grim7/11/2026, 11:22:40 AM

- contracts: workflow.ts (trigger/rule/gate/action nodes, conditional edges,
  approve/deny moderation edges)
- core: validate.ts (schema, ids, reachability, not-gate arity, cycle
  detection), executor.ts (topo walk, gate short-circuit, pause/resume,
  step records with timings), exports
- db: runs service (createRun with validated snapshot, recordSteps with
  RuleResult-validated evidence, recordActions rows-first, markActionExecuted,
  completeRun/pauseRun/getRunWithSteps), repos service (ensureRepo, enabled
  workflows, rule-config CRUD)
- forge-github: GithubReads (diff/commits/readFile/contributor via fetch)
- worker: default workflow (validated at load), context builder with
  per-read degradation, run-workflows join + persistence, maintainer
  exemption, env-gated reads wiring
- integration: fresh-account PR ⇒ blocked run w/ snapshot+evidence+action row;
  maintainer exempt; degraded reads ⇒ skips, pass

Parent6760718