@zq-silk/yui 0.14.1 → 0.14.2

package/dist/task/publicationVerification.js

@@ -0,0 +1 @@
+export {};

package/dist/task/remoteDelivery.js

@@ -0,0 +1,233 @@
+/**
+ * One read-only delivery projection over existing Task, workspace, completion,
+ * and Publication facts. It never writes a merged flag or queries a provider.
+ */
+export function projectTaskRemoteDelivery(facts) {
+    const expected = expectedDelivery(facts);
+    const baseCommits = projectBaseCommits(facts, expected.event);
+    const archiveDisposition = latestEvent(facts.events, "task.archived", () => true)?.payload.workspaceDisposition;
+    const currentPublications = currentPublicationReferences(facts.publications);
+    const projects = facts.task.projectBindings.map((binding) => {
+        const expectedLocalCommit = expected.commits.get(binding.projectId) ?? null;
+        const baseCommit = baseCommits.get(binding.projectId) ?? null;
+        const codeDelivery = expectedLocalCommit === null
+            ? "unknown"
+            : baseCommit === null
+                ? "unknown"
+                : expectedLocalCommit === baseCommit ? "none" : "code";
+        const projectPublications = currentPublications
+            .filter((reference) => reference.projectId === binding.projectId);
+        const matching = expectedLocalCommit === null
+            ? []
+            : projectPublications.filter((reference) => reference.localCommit === expectedLocalCommit);
+        const publication = bestPublication(matching.length > 0 ? matching : projectPublications);
+        const coverage = projectCoverage(codeDelivery, expectedLocalCommit, publication);
+        const merged = codeDelivery === "none"
+            || (publication !== null
+                && expectedLocalCommit !== null
+                && publication.localCommit === expectedLocalCommit
+                && publication.state === "merged");
+        const verified = codeDelivery === "none"
+            || (merged && publication?.verification === "verified");
+        return {
+            projectId: binding.projectId,
+            directory: binding.directory,
+            baseCommit,
+            expectedLocalCommit,
+            codeDelivery,
+            publication,
+            state: publication?.state ?? null,
+            verification: publication?.verification ?? null,
+            remoteCommit: publication?.remoteCommit ?? null,
+            coverage,
+            merged,
+            verified,
+            reason: projectCoverageReason(codeDelivery, expectedLocalCommit, publication, coverage)
+        };
+    });
+    const codeProjects = projects.filter((project) => project.codeDelivery !== "none");
+    const mergedProjectCount = codeProjects.filter((project) => project.merged).length;
+    const verifiedProjectCount = codeProjects.filter((project) => project.verified).length;
+    const allMerged = codeProjects.every((project) => project.merged);
+    const allVerified = codeProjects.every((project) => project.verified);
+    const status = codeProjects.length === 0
+        ? "none"
+        : codeProjects.some((project) => project.coverage === "head-unavailable")
+            ? "unavailable"
+            : allMerged
+                ? "merged"
+                : mergedProjectCount > 0 ? "partial" : "pending";
+    return {
+        taskId: facts.task.id,
+        source: expected.source,
+        provisional: expected.provisional,
+        archiveDisposition: archiveDisposition === "integrated"
+            || archiveDisposition === "abandoned"
+            ? archiveDisposition
+            : null,
+        status,
+        allMerged,
+        allVerified,
+        totalProjectCount: projects.length,
+        codeProjectCount: codeProjects.length,
+        mergedProjectCount,
+        verifiedProjectCount,
+        integratedCoverageSatisfied: allMerged && allVerified,
+        projects
+    };
+}
+function expectedDelivery(facts) {
+    const { task } = facts;
+    if ((task.status === "completed" || task.status === "archived")
+        && task.completedAt !== undefined) {
+        const event = completionEvent(facts.events, task.completedAt);
+        return {
+            source: "task-completed",
+            provisional: false,
+            commits: commitMap(event?.payload.projectHeads),
+            ...(event === undefined ? {} : { event })
+        };
+    }
+    if (task.status === "archived") {
+        const event = latestEvent(facts.events, "task.archived", (candidate) => (candidate.payload.workspaceDisposition === "integrated"
