@taskforcehq/taskforce 0.3.329 → 0.3.330

package/dist/storage/taskforceAgentConnectionBindingStore.js

@@ -0,0 +1,84 @@
+function normalizeRequired(value, label) {
+    const normalized = String(value || '').trim();
+    if (!normalized)
+        throw new Error(`${label} is required.`);
+    return normalized;
+}
+function mapRow(row) {
+    return {
+        tenantId: String(row.tenant_id || ''),
+        workspaceId: String(row.workspace_id || ''),
+        agentId: String(row.agent_id || ''),
+        connectionId: String(row.connection_id || ''),
+        ownerUserId: String(row.owner_user_id || ''),
+        providerKey: String(row.provider_key || ''),
+        modelSource: String(row.model_source || ''),
+        createdByUserId: String(row.created_by_user_id || ''),
+        updatedByUserId: String(row.updated_by_user_id || ''),
+        createdAt: String(row.created_at || ''),
+        updatedAt: String(row.updated_at || ''),
+    };
+}
+export class TaskforceAgentConnectionBindingStore {
+    db;
+    tenantId;
+    now;
+    constructor(db, tenantId, now = () => new Date()) {
+        this.db = db;
+        this.tenantId = tenantId;
+        this.now = now;
+    }
+    get(workspaceIdRaw, agentIdRaw) {
+        const workspaceId = String(workspaceIdRaw || '').trim();
+        const agentId = String(agentIdRaw || '').trim();
+        if (!workspaceId || !agentId)
+            return null;
+        const row = this.db.prepare(`
+            SELECT *
+            FROM taskforce_agent_connection_bindings
+            WHERE tenant_id = ? AND workspace_id = ? AND agent_id = ?
+            LIMIT 1
+        `).get(this.tenantId, workspaceId, agentId);
+        return row ? mapRow(row) : null;
+    }
+    bind(input) {
+        const workspaceId = normalizeRequired(input.workspaceId, 'Workspace ID');
+        const agentId = normalizeRequired(input.agentId, 'Agent ID');
+        const connectionId = normalizeRequired(input.connectionId, 'Connection ID');
+        const ownerUserId = normalizeRequired(input.ownerUserId, 'Connection owner');
+        const providerKey = normalizeRequired(input.providerKey, 'Provider key');
+        const modelSource = normalizeRequired(input.modelSource, 'Model source');
+        const actorUserId = normalizeRequired(input.actorUserId, 'Actor user');
+        const now = this.now().toISOString();
+        const result = this.db.prepare(`
+            INSERT INTO taskforce_agent_connection_bindings (
+                tenant_id, workspace_id, agent_id, connection_id, owner_user_id,
+                provider_key, model_source, created_by_user_id, updated_by_user_id,
+                created_at, updated_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            ON CONFLICT (tenant_id, workspace_id, agent_id) DO UPDATE SET
+                connection_id = excluded.connection_id,
+                owner_user_id = excluded.owner_user_id,
+                provider_key = excluded.provider_key,
+                model_source = excluded.model_source,
+                updated_by_user_id = excluded.updated_by_user_id,
+                updated_at = excluded.updated_at
+            WHERE taskforce_agent_connection_bindings.owner_user_id = excluded.owner_user_id
+        `).run(this.tenantId, workspaceId, agentId, connectionId, ownerUserId, providerKey, modelSource, actorUserId, actorUserId, now, now);
+        if (Number(result.changes || 0) === 0)
+            return null;
+        return this.get(workspaceId, agentId);
+    }
+    clear(workspaceIdRaw, agentIdRaw, ownerUserIdRaw) {
+        const workspaceId = String(workspaceIdRaw || '').trim();
+        const agentId = String(agentIdRaw || '').trim();
+        const ownerUserId = String(ownerUserIdRaw || '').trim();
+        if (!workspaceId || !agentId || !ownerUserId)
+            return false;
+        const result = this.db.prepare(`
+            DELETE FROM taskforce_agent_connection_bindings
+            WHERE tenant_id = ? AND workspace_id = ? AND agent_id = ? AND owner_user_id = ?
+        `).run(this.tenantId, workspaceId, agentId, ownerUserId);
+        return Number(result.changes || 0) > 0;
+    }
+}

