🏭 Add durable workflow evidence execution

[minkimcello]

Parent: #633

Architecture ancestry: PR #630

Planning base: 0479b3b1e6a3de08fb7d9de515a3efde80e7fe91; implementation base is the exact accepted C0 feedback commit recorded before handoff

Stack position: F5; parallel with F1, F3, F4, and F6; consumed by L8

Readiness: blocked only until C0's accepted feedback SHA is recorded and present; no execution authority, environment, cancellation, output, or replay choice is delegated

Purpose and observable outcome

An authored factory step can execute the accepted plan's exact native evidence commands on the ephemeral runner as one trusted, retained, cancellable host operation. The Agent, generated XMD, and Actions YAML cannot acquire or reconstruct this process authority.

Authoritative behavior

• Evidence requests are authored structured argv invocations with exact working root, bounded environment names, timeout, output ceiling, and ordered command identity; they are not shell strings and expose no ambient shell.
• The Deno/compiled runner adapter owns native process execution. Shared modules expose only the provider-neutral operation frozen by C0 and never detect the runtime.
• The operation retains request identity and a closed success, numeric-failure, timeout, cancellation, or launch/teardown failure result with bounded original output.
• Cancellation terminates the complete child process tree, drains configured output pumps, releases resources, and settles according to the repository's fatal precedence contract.
• Completed replay starts no process. Generated XMD's write table and the workflow Agent receive no evidence/process component.
• This is distinct from Worker Shell: it runs trusted host programs such as Deno test commands and does not offer just-bash or Workspace mutation semantics.

Current state

packages/workflow/src/deno/composition/subprocess.ts provides internal process invocation for trusted composition adapters, and CLI tests cover process retention/cancellation. specs/workflow-workspace-spec.md defines Worker Shell but production integration is unbuilt and cannot execute native toolchain commands. No provider-neutral authored evidence operation, durable request/result, output policy, or replay contract exists.

Affected modules and public contracts

• Add the exact trusted evidence API/component/records frozen by C0 under packages/workflow/src/composition/**; do not register it in generated-XMD allow tables or Agent tools.
• Add the Deno/compiled execution adapter under packages/workflow/src/deno/composition/**, reusing scope-owned process primitives and repository-authenticated materialization.
• Extend CLI host configuration with exact command/environment/time/output ceilings; production defaults deny all unconfigured evidence.
• Update workflow Workspace/executable specs, architecture, public exports, and construct/test inventory.
• Add explicit subprocess tests and support children under packages/workflow/tests/ and packages/cli/tests/.

Ordered implementation plan

1. Define strict evidence request/result records and derive effect identity from run/expansion plus the complete detached request.
2. Authenticate the selected retained Workspace root and materialize it into an invocation-owned runner directory; never accept a host path from the document or Agent.
3. Validate executable/argv, working logical directory, environment allowlist, timeout, output limits, and command ordering before spawn.
4. Execute each command through the Deno adapter, stream bounded evidence without swallowing child output, and retain the first authoritative failure while performing the plan's specified continuation/stop policy.
5. Implement process-tree cancellation, pump completion, timeout, and cleanup with no yield from unsafe finalization sites.
6. Commit the filtered result and make completed replay return it without materialization or spawn.
7. Prove the component is absent from Agent/generated-XMD capabilities and Actions YAML owns no duplicate command list.

Failure, cancellation, teardown, and replay

Unconfigured executable, changed request, invalid root/directory/environment, over-limit request, stale acquisition, launch failure, numeric exit, timeout, cancellation, output failure, and teardown failure each produce the closed outcome selected by C0; none silently becomes success. Cancellation kills descendants before settlement. Host death leaves no invented completed result; resume reruns only if no result committed. Completed replay allocates no directory and starts no process.

Frozen evidence matrix

• Exact argv commands run in order against the authenticated retained root with only admitted environment variables.
• Success and numeric failure retain exit status and bounded original stdout/stderr sufficient to diagnose the command.
• Unconfigured command, host path, environment key, timeout, and output ceiling refuse before spawn.
• Timeout, cancellation, and parent failure terminate the complete process tree and wait for output/teardown ownership to settle.
• Kill before result commit leaves no completion and permits one rerun; completed replay starts nothing.
• Agent and generated-XMD attempts to reach the component/process API fail before provider placement.
• Actions workflow contains no evidence command or result parser.
• Existing Git subprocess and ordinary CLI process behavior remain unchanged.

Focused feedback evidence

Add explicit files such as packages/workflow/tests/evidence-execution.test.ts, evidence-cancellation.test.ts, evidence-replay.test.ts, and packages/cli/tests/evidence-host.test.ts, with dedicated child-process fixtures. Run those exact files, the existing packages/cli/tests/process-retention.test.ts, and deno task test --changed. Commit when they pass and report the exact F5 SHA and commands.

Delivery verification

Run deno task lint, deno task check, and deno task check:jsr for public API changes. Run full local suites only if shared process/test setup changes; otherwise CI owns exhaustive runtimes.

Exclusions

No general shell, Worker Shell implementation, network by default, Agent/native tool, generated-XMD process component, Git mutation, lifecycle choice, ambient Actions command, or durable host path.

Risks and recovery

Process-tree teardown is the principal ownership risk. A failing cancellation/teardown criterion remains in F5; L8 cannot weaken it or substitute an Actions step. If a required evidence command needs a wider ceiling, that exact authorization is a plan/host configuration amendment, not Agent input.

Handoff

Record C0's exact feedback SHA, implement only the trusted evidence boundary, and return the exact F5 feedback commit with its process-level focused evidence. L8 consumes it from the foundation integration head.