: input.proof.postCommitVerificationAuthority.records,
-    sourceRevision: input.proof.postCommitCandidate.sourceRevision,
-    workspaceFingerprint: input.proof.postCommitCandidate.verificationWorkspaceFingerprint,
-  });
-  if (postVerification.missingCheckIds.length > 0
-    || !sameEvidenceIdentity(postVerification.evidence, input.proof.postCommitCandidate.verificationEvidence)) {
-    throw new Error('WORK_IMPLEMENTATION_REVIEW_TRANSFER_VERIFICATION_REQUIRED');
-  }
-  if (input.proof.postCommitVerificationAuthority.workId !== input.workId) {
-    throw new Error('WORK_IMPLEMENTATION_REVIEW_TRANSFER_WORK_MISMATCH');
-  }
-  if (!input.proof.preCommitContentDigest.trim() || !input.proof.postCommitContentDigest.trim()) {
-    throw new Error('WORK_IMPLEMENTATION_REVIEW_TRANSFER_CONTENT_IDENTITY_REQUIRED');
-  }
-  if (input.proof.preCommitContentDigest !== input.proof.preCommitCandidate.workspaceFingerprint
-    || input.proof.postCommitContentDigest !== input.proof.postCommitCandidate.workspaceFingerprint) {
-    throw new Error('WORK_IMPLEMENTATION_REVIEW_TRANSFER_CONTENT_IDENTITY_MISMATCH');
-  }
-  if (input.proof.preCommitContentDigest !== input.proof.postCommitContentDigest) {
-    throw new Error('WORK_IMPLEMENTATION_REVIEW_TRANSFER_CONTENT_CHANGED');
-  }
-
-  const reviewedPaths = normalizeImplementationReviewChangedPaths(gate.review.changedPaths);
-  const postPaths = normalizeImplementationReviewChangedPaths(input.proof.postCommitCandidate.changedPaths);
-  const dirtyPaths = normalizeImplementationReviewChangedPaths(input.proof.preCommitDirtyPaths);
-  const committedPaths = normalizeImplementationReviewChangedPaths(input.proof.committedPaths);
-  if (!sameStringSet(reviewedPaths, postPaths)) {
-    throw new Error('WORK_IMPLEMENTATION_REVIEW_TRANSFER_CHANGED_PATHS_MISMATCH');
-  }
-  if (!sameEvidenceIdentity(gate.review.architectureEvidence, input.proof.postCommitCandidate.architectureEvidence ?? [])) {
-    // A representation-only commit may transfer existing architecture review
-    // evidence, but it cannot add/drop architecture evidence without a new review.
-    throw new Error('WORK_IMPLEMENTATION_REVIEW_TRANSFER_ARCHITECTURE_EVIDENCE_CHANGED');
-  }
-  const reviewedSet = new Set(reviewedPaths);
-  const dirtyOutsideReview = dirtyPaths.filter((path) => !reviewedSet.has(path));
-  if (dirtyOutsideReview.length > 0) {
-    throw new Error(`WORK_IMPLEMENTATION_REVIEW_TRANSFER_UNREVIEWED_DIRTY_PATH: ${dirtyOutsideReview.join(', ')}`);
-  }
-  // A controlled representation-only commit must materialize the complete
-  // reviewed changed-path set. Allowing a caller-supplied dirty subset would
-  // leave reviewed content in the workspace while moving sourceRevision,
-  // creating a mixed committed/dirty candidate that the original approval did
-  // not authorize.
-  if (!sameStringSet(dirtyPaths, reviewedPaths) || !sameStringSet(committedPaths, reviewedPaths)) {
-    throw new Error('WORK_IMPLEMENTATION_REVIEW_TRANSFER_COMMIT_SCOPE_MISMATCH');
-  }
-
-  const derived: WorkImplementationReviewRecord = {
-    ...gate.review,
-    reviewId: input.derivedReviewId,
-    sourceRevision: input.proof.postCommitCandidate.sourceRevision,
-    workspaceFingerprint: input.proof.postCommitCandidate.workspaceFingerprint,
-    verificationWorkspaceFingerprint: input.proof.postCommitCandidate.verificationWorkspaceFingerprint,
-    changedPaths: postPaths,
-    changedPathDigest: implementationReviewChangedPathDigest(postPaths),
-    verificationEvidence: normalizeImplementationReviewEvidence(input.proof.postCommitCandidate.verificationEvidence),
-    architectureEvidence: normalizeImplementationReviewEvidence(input.proof.postCommitCandidate.architectureEvidence ?? []),
-    recordedAt: input.recordedAt,
-    derivedFromReviewId: gate.review.reviewId,
-    derivation: 'content_equivalent_commit',
-  };
-  validateImplementationReviewRecord(derived);
-  return derived;
-}