package/dist/sync/coordinator/localSyncExecutionPermitStore.js

@@ -1,4 +1,4 @@
-import { randomUUID } from 'crypto';
+import { createHash, randomUUID } from 'crypto';
 import { assertSynchronousTransactionResult, } from '../../storage/databaseAdapter.js';
 import { validateWorkspaceSyncEngineTransferCompletionGroup, } from '../engine/workspaceSyncEngineTransferCompletion.js';
 import { canonicalWorkspaceSyncJson } from '../v3/canonicalWorkspaceSyncJson.js';
@@ -1407,36 +1407,67 @@ export class LocalSyncExecutionPermitStore {
         const requiredAction = mutationReplay
             ? 'replay-operation-then-reconcile'
             : 'refetch-from-committed-cursor';
-        const coalescesRepeatedApplyFailure = errorCode === 'WORKSPACE_SYNC_V3_APPLY_NOT_COMMITTED'
+        const coalescesLegacyApplyFailure = errorCode === 'WORKSPACE_SYNC_V3_APPLY_NOT_COMMITTED'
             || errorCode === 'WORKSPACE_SYNC_V3_ATTACHMENT_HYDRATION_NOT_COMMITTED';
-        if (coalescesRepeatedApplyFailure) {
-            const committedBoundary = canonicalWorkspaceSyncJson(permit.lastCommittedCursor);
-            const equivalentOpenObligation = this.db.prepare(`
-                SELECT obligation.*
-                FROM local_sync_recovery_obligations AS obligation
-                INNER JOIN local_sync_execution_permits AS origin
-                    ON origin.permit_id = obligation.permit_id
-                WHERE obligation.workspace_id = ?
-                  AND obligation.operation_class = ?
-                  AND obligation.upstream_disposition = ?
-                  AND obligation.required_action = ?
-                  AND obligation.resolved_at IS NULL
-                  AND origin.error_code = ?
-                ORDER BY obligation.created_at ASC
-            `).all(permit.workspaceId, permit.operationClass, disposition, requiredAction, errorCode).map(mapObligation).some((obligation) => ((obligation.operationIdentity || null) === (permit.operationIdentity || null)
-                && canonicalWorkspaceSyncJson(obligation.lastCommittedCursor) === committedBoundary));
-            if (equivalentOpenObligation)
-                return;
+        const coalescingKey = mutationReplay || coalescesLegacyApplyFailure
+            ? createHash('sha256').update(canonicalWorkspaceSyncJson(mutationReplay ? {
+                workspaceId: permit.workspaceId,
+                operationClass: permit.operationClass,
+                operationIdentity: permit.operationIdentity || null,
+                lastCommittedCursor: permit.lastCommittedCursor,
+                requiredAction,
+            } : {
+                workspaceId: permit.workspaceId,
+                operationClass: permit.operationClass,
+                operationIdentity: permit.operationIdentity || null,
+                upstreamDisposition: disposition,
+                lastCommittedCursor: permit.lastCommittedCursor,
+                requiredAction,
+                errorCode,
+            })).digest('hex')
+            : null;
+        // This store method normally runs inside the permit transition
+        // transaction. The nested transaction gives PostgreSQL a savepoint
+        // boundary while the partial unique index arbitrates concurrent
+        // equivalent inserts without poisoning the outer transaction.
+        let inserted = false;
+        try {
+            this.db.transaction(() => {
+                this.db.prepare(`
+                INSERT INTO local_sync_recovery_obligations (
+                    obligation_id, permit_id, workspace_id, operation_class,
+                    operation_identity, upstream_disposition,
+                    last_committed_cursor_json, required_action, coalescing_key,
+                    created_at, resolved_at
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)
+            `).run(this.createId(), permit.permitId, permit.workspaceId, permit.operationClass, permit.operationIdentity, disposition, permit.lastCommittedCursor === null
+                    ? null
+                    : JSON.stringify(permit.lastCommittedCursor), requiredAction, coalescingKey, this.now());
+                inserted = true;
+            })();
+        }
+        catch (error) {
+            const existing = coalescingKey
+                ? this.db.prepare(`
+                    SELECT obligation_id
+                    FROM local_sync_recovery_obligations
+                    WHERE coalescing_key = ? AND resolved_at IS NULL
+                `).get(coalescingKey)
+                : undefined;
+            if (!existing?.obligation_id)
+                throw error;
         }
+        if (inserted || !coalescingKey)
+            return;
         this.db.prepare(`
-            INSERT INTO local_sync_recovery_obligations (
-                obligation_id, permit_id, workspace_id, operation_class,
-                operation_identity, upstream_disposition, last_committed_cursor_json,
-                required_action, created_at, resolved_at
-            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)
-            ON CONFLICT (permit_id) DO NOTHING
-        `).run(this.createId(), permit.permitId, permit.workspaceId, permit.operationClass, permit.operationIdentity, disposition, permit.lastCommittedCursor === null
-            ? null
-            : JSON.stringify(permit.lastCommittedCursor), requiredAction, this.now());
+            UPDATE local_sync_recovery_obligations
+            SET upstream_disposition = CASE
+                WHEN upstream_disposition = 'accepted' OR ? = 'accepted' THEN 'accepted'
+                WHEN upstream_disposition = 'unknown' OR ? = 'unknown' THEN 'unknown'
+                WHEN upstream_disposition = 'rejected' OR ? = 'rejected' THEN 'rejected'
+                ELSE upstream_disposition
+            END
+            WHERE coalescing_key = ? AND resolved_at IS NULL
+        `).run(disposition, disposition, disposition, coalescingKey);
     }
 }

