feat(workflow): ground blocker transitions

[trvon]

Summary

Convert the blocker-reconciliation experiment into production workflow transition admission.

• require a typed, trusted blocker claim before entering a paused terminal state
• resolve bounded observations outside the LoopStore lock
• recheck runtime/store/workspace identity and use existing state/revision/execution CAS before mutation
• provide a built-in monitor provider for status, exitCode, and stopReason; raw output is never evidence
• fail user-authority claims closed because no authority provider is built in
• persist only a bounded transition admission receipt, not pending proposals or a general ledger
• persist distinct pause provenance for semantic terminal, administrative, controller-limit, and orchestration-settlement pauses
• explicitly resubmit after restart; no automatic pending-intent recovery

The original test-only helper and experiment suite were removed after their replay, conflict, expiry/error, authority, byte-preservation, race, and restart cases were ported to production tests.

Trust and authority boundaries

1. WorkflowTransition snapshots workflow/state/revision/execution plus an independently sourced workspace context.
2. Trusted providers observe outside the store lock.
3. Observation freshness is checked after provider execution.
4. Runtime actor, store identity, and context digest are rechecked.
5. LoopStore/workflow reducer rejects any paused-terminal mutation without a valid bounded admission receipt.
6. Existing CAS rejects concurrent transitions or revisions.

Admission verifies an exact fact, not whether that fact should be policy. The workflow author's declared edge remains the policy boundary. Machine evidence never grants user consent or authority.

Pause provenance

New pauses record one of:

• semantic_terminal
• administrative
• controller_limit
• orchestration_settlement

Legacy paused snapshots remain valid and may be unattributed. Malformed new pause/admission provenance fails closed during load. LoopList displays available cause and admission details.

Review hardening

Addressed the earlier Copilot findings:

• conflict detection and final comparison both use Object.is, including 0 versus -0
• workspace/runtime context is independent from the claim and replay-tested across every context dimension

A separate adversarial implementation review found and fixed:

• freshness was previously checked against the pre-provider timestamp; decision time is now recaptured after provider execution
• string fact values were unbounded; tool, runtime, and persisted receipt validation now cap them at 1,024 characters

Validation

• npm run lint — four established optional-chain warnings only
• npm run typecheck
• npm test — 51 files, 792 tests
• npm run build
• npm run test:package — 112 files
• npm audit --audit-level=moderate — 0 vulnerabilities
• git diff --check
• pre-push coverage — 89.59% statements, 82.84% branches, 96.26% functions, 94.37% lines
• workflow live harness builds; live model execution remains opt-in through PI_LOOP_LIVE_MODEL

Remaining limits

• only monitor facts have a built-in provider
• no built-in user-authority provider
• no automatic restart resume, duplicate-prompt suppression, or persisted pending proposal
• no general evidence ledger

Closes no issue automatically; keep open for review until current Linux, Windows, and CodeQL checks settle.

[Copilot]

🟡 Changes recommended

The reconciliation helper has a confirmed logic mismatch (conflict detection vs Object.is decision semantics) and a likely ineffective context-digest stale-check that should be resolved to keep the experiment’s results trustworthy.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a provider-neutral, test-only “claim/observe/decide” reconciliation experiment around workflow blocker handling, and exercises the real LoopStore.transitionWorkflow CAS path while asserting file-backed LoopStore/TaskStore byte stability. This fits into the codebase’s workflow contract validation by probing reconciliation edge-cases without changing production code.

Changes:

• Introduces a new test-only reconciliation helper (reconcileClaim + attemptClaimedTransition) for claimed blocker admission.
• Adds a Vitest suite covering contradiction, authority scoping, monitor-shaped facts, abstention/errors/conflicts, expiry/context mismatch, malformed provenance, competing transitions, and admin pause distinction.

File summaries

File	Description
test/experiments/blocker-reconciliation-experiment.ts	Adds the test-only reconciliation types and logic, plus a helper that gates actual LoopStore.transitionWorkflow via a confirmed claim.
test/blocker-reconciliation-experiment.test.ts	Adds end-to-end tests that drive the experiment and assert CAS behavior plus on-disk byte preservation.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[trvon]

Refinement complete at ca19ac6 (still not a production fix and intentionally left open/unmerged). The new evidence supports synchronous, CAS-fenced admission with explicit resubmission as sufficient for state-machine correctness. It does not establish product semantics for automatic restart resume or pause-cause attribution. Current persisted state identifies semantic terminal pause but only classifies direct pause as nonsemantic/unattributed. A bounded proposal/cause record should be explored only if automatic resume, duplicate-prompt suppression, or durable pause attribution becomes a requirement; no evidence supports a general ledger. Current Linux, Windows, and CodeQL checks pass.