@xfey/tutti 0.1.49 → 0.1.51

package/dist/workspace-ops/project-workspace.js

@@ -0,0 +1,257 @@
+import { createHash } from "node:crypto";
+import { classifyRepositoryPathMetadata } from "@tutti/shared/utils";
+import { WorkspaceOpsError } from "./errors.js";
+import { runGit, runGitRaw, runGitText, stagedChangesExist, summarizeGitFailure, tryGitText, } from "./git.js";
+import { requireMainlineBranch } from "./mainline.js";
+const MAX_RUN_DIFF_SUMMARY_BYTES = 32 * 1024;
+const ACCEPTED_TAG_PREFIX = "tutti/accepted/";
+function truncateText(text, maxBytes) {
+    const buffer = Buffer.from(text, "utf8");
+    if (buffer.byteLength <= maxBytes) {
+        return text;
+    }
+    return `${buffer.subarray(0, maxBytes).toString("utf8")}\n[truncated]`;
+}
+function parsePorcelainChangedPaths(output) {
+    const entries = output
+        .toString("utf8")
+        .split("\0")
+        .filter((entry) => entry.length > 0);
+    const paths = new Set();
+    const addPath = (path) => {
+        const classification = classifyRepositoryPathMetadata(path);
+        if (classification.kind === "allowed" && classification.path_kind === "project_relative") {
+            paths.add(classification.normalized_path);
+        }
+    };
+    for (let index = 0; index < entries.length; index += 1) {
+        const entry = entries[index];
+        if (entry === undefined || entry.length < 4) {
+            continue;
+        }
+        const status = entry.slice(0, 2);
+        addPath(entry.slice(3));
+        if (status.includes("R") || status.includes("C")) {
+            const originalPath = entries[index + 1];
+            if (originalPath !== undefined) {
+                addPath(originalPath);
+                index += 1;
+            }
+        }
+    }
+    return [...paths].sort((left, right) => left.localeCompare(right, "en"));
+}
+function requireGitCommandSuccess(args, workspaceRoot) {
+    const result = runGitRaw(args, workspaceRoot);
+    if (result.status !== 0) {
+        throw new WorkspaceOpsError("git_failed", summarizeGitFailure(args, result));
+    }
+    return result;
+}
+export function fingerprintProjectSourceState(workspaceRoot) {
+    const status = requireGitCommandSuccess(["status", "--porcelain=v1", "-z"], workspaceRoot);
+    const diff = requireGitCommandSuccess(["diff", "--binary", "HEAD", "--"], workspaceRoot);
+    const untracked = requireGitCommandSuccess(["ls-files", "--others", "--exclude-standard", "-z"], workspaceRoot);
+    const hash = createHash("sha256").update(status.stdout).update(diff.stdout);
+    for (const path of untracked.stdout.toString("utf8").split("\0")) {
+        if (path.length === 0) {
+            continue;
+        }
+        const object = requireGitCommandSuccess(["hash-object", "--no-filters", "--", path], workspaceRoot);
+        hash.update(path).update("\0").update(object.stdout);
+    }
+    return hash.digest("hex");
+}
+export function collectProjectSourceDiff(workspaceRoot) {
+    const status = requireGitCommandSuccess(["status", "--porcelain=v1", "-z"], workspaceRoot);
+    const changedPaths = parsePorcelainChangedPaths(status.stdout);
+    const summaryParts = [];
+    const statusText = runGitText(["status", "--short"], workspaceRoot);
+    if (statusText.length > 0) {
+        summaryParts.push(statusText);
+    }
+    const unstagedStat = tryGitText(["diff", "--stat"], workspaceRoot);
+    if (unstagedStat !== null && unstagedStat.length > 0) {
+        summaryParts.push(unstagedStat);
+    }
+    const stagedStat = tryGitText(["diff", "--cached", "--stat"], workspaceRoot);
+    if (stagedStat !== null && stagedStat.length > 0) {
+        summaryParts.push(stagedStat);
+    }
+    return {
+        has_changes: status.stdout.length > 0,