+            && candidate.payload.projectHeads !== undefined));
+        return {
+            source: event === undefined ? "unavailable" : "task-archive",
+            provisional: false,
+            commits: commitMap(event?.payload.projectHeads),
+            ...(event === undefined ? {} : { event })
+        };
+    }
+    if (task.status === "active" || task.status === "retired") {
+        return {
+            source: "current-task-main",
+            provisional: true,
+            commits: candidateCommits(facts.currentCandidate)
+        };
+    }
+    return {
+        source: "unavailable",
+        provisional: false,
+        commits: new Map()
+    };
+}
+function completionEvent(events, completedAt) {
+    const exact = latestEvent(events, "task.completed", (event) => (event.createdAt === completedAt));
+    return exact ?? latestEvent(events, "task.completed", (event) => (event.createdAt <= completedAt));
+}
+function latestEvent(events, type, predicate) {
+    return events
+        .filter((event) => event.type === type && predicate(event))
+        .slice()
+        .sort(compareCreated)
+        .at(-1);
+}
+function projectBaseCommits(facts, event) {
+    const result = commitMap(event?.payload.projectBases);
+    const archived = latestEvent(facts.events, "task.archived", (candidate) => (candidate.payload.projectBases !== undefined));
+    for (const [projectId, commit] of commitMap(archived?.payload.projectBases)) {
+        if (!result.has(projectId))
+            result.set(projectId, commit);
+    }
+    const current = facts.managedWorkspaces.find((workspace) => (workspace.owner.type === "task"
+        && workspace.owner.taskId === facts.task.id));
+    for (const entry of current?.entries ?? []) {
+        if (!result.has(entry.projectId))
+            result.set(entry.projectId, entry.baseCommit);
+    }
+    const taskTurns = facts.turns
+        .filter((turn) => (turn.workspace?.owner.type === "task"
+        && turn.workspace.owner.taskId === facts.task.id))
+        .slice()
+        .sort(compareCreated);
+    for (const turn of taskTurns) {
+        for (const entry of turn.workspace?.entries ?? []) {
+            if (!result.has(entry.projectId))
+                result.set(entry.projectId, entry.baseCommit);
+        }
+    }
+    return result;
+}
+function candidateCommits(candidate) {
+    return new Map((candidate?.projects ?? []).map(({ projectId, commit }) => [
+        projectId,
+        commit.toLowerCase()
+    ]));
+}
+function commitMap(value) {
+    const result = new Map();
+    for (const entry of value?.split(",") ?? []) {
+        const separator = entry.indexOf("@");
+        if (separator <= 0)
+            continue;
+        const projectId = entry.slice(0, separator).trim();
+        const commit = entry.slice(separator + 1).trim().toLowerCase();
+        if (projectId.length === 0 || !/^[0-9a-f]{40}$/u.test(commit))
+            continue;
+        result.set(projectId, commit);
+    }
+    return result;
+}
+function currentPublicationReferences(publications) {
+    const superseded = new Set(publications.flatMap((reference) => (reference.supersedes === undefined ? [] : [reference.supersedes])));
+    return publications.filter((reference) => !superseded.has(reference.id));
+}
+function bestPublication(publications) {
+    return publications
+        .slice()
+        .sort((left, right) => (publicationRank(left) - publicationRank(right)
+        || compareCreated(left, right)))
+        .at(-1) ?? null;
+}
+function publicationRank(reference) {
+    if (reference.state === "merged" && reference.verification === "verified")
+        return 4;
+    if (reference.state === "merged")
+        return 3;
+    if (reference.state === "open")
+        return 2;
+    return 1;
+}
+function projectCoverage(codeDelivery, expectedLocalCommit, publication) {
+    if (codeDelivery === "none")
+        return "not-applicable";
+    if (expectedLocalCommit === null)
+        return "head-unavailable";
+    if (publication === null)
+        return "missing";
+    if (publication.localCommit === undefined)
+        return "missing-local-commit";
+    if (publication.localCommit !== expectedLocalCommit)
+        return "stale";
+    if (publication.state === "open")
+        return "open";
+    if (publication.state === "closed")
+        return "closed";
+    return publication.verification === "verified" ? "verified" : "merged";
+}
