@xfey/tutti 0.1.50 → 0.1.52

package/dist/workspace-ops/project-workspace.js

@@ -0,0 +1,257 @@
+import { createHash } from "node:crypto";
+import { classifyRepositoryPathMetadata } from "@tutti/shared/utils";
+import { WorkspaceOpsError } from "./errors.js";
+import { runGit, runGitRaw, runGitText, stagedChangesExist, summarizeGitFailure, tryGitText, } from "./git.js";
+import { requireMainlineBranch } from "./mainline.js";
+const MAX_RUN_DIFF_SUMMARY_BYTES = 32 * 1024;
+const ACCEPTED_TAG_PREFIX = "tutti/accepted/";
+function truncateText(text, maxBytes) {
+    const buffer = Buffer.from(text, "utf8");
+    if (buffer.byteLength <= maxBytes) {
+        return text;
+    }
+    return `${buffer.subarray(0, maxBytes).toString("utf8")}\n[truncated]`;
+}
+function parsePorcelainChangedPaths(output) {
+    const entries = output
+        .toString("utf8")
+        .split("\0")
+        .filter((entry) => entry.length > 0);
+    const paths = new Set();
+    const addPath = (path) => {
+        const classification = classifyRepositoryPathMetadata(path);
+        if (classification.kind === "allowed" && classification.path_kind === "project_relative") {
+            paths.add(classification.normalized_path);
+        }
+    };
+    for (let index = 0; index < entries.length; index += 1) {
+        const entry = entries[index];
+        if (entry === undefined || entry.length < 4) {
+            continue;
+        }
+        const status = entry.slice(0, 2);
+        addPath(entry.slice(3));
+        if (status.includes("R") || status.includes("C")) {
+            const originalPath = entries[index + 1];
+            if (originalPath !== undefined) {
+                addPath(originalPath);
+                index += 1;
+            }
+        }
+    }
+    return [...paths].sort((left, right) => left.localeCompare(right, "en"));
+}
+function requireGitCommandSuccess(args, workspaceRoot) {
+    const result = runGitRaw(args, workspaceRoot);
+    if (result.status !== 0) {
+        throw new WorkspaceOpsError("git_failed", summarizeGitFailure(args, result));
+    }
+    return result;
+}
+export function fingerprintProjectSourceState(workspaceRoot) {
+    const status = requireGitCommandSuccess(["status", "--porcelain=v1", "-z"], workspaceRoot);
+    const diff = requireGitCommandSuccess(["diff", "--binary", "HEAD", "--"], workspaceRoot);
+    const untracked = requireGitCommandSuccess(["ls-files", "--others", "--exclude-standard", "-z"], workspaceRoot);
+    const hash = createHash("sha256").update(status.stdout).update(diff.stdout);
+    for (const path of untracked.stdout.toString("utf8").split("\0")) {
+        if (path.length === 0) {
+            continue;
+        }
+        const object = requireGitCommandSuccess(["hash-object", "--no-filters", "--", path], workspaceRoot);
+        hash.update(path).update("\0").update(object.stdout);
+    }
+    return hash.digest("hex");
+}
+export function collectProjectSourceDiff(workspaceRoot) {
+    const status = requireGitCommandSuccess(["status", "--porcelain=v1", "-z"], workspaceRoot);
+    const changedPaths = parsePorcelainChangedPaths(status.stdout);
+    const summaryParts = [];
+    const statusText = runGitText(["status", "--short"], workspaceRoot);
+    if (statusText.length > 0) {
+        summaryParts.push(statusText);
+    }
+    const unstagedStat = tryGitText(["diff", "--stat"], workspaceRoot);
+    if (unstagedStat !== null && unstagedStat.length > 0) {
+        summaryParts.push(unstagedStat);
+    }
+    const stagedStat = tryGitText(["diff", "--cached", "--stat"], workspaceRoot);
+    if (stagedStat !== null && stagedStat.length > 0) {
+        summaryParts.push(stagedStat);
+    }
+    return {
+        has_changes: status.stdout.length > 0,
