packages/forkhorse-gatekeeper/FH-065b-CHECKPOINT.md

1# FH-065b integration checkpoint
2
3Status: production wiring and context reconciliation implemented. Acceptance
4remains open; this is not approval to merge or deploy.
5
6Accepted Stable dependency: `5fb494946ddabe0a732daf5a1b668a677c7970a7`.
7Plain merge: `4a13b72a61a3d33897cfd8c8dc940b199c07fc5e`, parents
8`b6a5a09c0a216ede0ab173821051d430a61a5acb` and the accepted dependency.
9No newer main was merged. Task-owned changes remain in this package.
10
11## Implemented
12
13- The production fork session exposes context, join, claim, release, requestReview,
14  readReview and readReceipts. It consumes the accepted Stable records and
15  stored-key credential provider. Every HTTP request obtains its bearer through
16  that provider, with account generation checks around asynchronous work.
17- Context combines core state and authenticated work. Receipt reads project the
18  agent-visible review summary, never the owner-only receipt log route.
19- Join requests a 60-second grant and discards its entire token-bearing response.
20  No Git token is returned, persisted in an action, or included in an error.
21- Writes persist their intent before queue submission and reauthorize at apply.
22  Interrupted submissions reuse the same action ID. Once an external request is
23  sent, fresh context reconciles natural evidence against stored intent. Applied
24  outcomes clear the fence; confirmed absence permits one retry; ambiguity or
25  exhausted retries retain the fence. Join requires one new agent fork, and push
26  requires the exact approved head. Reads never resend writes.
27- Claim, race entry, join, push, request review and release each have an eligible
28  action kind. Core packet mode selects claim versus race entry and is checked
29  again at apply. Only the OS's user-controlled per-kind rules decide approval.
30- Push and workflow writes share one serial queue and action counter. Unresolved
31  writes block further writes; existing queued pushes retain their dispatcher.
32- Code Mode declarations compose the accepted Stable source with both session
33  interfaces. Resource descriptions and the picker use the accepted address
34  helper. Account cards show the verified agent, and Ask an agent prefills the
35  concrete contribution workflow. Human approvals use seven-character commits
36  while payloads keep full SHAs; join/race copy names the actual agent.
37
38## Focused evidence
39
40The native workerd tests exercise production gatekeeper/account RPC and real
41Durable Object storage against mocked core HTTP. They verify provider bearer
42use, each verb's route/body, join TTL and token containment, observation calls,
43separate action kinds, claim/race classification, pending-action conflicts,
44revocation, lost queue replies, all six reconciliation kinds, bounded retries,
45missing/ambiguous evidence and serialization against in-flight writes. These are local
46fixture results, not live core, Cloudflare OS or Artifacts acceptance.
47
48Successful commands:
49
50- `pnpm install --frozen-lockfile` — exit 0.
51- `pnpm --dir cloudflare-os install --frozen-lockfile` — exit 0.
52- `pnpm --filter forkhorse-gatekeeper test` — exit 0; 19 Node tests and 57
53  workerd tests across 6 files pass. Existing negative native RPC rejection/hang
54  diagnostics remain in output; passing tests do not assert clean runtime logs.
55- `pnpm exec vp lint packages/forkhorse-gatekeeper` — exit 0.
56- `pnpm --filter forkhorse-gatekeeper build` — exit 0, including both typechecks,
57  the production Worker and three self-contained frame checks. Existing mixed
58  JSON import-attribute warning remains.
59
60The focused commands use `pnpm_config_verify_deps_before_run=false` after the
61frozen installation to avoid an environment-specific dependency-store recheck.
62The native runtime suite caught and verified the correction of an iterator
63assumption that the earlier Map fixture did not expose.
64
65## Open gates
66
671. The v0 queued-result adapter contract is confirmed: workflow writes return
68   `Promise<void>` with `awaitDecision: true`, then context supplies the applied
69   result. Stable's applied-result interfaces are unchanged.
702. Root test/lint, fresh-clone acceptance and D5 are assigned to the operator's
71   fresh-clone review; this builder is explicitly exempt from those heavy suites.
723. The designated copy reviewer must recheck the requested string-only diff.
734. The live Cloudflare OS builder loop follows operator merge and deployment.
74   Local mocked HTTP/workerd evidence does not satisfy that gate.
75
76The assigned live packet and original fork are retained for publication and
77review. No second join, core or upstream changes, live OS rule changes, canonical
78write, or deployment are included.
79