+function projectCoverageReason(codeDelivery, expectedLocalCommit, publication, coverage) {
+    switch (coverage) {
+        case "not-applicable":
+            return "Task head equals the managed workspace base; no code delivery is required.";
+        case "head-unavailable":
+            return "The exact Task delivery head is unavailable, so merge coverage is fail-closed.";
+        case "missing":
+            return "No current Publication records this Project delivery.";
+        case "missing-local-commit":
+            return `Publication ${publication.id} does not record a local commit.`;
+        case "stale":
+            return `Publication ${publication.id} covers ${publication.localCommit}, not the expected Task head ${expectedLocalCommit}.`;
+        case "open":
+            return `Publication ${publication.id} covers the Task head but is still open.`;
+        case "closed":
+            return `Publication ${publication.id} covers the Task head but is closed without merge.`;
+        case "merged":
+            return `Publication ${publication.id} reports the exact Task head as merged.`;
+        case "verified":
+            return `Publication ${publication.id} verifies the exact Task head as merged.`;
+    }
+}
+function compareCreated(left, right) {
+    return left.createdAt.localeCompare(right.createdAt)
+        || left.id.localeCompare(right.id, undefined, { numeric: true });
+}

package/dist/task/task.js

@@ -2,7 +2,7 @@ import { validateTaskWorkspaceIdentity } from "../repository/taskWorkspaceIdenti
 export function createTask(id, title, now, metadata = {}) {
     const timestamp = now.toISOString();
     return {
-        schemaVersion: 6,
+        schemaVersion: 7,
         id: requireSafeIdentity(id, "Task id"),
         title: requireText(title, "Task title"),
         ...cloneMetadata(metadata),
@@ -49,6 +49,89 @@ export function activateTask(task, now) {
         return task;
     return { ...task, status: "active", updatedAt: now.toISOString() };
 }
+/**
+ * Freeze the exact remote inputs adopted by activation. Every Project must be
+ * present exactly once; Draft metadata remains declarative until this call.
+ */
+export function bindTaskProjectCommits(task, commits, now) {
+    validateTask(task);
+    if (task.status !== "draft") {
+        throw new Error(`Task Project commits can only be bound during Draft activation: ${task.id}.`);
+    }
+    const byProject = new Map(commits.map(({ projectId, commit }) => [
+        requireSafeIdentity(projectId, "Project id"),
+        requireCommit(commit, "Task Project commit")
+    ]));
+    if (byProject.size !== commits.length
+        || byProject.size !== task.projectBindings.length
+        || task.projectBindings.some(({ projectId }) => !byProject.has(projectId))) {
+        throw new Error(`Task Project commit scope does not match its bindings: ${task.id}.`);
+    }
+    return validateTask({
+        ...task,
+        projectBindings: task.projectBindings.map((binding) => {
+            const commit = byProject.get(binding.projectId);
+            return { ...binding, baseCommit: commit, currentCommit: commit };
+        }),
+        updatedAt: now.toISOString()
+    });
+}
+/** Compare-and-swap one authoritative Task-main Project commit. */
+export function advanceTaskProjectCommit(task, projectId, expectedCommit, nextCommit, now) {
+    validateTask(task);
+    const expected = requireCommit(expectedCommit, "Expected Task Project commit");
+    const next = requireCommit(nextCommit, "Next Task Project commit");
+    let found = false;
+    const projectBindings = task.projectBindings.map((binding) => {
+        if (binding.projectId !== projectId)
+            return binding;
+        found = true;
+        if (binding.currentCommit !== expected) {
+            throw new Error(`Task Project current commit moved: ${task.id}/${projectId}; `
+                + `expected ${expected}, found ${String(binding.currentCommit)}.`);
+        }
+        return { ...binding, currentCommit: next };
+    });
+    if (!found)
+        throw new Error(`Task Project binding not found: ${task.id}/${projectId}.`);
+    return validateTask({
+        ...task,
+        projectBindings,
+        updatedAt: now.toISOString()
+    });
+}
+/**
+ * Refresh Task commit facts from its authoritative main clones. An active
+ * Task may persist a newly added Project as pending intent before its first
+ * workspace prepare; that first successful prepare adopts the clone's HEAD as
+ * both the Project baseline and current result.