+        changed_paths: changedPaths,
+        summary: truncateText(summaryParts.join("\n\n"), MAX_RUN_DIFF_SUMMARY_BYTES),
+        fingerprint: fingerprintProjectSourceState(workspaceRoot),
+    };
+}
+function acceptedTagName(workspaceRoot, activityRef) {
+    const tagName = `${ACCEPTED_TAG_PREFIX}${activityRef}`;
+    const check = runGitRaw(["check-ref-format", `refs/tags/${tagName}`], workspaceRoot);
+    if (check.status !== 0) {
+        throw new WorkspaceOpsError("validation_failed", "Accepted checkpoint tag is invalid", {
+            reason_code: "accepted_tag_invalid",
+        });
+    }
+    return tagName;
+}
+function nearestAcceptedCommit(workspaceRoot) {
+    const refs = requireGitCommandSuccess([
+        "for-each-ref",
+        "--format=%(objectname) %(refname:short)",
+        `refs/tags/${ACCEPTED_TAG_PREFIX}`,
+    ], workspaceRoot).stdout
+        .toString("utf8")
+        .trim();
+    if (refs.length === 0) {
+        return null;
+    }
+    const acceptedCommits = new Set(refs
+        .split("\n")
+        .map((line) => line.trim().split(/\s+/u)[0])
+        .filter((oid) => oid !== undefined && oid.length > 0));
+    const firstParent = runGitText(["rev-list", "--first-parent", "HEAD"], workspaceRoot);
+    for (const oid of firstParent.split("\n")) {
+        if (acceptedCommits.has(oid)) {
+            return oid;
+        }
+    }
+    return null;
+}
+function commitMessage(workspaceRoot, commitOid) {
+    return runGitText(["show", "-s", "--format=%B", commitOid], workspaceRoot);
+}
+function trailerValue(message, key) {
+    const prefix = `${key}:`;
+    for (const line of message.split("\n").reverse()) {
+        if (line.startsWith(prefix)) {
+            const value = line.slice(prefix.length).trim();
+            return value.length === 0 ? null : value;
+        }
+    }
+    return null;
+}
+function requireCheckpointIdentity(options) {
+    const message = commitMessage(options.workspaceRoot, options.commitOid);
+    if (trailerValue(message, "Task") !== options.taskId ||
+        trailerValue(message, "Activity") !== options.activityRef) {
+        throw new WorkspaceOpsError("conflict", "Accepted checkpoint Git identity does not match the Run activity", { reason_code: "accepted_tag_conflict" });
+    }
+}
+function resolveTagCommit(workspaceRoot, tagName) {
+    return tryGitText(["rev-parse", "--verify", `${tagName}^{commit}`], workspaceRoot);
+}
+function createAcceptedTag(options) {
+    const existing = resolveTagCommit(options.workspaceRoot, options.tagName);
+    if (existing !== null) {
+        if (existing !== options.commitOid) {
+            throw new WorkspaceOpsError("conflict", "Accepted checkpoint tag already points to another commit", { reason_code: "accepted_tag_conflict" });
+        }
+        return;
+    }
+    runGit(["tag", options.tagName, options.commitOid], options.workspaceRoot);
+}
+function changedPathsForCommit(workspaceRoot, commitOid) {
+    const result = requireGitCommandSuccess(["diff-tree", "--root", "--no-commit-id", "--name-only", "-r", "-z", commitOid], workspaceRoot);
+    const paths = new Set();
+    for (const path of result.stdout.toString("utf8").split("\0")) {
+        if (path.length === 0) {
+            continue;
+        }
+        const classification = classifyRepositoryPathMetadata(path);
+        if (classification.kind === "allowed" && classification.path_kind === "project_relative") {
+            paths.add(classification.normalized_path);
+        }
+    }
+    return [...paths].sort((left, right) => left.localeCompare(right, "en"));
+}
+export function inspectProjectWorkspace(workspaceRoot) {
+    requireMainlineBranch(workspaceRoot);
+    return {
