feat(flowsafe): Track F — goals (M-005)

[gcharang]

Wave 5/7 of the long-running-agents program (plan M-005, DL-018/DL-007/DL-006). Smallest track: the goal objective surface over Track C's already-merged mastra_thread_state domain — no new table, no schema-guard/purge/TTL change, additive-only, opt-in.

What ships

• @proofoftech/flowsafe/goals (new subpath): createObjectiveRouter — role-gated + audited set/get/update/clear (PUT/GET/PATCH/DELETE /api/threads/:threadId/goal) over the thread-scoped goal record (GOAL_STATE_TYPE 'goal'), persisting through core's OWN writeObjective/readObjective/clearObjective so the stored shape is byte-identical to what the durable goal step reads via resolveGoalStore (DL-018 premise proven on workerd).
• P6-lite ingestion gate (an objective is a standing instruction injected into future model turns): resolve → INV-3 → coarse role on mutations → thread-prefix ownership 404 (no existence oracle) → size cap → assertNoClientMemoryIds → field allowlist → maxRuns cap; audited on accept and EVERY post-auth denial (pre-auth 401 un-audited).
• maxRuns host cap (DL-007): over-cap REJECTED (400), never clamped; default = core DEFAULT_GOAL_MAX_RUNS (50); Track F starts NO runs — run budgets stay at the existing seams.
• GOAL_REQUEST_CONTEXT_KEY ('mastra:goal') reserved: mirrored (NOT exports-reachable in core 1.50.0 — verified against the exports map), no-collision-pinned against the #requestContextFor base keys AND drift-pinned against the core dist declaration (a core bump changing the value fails loudly).
• Opt-in worker seam buildObjectiveRouter in createFlowsafeWorker (mirrors Track C's buildSignalRouter); absent ⇒ byte-identical hosts.
• Spike steps K/L/M (F-S1/F-S3/F-S2) in spike:verify on real workerd+D1: route-write → durable read-path round-trip; cross-tenant 404 + over-cap 400 both audited; objective survives kill+restart.
• P8 intact: goals never touch requestContext, never mint capability; grants/approvals untouched.

Verification

• Gate: lint + typecheck + 1663 tests (84 files) + build + spike:verify (scenario ladder A–M) — all green, run twice (implementer + independent orchestrator re-run).
• 3-lane review on the final tree: quality CLEAN, architect SOUND (delta re-verified CONFIRMED), adversarial QA PASS (14 probes: no-oracle 404s incl. encoded/system_ ids, prototype-pollution bodies, maxRuns boundary sweep, capability hygiene, spike-restart integrity).
• Review fixes folded in: dist drift-pin test for the mirrored constant (replaces an inaccurate canary claim), blank-judgeModelId rejection, explicit write-serialization documentation (update is a non-atomic RMW at the Worker — core-parity, within-tenant).

Follow-up notes (reviewer LOWs, deliberately not fixed here)

• The 500 catch-all is un-audited and echoes error.message — the shared convention across all four routers; candidate for one cross-cutting hardening pass, not a per-track divergence.
• Body size cap is measured after a full request.text() read (same as signals; bounded by the platform request limit).
• An objective write is accepted for an owned-prefix threadId with no memory-backed thread (orphan record; tenant-bounded, reaped by the thread-state TTL / purgeTenant).

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	anchorage-showcase	6c80e92	Jul 17 2026, 05:45 PM