+ */
+export function synchronizeTaskProjectCommits(task, commits, now) {
+    validateTask(task);
+    const byProject = new Map(commits.map(({ projectId, commit }) => [
+        requireSafeIdentity(projectId, "Project id"),
+        requireCommit(commit, "Task Project current commit")
+    ]));
+    if (byProject.size !== commits.length
+        || byProject.size !== task.projectBindings.length
+        || task.projectBindings.some(({ projectId }) => !byProject.has(projectId))) {
+        throw new Error(`Task Project commit scope does not match its bindings: ${task.id}.`);
+    }
+    const projectBindings = task.projectBindings.map((binding) => {
+        const commit = byProject.get(binding.projectId);
+        if (binding.baseCommit === undefined) {
+            return { ...binding, baseCommit: commit, currentCommit: commit };
+        }
+        return { ...binding, currentCommit: commit };
+    });
+    if (projectBindings.every((binding, index) => (binding.currentCommit === task.projectBindings[index]?.currentCommit)))
+        return task;
+    return validateTask({
+        ...task,
+        projectBindings,
+        updatedAt: now.toISOString()
+    });
+}
 /** Explicitly retires a stale aggregate while retaining all historical facts. */
 export function retireTask(task, input, now) {
     validateTask(task);
@@ -200,8 +283,8 @@ export function startTaskExecution(task, now) {
     });
 }
 export function validateTask(task) {
-    if (task.schemaVersion !== 6)
-        throw new Error("Task must use schemaVersion 6.");
+    if (task.schemaVersion !== 7)
+        throw new Error("Task must use schemaVersion 7.");
     requireSafeIdentity(task.id, "Task id");
     requireText(task.title, "Task title");
     if (task.type !== undefined)
@@ -338,6 +421,15 @@ function normalizeProjectBindings(bindings) {
         const projectId = requireSafeIdentity(binding.projectId, "Project id");
         const directory = requireSafeIdentity(binding.directory, "Project directory");
         const baseRef = requireText(binding.baseRef, "Task base ref");
+        const baseCommit = binding.baseCommit === undefined
+            ? undefined
+            : requireCommit(binding.baseCommit, "Task Project base commit");
+        const currentCommit = binding.currentCommit === undefined
+            ? undefined
+            : requireCommit(binding.currentCommit, "Task Project current commit");
+        if ((baseCommit === undefined) !== (currentCommit === undefined)) {
+            throw new Error(`Task Project commit metadata must include both baseCommit and currentCommit: ${projectId}.`);
+        }
         if (projectIds.has(projectId)) {
             throw new Error(`Task Project is duplicated: ${projectId}.`);
         }
@@ -346,9 +438,21 @@ function normalizeProjectBindings(bindings) {
         }
         projectIds.add(projectId);
         directories.add(directory);
-        return { projectId, directory, baseRef };
+        return {
+            projectId,
+            directory,
+            baseRef,
+            ...(baseCommit === undefined ? {} : { baseCommit, currentCommit })
+        };
     });
 }
+function requireCommit(value, label) {
+    const normalized = requireText(value, label).toLowerCase();
+    if (!/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/u.test(normalized)) {
+        throw new Error(`${label} is invalid.`);
+    }
+    return normalized;
+}
 export function taskProjectBinding(task, projectId) {
     return task.projectBindings.find((binding) => binding.projectId === projectId);
 }

package/dist/task/taskRecordReference.js

@@ -4,7 +4,6 @@ export const TASK_RECORD_ID_PREFIXES = {
     contextSnapshot: "context-snapshot",
     turn: "turn",
     reviewRound: "review-round",
-    reviewFinding: "review-finding",
     changeSet: "change-set",
     integrationAttempt: "integration",
     integrationQueue: "integration-queue",

package/dist/turn/turn.js

@@ -2,6 +2,8 @@ import { validateEffectiveLaunchSnapshot } from "../executor/effectiveLaunch.js"