+        workspace_root: workspaceRoot,
+        head_ref: runGitText(["rev-parse", "--verify", "HEAD"], workspaceRoot),
+        previous_accepted_commit_oid: nearestAcceptedCommit(workspaceRoot),
+    };
+}
+export function recoverAcceptedCheckpoint(options) {
+    const inspection = inspectProjectWorkspace(options.workspaceRoot);
+    const tagName = acceptedTagName(options.workspaceRoot, options.activityRef);
+    const taggedCommit = resolveTagCommit(options.workspaceRoot, tagName);
+    if (taggedCommit !== null) {
+        requireCheckpointIdentity({
+            workspaceRoot: options.workspaceRoot,
+            commitOid: taggedCommit,
+            taskId: options.taskId,
+            activityRef: options.activityRef,
+        });
+        return {
+            kind: "recovered",
+            recovered_from: "accepted_tag",
+            commit_oid: taggedCommit,
+            accepted_tag: tagName,
+            changed_paths: changedPathsForCommit(options.workspaceRoot, taggedCommit),
+        };
+    }
+    const headMessage = commitMessage(options.workspaceRoot, inspection.head_ref);
+    if (trailerValue(headMessage, "Activity") !== options.activityRef) {
+        return { kind: "not_found" };
+    }
+    requireCheckpointIdentity({
+        workspaceRoot: options.workspaceRoot,
+        commitOid: inspection.head_ref,
+        taskId: options.taskId,
+        activityRef: options.activityRef,
+    });
+    createAcceptedTag({
+        workspaceRoot: options.workspaceRoot,
+        tagName,
+        commitOid: inspection.head_ref,
+    });
+    return {
+        kind: "recovered",
+        recovered_from: "head_trailer",
+        commit_oid: inspection.head_ref,
+        accepted_tag: tagName,
+        changed_paths: changedPathsForCommit(options.workspaceRoot, inspection.head_ref),
+    };
+}
+export function createAcceptedCheckpoint(options) {
+    const recovered = recoverAcceptedCheckpoint(options);
+    if (recovered.kind === "recovered") {
+        return {
+            promoted_commit_oid: recovered.commit_oid,
+            accepted_tag: recovered.accepted_tag,
+            disposition: "already_accepted",
+        };
+    }
+    const inspection = inspectProjectWorkspace(options.workspaceRoot);
+    if (options.expectedSourceFingerprint !== undefined &&
+        fingerprintProjectSourceState(options.workspaceRoot) !== options.expectedSourceFingerprint) {
+        throw new WorkspaceOpsError("conflict", "Project source changed after validation and before accepted checkpoint", { reason_code: "accepted_checkpoint_candidate_changed" });
+    }
+    runGit(["add", "-A"], options.workspaceRoot);
+    if (!stagedChangesExist(options.workspaceRoot)) {
+        throw new WorkspaceOpsError("validation_failed", "Accepted checkpoint has no staged source changes", { reason_code: "accepted_checkpoint_candidate_missing" });
+    }
+    const previousAccepted = inspection.previous_accepted_commit_oid ?? "none";
+    runGit([
+        "commit",
+        "-m",
+        options.summary.trim().length === 0 ? "Complete Tutti task" : options.summary.trim(),
+        "-m",
+        [
+            `Task: ${options.taskId}`,
+            `Activity: ${options.activityRef}`,
+            `Previous-Accepted: ${previousAccepted}`,
+        ].join("\n"),
+    ], options.workspaceRoot);
+    const commitOid = runGitText(["rev-parse", "--verify", "HEAD"], options.workspaceRoot);
+    const tagName = acceptedTagName(options.workspaceRoot, options.activityRef);
+    createAcceptedTag({ workspaceRoot: options.workspaceRoot, tagName, commitOid });
+    return {
+        promoted_commit_oid: commitOid,
+        accepted_tag: tagName,
+        disposition: "created",
+    };
+}
+//# sourceMappingURL=project-workspace.js.map

