@moretea-labs/forge 1.8.0 → 1.8.2

package/src/cli/local-bridge/server.ts

@@ -1,6 +1,5 @@
 import { randomBytes } from "crypto";
 import { readFileSync } from "fs";
-import { spawn } from "child_process";
 import { createServer, type Server } from "http";
 import express, {
   type NextFunction,
@@ -36,11 +35,6 @@ import {
 } from "../controller/issue-store";
 import { readTaskRunEvidence } from "../controller/run-evidence";
 import { resolveEffectiveTaskState } from "../controller/task-status-resolver";
-import {
-  getControllerTimeline,
-  getProjectProgress,
-  getTaskProgressDetail,
-} from "../controller/progress";
 import { buildControllerTaskLedgerProjection } from "../controller/task-ledger";
 import { buildControllerOperationalPlan } from "../controller/operational-plan";
 import { exportControllerWorklog, listControllerWorklogEvents, parseWorklogCategory } from "../controller/worklog";
@@ -73,8 +67,6 @@ import {
   rollbackEditSession,
   verifyEditSession,
 } from "../editing/edit-session";
-import { localBridgeDashboardHtml } from "./dashboard";
-import { readConsoleAsset, type ConsoleAssetName } from "./console-assets";
 import { applyConsoleAutomationAction, listConsoleAutomations, summarizeConsoleAutomations } from "./console-automations";
 import {
   ackConsoleHandoff,
@@ -89,21 +81,17 @@ import {
   getConsolePlugin,
   listConsolePlugins,
   toConsoleOperationFeedback,
-  continueConsoleWork,
   delegateConsoleWork,
   dismissConsoleHandoff,
-  finalizeConsoleWork,
   getConsoleHandoff,
   getConsoleWork,
   listConsoleHandoffs,
   listConsoleWork,
   mapRepositoryCard,
-  previewExecutionMode,
   repairConsole,
   resolveConsoleHandoff,
   setConsoleAccessPolicy,
   startConsoleWork,
-  stopConsoleWork,
   verifyConsoleWork,
 } from "./facade-api";
 import {
@@ -113,7 +101,7 @@ import {
   forgeToolSurfaceFingerprint,
   defaultLocalAgentRunners,
 } from "../controller/runtime-config";
-import { taskExecutionPolicy, taskWriteScopesConflict } from "../controller/execution-policy";
+import { taskWriteScopesConflict } from "../controller/execution-policy";
 import { continueTaskAfterSuccessfulRun } from "../controller/execution-completion";
 import { applyCompletionDecision, completionDecisionQueues, finishCompletionBacklog, inspectCompletionBacklog } from "../controller/completion-backlog";
 import { finishEditSession, finishTaskRun } from "../controller/completion-orchestrator";
@@ -158,7 +146,6 @@ export interface LocalBridgeServerOptions {
   defaultRepoId?: string;
   host?: string;
   port?: number;
-  openBrowser?: boolean;
   token?: string;
   allowLanMobileIntents?: boolean;
   mode?: "standalone" | "embedded" | "remote" | "disabled" | "unknown";
@@ -218,22 +205,6 @@ function cookieValue(request: Request, name: string): string | undefined {
   return undefined;
 }
 
-function openUrl(url: string): void {
-  const command =
-    process.platform === "darwin"
-      ? "open"
-      : process.platform === "win32"
-        ? "cmd"
-        : "xdg-open";
-  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
-  try {
-    const child = spawn(command, args, { detached: true, stdio: "ignore" });
-    child.unref();
-  } catch (_error) {
-    // The URL is still printed by the caller when a desktop opener is unavailable.
-  }
-}
-
 function errorMessage(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }
@@ -263,6 +234,15 @@ function legacyControlPlaneMutationRetiredPayload(): Record<string, unknown> {
   };
 }
 