package/packages/kernel/work/domain/objective-graph.ts

@@ -0,0 +1,119 @@
+import type { WorkContract, WorkSemanticView } from './types';
+
+export const MAX_WORK_OBJECTIVE_RELATIONS = 32;
+export const MAX_WORK_OBJECTIVE_GRAPH_NODES = 100;
+export const MAX_WORK_OBJECTIVE_GRAPH_HISTORY_NODES = 200;
+
+export function normalizeWorkObjectiveRelationIds(ids: readonly string[] | undefined): string[] {
+  return [...new Set((ids ?? []).map((id) => id.trim()).filter(Boolean))].sort();
+}
+
+export function validateWorkObjectiveRelationShape(
+  work: Pick<WorkContract, 'workId' | 'lifecycleRole' | 'semanticParentWorkId' | 'dependsOnWorkIds'>,
+): void {
+  const workId = work.workId.trim();
+  const semanticParentWorkId = work.semanticParentWorkId?.trim();
+  const dependsOnWorkIds = normalizeWorkObjectiveRelationIds(work.dependsOnWorkIds);
+  if ((semanticParentWorkId || dependsOnWorkIds.length > 0) && (work.lifecycleRole ?? 'primary') !== 'primary') {
+    throw new Error('WORK_OBJECTIVE_RELATION_PRIMARY_REQUIRED');
+  }
+  if (semanticParentWorkId === workId) throw new Error('WORK_SEMANTIC_PARENT_SELF_REFERENCE');
+  if (dependsOnWorkIds.includes(workId)) throw new Error('WORK_DEPENDENCY_SELF_REFERENCE');
+  if (dependsOnWorkIds.length > MAX_WORK_OBJECTIVE_RELATIONS) throw new Error('WORK_DEPENDENCY_LIMIT_EXCEEDED');
+}
+
+export interface WorkObjectiveGraphEdge {
+  kind: 'decomposition' | 'dependency';
+  fromWorkId: string;
+  toWorkId: string;
+  workRevision: number;
+}
+
+export interface WorkObjectiveGraphProjection {
+  schemaVersion: 1;
+  rootWorkId?: string;
+  current: {
+    nodes: WorkSemanticView[];
+    edges: WorkObjectiveGraphEdge[];
+    truncated: boolean;
+  };
+  history: {
+    nodes: WorkSemanticView[];
+    edges: WorkObjectiveGraphEdge[];
+    truncated: boolean;
+  };
+}
+
+function relationEdges(view: WorkSemanticView): WorkObjectiveGraphEdge[] {
+  const edges: WorkObjectiveGraphEdge[] = [];
+  const parent = view.semanticParentWorkId?.trim();
+  if (parent) edges.push({ kind: 'decomposition', fromWorkId: parent, toWorkId: view.workId, workRevision: view.revision });
+  for (const dependency of normalizeWorkObjectiveRelationIds(view.dependsOnWorkIds)) {
+    edges.push({ kind: 'dependency', fromWorkId: dependency, toWorkId: view.workId, workRevision: view.revision });
+  }
+  return edges;
+}
+
+function connectedCurrentIds(current: readonly WorkSemanticView[], rootWorkId?: string): { ids: Set<string>; truncated: boolean } {
+  const byId = new Map(current.map((view) => [view.workId, view] as const));
+  if (!rootWorkId?.trim()) {
+    const ids = new Set([...byId.keys()].sort().slice(0, MAX_WORK_OBJECTIVE_GRAPH_NODES));
+    return { ids, truncated: byId.size > ids.size };
+  }
+  const root = rootWorkId.trim();
+  if (!byId.has(root)) return { ids: new Set(), truncated: false };
+  const adjacency = new Map<string, Set<string>>();