package/dist/sync/coordinator/localWorkspaceSyncPendingV2PushProgress.d.ts

@@ -0,0 +1,10 @@
+import type { LocalWorkspaceSyncPendingV2Push } from './localWorkspaceSyncRunnerState.js';
+export interface LocalWorkspaceSyncPendingV2PushProgress {
+    effectiveTotalBatches: number;
+    settledBatches: number;
+    effectiveTotalChanges: number;
+    settledChanges: number;
+    remainingChanges: number;
+    firstUnsettledBatchIndex: number | null;
+}
+export declare function resolveLocalWorkspaceSyncPendingV2PushProgress(pending: LocalWorkspaceSyncPendingV2Push | null | undefined): LocalWorkspaceSyncPendingV2PushProgress | null;

package/dist/sync/coordinator/localWorkspaceSyncPendingV2PushProgress.js

@@ -0,0 +1,29 @@
+export function resolveLocalWorkspaceSyncPendingV2PushProgress(pending) {
+    const plan = pending?.preparedPlan;
+    const settledIdentities = pending?.settledBatchOperationIdentities;
+    if (pending?.settlementVersion !== 1
+        || !plan
+        || !Array.isArray(settledIdentities)
+        || plan.batches.length !== plan.batchOperationIdentities.length
+        || new Set(plan.batchOperationIdentities).size !== plan.batchOperationIdentities.length
+        || new Set(settledIdentities).size !== settledIdentities.length
+        || settledIdentities.some((identity) => !plan.batchOperationIdentities.includes(identity))) {
+        return null;
+    }
+    const settled = new Set(settledIdentities);
+    const effectiveTotalChanges = plan.batches.reduce((total, batch) => total + batch.length, 0);
+    const settledChanges = plan.batches.reduce((total, batch, index) => (settled.has(plan.batchOperationIdentities[index])
+        ? total + batch.length
+        : total), 0);
+    const firstUnsettledBatchIndex = plan.batchOperationIdentities.findIndex((identity) => !settled.has(identity));
+    return {
+        effectiveTotalBatches: plan.batches.length,
+        settledBatches: settled.size,
+        effectiveTotalChanges,
+        settledChanges,
+        remainingChanges: effectiveTotalChanges - settledChanges,
+        firstUnsettledBatchIndex: firstUnsettledBatchIndex < 0
+            ? null
+            : firstUnsettledBatchIndex,
+    };
+}