+function legacyProgressProjectionRetiredPayload(): Record<string, unknown> {
+  return {
+    error: "LEGACY_PROGRESS_PROJECTION_RETIRED",
+    message: "Legacy Issue/Task progress projections were retired with the Local Bridge web UI. Use Requirement, Plan, Work and execution evidence APIs.",
+    authority: "controller-home-sqlite",
+    deprecated: true,
+  };
+}
+
 function queryString(value: unknown): string | undefined {
   return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }
@@ -545,8 +525,7 @@ export function buildLocalControllerSnapshot(repoRoot: string) {
     projectState: loadControllerProjectState(repoRoot),
     governance: inspectProjectGovernance(repoRoot),
     recovery,
-    progress: getProjectProgress(repoRoot),
-    timeline: getControllerTimeline(repoRoot, { limit: 40 }),
+    timeline: listControllerWorklogEvents(repoRoot, { limit: 40 }),
     githubPlugin: getGitHubPluginStatus(repoRoot),
     assistantPlugins,
     mobileIntents,
@@ -949,26 +928,6 @@ export async function startLocalBridgeServer(
     next();
   };
 
-  app.get("/console-assets/:asset", (request, response) => {
-    const asset = String(request.params.asset ?? "");
-    if (asset !== "app.js" && asset !== "app.css") { response.status(404).end(); return; }
-    response.setHeader("Cache-Control", "no-cache");
-    response.type(asset.endsWith(".css") ? "text/css" : "application/javascript");
-    response.send(readConsoleAsset(asset as ConsoleAssetName));
-  });
-
-  app.get("/", (_request, response) => {
-    response.setHeader("Cache-Control", "no-store, max-age=0");
-    response.setHeader("Pragma", "no-cache");
-    response.setHeader("Expires", "0");
-    response.setHeader("Referrer-Policy", "no-referrer");
-    response.setHeader(
-      "Set-Cookie",
-      `${cookieName}=${encodeURIComponent(token)}; Path=/api; HttpOnly; SameSite=Strict`,
-    );
-    response.setHeader("Content-Type", "text/html; charset=utf-8");
-    response.send(localBridgeDashboardHtml());
-  });
   app.get("/health", (_request, response) => {
     const exposure = controllerExposureSnapshot(mcpExposureContext);
     const fingerprint = exposure.fingerprint;
@@ -1242,15 +1201,15 @@ export async function startLocalBridgeServer(
           repositoryName: repository.displayName,
         })),
       ).sort((left, right) => right.updatedAt.localeCompare(left.updatedAt));
-      const statusOf = (item: (typeof items)[number]) => String(item.advanced?.status ?? "");
+      const stateOf = (item: (typeof items)[number]) => String(item.advanced?.state ?? "");
       response.json({
         schemaVersion: 1,
         generatedAt: new Date().toISOString(),
         summary: {
           total: items.length,
-          open: items.filter((item) => ["open", "running", "ready"].includes(statusOf(item))).length,
-          needsAttention: items.filter((item) => ["blocked", "failed"].includes(statusOf(item))).length,
-          completed: items.filter((item) => ["completed", "cancelled"].includes(statusOf(item))).length,
+          open: items.filter((item) => stateOf(item) === "open").length,
+          needsAttention: items.filter((item) => ["blocked", "failed", "needs_attention"].includes(item.phase)).length,
+          completed: items.filter((item) => ["completed", "cancelled"].includes(stateOf(item))).length,
         },
         repositories: repositories.map((repository) => ({ repoId: repository.repoId, repositoryName: repository.displayName })),
         items,
@@ -1388,28 +1347,6 @@ export async function startLocalBridgeServer(
     }
   });
 
