feat(effects): add resource-controlled trusted writes

CHANGELOG.md

@@ -2,6 +2,40 @@
 
 All notable changes to taskflow are documented here. This project follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) format.
 
+## [0.3.0] — Unreleased (Trusted Effects candidate)
+
+> **Version plan:** keep published packages at **0.2.7** until a human cuts `v0.3.0`.
+> Branch: `feat/0.3.0-trusted-effects`. **Not GA until tag + publish.**
+
+### Added
+
+- **Trusted Effects MVP** (`packages/taskflow-core/src/effects/`):
+  - EffectIR (`EFFECT_KINDS`), PathRef reuse, SecretRef/ServiceRef (type-only fail-closed)
+  - closed TypeBox EffectIR + confidentiality/integrity source-to-sink validation
+  - resource-controlled FS transaction: durable snapshot → persistent lease → journal intent/permit → stage → Commit or Restore+Reject
+  - declaration-only bridge in `effects/runtime-apply.ts`; no second changeset/gateway authority
+  - ledger-backed `whyAuthorized` / `whyContext` / `whyEffect`
+- Optional phase `effects[]`; FlowIR translate/compile/hash include effects
+- Built-in `detectEffectsIssues` (category `effects`) + `effectsLintVerifier`
+- Every imperative phase fast path finalizes declared `fs.write` through the resource transaction; event-kernel-enabled runs use the same safe imperative path
+- Honest host baseline: `conformance/workspace/host-support-baseline.json`
+- Docs: `docs/internal/0.3.0-trusted-effects-mvp.md`, `0.3.0-agent-goal.md`, `0.3.0-ga-scoreboard.md`
+- Example: `examples/trusted-effects-write.json`
+- Tests: `test/effects*.test.ts`, `test/verify-effects.test.ts`
+
+### Fixed
+
+- Resource-bearing inline/saved/expanded/`ctx_spawn` children can no longer be skipped by parent cache or resume reuse.
+- Information-flow labels compose across nested flow boundaries; unresolved dynamic definitions remain tainted, malformed non-array `effects` fail admission/compile, and `why-effect` follows DAG dependencies.
+- Durable commit/abort results survive staging/lease cleanup faults, activation double faults release leases, and clean-terminal/aged-orphan before-images are garbage-collected.
+
+### Notes
+
+- SecretRef/ServiceRef have **no** vault/network backends in this cut.
+- Resolve-only is not an OS sandbox. Direct writes to declared targets are detected and restored; writes outside declared targets remain host-policy dependent.
+- Historical Control Plane (`feat/0.3.0`) is **not** this release definition.
+- **Not released; not GA.**
+
 ## [0.2.7] — 2026-08-06
 