package/dist/sync/coordinator/localWorkspaceSyncRunnerState.d.ts

@@ -1,5 +1,5 @@
 import type { DatabaseAdapter } from '../../storage/databaseAdapter.js';
-import type { WorkspaceSyncDeltaDiagnostics, WorkspaceSyncPayload } from '../workspaceSyncModel.js';
+import type { WorkspaceSyncDeltaDiagnostics, WorkspaceSyncDurableTaskRevision, WorkspaceSyncPayload, WorkspaceSyncTaskSnapshot } from '../workspaceSyncModel.js';
 import { type WorkspacePushPreparedPlan } from '../workspacePushPreparedPlan.js';
 import type { WorkspaceSyncPhase, WorkspaceSyncPushBaselineSnapshot } from '../workspaceSyncState.js';
 import type { LocalSyncCoordinatorCommandStatus } from './localSyncCoordinatorTypes.js';
@@ -30,6 +30,7 @@ export interface EncodedWorkspaceSyncPayload {
     currentInitiativeWatermarks: EncodedStringMap;
     currentWorkstreamIds: string[];
     currentWorkstreamWatermarks: EncodedStringMap;
+    currentPlanningIdentityWatermarks?: EncodedStringMap;
     currentAiProfileIds: string[];
     currentAiProfileWatermarks: EncodedStringMap;
     currentAiProfileChangeKeys?: EncodedStringMap;
@@ -68,8 +69,20 @@ export interface LocalWorkspaceSyncPendingV2Push {
     preparedPlan: WorkspacePushPreparedPlan | null;
     preparedPlanFingerprint: string | null;
     acknowledgedNonApplyingBatchOperationIdentities: string[];
+    settlementVersion?: 1;
+    settledBatchOperationIdentities?: string[];
+    settledBatchContributions?: LocalWorkspaceSyncSettledV2PushBatch[];
     lastBatchProgress: LocalWorkspaceSyncPendingV2PushBatchProgress | null;
 }
+export interface LocalWorkspaceSyncSettledV2PushBatch {
+    operationIdentity: string;
+    settlementIdentityFingerprint: string;
+    appliedTaskUpserts: Array<{
+        archived: boolean;
+        task: WorkspaceSyncTaskSnapshot;
+        durableRevision?: WorkspaceSyncDurableTaskRevision;
+    }>;
+}
 export interface LocalWorkspaceSyncPendingV2PushBatchProgress {
     totalBatches: number;
     completedBatches: number;
@@ -144,6 +157,7 @@ export declare function createLocalWorkspaceSyncPendingV2Push(input: {
     repairMode: boolean;
 }): LocalWorkspaceSyncPendingV2Push;
 export declare function fingerprintLocalWorkspaceSyncPreparedPlan(plan: WorkspacePushPreparedPlan): string;
+export declare function upgradeLocalWorkspaceSyncPendingV2PushSettlement(pending: LocalWorkspaceSyncPendingV2Push): LocalWorkspaceSyncPendingV2Push;
 export declare function createDefaultLocalWorkspaceSyncRunnerCheckpoint(): LocalWorkspaceSyncRunnerCheckpoint;
 export declare class LocalWorkspaceSyncRunnerStateStore {
     private readonly db;