 import { validateTaskRecordReference } from "../task/taskRecordReference.js";
 import { validateManagedWorkspace } from "../worktree/managedWorkspace.js";
 import { createTurnInput, createTurnInputEnvelope, validateTurnInput } from "../context/turnInputContract.js";
+import { boundedTurnFailureDiagnostic, MAX_TURN_FAILURE_DIAGNOSTIC_BYTES, MAX_TURN_RESULT_OUTPUT_BYTES } from "../domain/agentResultTransport.js";
+export { boundedTurnFailureDiagnostic, MAX_TURN_FAILURE_DIAGNOSTIC_BYTES, MAX_TURN_RESULT_OUTPUT_BYTES, transportAgentResult } from "../domain/agentResultTransport.js";
 export function createTurn(id, taskId, roleName, mode, input, now, context) {
     if (mode !== "new" && mode !== "resume") {
         throw new Error(`Turn dispatch mode is invalid: ${mode}.`);
@@ -9,7 +11,7 @@ export function createTurn(id, taskId, roleName, mode, input, now, context) {
     const timestamp = now.toISOString();
     const normalizedInput = validateTurnInput(input);
     return {
-        schemaVersion: 1,
+        schemaVersion: 5,
         id: requireSafeIdentity(id, "Turn id"),
         taskId: requireSafeIdentity(taskId, "Task id"),
         roleName: requireSafeIdentity(roleName, "Role name"),
@@ -28,6 +30,11 @@ export function createTurn(id, taskId, roleName, mode, input, now, context) {
         ...(context.executionLaneId === undefined
             ? {}
             : { executionLaneId: requireSafeIdentity(context.executionLaneId, "ExecutionLane id") }),
+        ...(context.sourceExecutionGroupId === undefined
+            ? {}
+            : {
+                sourceExecutionGroupId: requireSafeIdentity(context.sourceExecutionGroupId, "Source ExecutionGroup id")
+            }),
         ...(context.workspace === undefined
             ? {}
             : { workspace: validateManagedWorkspace(context.workspace) }),
@@ -91,6 +98,7 @@ export function validateTurn(run) {
         "reviewRoundId",
         "executionGroupId",
         "executionLaneId",
+        "sourceExecutionGroupId",
         "workspace",
         "effective",
         "status",
@@ -98,8 +106,8 @@ export function validateTurn(run) {
         "createdAt",
         "updatedAt"
     ], "Turn");
-    if (run.schemaVersion !== 1)
-        throw new Error("Turn must use schemaVersion 1.");
+    if (run.schemaVersion !== 5)
+        throw new Error("Turn must use schemaVersion 5.");
     validateTaskRecordReference({ taskId: run.taskId, localId: run.id }, "turn");
     requireSafeIdentity(run.roleName, "Role name");
     if (run.mode !== "new" && run.mode !== "resume") {
@@ -133,6 +141,16 @@ export function validateTurn(run) {
         requireSafeIdentity(run.executionGroupId, "ExecutionGroup id");
         requireSafeIdentity(run.executionLaneId, "ExecutionLane id");
     }
+    if (run.sourceExecutionGroupId !== undefined) {
+        requireSafeIdentity(run.sourceExecutionGroupId, "Source ExecutionGroup id");
+        if ((run.purpose === "execution" && run.workItemId === undefined)
+            || (run.purpose === "review" && run.reviewRoundId === undefined)) {
+            throw new Error("A source ExecutionGroup requires a main execution or review Turn.");
+        }
+        if (run.executionGroupId !== undefined || run.executionLaneId !== undefined) {
+            throw new Error("A main Turn cannot also be an Execution Lane Turn.");
+        }
+    }
     if (run.workspace !== undefined) {
         validateManagedWorkspace(run.workspace);
         if (run.workspace.owner.taskId !== run.taskId) {
@@ -233,20 +251,31 @@ export function validateTurn(run) {
             if (!isTurnFailureReason(result.failureReason)) {
                 throw new Error(`Failed Turn reason is invalid: ${String(result.failureReason)}.`);
             }
+            if (result.diagnostic === undefined) {
+                throw new Error("A failed Turn requires a Core diagnostic.");
+            }
+            if (result.systemEvidence !== undefined) {
+                throw new Error("A failed Turn cannot carry successful system evidence.");