+        changed_paths: changedPaths,
+        summary: truncateText(summaryParts.join("\n\n"), MAX_RUN_DIFF_SUMMARY_BYTES),
+        fingerprint: fingerprintProjectSourceState(workspaceRoot),
+    };
+}
+function acceptedTagName(workspaceRoot, activityRef) {
+    const tagName = `${ACCEPTED_TAG_PREFIX}${activityRef}`;
+    const check = runGitRaw(["check-ref-format", `refs/tags/${tagName}`], workspaceRoot);
+    if (check.status !== 0) {
+        throw new WorkspaceOpsError("validation_failed", "Accepted checkpoint tag is invalid", {
+            reason_code: "accepted_tag_invalid",
+        });
+    }
+    return tagName;
+}
+function nearestAcceptedCommit(workspaceRoot) {
+    const refs = requireGitCommandSuccess([
+        "for-each-ref",
+        "--format=%(objectname) %(refname:short)",
+        `refs/tags/${ACCEPTED_TAG_PREFIX}`,
+    ], workspaceRoot).stdout
+        .toString("utf8")
+        .trim();
+    if (refs.length === 0) {
+        return null;
+    }
+    const acceptedCommits = new Set(refs
+        .split("\n")
+        .map((line) => line.trim().split(/\s+/u)[0])
+        .filter((oid) => oid !== undefined && oid.length > 0));
+    const firstParent = runGitText(["rev-list", "--first-parent", "HEAD"], workspaceRoot);
+    for (const oid of firstParent.split("\n")) {
+        if (acceptedCommits.has(oid)) {
+            return oid;
+        }
+    }
+    return null;
+}
+function commitMessage(workspaceRoot, commitOid) {
+    return runGitText(["show", "-s", "--format=%B", commitOid], workspaceRoot);
+}
+function trailerValue(message, key) {
+    const prefix = `${key}:`;
+    for (const line of message.split("\n").reverse()) {
+        if (line.startsWith(prefix)) {
+            const value = line.slice(prefix.length).trim();
+            return value.length === 0 ? null : value;
+        }
+    }
+    return null;
+}
+function requireCheckpointIdentity(options) {
+    const message = commitMessage(options.workspaceRoot, options.commitOid);
+    if (trailerValue(message, "Task") !== options.taskId ||
+        trailerValue(message, "Activity") !== options.activityRef) {
+        throw new WorkspaceOpsError("conflict", "Accepted checkpoint Git identity does not match the Run activity", { reason_code: "accepted_tag_conflict" });
+    }
+}
+function resolveTagCommit(workspaceRoot, tagName) {
+    return tryGitText(["rev-parse", "--verify", `${tagName}^{commit}`], workspaceRoot);
+}
+function createAcceptedTag(options) {
+    const existing = resolveTagCommit(options.workspaceRoot, options.tagName);
+    if (existing !== null) {
+        if (existing !== options.commitOid) {
+            throw new WorkspaceOpsError("conflict", "Accepted checkpoint tag already points to another commit", { reason_code: "accepted_tag_conflict" });
+        }
+        return;
+    }
+    runGit(["tag", options.tagName, options.commitOid], options.workspaceRoot);
+}
+function changedPathsForCommit(workspaceRoot, commitOid) {
+    const result = requireGitCommandSuccess(["diff-tree", "--root", "--no-commit-id", "--name-only", "-r", "-z", commitOid], workspaceRoot);
+    const paths = new Set();
+    for (const path of result.stdout.toString("utf8").split("\0")) {
+        if (path.length === 0) {
+            continue;
+        }
+        const classification = classifyRepositoryPathMetadata(path);
+        if (classification.kind === "allowed" && classification.path_kind === "project_relative") {
+            paths.add(classification.normalized_path);
+        }
+    }
+    return [...paths].sort((left, right) => left.localeCompare(right, "en"));
+}
+export function inspectProjectWorkspace(workspaceRoot) {
+    requireMainlineBranch(workspaceRoot);
+    return {