package/dist/sync/coordinator/localWorkspaceSyncRunnerState.js

@@ -1,6 +1,7 @@
 import { fingerprintWorkspaceSyncPayload, } from '../v3/syncDurabilityStore.js';
 import { canonicalWorkspaceSyncJson } from '../v3/canonicalWorkspaceSyncJson.js';
 import { WORKSPACE_SYNC_V2_EXCLUDABLE_PROJECTIONS, } from '../v3/workspaceSyncV2ProjectionExclusions.js';
+import { createWorkspaceSyncEngineV2SettlementIdentityProjection } from '../engine/workspaceSyncEnginePushCompletion.js';
 import { WORKSPACE_PUSH_PREPARED_PLAN_VERSION, } from '../workspacePushPreparedPlan.js';
 import { LOCAL_SYNC_COORDINATOR_ID } from './localSyncCoordinatorTypes.js';
 export const LOCAL_WORKSPACE_SYNC_RUNNER_STATE_VERSION = 1;
@@ -123,6 +124,7 @@ const ENCODED_PAYLOAD_OPTIONAL_KEYS = [
     'currentTaskChangeKeys',
     'currentTaskRelationshipChangeKeys',
     'currentTaxonomyChangeKey',
+    'currentPlanningIdentityWatermarks',
     'currentAiProfileChangeKeys',
     'currentTaskforceAgentIds',
     'currentTaskforceAgentWatermarks',
@@ -176,6 +178,7 @@ const OPTIONAL_DIAGNOSTIC_DOMAINS = [
     'taskforceAgents',
     'taskforceAgentSkills',
     'agentConversations',
+    'planningIdentities',
 ];
 function isDeltaDiagnostics(value) {
     if (!isRecord(value) || !hasExactKeys(value, [
@@ -240,6 +243,7 @@ function isEncodedWorkspaceSyncPayload(value) {
         'currentTaskWatermarks',
         'currentTaskChangeKeys',
         'currentTaskRelationshipChangeKeys',
+        'currentPlanningIdentityWatermarks',
         'currentAiProfileChangeKeys',
         'currentTaskforceAgentWatermarks',
         'currentTaskforceAgentSkillWatermarks',
@@ -302,6 +306,7 @@ export function encodeWorkspaceSyncPayload(payload) {
         currentInitiativeWatermarks: encodeStringMap(payload.currentInitiativeWatermarks, 'Initiative watermarks'),
         currentWorkstreamIds: encodeStringSet(payload.currentWorkstreamIds, 'Current workstream ids'),
         currentWorkstreamWatermarks: encodeStringMap(payload.currentWorkstreamWatermarks, 'Workstream watermarks'),
+        currentPlanningIdentityWatermarks: encodeStringMap(payload.currentPlanningIdentityWatermarks || new Map(), 'Planning identity watermarks'),
         currentAiProfileIds: encodeStringSet(payload.currentAiProfileIds, 'Current AI profile ids'),
         currentAiProfileWatermarks: encodeStringMap(payload.currentAiProfileWatermarks, 'AI profile watermarks'),
         currentAiProfileChangeKeys: encodeOptionalStringMap(payload.currentAiProfileChangeKeys, 'AI profile change keys'),
@@ -356,6 +361,7 @@ export function decodeWorkspaceSyncPayload(encoded) {
         currentInitiativeWatermarks: new Map(encoded.currentInitiativeWatermarks),
         currentWorkstreamIds: new Set(encoded.currentWorkstreamIds),
         currentWorkstreamWatermarks: new Map(encoded.currentWorkstreamWatermarks),
+        currentPlanningIdentityWatermarks: new Map(encoded.currentPlanningIdentityWatermarks || []),
         currentAiProfileIds: new Set(encoded.currentAiProfileIds),
         currentAiProfileWatermarks: new Map(encoded.currentAiProfileWatermarks),
         currentAiProfileChangeKeys: encoded.currentAiProfileChangeKeys
@@ -411,6 +417,21 @@ export function createLocalWorkspaceSyncPendingV2Push(input) {
 export function fingerprintLocalWorkspaceSyncPreparedPlan(plan) {
     return fingerprintWorkspaceSyncPayload(plan);
 }
+export function upgradeLocalWorkspaceSyncPendingV2PushSettlement(pending) {
+    if (pending.settlementVersion === 1)
+        return structuredClone(pending);
+    if (!pending.preparedPlan || !pending.preparedPlanFingerprint) {
+        throw new Error('The frozen V2 push must have a prepared plan before settlement activation.');
+    }
+    return {
+        ...structuredClone(pending),
+        settlementVersion: 1,
+        settledBatchOperationIdentities: [
+            ...pending.acknowledgedNonApplyingBatchOperationIdentities,
+        ],
+        settledBatchContributions: [],
+    };
+}
 function isPushBaseline(value) {
     if (!isRecord(value))
         return false;
@@ -421,6 +442,7 @@ function isPushBaseline(value) {
         'taskRelationshipChangeKeys',
         'initiativeWatermarks',
         'workstreamWatermarks',
+        'planningIdentityWatermarks',
         'aiProfileWatermarks',
         'aiProfileChangeKeys',
         'taskforceAgentWatermarks',
@@ -458,6 +480,7 @@ function isPushBaseline(value) {
         'taskforceAgentWatermarks',
         'taskforceAgentSkillWatermarks',
         'agentConversationWatermarks',
+        'planningIdentityWatermarks',
     ];
     if (optionalPairs.some((key) => value[key] !== undefined && !isStringPairArray(value[key])))
         return false;
@@ -470,7 +493,9 @@ function isPushBaseline(value) {
     return true;
 }
 function isPendingV2Push(value) {
-    if (!isRecord(value) || !hasExactKeys(value, [
+    if (!isRecord(value))
+        return false;
+    const legacyKeys = [
         'signature',
         'payloadFingerprint',
         'frozenPayload',
@@ -480,8 +505,71 @@ function isPendingV2Push(value) {
         'preparedPlanFingerprint',