+            }
         }
-        else if (result.failureReason !== undefined) {
-            throw new Error("A completed Turn cannot carry a failure reason.");
+        else {
+            if (result.output === undefined) {
+                throw new Error("A completed Turn requires an Agent result.");
+            }
+            if (result.failureReason !== undefined || result.diagnostic !== undefined) {
+                throw new Error("A completed Turn cannot carry failure metadata.");
+            }
         }
     }
     return run;
 }
-export function completeTurn(run, output, now, provider) {
-    return finishTurn(run, "completed", output, now, undefined, provider);
+export function completeTurn(run, output, now, provider, systemEvidence) {
+    return finishTurn(run, "completed", output, now, undefined, provider, systemEvidence);
 }
-export function failTurn(run, reason, output, now, provider) {
-    return finishTurn(run, "failed", output, now, reason, provider);
+export function failTurn(run, reason, diagnostic, now, provider, output) {
+    return finishTurn(run, "failed", output, now, reason, provider, undefined, boundedTurnFailureDiagnostic(diagnostic));
 }
-function finishTurn(run, status, output, now, failureReason, provider) {
+function finishTurn(run, status, output, now, failureReason, provider, systemEvidence, diagnostic) {
     if (run.status !== "active") {
         throw new Error(`Turn is already terminal: ${run.id}.`);
     }
@@ -255,10 +284,16 @@ function finishTurn(run, status, output, now, failureReason, provider) {
         ...run,
         status,
         result: {
-            schemaVersion: 1,
-            output: requireResultText(output, "Turn result output"),
+            schemaVersion: 2,
+            ...(output === undefined ? {} : { output: requireResultText(output, "Turn result output") }),
+            ...(diagnostic === undefined
+                ? {}
+                : { diagnostic: requireDiagnosticText(diagnostic, "Turn result diagnostic") }),
             completedAt: timestamp,
             ...(provider === undefined ? {} : { provider: validateTurnProviderResult(provider) }),
+            ...(systemEvidence === undefined
+                ? {}
+                : { systemEvidence: validateTurnSystemEvidence(systemEvidence) }),
             ...(failureReason === undefined ? {} : { failureReason })
         },
         updatedAt: timestamp,
@@ -266,15 +301,54 @@ function finishTurn(run, status, output, now, failureReason, provider) {
     return validateTurn(terminal);
 }
 function validateTurnResult(result) {
-    if (result === undefined || result.schemaVersion !== 1) {
-        throw new Error("A terminal Turn requires TurnResult schemaVersion 1.");
+    if (result === undefined || result.schemaVersion !== 2) {
+        throw new Error("A terminal Turn requires TurnResult schemaVersion 2.");
+    }
+    rejectUnknownFields(result, [
+        "schemaVersion",
+        "output",
+        "diagnostic",
+        "completedAt",
+        "provider",
+        "systemEvidence",
+        "failureReason"
+    ], "Turn result");
+    if (result.output !== undefined)
+        requireResultText(result.output, "Turn result output");
+    if (result.diagnostic !== undefined) {
+        requireDiagnosticText(result.diagnostic, "Turn result diagnostic");
     }
-    requireResultText(result.output, "Turn result output");
     requireTimestamp(result.completedAt, "Turn result completedAt");
     if (result.provider !== undefined)
         validateTurnProviderResult(result.provider);
+    if (result.systemEvidence !== undefined)
+        validateTurnSystemEvidence(result.systemEvidence);
     return result;
 }
+function validateTurnSystemEvidence(evidence) {
+    rejectUnknownFields(evidence, [
+        "workspaceSnapshot"
+    ], "Turn system evidence");
+    if (evidence.workspaceSnapshot !== undefined) {
+        const snapshot = evidence.workspaceSnapshot;
+        if (snapshot.schemaVersion !== 1 || !Array.isArray(snapshot.projects)) {
