PR 007 — Autoflow State Machine: commit-bound, pure orchestration state

README.md

@@ -26,6 +26,8 @@ PR 005 adds review ingestion: untrusted reviewer output is normalized into commi
 
 PR 006 adds the provider-neutral agent invocation boundary: a commit-bound record of what AgentBridge asked which agent to do, and normalization of what that agent reported back. An agent's report is an untrusted **claim** — PR 006 records that an artifact was claimed, never that it exists remotely, is integrated, is validated, or is authorized. Provider identity is inert: it never implies a role or grants authority, and roles remain configurable. The layer invokes nothing, models no lifecycle transitions, and performs no I/O. See `docs/architecture/006-agent-invocation-boundary.md`.
 
+PR 007 adds the Autoflow state machine: the smallest durable orchestration state model that binds a unit of work to an exact repository and commit, with an optional pull request, and records — in order — what was requested and what was independently established. It consumes only the outputs of PR 004, 005, and 006; it never normalizes agent output, never judges freshness, and never grants authority. Provider identity, invocation purpose, and agent-reported status are inert: no transition's legality depends on any of them, and a claim can never become an observation. State is an immutable value produced by a pure, total transition function, and the layer performs no I/O. See `docs/architecture/007-autoflow-state-machine.md`.
+
 ## Runtime
 
 - Node.js 24 LTS

src/domain/index.ts

@@ -209,3 +209,48 @@ export {
   type FreshnessReason,
   type FreshnessState,
 } from './evidence-freshness.js';
+
+export {
+  INVOCATION_STATE,
+  INVOCATION_STATES,
+  isInvocationState,
+  isWorkflowClosure,
+  isWorkflowEventKind,
+  isWorkflowStatus,
+  REQUIRED_BINDING_FIELDS,
+  TRANSITION_OUTCOME,
+  TRANSITION_OUTCOMES,
+  TRANSITION_REJECTION,
+  TRANSITION_REJECTIONS,
+  WORKFLOW_BINDING_FIELD_ORDER,
+  WORKFLOW_BOUNDS,
+  WORKFLOW_CLOSURE,
+  WORKFLOW_CLOSURES,
+  WORKFLOW_EVENT_KIND,
+  WORKFLOW_EVENT_KINDS,
+  WORKFLOW_STATUS,
+  WORKFLOW_STATUSES,
+  type AdmittedEvidence,
+  type AdmittedReview,
+  type CloseRequestedEvent,
+  type EvidenceAdmittedEvent,
+  type HeadObservedEvent,
+  type HumanGateOpenedEvent,
+  type InvocationReportedEvent,
+  type InvocationRequestedEvent,
+  type InvocationState,
+  type ReviewAdmittedEvent,
+  type TrackedInvocation,
+  type TransitionOutcome,
+  type TransitionRejection,
+  type TransitionResult,
+  type WorkflowBinding,
+  type WorkflowClosure,
+  type WorkflowEvent,
+  type WorkflowEventKind,
+  type WorkflowOpenResult,
+  type WorkflowState,
+  type WorkflowStatus,
+} from './workflow.js';
+
+export { applyWorkflowEvent, openWorkflow } from './workflow-transitions.js';

src/domain/job-operation.ts

@@ -36,6 +36,10 @@ import {
 } from './repair-job.js';
 
 const objectFreeze = Object.freeze;
+// Captured at module load, before any untrusted request is evaluated, so a
+// property planted on a global after this module initializes cannot substitute
+// the own-property test the force reader fails closed on.
+const objectHasOwn = Object.hasOwn;
 
 /**
  * Operations a repair job may be authorized to perform.
@@ -320,15 +324,53 @@ const UNREADABLE_OPERATION: NormalizedJobOperation = objectFreeze({
 });
 
 /**
- * Read a force flag, failing closed.
+ * Read a push force flag, presence-aware and failing closed.
  *
- * Absent or literally `false` is not a force. **Everything else is**, including
- * `0`, `''`, `null`, `'false'`, and an object — a value that cannot be read as
- * "definitely not forced" is treated as forced, and forced pushes are denied
- * unconditionally.
+ * Only two shapes are "definitely not forced": an **absent** own `force`, and
+ * an own `force` whose value reads as literally `false`. **Everything else is
+ * forced**, and forced pushes are denied unconditionally.
+ *
+ * The distinction absence-versus-unreadable is the whole point. The shared
+ * {@link readOwnProperty} reader reports both an absent property and a getter
+ * that threw as `undefined`, so a value-only parser cannot tell "the caller
+ * sent nothing" from "the caller sent something this process could not read".
+ * Collapsing the second into the first is a fail-*open*: a present-but-
+ * unreadable force operand would normalize to non-forced and a push it could
+ * not establish as unforced would be authorized. So this reader looks at
+ * presence itself, not only a read value:
+ *
+ * - The own-property test is guarded; if it throws, presence is undecidable and
+ *   the flag fails closed to forced.
+ * - An absent own `force` is not forced — the ordinary unforced push.
+ * - A present own `force` is read exactly once, own-only. If that read throws —
+ *   an own getter or a Proxy `get` trap — it is unreadable and fails closed.
+ * - Only a read value of literally `false` is unforced. Any other value —
+ *   `undefined` included, so a present-but-`undefined` own property is forced
+ *   rather than mistaken for absence — is forced, as are `0`, `''`, `null`,
+ *   `'false'`, and an object. No truthiness coercion is applied; `=== false`
+ *   is the only unforced value.
+ *
+ * The own value is read at most once, so an accessor's getter runs at most once
+ * per {@link readJobOperation} call and the single-read snapshot discipline is
+ * preserved. Pure, total, deterministic, and never throws.
  */
-function readForceFlag(value: unknown): boolean {
-  return !(value === undefined || value === false);
+function readForceFlag(record: object): boolean {
+  let present: boolean;
+  try {
+    present = objectHasOwn(record, 'force');
+  } catch {
+    return true;
+  }
+  if (!present) {
+    return false;
+  }
+  let value: unknown;
+  try {
+    value = (record as Record<string, unknown>).force;
+  } catch {
+    return true;
+  }
+  return value !== false;
 }
 
 /**
@@ -376,7 +418,7 @@ export function readJobOperation(request: JobOperationRequest): NormalizedJobOpe
     sourceRefMalformed: sourceRef === null && rawSourceRef !== undefined,
     targetRef,
     targetRefMalformed: targetRef === null && rawTargetRef !== undefined,
-    force: readForceFlag(readOwnProperty(record, 'force')),
+    force: readForceFlag(record),
   });
 }