package/dist/workspace-ops/reference-files.js

@@ -3,9 +3,8 @@ import { extname, join, posix } from "node:path";
 import { classifyViewerPath } from "@tutti/shared/utils";
 import { MAX_REFERENCE_UPLOAD_BYTES, REFERENCE_DIRECTORY_PATH, REFERENCE_INDEX_PATH, } from "./constants.js";
 import { WorkspaceOpsError } from "./errors.js";
-import { runGit, runGitText, stagedChangesExist } from "./git.js";
-import { requireMainlineWriteReady } from "./mainline.js";
 import { classifyReferenceUpload } from "./reference-metadata.js";
+import { commitOwnedPaths, requireOwnedPathsWriteReady } from "./system-commits.js";
 import { readViewerFile } from "./viewer.js";
 function commandSuffix(commandId) {
     return commandId.slice(-8).toLowerCase();
@@ -90,7 +89,6 @@ export function uploadReferenceFile(options) {
     if (options.content.byteLength > MAX_REFERENCE_UPLOAD_BYTES) {
         throw new WorkspaceOpsError("validation_failed", `Reference file content cannot exceed ${MAX_REFERENCE_UPLOAD_BYTES} bytes`);
     }
-    requireMainlineWriteReady(options.workspaceRoot);
     const safeName = sanitizeReferenceFileName(options.fileName, options.commandId);
     const classification = classifyReferenceUpload({
         fileName: options.fileName,
@@ -100,6 +98,7 @@ export function uploadReferenceFile(options) {
     const referenceDirectory = join(options.workspaceRoot, ...classification.directoryPath.split("/"));
     const repoPath = `${classification.directoryPath}/${safeName}`;
     const filesystemPath = join(referenceDirectory, safeName);
+    requireOwnedPathsWriteReady(options.workspaceRoot, [REFERENCE_INDEX_PATH, repoPath]);
     mkdirSync(referenceDirectory, { recursive: true });
     if (existsSync(filesystemPath)) {
         const existing = readFileSync(filesystemPath);
@@ -117,11 +116,12 @@ export function uploadReferenceFile(options) {
         category: classification.category,
         ...(options.note === undefined ? {} : { note: options.note }),
     });
-    runGit(["add", "--", REFERENCE_INDEX_PATH, repoPath], options.workspaceRoot);
-    if (stagedChangesExist(options.workspaceRoot)) {
-        runGit(["commit", "-m", `Add reference file: ${safeName}`], options.workspaceRoot);
-    }
-    const commitOid = runGitText(["rev-parse", "--verify", "HEAD"], options.workspaceRoot);
+    const commitOid = commitOwnedPaths({
+        workspaceRoot: options.workspaceRoot,
+        paths: [REFERENCE_INDEX_PATH, repoPath],
+        message: `Add reference file: ${safeName}`,
+    });
+    const resolvedCommitOid = commitOid ?? readViewerFile({ workspaceRoot: options.workspaceRoot, path: repoPath }).snapshot.head.oid;
     const file = readViewerFile({
         workspaceRoot: options.workspaceRoot,
         path: repoPath,
@@ -131,7 +131,7 @@ export function uploadReferenceFile(options) {
         file: file.file,
         category: classification.category,
         index_path: REFERENCE_INDEX_PATH,
-        commit_oid: commitOid,
+        commit_oid: resolvedCommitOid,
     };
 }
 //# sourceMappingURL=reference-files.js.map

package/dist/workspace-ops/reference-summaries.js

@@ -2,9 +2,8 @@ import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { redactText } from "@tutti/shared/utils";
 import { REFERENCE_DIRECTORY_PATH, REFERENCE_INDEX_PATH, } from "./constants.js";
-import { runGit, runGitText, stagedChangesExist } from "./git.js";
-import { requireMainlineWriteReady } from "./mainline.js";
 import { referenceFileCategoryForPath, referenceMediaTypeForPath } from "./reference-metadata.js";
+import { commitOwnedPaths, requireOwnedPathsWriteReady } from "./system-commits.js";
 import { readViewerTree } from "./viewer.js";
 const SUMMARY_SECTION_HEADING = "## Summaries";
 const SUMMARY_BLOCK_START = "<!-- tutti-reference-summaries:v1";
@@ -266,7 +265,7 @@ export function updateReferenceSummaries(options) {
     if (options.summaries.length === 0) {
         return { updated_paths: [] };
     }
-    requireMainlineWriteReady(options.workspaceRoot);
+    requireOwnedPathsWriteReady(options.workspaceRoot, [REFERENCE_INDEX_PATH]);
     const existingContent = readReferenceIndexContent(options.workspaceRoot);
     const existing = parseSummaryIndex(existingContent);
     const changedPaths = [];
@@ -285,14 +284,17 @@ export function updateReferenceSummaries(options) {
     const nextContent = `${removeSummarySection(existingContent)}\n\n${renderSummariesSection(records)}\n`;
     const indexPath = join(options.workspaceRoot, "docs", "reference", "README.md");
     writeFileSync(indexPath, nextContent, "utf8");
-    runGit(["add", "--", REFERENCE_INDEX_PATH], options.workspaceRoot);
-    if (!stagedChangesExist(options.workspaceRoot)) {
+    const commitOid = commitOwnedPaths({
+        workspaceRoot: options.workspaceRoot,
+        paths: [REFERENCE_INDEX_PATH],
+        message: "Update reference summaries",
+    });
+    if (commitOid === null) {
         return { updated_paths: [] };
     }
-    runGit(["commit", "-m", "Update reference summaries"], options.workspaceRoot);
     return {
         updated_paths: changedPaths.length === 0 ? options.summaries.map((summary) => summary.path) : changedPaths,
-        commit_oid: runGitText(["rev-parse", "--verify", "HEAD"], options.workspaceRoot),
+        commit_oid: commitOid,
     };
 }
 //# sourceMappingURL=reference-summaries.js.map