         'acknowledgedNonApplyingBatchOperationIdentities',
         'lastBatchProgress',
-    ]))
+    ];
+    const settlementKeys = [
+        ...legacyKeys,
+        'settlementVersion',
+        'settledBatchOperationIdentities',
+        'settledBatchContributions',
+    ];
+    const hasLegacyShape = hasExactKeys(value, legacyKeys);
+    const hasSettlementShape = hasExactKeys(value, settlementKeys);
+    if (!hasLegacyShape && !hasSettlementShape)
         return false;
+    const settledBatchOperationIdentities = isStringArray(value.settledBatchOperationIdentities) ? value.settledBatchOperationIdentities : null;
+    const settledBatchContributions = Array.isArray(value.settledBatchContributions) ? value.settledBatchContributions : null;
+    const preparedPlan = isPreparedV2PushPlan(value.preparedPlan)
+        ? value.preparedPlan
+        : null;
+    const settlementValid = hasLegacyShape || (value.settlementVersion === 1
+        && settledBatchOperationIdentities !== null
+        && new Set(settledBatchOperationIdentities).size
+            === settledBatchOperationIdentities.length
+        && settledBatchOperationIdentities.every((identity) => /^[a-f0-9]{64}$/.test(identity))
+        && settledBatchContributions !== null
+        && settledBatchContributions.every((entry) => (isRecord(entry)
+            && hasExactKeys(entry, [
+                'operationIdentity',
+                'settlementIdentityFingerprint',
+                'appliedTaskUpserts',
+            ])
+            && typeof entry.operationIdentity === 'string'
+            && /^[a-f0-9]{64}$/.test(entry.operationIdentity)
+            && typeof entry.settlementIdentityFingerprint === 'string'
+            && /^[a-f0-9]{64}$/.test(entry.settlementIdentityFingerprint)
+            && Array.isArray(entry.appliedTaskUpserts)
+            && entry.appliedTaskUpserts.every((upsert) => (isRecord(upsert)
+                && hasRequiredAndAllowedKeys(upsert, ['archived', 'task'], ['durableRevision'])
+                && typeof upsert.archived === 'boolean'
+                && isRecord(upsert.task)
+                && isNonEmptyText(upsert.task.id)
+                && isJson(upsert.task)
+                && (upsert.durableRevision === undefined
+                    || (isRecord(upsert.durableRevision) && isJson(upsert.durableRevision)))))))
+        && new Set(settledBatchContributions.map((entry) => entry.operationIdentity)).size === settledBatchContributions.length
+        && settledBatchContributions.every((entry) => (settledBatchOperationIdentities.includes(entry.operationIdentity))));
+    const settlementContributionsMatchPlan = hasLegacyShape || (preparedPlan !== null
+        && settledBatchContributions !== null
+        && settledBatchContributions.every((rawEntry) => {
+            const entry = rawEntry;
+            const batchIndex = preparedPlan.batchOperationIdentities.indexOf(entry.operationIdentity);
+            if (batchIndex < 0)
+                return false;
+            const changes = preparedPlan.batches[batchIndex].map((planEntry) => (planEntry.preparedChange
+                || value.frozenPayload
+                    .changes[planEntry.sourceChangeIndex]));
+            try {
+                return fingerprintWorkspaceSyncPayload(createWorkspaceSyncEngineV2SettlementIdentityProjection({
+                    operationIdentity: entry.operationIdentity,
+                    changes,
+                    appliedTaskUpserts: entry.appliedTaskUpserts,
+                    excludedProjections: preparedPlan.ownership.combinedExcludedProjections,
+                })) === entry.settlementIdentityFingerprint;
+            }
+            catch {
+                return false;
+            }
+        }));
     return isNonEmptyText(value.signature)
         && typeof value.payloadFingerprint === 'string'
         && /^[a-f0-9]{64}$/.test(value.payloadFingerprint)
@@ -499,6 +587,12 @@ function isPendingV2Push(value) {
                     < value.frozenPayload.changes.length))))
         && isStringArray(value.acknowledgedNonApplyingBatchOperationIdentities)
         && value.acknowledgedNonApplyingBatchOperationIdentities.every((identity) => /^[a-f0-9]{64}$/.test(identity))
+        && settlementValid
+        && settlementContributionsMatchPlan
+        && (!hasSettlementShape
+            || (preparedPlan !== null
+                && settledBatchOperationIdentities !== null
+                && settledBatchOperationIdentities.every((identity) => preparedPlan.batchOperationIdentities.includes(identity))))
         && (value.lastBatchProgress === null
             || (isPendingV2PushBatchProgress(value.lastBatchProgress)
                 && value.lastBatchProgress.completedChanges <= value.frozenPayload.changes.length
@@ -582,6 +676,9 @@ function normalizePendingV2Push(value) {
         'preparedPlan',
         'preparedPlanFingerprint',
         'acknowledgedNonApplyingBatchOperationIdentities',
+        'settlementVersion',
+        'settledBatchOperationIdentities',
+        'settledBatchContributions',
         'lastBatchProgress',
     ])) {
         return value;