-  app.post("/api/console/mode-preview", (request, response) => {
-    try {
-      const body = request.body && typeof request.body === "object" && !Array.isArray(request.body)
-        ? request.body as Record<string, unknown>
-        : {};
-      const modePreview = previewExecutionMode({
-        objective: queryString(body.objective) ?? "",
-        expectedFiles: typeof body.expectedFiles === "number" ? body.expectedFiles : undefined,
-        expectedChangedLines: typeof body.expectedChangedLines === "number" ? body.expectedChangedLines : undefined,
-        scopeClear: body.scopeClear !== false,
-        requiresInvestigation: body.requiresInvestigation === true,
-        requiresLongRunningChecks: body.requiresLongRunningChecks === true,
-        requiresWorker: body.requiresWorker === true,
-        requiresApproval: body.requiresApproval === true,
-        destructive: body.destructive === true,
-      });
-      response.json({ modePreview });
-    } catch (error) {
-      response.status(400).json({ error: errorMessage(error) });
-    }
-  });
-
   app.get("/api/console/inbox", (request, response) => {
     try {
       const status = queryString(request.query.status) === "all" ? "all"
@@ -1529,19 +1466,11 @@ export async function startLocalBridgeServer(
         acceptanceCriteria: Array.isArray(body.acceptanceCriteria) ? body.acceptanceCriteria.map(String) : undefined,
         allowedPaths: Array.isArray(body.allowedPaths) ? body.allowedPaths.map(String) : undefined,
         forbiddenPaths: Array.isArray(body.forbiddenPaths) ? body.forbiddenPaths.map(String) : undefined,
-        expectedFiles: typeof body.expectedFiles === "number" ? body.expectedFiles : undefined,
-        expectedChangedLines: typeof body.expectedChangedLines === "number" ? body.expectedChangedLines : undefined,
         scopeClear: body.scopeClear !== false,
-        requiresInvestigation: body.requiresInvestigation === true,
-        requiresLongRunningChecks: body.requiresLongRunningChecks === true,
-        requiresWorker: body.requiresWorker === true,
         requiresApproval: body.requiresApproval === true,
         destructive: body.destructive === true,
         accessMode: body.accessMode === 'full_access' ? 'full_access' : body.accessMode === 'request' ? 'request' : undefined,
         approvalConfirmed: body.approvalConfirmed === true,
-        forceMode: body.forceMode === "direct_control" || body.forceMode === "goal_workloop" || body.forceMode === "handoff_only"
-          ? body.forceMode
-          : undefined,
         checkIds: Array.isArray(body.checkIds) ? body.checkIds.map(String) : undefined,
       });
       const feedback = toConsoleOperationFeedback(result);
@@ -1560,18 +1489,6 @@ export async function startLocalBridgeServer(
     return { ...result, ...feedback, feedback };
   };
 
-  app.post("/api/console/work/continue", (request, response) => {
-    try {
-      const body = request.body && typeof request.body === "object" && !Array.isArray(request.body)
-        ? request.body as Record<string, unknown>
-        : {};
-      const result = continueConsoleWork(consoleCtx(request), queryString(body.workId) ?? "", queryString(body.note));
-      response.status(result.status === "not_found" ? 404 : result.status === "blocked" || result.status === "failed" ? 409 : 200).json(withFeedback(result));
-    } catch (error) {
-      response.status(400).json({ error: errorMessage(error) });
-    }
-  });
-
   app.post("/api/console/work/verify", async (request, response) => {
     try {
       const body = request.body && typeof request.body === "object" && !Array.isArray(request.body)
@@ -1590,30 +1507,6 @@ export async function startLocalBridgeServer(
     }
   });
 