+        workspace_root: workspaceRoot,
+        head_ref: runGitText(["rev-parse", "--verify", "HEAD"], workspaceRoot),
+        previous_accepted_commit_oid: nearestAcceptedCommit(workspaceRoot),
+    };
+}
+export function recoverAcceptedCheckpoint(options) {
+    const inspection = inspectProjectWorkspace(options.workspaceRoot);
+    const tagName = acceptedTagName(options.workspaceRoot, options.activityRef);
+    const taggedCommit = resolveTagCommit(options.workspaceRoot, tagName);
+    if (taggedCommit !== null) {
+        requireCheckpointIdentity({
+            workspaceRoot: options.workspaceRoot,
+            commitOid: taggedCommit,
+            taskId: options.taskId,
+            activityRef: options.activityRef,
+        });
+        return {
+            kind: "recovered",
+            recovered_from: "accepted_tag",
+            commit_oid: taggedCommit,
+            accepted_tag: tagName,
+            changed_paths: changedPathsForCommit(options.workspaceRoot, taggedCommit),
+        };
+    }
+    const headMessage = commitMessage(options.workspaceRoot, inspection.head_ref);
+    if (trailerValue(headMessage, "Activity") !== options.activityRef) {
+        return { kind: "not_found" };
+    }
+    requireCheckpointIdentity({
+        workspaceRoot: options.workspaceRoot,
+        commitOid: inspection.head_ref,
+        taskId: options.taskId,
+        activityRef: options.activityRef,
+    });
+    createAcceptedTag({
+        workspaceRoot: options.workspaceRoot,
+        tagName,
+        commitOid: inspection.head_ref,
+    });
+    return {
+        kind: "recovered",
+        recovered_from: "head_trailer",
+        commit_oid: inspection.head_ref,
+        accepted_tag: tagName,
+        changed_paths: changedPathsForCommit(options.workspaceRoot, inspection.head_ref),
+    };
+}
+export function createAcceptedCheckpoint(options) {
+    const recovered = recoverAcceptedCheckpoint(options);
+    if (recovered.kind === "recovered") {
+        return {
+            promoted_commit_oid: recovered.commit_oid,
+            accepted_tag: recovered.accepted_tag,
+            disposition: "already_accepted",
+        };
+    }
+    const inspection = inspectProjectWorkspace(options.workspaceRoot);
+    if (options.expectedSourceFingerprint !== undefined &&
+        fingerprintProjectSourceState(options.workspaceRoot) !== options.expectedSourceFingerprint) {
+        throw new WorkspaceOpsError("conflict", "Project source changed after validation and before accepted checkpoint", { reason_code: "accepted_checkpoint_candidate_changed" });
+    }
+    runGit(["add", "-A"], options.workspaceRoot);
+    if (!stagedChangesExist(options.workspaceRoot)) {
+        throw new WorkspaceOpsError("validation_failed", "Accepted checkpoint has no staged source changes", { reason_code: "accepted_checkpoint_candidate_missing" });
+    }
+    const previousAccepted = inspection.previous_accepted_commit_oid ?? "none";
+    runGit([
+        "commit",
+        "-m",
+        options.summary.trim().length === 0 ? "Complete Tutti task" : options.summary.trim(),
+        "-m",
+        [
+            `Task: ${options.taskId}`,
+            `Activity: ${options.activityRef}`,
+            `Previous-Accepted: ${previousAccepted}`,
+        ].join("\n"),
+    ], options.workspaceRoot);
+    const commitOid = runGitText(["rev-parse", "--verify", "HEAD"], options.workspaceRoot);
+    const tagName = acceptedTagName(options.workspaceRoot, options.activityRef);
+    createAcceptedTag({ workspaceRoot: options.workspaceRoot, tagName, commitOid });
+    return {
+        promoted_commit_oid: commitOid,
+        accepted_tag: tagName,
+        disposition: "created",
+    };
+}
+//# sourceMappingURL=project-workspace.js.map