package/dist/sync/coordinator/workspaceSyncCredentialBroker.d.ts

@@ -43,6 +43,7 @@ export declare class WorkspaceSyncCredentialBrokerError extends Error {
 export declare class WorkspaceSyncCredentialBroker {
     private readonly options;
     private capability;
+    private boundIdentity;
     private blockedReason;
     constructor(options: {
         sessionCookieName: string;

package/dist/sync/coordinator/workspaceSyncCredentialBroker.js

@@ -12,6 +12,9 @@ export class WorkspaceSyncCredentialBrokerError extends Error {
 export class WorkspaceSyncCredentialBroker {
     options;
     capability = null;
+    // Retain the non-secret principal fence while auth is blocked so a logout or
+    // expired cookie cannot let another account adopt the live coordinator.
+    boundIdentity = null;
     blockedReason = 'server-restart';
     constructor(options) {
         this.options = options;
@@ -39,16 +42,21 @@ export class WorkspaceSyncCredentialBroker {
             throw new WorkspaceSyncCredentialBrokerError('The Taskforce session is not valid for the requested workspace.', 'SYNC_COORDINATOR_AUTH_INVALID');
         }
         const existing = this.capability;
+        const identity = existing || this.boundIdentity;
         const samePrincipal = existing
             && existing.workspaceId === validated.workspaceId
             && existing.principal.userId === validated.principal.userId
             && existing.principal.tenantId === validated.principal.tenantId;
-        if (existing && !samePrincipal && !input.allowPrincipalRebind) {
+        const sameBoundIdentity = identity
+            && identity.workspaceId === validated.workspaceId
+            && identity.principal.userId === validated.principal.userId
+            && identity.principal.tenantId === validated.principal.tenantId;
+        if (identity && !sameBoundIdentity && !input.allowPrincipalRebind) {
             throw new WorkspaceSyncCredentialBrokerError('A different Taskforce principal is already bound to this workspace coordinator.', 'SYNC_COORDINATOR_PRINCIPAL_CONFLICT');
         }
-        if (samePrincipal
-            && input.coordinatorGeneration < existing.coordinatorGeneration) {
-            throw new WorkspaceSyncCredentialBrokerError(`Coordinator generation ${input.coordinatorGeneration} is stale; current generation is ${existing.coordinatorGeneration}.`, 'SYNC_COORDINATOR_STALE_GENERATION');
+        if (sameBoundIdentity
+            && input.coordinatorGeneration < identity.coordinatorGeneration) {
+            throw new WorkspaceSyncCredentialBrokerError(`Coordinator generation ${input.coordinatorGeneration} is stale; current generation is ${identity.coordinatorGeneration}.`, 'SYNC_COORDINATOR_STALE_GENERATION');
         }
         const authorizedCookies = samePrincipal
             ? new Map(existing.authorizedCookies)
@@ -67,6 +75,11 @@ export class WorkspaceSyncCredentialBroker {
             cookieHeader,
             authorizedCookies,
         };
+        this.boundIdentity = {
+            workspaceId: validated.workspaceId,
+            coordinatorGeneration: input.coordinatorGeneration,
+            principal: validated.principal,
+        };
         this.blockedReason = null;
         return this.readSnapshot();
     }
@@ -143,6 +156,11 @@ export class WorkspaceSyncCredentialBroker {
             cookieHeader: prepared.cookieHeader,
             authorizedCookies: new Map([[cookieValue, prepared.validation]]),
         };
+        this.boundIdentity = {
+            workspaceId: prepared.targetWorkspaceId,
+            coordinatorGeneration: prepared.targetCoordinatorGeneration,
+            principal: prepared.principal,
+        };
         prepared.activated = true;
         this.blockedReason = null;
         return this.readSnapshot();
@@ -159,6 +177,11 @@ export class WorkspaceSyncCredentialBroker {
                 coordinatorGeneration,
                 authorizedCookies: new Map(prepared.sourceCapability.authorizedCookies),
             };
+            this.boundIdentity = {
+                workspaceId: prepared.sourceWorkspaceId,
+                coordinatorGeneration,
+                principal: prepared.sourceCapability.principal,
+            };
             prepared.activated = false;
             this.blockedReason = null;
         }
@@ -175,6 +198,9 @@ export class WorkspaceSyncCredentialBroker {
             throw new WorkspaceSyncCredentialBrokerError('The coordinator generation transition is invalid.', 'SYNC_COORDINATOR_STALE_GENERATION');
         }
         this.capability.coordinatorGeneration = input.toCoordinatorGeneration;
+        if (this.boundIdentity) {
+            this.boundIdentity.coordinatorGeneration = input.toCoordinatorGeneration;
+        }
         return this.readSnapshot();
     }
     /**
@@ -197,6 +223,9 @@ export class WorkspaceSyncCredentialBroker {
             throw new WorkspaceSyncCredentialBrokerError('The coordinator generation transition is stale or non-adjacent.', 'SYNC_COORDINATOR_STALE_GENERATION');
         }
         capability.coordinatorGeneration = input.toCoordinatorGeneration;
+        if (this.boundIdentity) {
+            this.boundIdentity.coordinatorGeneration = input.toCoordinatorGeneration;
+        }
         return this.readSnapshot();
     }
     authorizeCookieHeader(input) {

