Add an isolated managed Git workspace service

[zhiiw]

Summary

Introduce a narrow managed Git workspace service that owns only Maka-internal repositories, epoch artifacts, and private worktrees.

• Require an explicit Git executable and verify its SHA-256 before every Git invocation.
• Separate source-backed creation from binding-backed reopen; an established epoch no longer depends on the current source checkout HEAD or dirty state.
• Separate repository capability records from epoch baseline artifacts so one managed repository can retain multiple epochs.
• Revalidate the source immediately before publishing the epoch artifact and reject a source that changed during import.
• Create and verify a Maka ownership lock for each linked worktree.
• Create baseline/head refs with compare-and-swap semantics; an existing conflicting ref is never overwritten.
• Reject source alternates and unsafe Git indirection, and disable replace objects, lazy fetch, fsmonitor, auto-GC, recursive submodules, credentials, and hooks in the managed runtime profile.
• Detect unsupported source state or managed-worktree drift and fail closed or quarantine without falling back to attached execution.

Why

Runtime resume needs an isolated workspace artifact owner before a later composition layer can bind canonical RuntimeEvents to Git state. Sharing the user's checkout cannot provide that isolation.

This PR establishes only the artifact lifecycle. It does not write RuntimeEvents, accept a canonical workspace version, or expose the worktree to tools.

Invariant and ownership

The service may create, verify, reopen, quarantine, and clean up artifacts only inside the Maka-owned storage namespace. Once an epoch artifact exists, the source checkout is historical provenance rather than reopen authority.

• Owner: packages/storage managed Git workspace service
• Repository record: one object universe and runtime capability
• Epoch artifact: one source observation and immutable baseline continuity
• Instance binding: one private linked worktree and ownership lock
• Failure state: unsupported source, invalid Git provenance, ref conflict, binding corruption, missing lock, or drift fails closed
• Rollback: there is no production consumer; removing this service does not migrate user execution state

Fault model

The current proof covers process-crash convergence. JSON control records fsync the temporary file and, on POSIX, the parent directory. This PR does not claim complete power-loss durability for every Git object/ref write or a full bundled-Git runtime manifest. Those guarantees belong to the bundled Git installation and Baseline Open composition layers.

Scope limits

This PR intentionally does not add:

• workspace RuntimeEvent facts, canonical workspace heads, or a verified baseline receipt;
• Desktop, CLI, runtime-host, or tool integration;
• source synchronization, merge, publish, Write/Edit transactions, or crash resume;
• ignored/untracked dependency environments, LFS, submodules, symlinks, attributes, or unsupported materialization filters;
• automatic changes to the user's checkout.

Validation

• npm run build --workspace @maka/storage
• node --test packages/storage/dist/__tests__/git-workspace-service.test.js
• 28/28 focused tests passed, including package-surface sealing, source-independent reopen, multiple epochs in one repository, source-race rejection, worktree ownership lock validation, ref-CAS conflict rejection, concurrent adoption, create/quarantine process-crash convergence, normalized unsafe-source config rejection, source isolation, and drift quarantine.

中文说明

概要

新增职责单一的 managed Git workspace service，只管理 Maka 内部 repository、epoch artifact 与 private worktree。

• Git executable 必须显式提供，并在每次 Git 调用前重新校验 SHA-256。
• 创建路径与基于 durable binding 的 reopen 路径分离；epoch 建立后不再依赖当前 source checkout 的 HEAD 或 dirty 状态。
• repository capability record 与 epoch baseline artifact 分离，同一个 managed repository 可以保存多个 epoch。
• epoch artifact 发布前再次观察 source；导入期间 source 改变时明确拒绝。
• 每个 linked worktree 都建立并验证 Maka ownership lock。
• baseline/head ref 使用 compare-and-swap；冲突 ref 永不被覆盖。
• 拒绝 source alternates 与危险 Git indirection，并关闭 replace object、lazy fetch、fsmonitor、auto-GC、递归 submodule、credential 与 hook 影响面。
• source 不合格或 managed worktree drift 时 fail closed/quarantine，不回退 attached execution。

不变量与边界

服务只能在 Maka-owned storage namespace 内创建、验证、reopen、quarantine 和清理 artifact。epoch artifact 一旦存在，source checkout 只保留历史 provenance，不再拥有 reopen authority。

• Owner： packages/storage managed Git workspace service
• Repository record： object universe 与 runtime capability
• Epoch artifact： source observation 与 immutable baseline continuity
• Instance binding： private linked worktree 与 ownership lock
• 失败状态： source 不支持、Git provenance 无效、ref 冲突、binding 损坏、lock 丢失或 drift 均 fail closed