package/dist/workspace-ops/reference-files.js

@@ -3,9 +3,8 @@ import { extname, join, posix } from "node:path";
 import { classifyViewerPath } from "@tutti/shared/utils";
 import { MAX_REFERENCE_UPLOAD_BYTES, REFERENCE_DIRECTORY_PATH, REFERENCE_INDEX_PATH, } from "./constants.js";
 import { WorkspaceOpsError } from "./errors.js";
-import { runGit, runGitText, stagedChangesExist } from "./git.js";
-import { requireMainlineWriteReady } from "./mainline.js";
 import { classifyReferenceUpload } from "./reference-metadata.js";
+import { commitOwnedPaths, requireOwnedPathsWriteReady } from "./system-commits.js";
 import { readViewerFile } from "./viewer.js";
 function commandSuffix(commandId) {
     return commandId.slice(-8).toLowerCase();
@@ -90,7 +89,6 @@ export function uploadReferenceFile(options) {
     if (options.content.byteLength > MAX_REFERENCE_UPLOAD_BYTES) {
         throw new WorkspaceOpsError("validation_failed", `Reference file content cannot exceed ${MAX_REFERENCE_UPLOAD_BYTES} bytes`);
     }
-    requireMainlineWriteReady(options.workspaceRoot);
     const safeName = sanitizeReferenceFileName(options.fileName, options.commandId);
     const classification = classifyReferenceUpload({
         fileName: options.fileName,
@@ -100,6 +98,7 @@ export function uploadReferenceFile(options) {
     const referenceDirectory = join(options.workspaceRoot, ...classification.directoryPath.split("/"));
     const repoPath = `${classification.directoryPath}/${safeName}`;
     const filesystemPath = join(referenceDirectory, safeName);
+    requireOwnedPathsWriteReady(options.workspaceRoot, [REFERENCE_INDEX_PATH, repoPath]);
     mkdirSync(referenceDirectory, { recursive: true });
     if (existsSync(filesystemPath)) {
         const existing = readFileSync(filesystemPath);
@@ -117,11 +116,12 @@ export function uploadReferenceFile(options) {
         category: classification.category,
         ...(options.note === undefined ? {} : { note: options.note }),
     });
-    runGit(["add", "--", REFERENCE_INDEX_PATH, repoPath], options.workspaceRoot);
-    if (stagedChangesExist(options.workspaceRoot)) {
-        runGit(["commit", "-m", `Add reference file: ${safeName}`], options.workspaceRoot);
-    }
-    const commitOid = runGitText(["rev-parse", "--verify", "HEAD"], options.workspaceRoot);
+    const commitOid = commitOwnedPaths({
+        workspaceRoot: options.workspaceRoot,
+        paths: [REFERENCE_INDEX_PATH, repoPath],
+        message: `Add reference file: ${safeName}`,
+    });
+    const resolvedCommitOid = commitOid ?? readViewerFile({ workspaceRoot: options.workspaceRoot, path: repoPath }).snapshot.head.oid;
     const file = readViewerFile({
         workspaceRoot: options.workspaceRoot,
         path: repoPath,
@@ -131,7 +131,7 @@ export function uploadReferenceFile(options) {
         file: file.file,
         category: classification.category,
         index_path: REFERENCE_INDEX_PATH,
-        commit_oid: commitOid,
+        commit_oid: resolvedCommitOid,
     };
 }
 //# sourceMappingURL=reference-files.js.map

package/dist/workspace-ops/reference-summaries.js

@@ -2,9 +2,8 @@ import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { redactText } from "@tutti/shared/utils";
 import { REFERENCE_DIRECTORY_PATH, REFERENCE_INDEX_PATH, } from "./constants.js";
-import { runGit, runGitText, stagedChangesExist } from "./git.js";
-import { requireMainlineWriteReady } from "./mainline.js";
 import { referenceFileCategoryForPath, referenceMediaTypeForPath } from "./reference-metadata.js";
+import { commitOwnedPaths, requireOwnedPathsWriteReady } from "./system-commits.js";
 import { readViewerTree } from "./viewer.js";
 const SUMMARY_SECTION_HEADING = "## Summaries";
 const SUMMARY_BLOCK_START = "<!-- tutti-reference-summaries:v1";
@@ -266,7 +265,7 @@ export function updateReferenceSummaries(options) {
     if (options.summaries.length === 0) {
         return { updated_paths: [] };
     }
-    requireMainlineWriteReady(options.workspaceRoot);
+    requireOwnedPathsWriteReady(options.workspaceRoot, [REFERENCE_INDEX_PATH]);
     const existingContent = readReferenceIndexContent(options.workspaceRoot);
     const existing = parseSummaryIndex(existingContent);
     const changedPaths = [];
@@ -285,14 +284,17 @@ export function updateReferenceSummaries(options) {
     const nextContent = `${removeSummarySection(existingContent)}\n\n${renderSummariesSection(records)}\n`;
     const indexPath = join(options.workspaceRoot, "docs", "reference", "README.md");
     writeFileSync(indexPath, nextContent, "utf8");
-    runGit(["add", "--", REFERENCE_INDEX_PATH], options.workspaceRoot);
-    if (!stagedChangesExist(options.workspaceRoot)) {
+    const commitOid = commitOwnedPaths({
+        workspaceRoot: options.workspaceRoot,
+        paths: [REFERENCE_INDEX_PATH],
+        message: "Update reference summaries",
+    });
+    if (commitOid === null) {
         return { updated_paths: [] };
     }
-    runGit(["commit", "-m", "Update reference summaries"], options.workspaceRoot);
     return {
         updated_paths: changedPaths.length === 0 ? options.summaries.map((summary) => summary.path) : changedPaths,
-        commit_oid: runGitText(["rev-parse", "--verify", "HEAD"], options.workspaceRoot),
+        commit_oid: commitOid,
     };
 }
 //# sourceMappingURL=reference-summaries.js.map