-  app.post("/api/console/work/finalize", (request, response) => {
-    try {
-      const body = request.body && typeof request.body === "object" && !Array.isArray(request.body)
-        ? request.body as Record<string, unknown>
-        : {};
-      const result = finalizeConsoleWork(consoleCtx(request), queryString(body.workId) ?? "");
-      response.status(result.status === "not_found" ? 404 : result.status === "failed" || result.status === "blocked" ? 409 : 200).json(withFeedback(result));
-    } catch (error) {
-      response.status(400).json({ error: errorMessage(error) });
-    }
-  });
-
-  app.post("/api/console/work/stop", (request, response) => {
-    try {
-      const body = request.body && typeof request.body === "object" && !Array.isArray(request.body)
-        ? request.body as Record<string, unknown>
-        : {};
-      const result = stopConsoleWork(consoleCtx(request), queryString(body.workId) ?? "", queryString(body.reason));
-      response.status(result.status === "not_found" ? 404 : 200).json(withFeedback(result));
-    } catch (error) {
-      response.status(400).json({ error: errorMessage(error) });
-    }
-  });
-
   app.post("/api/console/work/delegate", (request, response) => {
     try {
       const body = request.body && typeof request.body === "object" && !Array.isArray(request.body)
@@ -1890,13 +1783,6 @@ export async function startLocalBridgeServer(
       response.status(400).json({ error: errorMessage(error) });
     }
   });
-  app.get("/api/progress", (request, response) => {
-    try {
-      response.json(getProjectProgress(requestRepositoryRoot(request, options, controllerHome)));
-    } catch (error) {
-      response.status(400).json({ error: errorMessage(error) });
-    }
-  });
   app.get("/api/governance", (request, response) => {
     try {
       response.json(inspectProjectGovernance(requestRepositoryRoot(request, options, controllerHome)));
@@ -2007,6 +1893,12 @@ export async function startLocalBridgeServer(
       response.status(400).json({ error: errorMessage(error) });
     }
   });
+  app.get("/api/progress", (_request, response) => {
+    response.status(410).json(legacyProgressProjectionRetiredPayload());
+  });
+  app.get("/api/issues/:issueId/tasks/:taskId", (_request, response) => {
+    response.status(410).json(legacyProgressProjectionRetiredPayload());
+  });
   app.patch("/api/project-state", (request, response) => {
     try {
       const body = request.body ?? {};
@@ -2093,7 +1985,6 @@ export async function startLocalBridgeServer(
         response.json(issue);
         return;
       }
-      const policy = taskExecutionPolicy(task);
       const confirmAcceptance = request.body?.confirmAcceptance === true;
       const reviewer = queryString(request.body?.reviewer) ?? "local-controller-human";
       const latestRunId = task.runIds.at(-1);
@@ -2140,8 +2031,8 @@ export async function startLocalBridgeServer(
           return { checkId, ok: false, summary: errorMessage(error) };
         }
       }));
-      if (policy.requiresAcceptanceEvidence && !confirmAcceptance) {
-        throw new Error(`${policy.executionClass} requires explicit acceptance evidence when no successful Run is linked`);
+      if (task.acceptanceCriteria.length > 0 && !confirmAcceptance) {
+        throw new Error('Explicit Task acceptance criteria require acceptance evidence when no successful Run is linked');
       }
       const at = new Date().toISOString();
       response.json(recordTaskVerification(repoRoot, issue.id, task.id, {
@@ -2278,7 +2169,7 @@ export async function startLocalBridgeServer(
   app.get("/api/timeline", (request, response) => {
     try {
       response.json({
-        events: getControllerTimeline(requestRepositoryRoot(request, options, controllerHome), {
+        events: listControllerWorklogEvents(requestRepositoryRoot(request, options, controllerHome), {
           category: parseWorklogCategory(queryString(request.query.category)),
           issueId: queryString(request.query.issueId),
           taskId: queryString(request.query.taskId),
@@ -2293,19 +2184,6 @@ export async function startLocalBridgeServer(
       response.status(400).json({ error: errorMessage(error) });
     }
   });
-  app.get("/api/issues/:issueId/tasks/:taskId", (request, response) => {
-    try {
-      response.json(
-        getTaskProgressDetail(
-          requestRepositoryRoot(request, options, controllerHome),
-          request.params.issueId,
-          request.params.taskId,
-        ),
-      );
-    } catch (error) {
-      response.status(404).json({ error: errorMessage(error) });
-    }
-  });
   app.post("/api/worklog/export", (request, response) => {
     try {
       response.json(
@@ -2703,7 +2581,6 @@ export async function startLocalBridgeServer(
   const port =
     typeof address === "object" && address ? address.port : requestedPort;
   const url = `http://${host === "::1" ? "[::1]" : host}:${port}/`;
-  if (options.openBrowser) openUrl(url);
   return {
     host,
     port,

package/src/cli/local-bridge/types.ts

@@ -167,7 +167,6 @@ export interface LocalBridgeConfig {
   version: 1;
   host?: string;
   port?: number;
-  autoOpen?: boolean;
   /** Allow only authenticated /mobile/intent requests on a wildcard/LAN bind. */
   allowLanMobileIntents?: boolean;
   approvals?: Partial<Record<LocalBridgeJobAction, LocalBridgeApproval>>;

