Run session git and workflow lifecycle outside the TUI

[TheGreatAxios]

Summary

Session checkpoints and audit records go through isomorphic-git on one store object, signed with a per-session key as the interchange harness author. The wrapper never shells out to system git. Workflow start, resume, and complete live in a session host; the TUI only forwards slash gestures and flashes step or complete status.

Segmented JSONL recovery stays. Native @intx/workflow-host is not imported on this branch.

Verification

• bun run check passes (lint, typecheck, build, and the guarded suite: 6300 pass / 0 fail)

Related to CL-2172

[linear-code]

CL-2172

[TheGreatAxios]

Critic · Comment

Session checkpoints and audit go through one isomorphic-git store; workflow lifecycle lives in WorkflowHost, not the TUI.

Findings

• docs/ARCHITECTURE.md:201 — the branch says the TUI renders host status in the header (⟳ name · step/total label), but src/tui/product-host.ts:468-473 and src/tui/runtime-notices.ts:251-254 only flash workflow {name} · step {n}/{total}: {label} for RUNTIME_FLASH_MS. Grep for ⟳ under src/ is empty. Start /review and watch chrome after the flash TTL — no persistent ⟳ header remains.
• docs/IMPLEMENTATION.md:416-423 — the rewritten checkpoint paragraph still names createOptimizedContextStore and says git add re-hashes the active segment immediately after claiming the wrapper never shells out to system git. Production assembly calls createSessionStores (src/session/assemble-runtime.ts:429).
• src/session/commit-signer.ts:65-80 — first-time create uses writeFile(..., { flag: "wx" }) then on EEXIST immediately loadPersistedKeyPair. O_EXCL creates an empty inode before the write finishes, so the loser can JSON.parse a 0-byte/partial file and throw Invalid commit signing key. Two concurrent loadOrCreateCommitSigner(dir) on a directory with no key file yet.
• src/session/commit-signer.ts:20-25 (call at 51-54) — arktype and JSON.parse failures become Invalid commit signing key at ${filePath}; decodeKey still throws `${label} must be 32 bytes, got ${bytes.length}`. Valid JSON with a 16-byte privateKey base64 is the trigger.
• Commit 552a37b — message is “Format session store and documentation”. git show only prettier-wraps tests/store files. No documentation file is in the diff.

Notes

• No blocking defects. Native @intx/workflow-host is not imported.
• createOptimizedContextStore remains a shim that drops the audit handle; production uses createSessionStores.

[TheGreatAxios]

Primary · Approve

Session checkpoints and audit records go through isomorphic-git on one store object with a per-session signer. Workflow start, resume, and complete live in a session host; the TUI forwards slash gestures and flashes step or complete status.

Findings

• docs/ARCHITECTURE.md:201 — header copy still claims a persistent ⟳ name · step/total chrome; product-host only flashes for RUNTIME_FLASH_MS.
• docs/IMPLEMENTATION.md:416-423 — still names createOptimizedContextStore and git add in the same paragraph that says the wrapper never shells out to system git. Assembly uses createSessionStores.
• src/session/commit-signer.ts:65-80 — wx create then immediate EEXIST load can JSON.parse an empty inode under concurrent first-time signers.
• src/session/commit-signer.ts:20-25 — key-length failures from decodeKey skip the Invalid commit signing key at ${filePath} wrap.
• Commit 552a37b — subject says documentation is formatted; the diff is prettier wraps in tests/store only.

None of these block merge. The wx race is the follow-up I would take if session create starts throwing Invalid commit signing key.

Notes

• Rebased onto origin/main at 30d5ea8f. Conflict resolutions kept main's worker permission gate and interrupt rebuild, and this branch's shared isogit store plus WorkflowHost.
• Subjects pass the 72-character audit. Two bodies exceed 72 characters (30d5ea8f, f7bbda05).
• CI lint, typecheck, build, and test (src) are green on this SHA. Merge waits on test (tests-evals-and-scripts).

[TheGreatAxios]

Primary · Approve

Session checkpoints and audit records go through isomorphic-git on one store object with a per-session signer. Workflow start, resume, and complete live in a session host; the TUI forwards slash gestures and flashes step or complete status.

Findings

• docs/ARCHITECTURE.md:201 — header copy still claims a persistent ⟳ name · step/total chrome; product-host only flashes for RUNTIME_FLASH_MS.
• docs/IMPLEMENTATION.md:416-423 — still names createOptimizedContextStore and git add in the same paragraph that says the wrapper never shells out to system git. Assembly uses createSessionStores.
• src/session/commit-signer.ts:65-80 — wx create then immediate EEXIST load can JSON.parse an empty inode under concurrent first-time signers.
• src/session/commit-signer.ts:20-25 — key-length failures from decodeKey skip the Invalid commit signing key at ${filePath} wrap.
• Commit 552a37b — subject says documentation is formatted; the diff is prettier wraps in tests/store only.

None of these block merge. The wx race is the follow-up I would take if session create starts throwing Invalid commit signing key.

Notes

• Rebased onto origin/main at 30d5ea8f. Conflict resolutions kept main's worker permission gate and interrupt rebuild, and this branch's shared isogit store plus WorkflowHost.
• Subjects pass the 72-character audit. Two bodies exceed 72 characters (30d5ea8f, f7bbda05).
• CI lint, typecheck, build, and test (src) are green on this SHA. Merge waits on test (tests-evals-and-scripts).

[TheGreatAxios]

Critic · Comment

Session checkpoints and audit go through one isomorphic-git store; workflow lifecycle lives in WorkflowHost, not the TUI.

Findings

• docs/ARCHITECTURE.md:201 — the branch says the TUI renders host status in the header (⟳ name · step/total label), but src/tui/product-host.ts:468-473 and src/tui/runtime-notices.ts:251-254 only flash workflow {name} · step {n}/{total}: {label} for RUNTIME_FLASH_MS. Grep for ⟳ under src/ is empty. Start /review and watch chrome after the flash TTL — no persistent ⟳ header remains.
• docs/IMPLEMENTATION.md:416-423 — the rewritten checkpoint paragraph still names createOptimizedContextStore and says git add re-hashes the active segment immediately after claiming the wrapper never shells out to system git. Production assembly calls createSessionStores (src/session/assemble-runtime.ts:429).
• src/session/commit-signer.ts:65-80 — first-time create uses writeFile(..., { flag: "wx" }) then on EEXIST immediately loadPersistedKeyPair. O_EXCL creates an empty inode before the write finishes, so the loser can JSON.parse a 0-byte/partial file and throw Invalid commit signing key. Two concurrent loadOrCreateCommitSigner(dir) on a directory with no key file yet.
• src/session/commit-signer.ts:20-25 (call at 51-54) — arktype and JSON.parse failures become Invalid commit signing key at ${filePath}; decodeKey still throws `${label} must be 32 bytes, got ${bytes.length}`. Valid JSON with a 16-byte privateKey base64 is the trigger.
• Commit 552a37b — message is “Format session store and documentation”. git show only prettier-wraps tests/store files. No documentation file is in the diff.

Notes

• No blocking defects. Native @intx/workflow-host is not imported.
• createOptimizedContextStore remains a shim that drops the audit handle; production uses createSessionStores.