+  const link = (left: string, right: string) => {
+    if (!byId.has(left) || !byId.has(right)) return;
+    const leftSet = adjacency.get(left) ?? new Set<string>();
+    const rightSet = adjacency.get(right) ?? new Set<string>();
+    leftSet.add(right);
+    rightSet.add(left);
+    adjacency.set(left, leftSet);
+    adjacency.set(right, rightSet);
+  };
+  for (const view of current) {
+    const parent = view.semanticParentWorkId?.trim();
+    if (parent) link(parent, view.workId);
+    for (const dependency of normalizeWorkObjectiveRelationIds(view.dependsOnWorkIds)) link(dependency, view.workId);
+  }
+  const ids = new Set<string>();
+  const queue = [root];
+  while (queue.length > 0 && ids.size < MAX_WORK_OBJECTIVE_GRAPH_NODES) {
+    const workId = queue.shift()!;
+    if (ids.has(workId)) continue;
+    ids.add(workId);
+    for (const adjacent of [...(adjacency.get(workId) ?? [])].sort()) {
+      if (!ids.has(adjacent)) queue.push(adjacent);
+    }
+  }
+  return { ids, truncated: queue.some((workId) => !ids.has(workId)) };
+}
+
+export function projectWorkObjectiveGraph(
+  currentViews: readonly WorkSemanticView[],
+  historyViews: readonly WorkSemanticView[] = [],
+  rootWorkId?: string,
+): WorkObjectiveGraphProjection {
+  const currentById = new Map(currentViews.map((view) => [view.workId, view] as const));
+  const connected = connectedCurrentIds(currentViews, rootWorkId);
+  const currentNodes = [...connected.ids]
+    .map((workId) => currentById.get(workId))
+    .filter((view): view is WorkSemanticView => Boolean(view))
+    .sort((left, right) => left.workId.localeCompare(right.workId));
+  const currentEdges = currentNodes.flatMap(relationEdges)
+    .filter((edge) => connected.ids.has(edge.fromWorkId) && connected.ids.has(edge.toWorkId))
+    .sort((left, right) => `${left.kind}:${left.fromWorkId}:${left.toWorkId}`.localeCompare(`${right.kind}:${right.fromWorkId}:${right.toWorkId}`));
+  const allHistory = historyViews
+    .filter((view) => connected.ids.has(view.workId))
+    .sort((left, right) => left.workId.localeCompare(right.workId) || right.revision - left.revision);
+  const historyNodes = allHistory.slice(0, MAX_WORK_OBJECTIVE_GRAPH_HISTORY_NODES);
+  const historyEdges = historyNodes.flatMap(relationEdges)
+    .filter((edge) => connected.ids.has(edge.fromWorkId) && connected.ids.has(edge.toWorkId));
+  return {
+    schemaVersion: 1,
+    ...(rootWorkId?.trim() ? { rootWorkId: rootWorkId.trim() } : {}),
+    current: { nodes: currentNodes, edges: currentEdges, truncated: connected.truncated },
+    history: { nodes: historyNodes, edges: historyEdges, truncated: allHistory.length > historyNodes.length },
+  };
+}

package/packages/kernel/work/domain/project-engineering-contract.ts

@@ -22,6 +22,12 @@ export interface ProjectEngineeringContractToolingRequirement {
   requiredFor?: EngineeringRiskClass[];
 }
 