package/src/cli/mcp/oauth-client-retirement.ts

@@ -0,0 +1,74 @@
+import {
+  mcpServiceOAuthTokenStoreFallbackPaths,
+  mcpServiceOAuthTokenStorePath,
+} from '../../../adapters/mcp/auth';
+import {
+  McpOAuthTokenStore,
+  type McpOAuthClientRetirementResult,
+} from '../../../adapters/mcp/oauth';
+import {
+  reconcilePluginCapabilityAuthorizations,
+  type ReconcilePluginCapabilityAuthorizationsResult,
+} from '../../runtime/plugins/capability-authorization-grants';
+
+export interface RetireMcpOAuthClientOptions {
+  now?: Date;
+}
+
+export interface RetireMcpOAuthClientResult {
+  clientId: string;
+  ownerScope: string;
+  oauth: McpOAuthClientRetirementResult;
+  capabilityAuthorizations: ReconcilePluginCapabilityAuthorizationsResult;
+  changed: boolean;
+}
+
+function requiredClientId(clientId: string): string {
+  const normalized = clientId.trim();
+  if (!normalized) throw new Error('MCP_OAUTH_CLIENT_ID_REQUIRED');
+  return normalized;
+}
+
+export function mcpOAuthClientOwnerScope(clientId: string): string {
+  return `mcp:oauth-client:${requiredClientId(clientId)}`;
+}
+
+/**
+ * Converge one retired MCP OAuth client across Forge's existing authorities.
+ *
+ * Ordering is deliberate and idempotent:
+ * 1. revoke credentials and remove the OAuth registration in the OAuth store;
+ * 2. once the client is absent from that authority, reclaim only its exact
+ *    capability-grant owner scope while compacting already-dead grants.
+ *
+ * This is ordered convergence across two atomic stores, not a fabricated
+ * cross-file transaction. A failure in step 2 can be retried safely: step 1
+ * becomes a no-op and the exact retired owner is reconciled on the next call.
+ */
+export function retireMcpOAuthClient(
+  controllerHome: string,
+  clientId: string,
+  options: RetireMcpOAuthClientOptions = {},
+): RetireMcpOAuthClientResult {
+  const normalizedClientId = requiredClientId(clientId);
+  const store = new McpOAuthTokenStore(
+    mcpServiceOAuthTokenStorePath(controllerHome),
+    mcpServiceOAuthTokenStoreFallbackPaths(controllerHome),
+  );
+  store.load();
+
+  const oauth = store.retireClient(normalizedClientId);
+  const ownerScope = mcpOAuthClientOwnerScope(normalizedClientId);
+  const capabilityAuthorizations = reconcilePluginCapabilityAuthorizations(controllerHome, {
+    retiredOwnerScopes: [ownerScope],
+    now: options.now,
+  });
+
+  return {
+    clientId: normalizedClientId,
+    ownerScope,
+    oauth,
+    capabilityAuthorizations,
+    changed: oauth.changed || capabilityAuthorizations.changed,
+  };
+}

package/src/cli/repositories/command-classifier.ts

@@ -255,11 +255,6 @@ function readOnlyGitSegment(words: string[], _segment: string): boolean {
   return isReadOnlyGitCommand(words);
 }
 