package/dist/workspace-ops/system-commits.d.ts

@@ -0,0 +1,7 @@
+export declare function requireOwnedPathsWriteReady(workspaceRoot: string, paths: readonly string[]): void;
+export declare function commitOwnedPaths(options: {
+    workspaceRoot: string;
+    paths: readonly string[];
+    message: string;
+}): string | null;
+//# sourceMappingURL=system-commits.d.ts.map

package/dist/workspace-ops/system-commits.js

@@ -0,0 +1,43 @@
+import { classifyRepositoryPathMetadata } from "@tutti/shared/utils";
+import { WorkspaceOpsError } from "./errors.js";
+import { runGit, runGitRaw, runGitText, summarizeGitFailure } from "./git.js";
+import { requireMainlineBranch } from "./mainline.js";
+function requireOwnedPaths(paths) {
+    if (paths.length === 0) {
+        throw new WorkspaceOpsError("validation_failed", "Owned path commit requires at least one path");
+    }
+    const normalized = paths.map((path) => {
+        const classification = classifyRepositoryPathMetadata(path);
+        if (classification.kind !== "allowed" || classification.path_kind !== "project_relative") {
+            throw new WorkspaceOpsError("forbidden", "Owned path commit contains an invalid repo path");
+        }
+        return classification.normalized_path;
+    });
+    return [...new Set(normalized)];
+}
+export function requireOwnedPathsWriteReady(workspaceRoot, paths) {
+    requireMainlineBranch(workspaceRoot);
+    const ownedPaths = requireOwnedPaths(paths);
+    const status = runGitRaw(["status", "--porcelain=v1", "-z", "--", ...ownedPaths], workspaceRoot);
+    if (status.status !== 0) {
+        throw new WorkspaceOpsError("git_failed", summarizeGitFailure(["status", "--", ...ownedPaths], status));
+    }
+    if (status.stdout.length > 0) {
+        throw new WorkspaceOpsError("conflict", "System write conflicts with existing unaccepted changes on an owned path", { reason_code: "owned_path_commit_conflict" });
+    }
+}
+export function commitOwnedPaths(options) {
+    requireMainlineBranch(options.workspaceRoot);
+    const ownedPaths = requireOwnedPaths(options.paths);
+    runGit(["add", "-A", "--", ...ownedPaths], options.workspaceRoot);
+    const staged = runGitRaw(["diff", "--cached", "--quiet", "--", ...ownedPaths], options.workspaceRoot);
+    if (staged.status === 0) {
+        return null;
+    }
+    if (staged.status !== 1) {
+        throw new WorkspaceOpsError("git_failed", summarizeGitFailure(["diff", "--cached", "--", ...ownedPaths], staged));
+    }
+    runGit(["commit", "--only", "-m", options.message, "--", ...ownedPaths], options.workspaceRoot);
+    return runGitText(["rev-parse", "--verify", "HEAD"], options.workspaceRoot);
+}
+//# sourceMappingURL=system-commits.js.map

