harnery 0.31.6 → 0.33.0

package/src/core/workflow/workspaces/execution.ts

@@ -14,9 +14,9 @@ import { appendWorkflowTranscriptEvent, stableDigest, writeWorkspaceRequest } fr
 import type {
   WorkspaceAttestation,
   WorkspaceBinding,
+  WorkspaceCompatibilityExecutionEvidence,
   WorkspaceIsolation,
   WorkspaceProvider,
-  WorkspaceUnsupportedExecutionEvidence,
 } from "./types.ts";
 import { isWorkspaceAttestation, isWorkspaceBinding } from "./validate.ts";
 
@@ -36,7 +36,7 @@ export async function resolveWorkspaceBinding(input: {
   workContext: Readonly<WorkflowWorkContext> | undefined;
   attemptContext: Readonly<WorkflowAttemptContext> | undefined;
   policy: NormalizedPolicy | undefined;
-  onUnsupportedFallback?: (evidence: WorkspaceUnsupportedExecutionEvidence) => void;
+  onUnsupportedFallback?: (evidence: WorkspaceCompatibilityExecutionEvidence) => void;
 }): Promise<WorkspaceBinding | undefined> {
   if (input.isolation === "shared") return undefined;
   if (
@@ -47,6 +47,13 @@ export async function resolveWorkspaceBinding(input: {
     throw new Error(`unsupported workflow isolation ${JSON.stringify(input.isolation)}`);
   }
   if (input.resumeState && !input.resumeState.manifest.execution.workspace_binding) {
+    const frozenFallback = input.resumeState.manifest.execution.workspace_fallback;
+    if (!frozenFallback) {
+      throw new Error(
+        `workflow run ${input.runId} requested ${input.isolation} isolation without frozen workspace evidence`,
+      );
+    }
+    input.onUnsupportedFallback?.(frozenFallback);
     return undefined;
   }
   const capability = input.isolation as WorkspaceIsolation;
@@ -55,7 +62,7 @@ export async function resolveWorkspaceBinding(input: {
     if (input.resumeState?.manifest.execution.workspace_binding) {
       throw new Error("isolated workflow resume requires the frozen workspace provider");
     }
-    const fallback: WorkspaceUnsupportedExecutionEvidence = {
+    const fallback: WorkspaceCompatibilityExecutionEvidence = {
       schema_version: 1,
       run_id: input.runId,
       requested_isolation: capability,
@@ -163,7 +170,7 @@ export async function resolveWorkspaceBinding(input: {
                 message: `provider does not support ${capability} isolation`,
               },
             ];
-      const fallback: WorkspaceUnsupportedExecutionEvidence = {
+      const fallback: WorkspaceCompatibilityExecutionEvidence = {
         schema_version: 1,
         run_id: input.runId,
         requested_isolation: capability,

package/src/core/workflow/workspaces/index.ts

@@ -56,7 +56,6 @@ export type {
   RepositoryBinding,
   RepositoryObservation,
   ValidatedFilesystemPath,
-  ValidatedFilesystemRoot,
   WorkspaceAllocationRequest,
   WorkspaceAttestation,
   WorkspaceBinding,
@@ -77,13 +76,11 @@ export type {
   WorkspaceOwner,
   WorkspaceProbeInput,
   WorkspaceProbeResult,
-  WorkspaceProofLifecycleState,
   WorkspaceProofOutcome,
   WorkspaceProvider,
   WorkspaceProviderCapabilities,
   WorkspaceProviderRef,
   WorkspaceResourceState,
-  WorkspaceUnsupportedExecutionEvidence,
 } from "./types.ts";
 export {
   WORKSPACE_BINDING_SCHEMA_VERSION,