-function isReadOnlyCodegraphCommand(words: string[]): boolean {
-  const program = words[0]?.split(/[\\/]/).at(-1)?.toLowerCase();
-  return program === 'codegraph' && words[1]?.toLowerCase() === 'status';
-}
-
 function githubCliApiMethod(words: string[]): string | undefined {
   for (let index = 2; index < words.length; index += 1) {
     const word = words[index]?.toLowerCase();
@@ -315,7 +310,6 @@ function isReadOnlySegment(segment: string): boolean {
   const program = words[0]?.toLowerCase();
   if (!program) return false;
   if (program === 'git') return readOnlyGitSegment(words, segment);
-  if (isReadOnlyCodegraphCommand(words)) return true;
   if (program === 'curl') return isReadOnlyLoopbackCurl(words);
   if (program === 'sqlite3') return isSafeReadOnlySqliteSegment(segment);
   if (program === 'find') return !/(?:-delete|-exec|-execdir|-ok|-okdir)\b/.test(segment);
@@ -621,9 +615,6 @@ function classifyArgvCommand(
   if (program === 'git' && isReadOnlyGitCommand(argv)) {
     return { risk: 'readonly', confirmation: 'none', reasons: ['the argv command is a recognized repository-local read operation'] };
   }
-  if (isReadOnlyCodegraphCommand(argv)) {
-    return { risk: 'readonly', confirmation: 'none', reasons: ['CodeGraph status only observes the local semantic index'] };
-  }
   if (program === 'curl' && isReadOnlyLoopbackCurl(argv)) {
     return { risk: 'readonly', confirmation: 'none', reasons: ['curl performs a read-only loopback HTTP observation without writing response data to disk'] };
   }

package/src/cli/repositories/command-executor.ts

@@ -4,7 +4,7 @@ import { appendFileSync, existsSync, lstatSync, mkdirSync } from 'fs';
 import { dirname, join, relative, resolve } from 'path';
 import { capProcessOutput, redactProcessOutput } from '../../effects/process-runner';
 import { MAX_AGENT_TIMEOUT_MS, MIN_AGENT_TIMEOUT_MS } from '../controller/runtime-config';
-import { repositoryControllerRoot } from './controller-home';
+import { scopedOperationRoot } from './controller-home';
 import {
   classifyRepositoryCommand,
   type RepositoryCommandAuthorization,
@@ -13,6 +13,8 @@ import {
 import {
   assertCommandPathOperandsStayInRepository,
   assertRepositoryCommandInputAllowed,
+  commandExecutionScopeKey,
+  type RepositoryCommandScopeTarget,
   type RepositoryCommandExternalPathUsage,
   resolveRepositoryCommandCwd,
 } from './command-scope';
@@ -22,7 +24,7 @@ import type { RepositoryRecord } from './types';
 import { readRepositoryAccessPolicy } from '../../runtime/control-plane/governance/access-policy';
 import { invalidateRepositoryReadCaches } from '../repository/inspector';
 import { assertResolvedAuthorization, decideAuthorization, type AuthorizationDecision } from '../../runtime/control-plane/governance/authorization';
-import { assertRuntimeMayWriteOrThrow } from '../../runtime/root/write-fence';
+import { assertRuntimeMayWriteOrThrow, isRuntimeWriteFenceError } from '../../runtime/root/write-fence';
 import { commandEnvironment, runCanonicalCommand, type RepositoryCommandAsyncHooks, type SpawnCommandResult } from './command-process';
 import {
   changedSnapshotPaths,
@@ -77,11 +79,13 @@ export interface ExecuteRepositoryCommandInput {
   snapshotFingerprintTimeoutMs?: number;
 }
 
+export type { RepositoryCommandScopeTarget as RepositoryCommandExecutionTarget };
+
 
 export interface RepositoryCommandExecution {
   status: 'preview' | 'approval_required' | 'executed';
   repoId: string;
-  checkoutId: string;
+  checkoutId?: string;
   cwd: string;
   command: RepositoryCommandValue;
   classification: RepositoryCommandClassification;
@@ -170,7 +174,7 @@ function boundedSnapshotFingerprintPaths(
 }
 
 function approvalToken(
-  repository: RepositoryRecord,
+  repository: RepositoryCommandScopeTarget,
   relativeCwd: string,
   command: RepositoryCommandValue,
   classification: RepositoryCommandClassification,
@@ -179,7 +183,7 @@ function approvalToken(
 ): string {
   return createHash('sha256').update(JSON.stringify({
     version: 2,
-    repoId: repository.repoId,
+    repoId: commandExecutionScopeKey(repository),
     checkoutId: repository.activeCheckoutId,
     cwd: relativeCwd,
     command,
@@ -190,7 +194,7 @@ function approvalToken(
 }
 