package/dist/workspace-ops/system-commits.d.ts

@@ -0,0 +1,7 @@
+export declare function requireOwnedPathsWriteReady(workspaceRoot: string, paths: readonly string[]): void;
+export declare function commitOwnedPaths(options: {
+    workspaceRoot: string;
+    paths: readonly string[];
+    message: string;
+}): string | null;
+//# sourceMappingURL=system-commits.d.ts.map

package/dist/workspace-ops/system-commits.js

@@ -0,0 +1,43 @@
+import { classifyRepositoryPathMetadata } from "@tutti/shared/utils";
+import { WorkspaceOpsError } from "./errors.js";
+import { runGit, runGitRaw, runGitText, summarizeGitFailure } from "./git.js";
+import { requireMainlineBranch } from "./mainline.js";
+function requireOwnedPaths(paths) {
+    if (paths.length === 0) {
+        throw new WorkspaceOpsError("validation_failed", "Owned path commit requires at least one path");
+    }
+    const normalized = paths.map((path) => {
+        const classification = classifyRepositoryPathMetadata(path);
+        if (classification.kind !== "allowed" || classification.path_kind !== "project_relative") {
+            throw new WorkspaceOpsError("forbidden", "Owned path commit contains an invalid repo path");
+        }
+        return classification.normalized_path;
+    });
+    return [...new Set(normalized)];
+}
+export function requireOwnedPathsWriteReady(workspaceRoot, paths) {
+    requireMainlineBranch(workspaceRoot);
+    const ownedPaths = requireOwnedPaths(paths);
+    const status = runGitRaw(["status", "--porcelain=v1", "-z", "--", ...ownedPaths], workspaceRoot);
+    if (status.status !== 0) {
+        throw new WorkspaceOpsError("git_failed", summarizeGitFailure(["status", "--", ...ownedPaths], status));
+    }
+    if (status.stdout.length > 0) {
+        throw new WorkspaceOpsError("conflict", "System write conflicts with existing unaccepted changes on an owned path", { reason_code: "owned_path_commit_conflict" });
+    }
+}
+export function commitOwnedPaths(options) {
+    requireMainlineBranch(options.workspaceRoot);
+    const ownedPaths = requireOwnedPaths(options.paths);
+    runGit(["add", "-A", "--", ...ownedPaths], options.workspaceRoot);
+    const staged = runGitRaw(["diff", "--cached", "--quiet", "--", ...ownedPaths], options.workspaceRoot);
+    if (staged.status === 0) {
+        return null;
+    }
+    if (staged.status !== 1) {
+        throw new WorkspaceOpsError("git_failed", summarizeGitFailure(["diff", "--cached", "--", ...ownedPaths], staged));
+    }
+    runGit(["commit", "--only", "-m", options.message, "--", ...ownedPaths], options.workspaceRoot);
+    return runGitText(["rev-parse", "--verify", "HEAD"], options.workspaceRoot);
+}
+//# sourceMappingURL=system-commits.js.map

package/dist/workspace-ops/types.d.ts

@@ -166,54 +166,35 @@ export type SyncProjectDocsResult = {
     updated_paths: string[];
     commit_oid?: string;
 };
-export type RunWorkspaceHandle = {
-    activity_ref: ActivityRef;
-    task_id: TaskId;
-    workspace_root: string;
-    run_workspace_root: string;
-    repo_root: string;
-    base_ref: string;
-    temp_branch: string;
-};
-export type MergeWorkspaceHandle = {
-    activity_ref: ActivityRef;
-    task_id: TaskId;
+export type RunDiffSummary = {
+    has_changes: boolean;
+    changed_paths: string[];
+    summary: string;
+    fingerprint: string;
+};
+export type ProjectWorkspaceInspection = {
     workspace_root: string;
-    merge_workspace_root: string;
-    repo_root: string;
-    base_ref: string;
-    source_base_ref: string;
-    source_result_commit_oid: string;
-    temp_branch: string;
-};
-export type PrepareRunWorkspaceOptions = WorkspaceViewerOptions & {
-    runWorkspaceRoot: string;
-    taskId: TaskId;
-    activityRef: ActivityRef;
+    head_ref: string;
+    previous_accepted_commit_oid: string | null;
 };
-export type PrepareMergeWorkspaceOptions = WorkspaceViewerOptions & {
-    mergeWorkspaceRoot: string;
+export type CreateAcceptedCheckpointOptions = WorkspaceViewerOptions & {
     taskId: TaskId;
     activityRef: ActivityRef;
-    sourceBaseRef: string;
-    sourceCommit: ResultCommit;
-};
-export type RunDiffSummary = {
-    changed_paths: string[];
     summary: string;
+    expectedSourceFingerprint?: string;
 };
-export type ResultCommit = {
-    commit_oid: string;
-};
-export type PromotionResult = {
+export type AcceptedCheckpointResult = {
     promoted_commit_oid: string;
+    accepted_tag: string;
+    disposition: "created" | "already_accepted";
 };
-export type CleanupRunWorkspaceResult = {
-    warnings: string[];
-};
-export type CleanupStaleRunWorkspacesResult = {
-    removed_run_workspace_count: number;
-    removed_temp_branch_count: number;
-    warnings: string[];
+export type AcceptedCheckpointRecoveryResult = {
+    kind: "not_found";
+} | {
+    kind: "recovered";
+    recovered_from: "accepted_tag" | "head_trailer";
+    commit_oid: string;
+    accepted_tag: string;
+    changed_paths: string[];
 };
 //# sourceMappingURL=types.d.ts.map