package/dist/workspace-ops/types.d.ts

@@ -166,54 +166,35 @@ export type SyncProjectDocsResult = {
     updated_paths: string[];
     commit_oid?: string;
 };
-export type RunWorkspaceHandle = {
-    activity_ref: ActivityRef;
-    task_id: TaskId;
-    workspace_root: string;
-    run_workspace_root: string;
-    repo_root: string;
-    base_ref: string;
-    temp_branch: string;
-};
-export type MergeWorkspaceHandle = {
-    activity_ref: ActivityRef;
-    task_id: TaskId;
+export type RunDiffSummary = {
+    has_changes: boolean;
+    changed_paths: string[];
+    summary: string;
+    fingerprint: string;
+};
+export type ProjectWorkspaceInspection = {
     workspace_root: string;
-    merge_workspace_root: string;
-    repo_root: string;
-    base_ref: string;
-    source_base_ref: string;
-    source_result_commit_oid: string;
-    temp_branch: string;
-};
-export type PrepareRunWorkspaceOptions = WorkspaceViewerOptions & {
-    runWorkspaceRoot: string;
-    taskId: TaskId;
-    activityRef: ActivityRef;
+    head_ref: string;
+    previous_accepted_commit_oid: string | null;
 };
-export type PrepareMergeWorkspaceOptions = WorkspaceViewerOptions & {
-    mergeWorkspaceRoot: string;
+export type CreateAcceptedCheckpointOptions = WorkspaceViewerOptions & {
     taskId: TaskId;
     activityRef: ActivityRef;
-    sourceBaseRef: string;
-    sourceCommit: ResultCommit;
-};
-export type RunDiffSummary = {
-    changed_paths: string[];
     summary: string;
+    expectedSourceFingerprint?: string;
 };
-export type ResultCommit = {
-    commit_oid: string;
-};
-export type PromotionResult = {
+export type AcceptedCheckpointResult = {
     promoted_commit_oid: string;
+    accepted_tag: string;
+    disposition: "created" | "already_accepted";
 };
-export type CleanupRunWorkspaceResult = {
-    warnings: string[];
-};
-export type CleanupStaleRunWorkspacesResult = {
-    removed_run_workspace_count: number;
-    removed_temp_branch_count: number;
-    warnings: string[];
+export type AcceptedCheckpointRecoveryResult = {
+    kind: "not_found";
+} | {
+    kind: "recovered";
+    recovered_from: "accepted_tag" | "head_trailer";
+    commit_oid: string;
+    accepted_tag: string;
+    changed_paths: string[];
 };
 //# sourceMappingURL=types.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xfey/tutti",
-  "version": "0.1.49",
+  "version": "0.1.51",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/prompts/README.md

@@ -15,7 +15,7 @@ Prompt / skill 改造后的 live 实验计划与记录见 [prompt-flow-experimen
 
 - `procedures/`：`scratchpad_refresh`、`project_brief_refresh`、`task_compile`、`project_context_bootstrap`、`context_sync`、`reference_summary_refresh`、`follow_up_check` 等 Procedure / workflow prompt。
 - `artifacts/`：候选实现完成后的 transient Artifact applicability 判断；只接收 bounded task / diff / repo evidence，不写回 Task contract 或 repo。
-- `runs/`：正式 task `Run`、task-bound continuation 与 pipeline self-correction retry 等 Run pipeline prompt；provider transient retry 不新增 prompt，而是复用失败 attempt 的同一 prompt family；Codex 参与式 promotion reconcile prompt 后续按 fallback 需求加入。
+- `runs/`：正式 task `Run`、task-bound continuation 与 pipeline self-correction retry 等 Run pipeline prompt；provider transient retry 不新增 prompt，而是复用失败 attempt 的同一 prompt family。所有 Run prompt都以持久 project workspace为 cwd contract，不设计 promotion reconcile prompt。
 - `codex/`：Codex app-server smoke 等 adapter / spike prompt。
 - `skills/`：Tutti packaged built-in Codex skills；由 server-side app-server skill selection 选择，不在 Web Skills 页面展示，也不保存 user skills。
 - `chat-assistant.md`：主群聊与 clarification round 内 `@tutti` 只读项目问答 prompt；它不是 Procedure / Run prompt。
@@ -32,6 +32,6 @@ Prompt / skill 改造后的 live 实验计划与记录见 [prompt-flow-experimen
 - 文件开头的 HTML metadata 注释块只用于维护索引；renderer 会在变量替换前剥离，不进入模型上下文。
 - renderer 会先 redaction 变量内容再做最终 secret-like 检查；repo evidence 中的 `{{ ... }}` 模板语法属于普通文件内容，不作为 Tutti prompt 占位符处理。
 - 输出结构化 schema 不写在 prompt 文件里；schema 仍由 TypeBox / JSON Schema 管理。
-- prompt 文件不得保存 provider secret、credential ref、host 绝对路径、run workspace path、join token、cookie 或 provider raw event。
+- prompt 文件不得保存 provider secret、credential ref、host 绝对路径、project workspace path、join token、cookie 或 provider raw event。
 - built-in skill 文件不得保存 context API token、host-local URL、provider secret、host 绝对路径或 user skill 内容。
 - workflow 语义和 prompt 选择归 `control-plane/workflows`；provider adapter 只执行渲染后的 provider request。

package/prompts/prompt-flow-experiment-plan.md

@@ -9,9 +9,9 @@ It is an experiment scratchpad, not a product contract. Canonical runtime behavi
 ## Goals
 