 ### Added

conformance/workspace/host-support-baseline.json

@@ -1,5 +1,79 @@
 {
   "schemaVersion": 1,
-  "baselineId": "taskflow-workspace-proposed-v1",
-  "cells": []
+  "baselineId": "taskflow-workspace-trusted-effects-v0.3.0-mvp",
+  "notes": "Honest cells for 0.3 Trusted Effects MVP. resolve-only is not a FileBroker sandbox. Empty claims removed.",
+  "cells": [
+    {
+      "host": "pi",
+      "resourceDomain": "filesystem",
+      "capability": "pathref-resolve",
+      "status": "supported",
+      "guarantee": "resolve-only",
+      "evidence": "packages/taskflow-core/src/resources/execution.ts"
+    },
+    {
+      "host": "codex",
+      "resourceDomain": "filesystem",
+      "capability": "pathref-resolve",
+      "status": "supported",
+      "guarantee": "resolve-only",
+      "evidence": "packages/taskflow-core/src/resources/execution.ts"
+    },
+    {
+      "host": "claude",
+      "resourceDomain": "filesystem",
+      "capability": "pathref-resolve",
+      "status": "supported",
+      "guarantee": "resolve-only",
+      "evidence": "packages/taskflow-core/src/resources/execution.ts"
+    },
+    {
+      "host": "opencode",
+      "resourceDomain": "filesystem",
+      "capability": "pathref-resolve",
+      "status": "supported",
+      "guarantee": "resolve-only",
+      "evidence": "packages/taskflow-core/src/resources/execution.ts"
+    },
+    {
+      "host": "grok",
+      "resourceDomain": "filesystem",
+      "capability": "pathref-resolve",
+      "status": "supported",
+      "guarantee": "resolve-only",
+      "evidence": "packages/taskflow-core/src/resources/execution.ts"
+    },
+    {
+      "host": "*",
+      "resourceDomain": "filesystem",
+      "capability": "file-broker",
+      "status": "unsupported",
+      "guarantee": "none",
+      "evidence": "No host has passed FileBroker adversarial baseline; do not claim sandbox."
+    },
+    {
+      "host": "node-local",
+      "resourceDomain": "filesystem",
+      "capability": "trusted-effects-resource-transaction",
+      "status": "supported",
+      "guarantee": "pathref-lease-journal-permit-commit-or-restore",
+      "evidence": "packages/taskflow-core/src/resources/file-transaction.ts + test/resource-file-transaction.test.ts"
+    },
+    {
+      "host": "*",
+      "resourceDomain": "secret",
+      "capability": "secretref-backend",
+      "status": "unsupported",
+      "guarantee": "type-only-fail-closed",
+      "evidence": "SecretRef validated; no vault adapter in 0.3 MVP"
+    },
+    {
+      "host": "*",
+      "resourceDomain": "service",
+      "capability": "serviceref-adapter",
+      "status": "unsupported",
+      "guarantee": "type-only-fail-closed",
+      "evidence": "ServiceRef validated; no live adapter in 0.3 MVP"
+    }
+  ]
 }