故障模型

当前证明覆盖 process-crash convergence。JSON control record 会 fsync 临时文件，并在 POSIX 上 fsync parent directory；本 PR 不宣称所有 Git object/ref 写入具备完整断电耐久性，也不宣称已经拥有完整 bundled-Git runtime manifest。这两项属于内置 Git 安装层与后续 Baseline Open composition。

明确不包含

• workspace RuntimeEvent、canonical workspace head 或 verified baseline receipt；
• Desktop、CLI、runtime-host 或 tool 接线；
• source sync、merge、publish、Write/Edit transaction 或 crash resume；
• ignored/untracked dependency environment、LFS、submodule、symlink、attribute 等扩展能力；
• 自动修改用户 checkout。

验证

• Storage build 通过。
• focused tests 28/28，通过 package public-surface 封锁、source-independent reopen、同 repository 多 epoch、source race 拒绝、worktree ownership lock、ref CAS 冲突、并发 adopt、create/quarantine 真实进程 crash 收敛、规范化 unsafe-source config 拒绝、source isolation 与 drift quarantine。

[zhiiw]

The artifact-owner findings are addressed in c6b0e7c0.

• Reopen is now binding-authoritative and does not inspect the current source HEAD or dirty state.
• Repository capability and epoch baseline records are separate; one repository can host multiple epochs.
• Creation performs a second source observation before publishing the epoch artifact.
• Worktrees are locked with a Maka ownership reason and that lock is verified on adoption.
• Baseline/head refs use create-or-exact-retry CAS semantics and never overwrite a conflicting ref.
• The executable digest is rechecked before every Git invocation; unsafe source indirection is rejected and mutable Git features are disabled in the managed profile.
• Control JSON writes fsync the file and POSIX parent directory. The PR now explicitly limits its claim to process-crash convergence rather than full power-loss durability.

The focused real-Git suite is green: 14/14 tests. A durable verified baseline receipt remains intentionally outside this artifact-lifecycle PR and is the next shared-contract/composition slice.

中文说明

c6b0e7c0 已处理 artifact owner 评审项：

• reopen 改为以 durable binding 为权威，不再读取当前 source HEAD/dirty 状态；
• repository capability 与 epoch baseline record 分离，同一 repository 可以承载多个 epoch；
• epoch artifact 发布前执行第二次 source observation；
• worktree 建立 Maka ownership lock，并在 adopt 时验证 lock reason；
• baseline/head ref 使用 create-or-exact-retry CAS，不覆盖冲突 ref；
• 每次 Git 调用前重新校验 executable digest，拒绝危险 source indirection，并关闭 managed profile 中的可变 Git 功能；
• control JSON 对文件及 POSIX parent directory 做 fsync；PR 明确只承诺 process-crash convergence，不冒充完整 power-loss durability。

真实 Git focused suite 14/14 通过。Durable verified baseline receipt 仍刻意留在下一张 shared-contract/composition PR，不塞入本 artifact lifecycle PR。

[likun666661]

整体方向认可：repository capability / epoch artifact / instance binding 的职责拆分很清楚，当前也没有接入 Desktop、CLI 或 runtime-host，因此现有运行链路没有直接回归面。不过我本地核对后有两个建议在合并前处理的 correctness / recovery 问题：

1. [blocking] unsafe source config fence 会漏掉 Git 规范化为小写的 key

assertSourceConfigurationFences 的 --get-regexp 使用了 includeIf、objectFormat 和 partialClone。但 git config --get-regexp 输出的 key 会规范化为小写，例如：

includeif.gitdir:/definitely-never/.path ...
extensions.objectformat=sha256

因此当前正则不会命中 includeif.*、extensions.partialclone、extensions.objectformat。我构造了一个带 local includeIf 的 clean source repository，createManagedWorkspaceFromSource() 仍然成功，和这里“拒绝 unsafe Git indirection”的不变量不一致。

建议把匹配统一为 Git 实际输出的小写形式（或读取后 lowercase 再按 key 判断），并分别补 local/worktree config 的 includeIf、partial-clone 回归测试。

2. [blocking] quarantine 不是 crash-convergent，公开 API 会进入无法恢复的状态

当前 quarantineWorktreeLocked 的顺序是：

unlock -> rename worktree -> remove binding -> prune -> write quarantine record

如果进程在 unlock 后退出，durable binding 仍存在，但：

• reopen 会因 ownership lock 丢失而返回 managed_workspace_identity_conflict；
• 再调用 quarantine 会因为 worktree 已经 unlocked 而被 Git 以 exit 128 拒绝。