package/dist/sync/engine/workspaceSyncContentLifecycleAdapter.d.ts

@@ -1,4 +1,4 @@
-import { type WorkspaceSyncContentHead, type WorkspaceSyncContentKind, type WorkspaceSyncContentScope, type WorkspaceSyncContentVersionStore } from './workspaceSyncContentVersionStore.js';
+import { type WorkspaceSyncContentHead, type WorkspaceSyncContentKind, type WorkspaceSyncContentScope, type WorkspaceSyncContentTombstoneProvenance, type WorkspaceSyncContentVersionStore } from './workspaceSyncContentVersionStore.js';
 export type WorkspaceSyncContentTombstoneInput = WorkspaceSyncContentScope & {
     kind: WorkspaceSyncContentKind;
     logicalPath: string;
@@ -6,6 +6,7 @@ export type WorkspaceSyncContentTombstoneInput = WorkspaceSyncContentScope & {
     publishedAt: string;
     deletedAt: string;
     retireGcAfter?: string | null;
+    provenance?: WorkspaceSyncContentTombstoneProvenance;
 };
 export interface WorkspaceSyncContentLifecyclePort {
     tombstone(input: WorkspaceSyncContentTombstoneInput): WorkspaceSyncContentHead;

package/dist/sync/engine/workspaceSyncContentVersionStore.d.ts

@@ -48,6 +48,36 @@ export type WorkspaceSyncContentHead = WorkspaceSyncContentScope & {
     publishedAt: string;
     deletedAt: string | null;
 };
+/**
+ * Durable, queryable attribution for an accepted content tombstone. operationId/
+ * actorId are optional because the current WorkspaceSyncChange wire format and
+ * apply pipeline don't yet carry per-change requester identity from origin
+ * through to this layer — threading that through is a larger, separate change
+ * (it would mean extending the delete-change payload and every intermediate
+ * outbox/apply layer, not just this store). What IS reliably knowable at the
+ * point a tombstone is admitted is recorded: which admission path produced it,
+ * the source revision it was admitted at, which runtime applied it, and
+ * whether workspace repair was involved.
+ */
+export type WorkspaceSyncContentTombstoneProvenance = {
+    source: 'explicit-delete' | 'synchronized-tombstone' | 'repair';
+    operationId?: string | null;
+    actorId?: string | null;
+    sourceRuntime?: string | null;
+    repairInvolved?: boolean;
+};
+export type WorkspaceSyncContentTombstoneProvenanceRecord = WorkspaceSyncContentScope & {
+    id: string;
+    kind: WorkspaceSyncContentKind;
+    logicalPath: string;
+    source: string;
+    operationId: string | null;
+    actorId: string | null;
+    sourceRuntime: string | null;
+    sourceUpdatedAt: string;
+    repairInvolved: boolean;
+    recordedAt: string;
+};
 export type WorkspaceSyncContentLegacyFallback = {
     source: 'legacy';
 };
@@ -141,7 +171,15 @@ export declare class WorkspaceSyncContentVersionStore {
         publishedAt: string;
         deletedAt: string;
         retireGcAfter?: string | null;
+        provenance?: WorkspaceSyncContentTombstoneProvenance;
     }): WorkspaceSyncContentHead;
+    private recordTombstoneProvenance;
+    /** Queryable read side for tombstone provenance — most recent admission first. */
+    listTombstoneProvenance(input: WorkspaceSyncContentScope & {
+        kind?: WorkspaceSyncContentKind;
+        logicalPath?: string;
+        limit?: number;
+    }): WorkspaceSyncContentTombstoneProvenanceRecord[];
     resolveHead(input: WorkspaceSyncContentScope & {
         kind: WorkspaceSyncContentKind;
         logicalPath: string;