docs/internal/0.3.0-agent-goal.md

@@ -0,0 +1,119 @@
+# Agent Goal — Taskflow 0.3 Trusted Effects → Closed-Loop GA
+
+> **Owner:** coding agent (this session and successors)
+> **Branch:** `feat/0.3.0-trusted-effects`
+> **Base:** `main` @ v0.2.7
+> **Normative product freeze:** [`0.3.0-trusted-effects-mvp.md`](./0.3.0-trusted-effects-mvp.md)
+> **Scoreboard:** [`0.3.0-ga-scoreboard.md`](./0.3.0-ga-scoreboard.md)
+> **Convergence workflow:** `tf-03-ga-converge` (`~/.grok/workflows/tf-03-ga-converge.rhai`)
+
+---
+
+## 1. Mission (one sentence)
+
+> **Drive Trusted Effects MVP from code-on-branch to honest closed-loop GA: every declared FS write effect is validated and finalized through the existing resources authority (PathRef, lease, journal, permit); eight deliverables are contract-tested; real host evidence is green; release candidate is cut — without claiming Control Plane / Adaptive / Retain as 0.3.**
+
+## 2. Success = L6 GA only when all below hold
+
+| ID | Requirement | Evidence |
+|----|-------------|----------|
+| G1 | Eight MVP deliverables each `pass` on scoreboard | scoreboard table |
+| G2 | `effects-trusted` + related unit suite green | test command exit 0 |
+| G3 | `pnpm run typecheck` (or package-filtered equivalent) green on branch | log |
+| G4 | Real host/fixture e2e applies a declared write through the resources ledger | terminal host evidence |
+| G5 | Runtime path: declared `fs.write` cannot bypass PathRef/lease/journal/permit authority; bypass restores exact pre-state | code + adversarial test |
+| G6 | Host baseline honest (no FileBroker claim without proof) | conformance JSON |
+| G7 | CHANGELOG Unreleased → versioned; root package version plan for 0.3.0 | CHANGELOG + package.json |
+| G8 | Branch pushed; CI green on clean candidate; tag only after G1–G7 | remote |
+
+**Forbidden claims until G1–G8:**
+
+- “0.3 GA” / “shipped” / “ready for everyone”
+- Equating historical `feat/0.3.0` Control Plane with this GA
+- Auto-tune / Retain / Adaptive as 0.3 scope
+
+## 3. Operating loop (how I work)
+
+```text
+forever until L6:
+  1. AUDIT    scoreboard + git + tests  → list gaps (ordered)
+  2. FAN-OUT  parallel implementers on non-overlapping files
+  3. VERIFY   effects tests + typecheck subset + e2e fixture
+  4. RECORD   update scoreboard (PASS/PARTIAL/FAIL + evidence)
+  5. DECIDE   if L6 ready → stop and ask human for release authority
+              else → next wave (workflow re-run)
+```
+
+**Parallel policy**
+
+- Prefer **file ownership** per agent (effects / verify / runtime / docs / e2e).
+- Max parallel implementers per wave: **5** (plus 1 auditor + 1 verifier).
+- Do **not** merge Control Plane monolith into this branch as a blocker.
+- Prefer small commits when human asks; default keep working tree until wave stable.
+
+**Workflows**
+
+| Name | Role |
+|------|------|
+| `tf-03-trusted-effects` | Initial wire / inventory (may still be running) |
+| `tf-03-ga-converge` | **Primary loop:** audit → parallel fill gaps → verify → scoreboard |
+
+Re-run: `/workflow` launch `tf-03-ga-converge` with high `agent_budget` (up to 1024).
+Same-process resume if paused for human release authority only.
+
+## 4. Wave plan (ordered, not optional)
+
+| Wave | Goal | Exit criteria |
+|------|------|----------------|
+| **W0** Freeze | Definition + branch | doc + branch exist ✅ |
+| **W1** Kernel | types, closed validate, resources transaction, ledger why | unit vertical slice |
+| **W2** Contract wire | schema, FlowIR, hash, effects verifier | verify + hash tests |
+| **W3** Runtime force | every phase kind routes declared writes through resources | bypass/fast-path tests fail closed |
+| **W4** Fixture e2e | no-LLM end-to-end under `test/` or `examples/` | L4 for MVP story |
+| **W5** Package honesty | versions, CHANGELOG, skills note, baseline | release-ready docs |
+| **W6** Candidate | full typecheck/test, push, CI | L5 evidence |
+| **W7** GA | human tag + publish decision | L6 |
+
+Current wave target after W1–W4 closure: **W5 package honesty + W6 clean candidate / remote CI**.
+
+## 5. Acceptance Gate (live)
+
+Update [`0.3.0-ga-scoreboard.md`](./0.3.0-ga-scoreboard.md) every wave. Template:
+
+| Level | Meaning for 0.3 TE |
+|-------|---------------------|
+| L1 local | effects code + tests on branch |
+| L2 contract | 8 deliverables + schema/verify/hash |
+| L3 N/A | no browser product for this MVP |
+| L4 real-environment | actual host invocation with durable ledger readback |
+| L5 released | tag + npm (or explicit monorepo release) |
+| L6 ga | L5 + scoreboard all pass + no dual-path lies |
+
+## 6. Standing orders
+
+1. **Truth over speed** — never promote PARTIAL to PASS without evidence path.
+2. **MVP over Control Plane** — ignore daemon/P13–P16 for this GA definition.
+3. **Fail closed** — unknown effect kinds, secret material, path overlap = error.
+4. **One claim band** — user-facing language ≤ Highest proven level.
+5. **Human for L5/L6** — agent prepares candidate; human authorizes tag/publish.
+
+## 7. Commands (agent cheat sheet)
+
+```bash
+# Focused suite
+PI_TASKFLOW_BUILTIN_AGENTS_DIR= node --conditions=development \
+  --experimental-strip-types --test 'packages/taskflow-core/test/effects*.test.ts'
+
+# Broader core (when wave allows)
+pnpm --filter taskflow-core test   # if script exists
+pnpm run typecheck
+
+# Scoreboard
+# edit docs/internal/0.3.0-ga-scoreboard.md after each wave
+```
+
+## 8. Stop condition
+
+- **Hard stop success:** L6 checklist complete and human accepted release.
+- **Hard stop blocked:** product redefines 0.3 away from Trusted Effects — rewrite freeze first.
+- **Soft continue:** any PARTIAL/FAIL on G1–G6 → another `tf-03-ga-converge` wave.