package/migrations/README.md

@@ -21,7 +21,7 @@
 - `0006_scratchpad_source_state.sql`：新增自动 Scratchpad refresh 的本机 source cursor / dirty / in-flight / backoff 状态表。
 - `0007_workspace_signal_read_state_scopes.sql`：扩展 read-state scope，允许 References 与 Skills 写入模块更新通知事件。
 - `0008_provider_usage_anchors.sql`：为 provider usage ledger 增加可空 activity / workflow / task / run result anchor 字段，供 Timeline 尽力把 token usage 挂到可证明的历史节点。
-- `0009_project_timeline_events.sql`：新增 Timeline 专用 append-only durable event 表，用于记录缺少其他稳定 record 的 context sync、reference summary 与 promotion reconcile 轻量可观测性节点。
+- `0009_project_timeline_events.sql`：新增 Timeline 专用 append-only durable event 表，用于记录缺少其他稳定 record 的 context sync、reference summary 与历史 promotion reconcile 轻量可观测性节点；新 Run 不再写 reconcile event。
 - `0010_project_brief.sql`：新增 host-local Project Brief projection 表，用于保存四个 baseline Project Docs 的短摘要和 source fingerprint。
 - `0011_message_author_avatar.sql`：为消息作者增加可选 Relay account avatar 快照，保证跨浏览器查看历史消息时不依赖当前 viewer profile 或 presence sample。
 - `0012_scratchpad_receipts.sql`：为当前 Scratchpad 增加 `submitted` 状态字段，并新增已提交 Scratchpad 小票历史表。
@@ -31,7 +31,7 @@
 
 - `0001_init.sql`、`0002_allow_sealed_round_successor_note.sql`、`0003_drop_scratchpad_source_message_refs.sql`、`0004_read_state.sql`、`0005_provider_usage.sql`、`0006_scratchpad_source_state.sql`、`0007_workspace_signal_read_state_scopes.sql`、`0008_provider_usage_anchors.sql`、`0009_project_timeline_events.sql`、`0010_project_brief.sql`、`0011_message_author_avatar.sql`、`0012_scratchpad_receipts.sql` 与 `0013_scratchpad_receipt_sources.sql` 已存在，代表当前 host project SQLite schema contract。
 - SQLite adapter、migration runner、checksum 校验、store metadata 初始化、transaction helper 与 command recovery scan helper 已实现。
-- 协作 repository 与 Control Plane 已实现第一批业务读写；Phase 7 首批已复用 `0001_init.sql` 中的 `tasks.latest_run_result_id`、`task_details.result_json` 与 `run_results` 表完成 Run result / checks / promotion 摘要持久化。Control Plane recovery resolver 与 task-bound continuation / retry 复用现有 schema；deterministic promotion reconcile 的业务 truth 仍写入最终 Run result / task detail result，Timeline 默认从 `tasks`、`run_results` 与历史主群聊 `refs.worklist_feedback` 投影任务级审计节点，当前 task terminal Chat feedback 写入 `refs.task_result` 消息；`project_timeline_events` 只保留缺少稳定 record 的轻量可观测性事件。merge workspace 不进入 SQLite truth。`provider_usage_events` 只保存 token 计数、调用来源、模型名、记录时间和可空 anchor，不保存 provider secret、prompt 或 raw response。store 基础设施本身已经可以创建并迁移 `tutti.sqlite`。
+- 协作 repository 与 Control Plane 已实现第一批业务读写；Phase 7 首批已复用 `0001_init.sql` 中的 `tasks.latest_run_result_id`、`task_details.result_json` 与 `run_results` 表完成 Run result / checks / promotion 摘要持久化。Control Plane recovery resolver 与 task-bound continuation / retry 复用现有 schema；新 Run 的 accepted checkpoint 业务 truth 继续写入最终 Run result / task detail result，Git tag / commit trailer 承担 crash recovery evidence。Timeline 默认从 `tasks`、`run_results` 与历史主群聊 `refs.worklist_feedback` 投影任务级审计节点，当前 task terminal Chat feedback 写入 `refs.task_result` 消息；`project_timeline_events` 只保留缺少稳定 record 的轻量可观测性事件和历史 reconcile 兼容记录。project workspace、working diff 与 ignored runtime state 都不进入 SQLite truth。`provider_usage_events` 只保存 token 计数、调用来源、模型名、记录时间和可空 anchor，不保存 provider secret、prompt 或 raw response。store 基础设施本身已经可以创建并迁移 `tutti.sqlite`。
 