我按这个中间状态做了复现，两个公开恢复入口都失败。如果退出发生在 rename 后、删除 binding 前，也会留下 binding 指向缺失路径的类似问题。

建议为 quarantine 增加 durable transaction/tombstone，使 unlock、move、binding removal、prune 都能识别“已经完成”的阶段并幂等重放，同时补真实子进程在各阶段退出的测试。否则 PR 当前“process-crash convergence”的描述只覆盖 create path，不覆盖 service 所有 artifact lifecycle 操作。

3. [minor] executable verification 与“每次 invocation”描述不完全一致

importTree 只执行一次 verify()，随后启动 pack-objects 和 index-pack 两个 Git process。若不变量严格要求每次 Git invocation 前校验 digest，这里需要分别校验，或者收窄 PR 中的保证范围。

除上述问题外，现有三层 artifact identity、source re-observation、ref CAS 和 worktree ownership lock 的设计是合理的；focused real-Git 测试我这边也跑到了 18/18 通过。

[zhiiw]

Addressed in c6aa3af0.

1. Source config fencing now follows Git's normalized key semantics. The service reads local/worktree config names with --name-only --get-regexp '.*', lowercases them in one parser, and rejects the reserved families (include.*, includeif.*, extensions.objectformat, extensions.partialclone, core.fsmonitor, and promisor remotes). Real-Git regressions cover a local includeIf key and a worktree-scoped partial-clone key.

2. Quarantine is now a crash-convergent durable protocol. Before the first destructive step, the service atomically writes a strict quarantine intent containing the exact binding, reason, and one fixed target path. Reopen/inspect/create detect that tombstone and resume the same operation under the artifact-writer lock. Unlock, move, binding removal, prune, and final-record publication are all idempotently revalidated; conflicting source/target artifacts, registration identity, binding, repository capability, epoch artifact, or final record fail closed. The intent remains as the durable tombstone, so a completed quarantine cannot be mistaken for a missing workspace or generate a second target.

3. Executable verification is per Git process. importTree now verifies the pinned executable immediately before both pack-objects and index-pack; if the second verification fails, the first child is terminated and awaited.

Validation:

• @maka/core build: passed
• @maka/storage build: passed
• complete real-Git workspace service suite: 25/25 passed
• real-process crash matrix covers after_quarantine_intent, after_quarantine_unlock, after_quarantine_move, after_quarantine_binding_removed, and after_quarantine_pruned; every case converges through the public reopen/quarantine APIs and repeated quarantine returns the same artifact.

中文说明

已在 c6aa3af0 中处理。

1. source config fence 现在按 Git 实际规范化后的 key 工作。 服务读取 local/worktree config 的全部名称，在同一个解析器中转成小写，再拒绝 include.*、includeif.*、extensions.objectformat、extensions.partialclone、core.fsmonitor 和 promisor remote。真实 Git 回归测试覆盖了 local includeIf 与 worktree partial-clone。

2. quarantine 已改为 crash-convergent 的 durable protocol。 第一个破坏性动作前会原子写入严格的 quarantine intent，其中绑定 exact binding、reason 和唯一固定 target path。create/open/inspect 发现 tombstone 后，会在 artifact writer lock 内继续同一事务。unlock、move、删除 binding、prune、写最终记录都支持阶段识别和幂等重放；source/target、Git registration、binding、repository capability、epoch artifact 或最终记录发生冲突时一律 fail closed。intent 会作为永久 tombstone 保留，因此完成后的 quarantine 不会被误判成普通 workspace 丢失，也不会重复生成目标目录。

3. Git executable 改为每次 invocation 前验证。 pack-objects 与 index-pack 各自启动前都会重新校验 pinned executable；第二次校验失败会终止并等待第一个子进程退出。

验证结果：core/storage build 通过；完整 real-Git workspace service suite 25/25 通过；真实子进程 crash matrix 覆盖 intent、unlock、move、binding removal、prune 五个阶段，均可通过公开 reopen/quarantine API 收敛，重复 quarantine 返回同一个 artifact。

[likun666661]

Re-checked c6aa3af against the three blocking items. The source-config fence now handles Git-normalized lowercase keys with local/worktree regressions; quarantine records a durable intent before unlock and converges through all five real-process crash stages via the public APIs; and importTree verifies the pinned executable before both Git processes. Local @maka/core and @maka/storage builds passed, and the complete real-Git workspace service suite passed 25/25. Approved.