docs/internal/0.3.0-ga-scoreboard.md

@@ -0,0 +1,84 @@
+# 0.3 Trusted Effects — GA Scoreboard
+
+> Living ledger. **Do not claim GA** unless L6 is PASS with human tag evidence.
+
+**Last updated:** 2026-08-08 (post-review correctness hardening; local contract evidence only)
+**Branch:** `codex/0.3.0-trusted-effects-candidate`
+**Code candidate:** `60126954` (scoreboard follow-up excluded)
+**Current evidence:** focused effects/resources/FlowIR suite 99/99; full monorepo typecheck PASS; full unit suite 2198/2198 PASS; full build PASS. These checks cover the post-review cache/composition, information-flow, malformed-admission, cleanup/lease, and before-image GC fixes. Exact-SHA remote CI and live-host E2E have **not** yet been rerun for `60126954`. Historical evidence remains: Draft PR #117 CI run 31167592775 passed all 10 matrix jobs plus GitHub CodeQL on `1478510f`; the prior candidate also passed built Codex MCP 16/16 and a live Codex CLI A→B→C run.
+
+---
+
+## Acceptance Gate
+
+| Level | Status | Evidence | Notes |
+|-------|--------|----------|-------|
+| L1 local | **PASS** | `60126954`: focused 99/99 + monorepo typecheck PASS | post-review fixes committed |
+| L2 contract | **PASS** | `60126954`: full unit suite 2198/2198 + full build PASS | exact-SHA remote CI not yet evidenced; prior CI was on `1478510f` |
+| L3 browser/electron | **N/A** | — | |
+| L4 real-environment | **NOT_RUN** | no live-host rerun on `60126954` | prior candidate had scoped live Codex + built MCP evidence; it is not exact-current-SHA proof |
+| L5 released | **FAIL** | no tag/publish | human gate |
+| L6 ga | **FAIL** | L5 missing | **NOT GA** |
+
+**Highest proven for the current code candidate:** **L2 contract**.
+**User-facing claim allowed:** *The post-review Trusted Effects candidate is local/contract green for admitted declared FS-write targets; current-SHA remote CI, live-host, release, and GA gates remain open.*
+**G5 status:** **contract pass for admitted declared targets** — PathRef escape, direct-write restore, crash recovery, multi-file rollback, terminal cleanup failure, activation/journal double-fault lease release, before-image GC, gate fast path, cross-run/dynamic-spawn cache bypass, and event-kernel fallback are adversarially covered. Resolve-only execution does not prevent or restore writes to undeclared paths; that requires a future FileBroker/native sandbox and is not a 0.3 MVP claim.
+
+---
+
+## Eight deliverables
+
+| # | Deliverable | Status | Evidence |
+|---|-------------|--------|----------|
+| 1 | EffectIR | **pass** | closed TypeBox schema; translate/compile diagnostics; invalid IR receives no canonical hash |
+| 2 | PathRef / SecretRef / ServiceRef | **pass** | typed refs; unsupported secret/service backends fail before body execution |
+| 3 | labels | **pass** | compositional source/sink summaries cover `flow.def`, saved `use`, `expand`, and unresolved dynamic definitions in schema, verifier, compiler, and runtime |
+| 4 | resource transaction | **pass** | durable snapshot/intent/permit + Commit-or-Restore + non-throwing post-terminal cleanup + process-crash recovery/GC |
+| 5 | single mutation authority | **pass** | legacy changeset/gateway authority removed; effects bridge delegates to resources |
+| 6 | mutating-path overlap | **pass** | phase-local static overlap + persistent cross-session/run lease admission |
+| 7 | host matrix | **pass (honest)** | five hosts explicitly resolve-only; FileBroker/secret/service cells explicitly unsupported |
+| 8 | why-* | **pass** | DAG-consistent explanation avoids invented independent-phase dependencies; ledger readback derives principal/capability/intent/generation |
+
+---
+
+## Wave log
+
+| Wave | Result |
+|------|--------|
+| Resource convergence | single resources authority; focused + full contract PASS |
+| Information flow | transitive DAG labels wired through validate/verify/compile/runtime; false-edge regression covered |
+| Real host | live Codex three-agent run persisted final output through resource transaction; ledger authorization PASS |
+| Remote candidate | Draft PR #117; run 31167592775 passed all CI jobs on `1478510f` |
+| Post-review hardening | composition/cache and dynamic-spawn taint; nested information flow; malformed `effects`; terminal cleanup/lease safety; terminal/orphan before-image GC; local contract PASS on `60126954` |
+
+## Explicitly deferred non-blocker
+
+The append-only resource journal still lacks a sharded/compacted projection designed for thousands of intents, and long-lived control-file scale has not been benchmarked. That is a performance/capacity limitation, not a Commit-or-Reject exception in the current bounded MVP. Full before-image bodies are now removed after durable clean terminal states, and aged pre-intent orphans are collected at startup; no high-scale journal claim is made for 0.3.
+
+---
+
+## Commands last green
+
+```text
+PI_TASKFLOW_BUILTIN_AGENTS_DIR= node --conditions=development \
+  --experimental-strip-types --test \
+  'packages/taskflow-core/test/effects*.test.ts' \
+  packages/taskflow-core/test/resource-file-transaction.test.ts \
+  packages/taskflow-core/test/resource-journal.test.ts \
+  packages/taskflow-core/test/verify-effects.test.ts
+# → 99/99 pass (effects/resources/FlowIR focused set)
+
+pnpm run typecheck
+# → PASS
+
+pnpm test
+# → 2198/2198 PASS
+
+pnpm run build
+# → PASS across core, CharterArc, MCP, hosts, DSL, and five delivery packages
+
+# NOT RERUN on 60126954:
+# pnpm run test:e2e-codex-mcp-full
+# pnpm run test:e2e-codex
+# Prior-candidate historical evidence: built MCP 16/16 and live Codex A→B→C PASS.
+```