 - Exercise the full user-visible loop:
-  `main chat -> Scratchpad -> Worklist -> Run -> checks / result commit / mechanical promotion when repo candidate exists`.
+  `main chat -> Scratchpad -> Worklist -> Run -> Artifact gate / checks / accepted checkpoint when repo candidate exists`.
 - Verify that implementation Runs update related project documents and directory `README.md` files
-  in the same candidate workspace when stable facts change.
+  in the persistent project workspace when stable facts change.
 - Verify that code-only Runs record `docs = sync_deferred` without blocking promotion.
 - Verify that independent `context_sync` remains the clean path for broader documentation
   maintenance after one or more Runs.
@@ -23,15 +23,14 @@ It is an experiment scratchpad, not a product contract. Canonical runtime behavi
 
 Current expected Run behavior:
 
-- `workspace_write_run` and `follow_up_run` usually produce candidate changes in a run workspace; tasks that do not require repository file changes can explicitly complete without a candidate diff.
+- `workspace_write_run` and `follow_up_run` produce candidate changes in the persistent project workspace; tasks that do not require repository file changes can explicitly complete without a candidate diff.
 - Codex is instructed to update related docs as part of implementation when stable facts change.
 - Run pipeline derives docs status from Git changed paths:
   - Markdown / README / MDX changes become `docs = updated`.
   - Code-only candidates become `docs = sync_deferred`.
 - Tutti checks run after candidate diff collection when a repo candidate exists.
-- Passing checks allow a result commit and mechanical fast-forward promotion.
-- If mainline moved, deterministic promotion reconcile applies the result to latest mainline,
-  reruns checks, creates a reconciled candidate commit, and mechanically promotes it.
+- Passing checks allow an accepted commit and immutable `tutti/accepted/<activity_ref>` tag.
+- Initial, continuation, provider retry, and self-correction attempts reuse the same cwd and retained source/dependency state; the pipeline does not create temporary branches or worktrees.
 - `context_sync` is the independent documentation maintenance Procedure; it is not a promotion gate.
 
 Current open issues to keep watching:

package/prompts/runs/README.md

@@ -4,7 +4,7 @@ These templates are used by task `Run` execution.
 
 - `task-run.md` is rendered for initial task Runs.
 - `task-continuation.md` is rendered for Phase 8 continuation Runs after task-bound clarification.
-- `task-retry.md` is rendered for bounded Run pipeline self-correction retries after pipeline feedback such as no candidate diff, failed checks, checks mutating the candidate, or deterministic promotion reconcile failure. It is not a failed-task follow-up path and does not resurrect `Task.failed`.
+- `task-retry.md` is rendered for bounded Run pipeline self-correction retries after feedback such as no candidate diff, Artifact validation failure, failed checks, source mutation, or accepted-checkpoint failure. It is not a failed-task follow-up path and does not resurrect `Task.failed`.
   Templates in this directory may describe task contracts, repo evidence, check expectations, artifact declaration rules, and documentation update responsibilities. They must never include provider credentials or host-local secret material.
 