package/src/core/workflow/workspaces/local-git.ts

@@ -76,7 +76,6 @@ import { isWorkspaceAttestation } from "./validate.ts";
 const PROVIDER_ID = "local-git-worktree";
 const PROVIDER_VERSION = "1";
 const WORKSPACE_PARENT_SEGMENT = ".harnery-workspaces";
-const LEGACY_WORKSPACE_PARENT_SEGMENT = "harnery-workspaces";
 const LOCK_STALE_MS = 5 * 60 * 1_000;
 const OBJECT_FORMAT = /^[a-f0-9]{40,64}$/;
 const REF_FORMAT = /^refs\/heads\/[A-Za-z0-9][A-Za-z0-9._/-]{0,180}$/;
@@ -308,7 +307,7 @@ async function allocate(
  */
 function claimedParentSegment(claim: WorkspaceClaim): string {
   const segment = basename(dirname(claim.workspace_root));
-  if (segment !== WORKSPACE_PARENT_SEGMENT && segment !== LEGACY_WORKSPACE_PARENT_SEGMENT) {
+  if (segment !== WORKSPACE_PARENT_SEGMENT) {
     throw new Error("claimed workspace path is not under a provider-owned workspace parent");
   }
   return segment;

package/src/core/workflow/workspaces/paths.ts

@@ -9,11 +9,11 @@ import {
   statSync,
 } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
-import type { FilesystemIdentity, ValidatedFilesystemRoot } from "./types.ts";
+import type { FilesystemIdentity, ValidatedFilesystemPath } from "./types.ts";
 
 const WINDOWS_AMBIGUOUS = /[<>:"|?*]|[ .]$/;
 
-export type ValidatedRoot = ValidatedFilesystemRoot;
+export type ValidatedRoot = ValidatedFilesystemPath;
 
 export interface OpenContainedDirectory {
   path: string;

package/src/core/workflow/workspaces/types.ts

@@ -21,9 +21,6 @@ export interface ValidatedFilesystemPath {
   identity: FilesystemIdentity;
 }
 
-/** @deprecated Use ValidatedFilesystemPath. */
-export type ValidatedFilesystemRoot = ValidatedFilesystemPath;
-
 export interface WorkspaceProviderRef {
   id: string;
   version: string;
@@ -184,9 +181,6 @@ export type WorkspaceProofOutcome =
   | "blocked"
   | "lost";
 
-/** @deprecated Use WorkspaceProofOutcome. */
-export type WorkspaceProofLifecycleState = WorkspaceProofOutcome;
-
 export type WorkspaceResourceState = "active" | "preserved_dirty" | "released" | "blocked" | "lost";
 
 export type WorkspaceIntegrationState = "none" | "planned" | "applying" | "applied";
@@ -492,9 +486,6 @@ export interface WorkspaceCompatibilityExecutionEvidence {
   receipts: Record<string, never>;
 }
 
-/** @deprecated Use WorkspaceCompatibilityExecutionEvidence. */
-export type WorkspaceUnsupportedExecutionEvidence = WorkspaceCompatibilityExecutionEvidence;
-
 export type WorkspaceExecutionEvidence =
   | WorkspaceBoundExecutionEvidence
   | WorkspaceCompatibilityExecutionEvidence;

package/src/core/workflow/workspaces/validate.ts

@@ -11,7 +11,6 @@ import type {
   WorkspaceCompatibilityExecutionEvidence,
   WorkspaceExecutionEvidence,
   WorkspaceOwner,
-  WorkspaceProofLifecycleState,
   WorkspaceProofOutcome,
 } from "./types.ts";
 
@@ -376,7 +375,7 @@ function workspaceCwdMatchesBinding(
 }
 
 function validWorkspaceProofOutcome(
-  outcome: WorkspaceProofLifecycleState,
+  outcome: WorkspaceProofOutcome,
   attestation: WorkspaceAttestation,
   workflowStatus?: "succeeded" | "failed",
 ): boolean {
@@ -420,9 +419,6 @@ export function isWorkspaceCompatibilityExecutionEvidence(
   );
 }
 
-/** @deprecated Use isWorkspaceCompatibilityExecutionEvidence. */
-export const isWorkspaceUnsupportedExecutionEvidence = isWorkspaceCompatibilityExecutionEvidence;
-
 function sameOwner(left: WorkspaceOwner, right: WorkspaceOwner): boolean {
   return (
     left.kind === right.kind &&