 function finalizePreparedExecution(
-  repository: RepositoryRecord,
+  repository: RepositoryCommandScopeTarget,
   input: ExecuteRepositoryCommandInput,
   controllerHome: string | undefined,
   root: string,
@@ -213,7 +217,7 @@ function finalizePreparedExecution(
 } {
   const commandForPersistence = commandValue(command);
   const token = approvalToken(repository, relativeCwd, commandForPersistence, classification, before, externalPathUsages);
-  const permission = controllerHome ? readRepositoryAccessPolicy(controllerHome, repository.repoId) : undefined;
+  const permission = controllerHome ? readRepositoryAccessPolicy(controllerHome, commandExecutionScopeKey(repository)) : undefined;
   const isGit = command.kind === 'argv'
     ? command.executable?.split(/[\\/]/).at(-1)?.toLowerCase() === 'git'
     : /^\s*git\s+/i.test(command.shellCommand!);
@@ -226,8 +230,8 @@ function finalizePreparedExecution(
     controllerHome,
     accessMode: permission?.mode ?? 'request',
     risk,
-    repositoryId: repository.repoId,
-    currentRepositoryId: repository.repoId,
+    repositoryId: commandExecutionScopeKey(repository),
+    currentRepositoryId: commandExecutionScopeKey(repository),
     permissionSnapshotVersion: permission?.revision ?? 1,
     approvalToken: token,
     command: commandForPersistence,
@@ -237,14 +241,14 @@ function finalizePreparedExecution(
     ...(input.workId ? { workId: input.workId, boundWorkId: input.workId } : {}),
   }) : undefined);
   const resolved = controllerHome && input.approvalRequestId
-    ? assertResolvedAuthorization({ controllerHome, repositoryId: repository.repoId, approvalRequestId: input.approvalRequestId, sessionId: input.sessionId, principalId: input.principalId, workId: input.workId, permissionSnapshotVersion: permission?.revision ?? 1, command: commandForPersistence })
+    ? assertResolvedAuthorization({ controllerHome, repositoryId: commandExecutionScopeKey(repository), approvalRequestId: input.approvalRequestId, sessionId: input.sessionId, principalId: input.principalId, workId: input.workId, permissionSnapshotVersion: permission?.revision ?? 1, command: commandForPersistence })
     : undefined;
   const effectiveDecision: AuthorizationDecision | undefined = resolved
     ? { decision: 'allow', source: 'user_confirmation', reason: 'Resolved approval request matches the exact command and current permission snapshot.' }
     : delegated;
   const execution: RepositoryCommandExecution = {
     status: input.dryRun === true ? 'preview' : 'approval_required',
-    repoId: repository.repoId,
+    repoId: commandExecutionScopeKey(repository),
     checkoutId: repository.activeCheckoutId,
     cwd: relativeCwd,
     command: commandForPersistence,
@@ -277,7 +281,7 @@ function finalizePreparedExecution(
 }
 
 function prepareRepositoryCommandExecution(
-  repository: RepositoryRecord,
+  repository: RepositoryCommandScopeTarget,
   input: ExecuteRepositoryCommandInput,
   controllerHome?: string,
 ): {
@@ -298,7 +302,7 @@ function prepareRepositoryCommandExecution(
   const externalGrants = loadExternalFilesystemGrants(root).grants;
   const externalPathUsages = assertCommandPathOperandsStayInRepository(command, cwd, root, externalGrants, {
     controllerHome,
-    repositoryId: repository.repoId,
+    repositoryId: commandExecutionScopeKey(repository),
   });
   const classification = classifyRepositoryCommand(command, repository.defaultBranch);
   const before = input.reuseSnapshot ?? (input.allowNonGitWorkspace ? emptyWorkspaceSnapshot() : repositorySnapshot(root));
@@ -317,7 +321,7 @@ function prepareRepositoryCommandExecution(
 }
 