 ## PRAGMA 边界
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xfey/tutti",
-  "version": "0.1.50",
+  "version": "0.1.52",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/prompts/README.md

@@ -15,7 +15,7 @@ Prompt / skill 改造后的 live 实验计划与记录见 [prompt-flow-experimen
 
 - `procedures/`：`scratchpad_refresh`、`project_brief_refresh`、`task_compile`、`project_context_bootstrap`、`context_sync`、`reference_summary_refresh`、`follow_up_check` 等 Procedure / workflow prompt。
 - `artifacts/`：候选实现完成后的 transient Artifact applicability 判断；只接收 bounded task / diff / repo evidence，不写回 Task contract 或 repo。
-- `runs/`：正式 task `Run`、task-bound continuation 与 pipeline self-correction retry 等 Run pipeline prompt；provider transient retry 不新增 prompt，而是复用失败 attempt 的同一 prompt family；Codex 参与式 promotion reconcile prompt 后续按 fallback 需求加入。
+- `runs/`：正式 task `Run`、task-bound continuation 与 pipeline self-correction retry 等 Run pipeline prompt；provider transient retry 不新增 prompt，而是复用失败 attempt 的同一 prompt family。所有 Run prompt都以持久 project workspace为 cwd contract，不设计 promotion reconcile prompt。
 - `codex/`：Codex app-server smoke 等 adapter / spike prompt。
 - `skills/`：Tutti packaged built-in Codex skills；由 server-side app-server skill selection 选择，不在 Web Skills 页面展示，也不保存 user skills。
 - `chat-assistant.md`：主群聊与 clarification round 内 `@tutti` 只读项目问答 prompt；它不是 Procedure / Run prompt。
@@ -32,6 +32,6 @@ Prompt / skill 改造后的 live 实验计划与记录见 [prompt-flow-experimen
 - 文件开头的 HTML metadata 注释块只用于维护索引；renderer 会在变量替换前剥离，不进入模型上下文。
 - renderer 会先 redaction 变量内容再做最终 secret-like 检查；repo evidence 中的 `{{ ... }}` 模板语法属于普通文件内容，不作为 Tutti prompt 占位符处理。
 - 输出结构化 schema 不写在 prompt 文件里；schema 仍由 TypeBox / JSON Schema 管理。
-- prompt 文件不得保存 provider secret、credential ref、host 绝对路径、run workspace path、join token、cookie 或 provider raw event。
+- prompt 文件不得保存 provider secret、credential ref、host 绝对路径、project workspace path、join token、cookie 或 provider raw event。
 - built-in skill 文件不得保存 context API token、host-local URL、provider secret、host 绝对路径或 user skill 内容。
 - workflow 语义和 prompt 选择归 `control-plane/workflows`；provider adapter 只执行渲染后的 provider request。

package/prompts/prompt-flow-experiment-plan.md

@@ -9,9 +9,9 @@ It is an experiment scratchpad, not a product contract. Canonical runtime behavi
 ## Goals
 
 - Exercise the full user-visible loop:
-  `main chat -> Scratchpad -> Worklist -> Run -> checks / result commit / mechanical promotion when repo candidate exists`.
+  `main chat -> Scratchpad -> Worklist -> Run -> Artifact gate / checks / accepted checkpoint when repo candidate exists`.
 - Verify that implementation Runs update related project documents and directory `README.md` files
-  in the same candidate workspace when stable facts change.
+  in the persistent project workspace when stable facts change.
 - Verify that code-only Runs record `docs = sync_deferred` without blocking promotion.
 - Verify that independent `context_sync` remains the clean path for broader documentation
   maintenance after one or more Runs.
@@ -23,15 +23,14 @@ It is an experiment scratchpad, not a product contract. Canonical runtime behavi
 