+            throw new Error("Turn workspace snapshot is invalid.");
+        }
+        const projectIds = new Set();
+        for (const project of snapshot.projects) {
+            requireSafeIdentity(project.projectId, "Turn workspace snapshot Project id");
+            if (projectIds.has(project.projectId)) {
+                throw new Error("Turn workspace snapshot Project ids must be unique.");
+            }
+            projectIds.add(project.projectId);
+            if (!/^[0-9a-f]{40}$/u.test(project.headCommit)) {
+                throw new Error("Turn workspace snapshot commit is invalid.");
+            }
+            requireText(project.branch, "Turn workspace snapshot branch");
+        }
+    }
+    return evidence;
+}
 function validateTurnProviderResult(provider) {
     requireText(provider.providerNamespace, "Provider namespace");
     requireText(provider.accountScope, "Provider account scope");
@@ -306,7 +380,10 @@ function turnEnvelopeContext(run) {
             ...(run.executionGroupId === undefined ? {} : {
                 executionGroupId: run.executionGroupId,
                 executionLaneId: run.executionLaneId
-            })
+            }),
+            ...(run.sourceExecutionGroupId === undefined
+                ? {}
+                : { sourceExecutionGroupId: run.sourceExecutionGroupId })
         }
     };
 }
@@ -332,6 +409,19 @@ function requireResultText(value, label) {
         throw new Error(`${label} is invalid.`);
     if (value.trim().length === 0)
         throw new Error(`${label} is required.`);
+    if (Buffer.byteLength(value, "utf8") > MAX_TURN_RESULT_OUTPUT_BYTES) {
+        throw new Error(`${label} exceeds ${MAX_TURN_RESULT_OUTPUT_BYTES} bytes.`);
+    }
+    return value;
+}
+function requireDiagnosticText(value, label) {
+    if (typeof value !== "string" || value.includes("\0"))
+        throw new Error(`${label} is invalid.`);
+    if (value.trim().length === 0)
+        throw new Error(`${label} is required.`);
+    if (Buffer.byteLength(value, "utf8") > MAX_TURN_FAILURE_DIAGNOSTIC_BYTES) {
+        throw new Error(`${label} exceeds ${MAX_TURN_FAILURE_DIAGNOSTIC_BYTES} bytes.`);
+    }
     return value;
 }
 function requireTimestamp(value, label) {
@@ -345,6 +435,9 @@ function isTurnFailureReason(value) {
         "runtime-failed",
         "delivery-unknown",
         "missing-result",
+        "workspace-unavailable",
+        "workspace-dirty",
+        "workspace-branch-mismatch",
         "cancelled"
     ].includes(String(value));
 }

package/dist/verification/verificationGateService.js

@@ -331,32 +331,6 @@ export async function verifyGateArtifactForReview(store, projectId, key, expecte
     }
     return { ok: true, artifact };
 }
-/**
- * Whether a `gate-artifact:` evidence reference covers the requested check
- * commands for an exact candidate commit. Used by the integration queue's
- * evidence fence: a passed gate step covers only its own command, and the
- * artifact must bind the exact candidate tree.
- */
-export async function gateArtifactCoversCheckCommands(store, projectId, ref, checkCommands, candidateCommit) {
-    const key = parseGateArtifactRef(ref);
-    if (key === undefined)
-        return false;
-    const artifact = loadGateArtifact(store, projectId, key);
-    if (artifact === null || !isReusableGateArtifact(artifact))
-        return false;
-    if (artifact.commit !== candidateCommit)
-        return false;
-    const logs = store.getGateArtifactLogs(artifact.key);
-    const verification = verifyGateArtifactLogs(artifact, logs);
-    if (!verification.ok)
-        return false;
-    if (checkCommands.length === 0)
-        return true;
-    const covered = new Set(artifact.steps
-        .filter((step) => step.outcome === "passed")
-        .map((step) => step.command));
-    return checkCommands.every((command) => covered.has(command));
-}
 /**
  * Enforce mode (rollout step 4): reject ad-hoc full-suite shell checks that
  * duplicate the plan's L2 steps for a configured Project. Explicit targeted