 async function prepareRepositoryCommandExecutionAsync(
-  repository: RepositoryRecord,
+  repository: RepositoryCommandScopeTarget,
   input: ExecuteRepositoryCommandInput,
   controllerHome?: string,
   mode: 'standard' | 'readonly_direct' = 'standard',
@@ -339,7 +343,7 @@ async function prepareRepositoryCommandExecutionAsync(
   const externalGrants = loadExternalFilesystemGrants(root).grants;
   const externalPathUsages = assertCommandPathOperandsStayInRepository(command, cwd, root, externalGrants, {
     controllerHome,
-    repositoryId: repository.repoId,
+    repositoryId: commandExecutionScopeKey(repository),
   });
   const classification = classifyRepositoryCommand(command, repository.defaultBranch);
   if (mode === 'readonly_direct' && classification.risk !== 'readonly') {
@@ -373,7 +377,7 @@ async function prepareRepositoryCommandExecutionAsync(
 }
 
 export function previewRepositoryCommandExecution(
-  repository: RepositoryRecord,
+  repository: RepositoryCommandScopeTarget,
   input: ExecuteRepositoryCommandInput,
   controllerHome?: string,
 ): PreparedRepositoryCommandExecution {
@@ -387,7 +391,7 @@ export function previewRepositoryCommandExecution(
 
 /** Async preview — preferred on Fast Path to avoid blocking Gateway with sync git snapshots. */
 export async function previewRepositoryCommandExecutionAsync(
-  repository: RepositoryRecord,
+  repository: RepositoryCommandScopeTarget,
   input: ExecuteRepositoryCommandInput,
   controllerHome?: string,
 ): Promise<PreparedRepositoryCommandExecution> {
@@ -401,10 +405,12 @@ export async function previewRepositoryCommandExecutionAsync(
 
 function auditCommand(
   controllerHome: string,
-  repository: RepositoryRecord,
+  repository: RepositoryCommandScopeTarget,
   execution: RepositoryCommandExecution,
 ): void {
-  const path = join(repositoryControllerRoot(controllerHome, repository.repoId), 'audit', 'commands.jsonl');
+  // A workspace target has no repository semantics; its command audit belongs to
+  // the workspace partition, not a synthetic repository partition.
+  const path = join(scopedOperationRoot(controllerHome, commandExecutionScopeKey(repository)), 'audit', 'commands.jsonl');
   mkdirSync(dirname(path), { recursive: true });
   appendFileSync(path, `${JSON.stringify({
     timestamp: new Date().toISOString(),
@@ -416,7 +422,7 @@ function auditCommand(
 
 export function executeRepositoryCommand(
   controllerHome: string,
-  repository: RepositoryRecord,
+  repository: RepositoryCommandScopeTarget,
   input: ExecuteRepositoryCommandInput,
 ): RepositoryCommandExecution {
   const prepared = prepareRepositoryCommandExecution(repository, input, controllerHome);
@@ -439,7 +445,7 @@ export function executeRepositoryCommand(
     try {
       assertRuntimeMayWriteOrThrow('remote_side_effect', controllerHome);
     } catch (error) {
-      if (error instanceof Error && error.message.startsWith('WRITER_FENCED:')) throw error;
+      if (isRuntimeWriteFenceError(error)) throw error;
       /* unbound legacy */
     }
   }
@@ -499,7 +505,7 @@ export function executeRepositoryCommand(
  * mutation snapshot or Controller write state, Process records, Leases, Jobs or receipts.
  */
 export async function executeRepositoryReadOnlyCommandDirect(
-  repository: RepositoryRecord,
+  repository: RepositoryCommandScopeTarget,
   input: ExecuteRepositoryCommandInput,
 ): Promise<RepositoryCommandExecution> {
   const prepared = await prepareRepositoryCommandExecutionAsync(
@@ -564,7 +570,7 @@ export async function executeRepositoryReadOnlyCommandDirect(
 
 export async function executeRepositoryCommandAsync(
   controllerHome: string,
-  repository: RepositoryRecord,
+  repository: RepositoryCommandScopeTarget,
   input: ExecuteRepositoryCommandInput,
   hooks: RepositoryCommandAsyncHooks = {},
 ): Promise<RepositoryCommandExecution> {