+export interface ProjectEngineeringContractSkillBinding {
+  id: string;
+  version?: string;
+  kinds: string[];
+}
+
 export interface ProjectEngineeringContractException {
   id: string;
   scope: string;
@@ -87,6 +93,7 @@ export interface ProjectEngineeringContract {
   platforms?: string[];
   tooling?: ProjectEngineeringContractToolingRequirement[];
   skillRefs?: string[];
+  skillBindings?: ProjectEngineeringContractSkillBinding[];
   exceptions?: ProjectEngineeringContractException[];
   knowledgeSources?: ProjectKnowledgeSource[];
 }
@@ -167,12 +174,26 @@ export function validateProjectEngineeringContract(value: unknown): ProjectEngin
     ...(item.purpose === undefined ? {} : { purpose: text(item.purpose, 'PROJECT_ENGINEERING_CONTRACT_TOOLING_PURPOSE_INVALID') }),
     ...(item.requiredFor === undefined ? {} : { requiredFor: riskClasses(item.requiredFor, 'PROJECT_ENGINEERING_CONTRACT_TOOLING_RISK_INVALID') }),
   }));
+  const skillBindings = root.skillBindings === undefined
+    ? []
+    : objectList(root.skillBindings, 'PROJECT_ENGINEERING_CONTRACT_SKILL_BINDINGS_INVALID').map((item) => {
+      const kinds = stringList(item.kinds, 'PROJECT_ENGINEERING_CONTRACT_SKILL_KINDS_INVALID')
+        .map((kind) => kind.toLowerCase());
+      if (kinds.length === 0 || new Set(kinds).size !== kinds.length) {
+        throw new Error('PROJECT_ENGINEERING_CONTRACT_SKILL_KINDS_INVALID');
+      }
+      return {
+        id: text(item.id, 'PROJECT_ENGINEERING_CONTRACT_SKILL_BINDING_ID_INVALID'),
+        ...(item.version === undefined ? {} : { version: text(item.version, 'PROJECT_ENGINEERING_CONTRACT_SKILL_BINDING_VERSION_INVALID') }),
+        kinds,
+      };
+    });
   const exceptions = root.exceptions === undefined ? [] : objectList(root.exceptions, 'PROJECT_ENGINEERING_CONTRACT_EXCEPTIONS_INVALID').map((item) => ({
     id: text(item.id, 'PROJECT_ENGINEERING_CONTRACT_EXCEPTION_ID_INVALID'),
     scope: text(item.scope, 'PROJECT_ENGINEERING_CONTRACT_EXCEPTION_SCOPE_INVALID'),
     rationale: text(item.rationale, 'PROJECT_ENGINEERING_CONTRACT_EXCEPTION_RATIONALE_INVALID'),
   }));
-  for (const [kind, items] of [['check', checks], ['journey', journeys], ['tooling', tooling], ['exception', exceptions]] as const) {
+  for (const [kind, items] of [['check', checks], ['journey', journeys], ['tooling', tooling], ['skill_binding', skillBindings], ['exception', exceptions]] as const) {
     const ids = items.map((item) => item.id);
     if (new Set(ids).size !== ids.length) throw new Error(`PROJECT_ENGINEERING_CONTRACT_${kind.toUpperCase()}_ID_DUPLICATE`);
   }
@@ -196,6 +217,7 @@ export function validateProjectEngineeringContract(value: unknown): ProjectEngin
     platforms: stringList(root.platforms, 'PROJECT_ENGINEERING_CONTRACT_PLATFORMS_INVALID'),
     tooling,
     skillRefs: stringList(root.skillRefs, 'PROJECT_ENGINEERING_CONTRACT_SKILLS_INVALID'),
+    skillBindings,
     exceptions,
     ...(root.knowledgeSources === undefined ? {} : { knowledgeSources: validateProjectKnowledgeSources(root.knowledgeSources) }),
   };

package/packages/kernel/work/domain/repository-completion-receipt.ts

@@ -55,7 +55,7 @@ export interface RepositoryCompletionReceipt {
   delivery: {
     kind: CompletionReceiptDeliveryKind;
     status: CompletionReceiptDeliveryStatus;
-    strategy: 'edit_session_commit' | 'already_integrated' | 'no_change' | 'remote';
+    strategy: 'edit_session_commit' | 'work_fast_forward' | 'work_merge_commit' | 'already_integrated' | 'no_change' | 'remote';
     reachable: boolean;
     recordedAt: string;
   };