docs/internal/0.3.0-release-plan.md

@@ -0,0 +1,37 @@
+# 0.3.0 Trusted Effects — release plan (human gate)
+
+## Current state
+
+| Item | Value |
+|------|--------|
+| Branch | `codex/0.3.0-trusted-effects-candidate` |
+| Code candidate | `f55abde1` (evidence-only follow-up excluded) |
+| Highest proven | **L4** (local + contract + built MCP + live Codex Trusted Effects fixture) |
+| Remote candidate | Draft PR #117; exact-SHA CI run 31167592775 green on `1478510f` |
+| Package versions on npm | still **0.2.7** |
+| Tag | **none** |
+
+## Human checklist for L5 → L6
+
+1. Review scoreboard: `docs/internal/0.3.0-ga-scoreboard.md` (all 8 deliverables **pass**, L4 **pass**).
+2. Run locally:
+   ```bash
+   PI_TASKFLOW_BUILTIN_AGENTS_DIR= node --conditions=development \
+     --experimental-strip-types --test \
+     'packages/taskflow-core/test/effects*.test.ts' \
+     packages/taskflow-core/test/verify-effects.test.ts
+   pnpm run typecheck
+   pnpm test
+   pnpm run build
+   pnpm run test:e2e-codex-mcp-full
+   pnpm run test:e2e-codex
+   ```
+3. ~~Isolate a clean candidate, push the exact candidate SHA, and confirm CI green.~~ Done on Draft PR #117; the evidence-only follow-up must also finish exact-SHA CI before release authorization.
+4. Bump workspace package versions to `0.3.0` (root + publishable packages) via existing release scripts (`RELEASE.md`).
+5. Move CHANGELOG `## [0.3.0] — Unreleased` → dated release section.
+6. Tag `v0.3.0` and publish **only with explicit human authority**.
+7. Update scoreboard L5/L6 to PASS with tag URL + publish receipt.
+
+## Agent stop line
+
+Agents **must not** tag or npm publish. Stop at candidate + truthful scoreboard (L5/L6 FAIL until step 6–7).