 `task-run.md` allows `needs_human` only for human requirement decisions, non-secret context, or risk confirmation. Unusable candidates, ordinary missing diffs, or repo/tooling errors that prevent implementation should be returned as `failed` so the Run does not open task-bound clarification incorrectly. If the task contract does not require repository file changes, the output can use `completed_no_repo_changes`; otherwise a completed implementation is expected to produce a candidate diff. If the candidate is complete but Codex self-validation commands are unavailable or blocked, the task-run output should still be `completed`; Tutti checks are the authoritative validation gate.
@@ -13,6 +13,8 @@ All three Run templates use a slim mutually exclusive structured output schema u
 Run templates describe `docs/reference/` as a user-visible file exchange area. Human uploads remain under `docs/reference/files/` and `docs/reference/images/`; `docs/reference/tutti/**` is for Tutti-generated files intended for direct member review in References, not temporary output, internal notes, logs, or canonical project documentation. Generated user-visible files must be written under `docs/reference/tutti/`, with `docs/reference/tutti/<meaningful-folder>/...` used when the folder name should be shown as a References UI group. Generated files under `docs/reference/tutti/` are discovered from promoted changed paths, rendered by References automatically, and may be listed in completed task result cards.
 Initial `task-run.md`, active `task-continuation.md`, and active pipeline `task-retry.md` also instruct Codex to write or update the single active `tutti.artifact.json` manifest only when the task creates or updates a member-viewable visual artifact. Each template includes the complete strict static and server JSON shapes: every behavior field is required, `network` is always an explicit boolean, and server `script / ready_path / port` fields are forbidden. A server package instead declares the fixed `artifact:preview` npm script in its own `package.json` and listens on the injected `HOST / PORT`. The manifest remains repo truth and is not reported through the structured output schema.
 Active task-bound follow-up still only starts continuation Runs from `Run.needs_human`. Pipeline self-correction retry happens before a terminal Run result is recorded and does not open clarification.
-Provider transient retry is separate from self-correction. If a retryable Codex app-server workspace-write failure occurs before usable structured output, Run pipeline may rerun the same prompt family once in a fresh run workspace: initial Runs stay on `task-run.md`, continuation Runs stay on `task-continuation.md`, and self-correction attempts stay on `task-retry.md`. This retry does not add `RunCorrectionContext` unless the failed attempt was already a self-correction attempt.
+All three templates state that cwd is the persistent project workspace, may contain unaccepted source and project-local runtime/dependency state from earlier failed attempts, and must not be reset, checked out, stashed, cleaned, or otherwise discarded. Continuation, provider transient retry, and self-correction reuse that same directory and accumulated state.
+
+Provider transient retry is separate from self-correction. If a retryable Codex app-server workspace-write failure occurs before usable structured output, Run pipeline may rerun the same prompt family once in the same project workspace: initial Runs stay on `task-run.md`, continuation Runs stay on `task-continuation.md`, and self-correction attempts stay on `task-retry.md`. This retry does not add `RunCorrectionContext` unless the failed attempt was already a self-correction attempt.
 Run templates are responsible for telling Codex to update related project documentation in the same candidate workspace whenever implementation changes stable project facts. Broader cleanup, fact reconciliation, and phase-level documentation maintenance belong to the independent `context_sync` Procedure.
-The Phase 8 promotion reconcile foundation currently uses deterministic workspace-ops apply and reruns checks on the reconciled merge candidate. A dedicated Codex `promotion-reconcile.md` prompt is reserved for a later fallback when deterministic apply cannot resolve the moved-mainline candidate.
+Successful source-changing Runs create an accepted commit and immutable `tutti/accepted/<activity_ref>` tag after Artifact validation and checks. Prompt templates do not own staging, commit/tag creation, recovery, or promotion semantics.

package/prompts/runs/task-continuation.md

@@ -6,9 +6,9 @@ model_path: codex.app_server.workspace_write
 
 # Role
 
-You continue one formal Tutti task after task-bound clarification, inside an isolated Git worktree.
+You continue one formal Tutti task after task-bound clarification, inside the project's persistent workspace.
 
-Treat this as continuation of the same frozen task contract, not a new task and not a scope change. Return only the structured JSON result; Tutti will inspect the Git diff and, when repository candidate changes exist, run checks, create the result commit, and promote successful changes.
+Treat this as continuation of the same frozen task contract, not a new task and not a scope change. Return only the structured JSON result; Tutti will inspect the Git diff and, when repository candidate changes exist, run checks and create an accepted checkpoint for successful changes.
 
 # Inputs
 
@@ -42,7 +42,9 @@ Human clarification answers may clarify or confirm work inside the frozen task c
 - Use `title` only for orientation; it does not expand the contract.
 - Use clarification answers only within the frozen contract.
 - Do not use main chat or Scratchpad as hidden scope.
-- Work only inside the provided repository worktree.
+- Work only inside the provided project workspace.
+- This workspace is the persistent development state. It may retain unaccepted source changes and project-local dependency or runtime state from the paused or failed work; inspect and continue from that state within the frozen task contract.
+- Do not reset, checkout, stash, clean, or otherwise discard existing workspace state. Do not remove changes merely because they were created before this continuation.
 - Prefer small, reviewable changes that preserve existing style and tests.
 
 If the formal task contract plus submitted clarification is still insufficient, return `needs_human` only for a human requirement decision, non-secret context, or risk confirmation. Return `failed` when no usable candidate can be produced.
@@ -68,7 +70,7 @@ When this task explicitly produces such a file deliverable, write it under `docs
 
 # Documentation
 
-If this change affects stable project facts, usage, public behavior, interfaces, setup, project organization, maintenance context, or project working rules, update the relevant project documentation in the same worktree.
+If this change affects stable project facts, usage, public behavior, interfaces, setup, project organization, maintenance context, or project working rules, update the relevant project documentation in the same project workspace.
 
 Broader phase-level documentation cleanup belongs to Tutti `context_sync`, but do not defer documentation that is directly required to make this task result understandable.