 Current expected Run behavior:
 
-- `workspace_write_run` and `follow_up_run` usually produce candidate changes in a run workspace; tasks that do not require repository file changes can explicitly complete without a candidate diff.
+- `workspace_write_run` and `follow_up_run` produce candidate changes in the persistent project workspace; tasks that do not require repository file changes can explicitly complete without a candidate diff.
 - Codex is instructed to update related docs as part of implementation when stable facts change.
 - Run pipeline derives docs status from Git changed paths:
   - Markdown / README / MDX changes become `docs = updated`.
   - Code-only candidates become `docs = sync_deferred`.
 - Tutti checks run after candidate diff collection when a repo candidate exists.
-- Passing checks allow a result commit and mechanical fast-forward promotion.
-- If mainline moved, deterministic promotion reconcile applies the result to latest mainline,
-  reruns checks, creates a reconciled candidate commit, and mechanically promotes it.
+- Passing checks allow an accepted commit and immutable `tutti/accepted/<activity_ref>` tag.
+- Initial, continuation, provider retry, and self-correction attempts reuse the same cwd and retained source/dependency state; the pipeline does not create temporary branches or worktrees.
 - `context_sync` is the independent documentation maintenance Procedure; it is not a promotion gate.
 
 Current open issues to keep watching:
@@ -77,7 +76,7 @@ repositories are background material only; they can be trimmed or adjusted to ma
 - Purpose:
   - Fast checks.
   - Easy task-bound clarification fixture.
-  - Deterministic promotion reconcile fixture.
+  - Accepted checkpoint / tag recovery fixture.
 - Adjustments:
   - Use a tiny TypeScript or JavaScript CLI.
   - Include one ambiguous data-format task that should require clarification.
@@ -89,13 +88,13 @@ repositories are background material only; they can be trimmed or adjusted to ma
 
 Purpose:
 
-- Verify project context bootstrap, task compile, Run, checks, result commit, and promotion.
+- Verify project context bootstrap, task compile, Run, Artifact gate, checks, and accepted checkpoint.
 
 Expected:
 
 - Missing baseline context files are created before Worklist proposal.
 - First task reaches `done`.
-- Run result includes changed paths and promoted commit.
+- Run result includes changed paths and promoted accepted commit; the immutable activity tag points to that commit.
 
 ### E2: Run Updates Related Docs
 
@@ -111,7 +110,7 @@ Expected:
 
 - Candidate changed paths include source changes and relevant Markdown / README changes.
 - Run result records `docs = updated`.
-- Promotion is mechanical after checks.
+- Accepted checkpoint is created after Artifact validation and checks.
 
 ### E3: Code-Only Run Defers Docs
 
@@ -151,26 +150,27 @@ Purpose:
 Expected:
 
 - Failed checks produce a finished result with failed outcome.
-- No result commit is promoted.
+- No accepted commit or activity tag is created.
 - Task remains explainable through Worklist and run result history.
 
-### E6: Promotion Reconcile
+### E6: Persistent Workspace Dependency Continuity
 
 Purpose:
 
-- Verify deterministic reconcile after mainline moves.
+- Verify candidate validation, accepted checkpoint, and formal Artifact preview use one persistent project directory without copying runtime state.
 
 Setup:
 
-- Start a Run.
-- Move mainline with a non-conflicting commit before promotion.
+- Use an existing npm repo with `node_modules/` ignored and dependencies initially absent.
+- Let the Run install the project-local dependency required by `npm run artifact:preview` and produce a valid Artifact candidate.
 
 Expected:
 
-- Initial promotion detects mainline movement.
-- Reconcile applies candidate changes to latest mainline.
-- Checks rerun on the reconciled workspace.
-- Mechanical promotion succeeds when checks pass.
+- Provider, candidate preview, checks, accepted checkpoint, and formal preview resolve the same project workspace root.
+- Candidate validation and checks pass, then accepted commit + immutable activity tag are created.
+- `node_modules/` is not committed but remains available in the project directory.
+- Formal preview and a later preview restart succeed without reinstalling or restoring a prepared snapshot.
+- No `tutti/run/*`, `tutti/merge/*`, extra worktree, or promotion reconcile event is created.
 
 ### E7: Task-Bound Clarification