Ground workflow progress in controller state

[Wibias]

Summary

Hardens workflow-state grounding from the Grok delivery trace:

• exposes one controller-owned nextAction instead of requiring the model to reconstruct progress from history;
• persists controller transition receipts for phases completed by the controller;
• treats model-authored SHA, PR, check, and phase claims as non-authoritative;
• rejects the public refs command that could inject caller-authored repository identity state;
• normalises reused legacy checkpoints and show output so stale or model-authored nextAction data cannot regain authority after resume.

Legacy checkpoints do not receive fabricated historical phase receipts. Missing receipts remain missing; only current actionable state is re-derived from trusted checkpoint fields.

Regression evidence

RED-first coverage reproduced the missing state-grounding behaviour and the public ref-injection path. A later RED compatibility test reproduced stale guidance surviving through old checkpoint resume. Both resume paths now normalise through the controller.

Verification

Exact head: d8cf9e21d5d22b57c6cace9eafe063fa9005cef6

• CI, including Node 22, Node 24, and Node 26 compatibility: success
• Dependency Review: success
• Windows trace bins: success
• CodeQL JavaScript/TypeScript and C#: success

Scope

Workflow state grounding only. Evidence integrity, publication reliability, and trace diagnostics are isolated in #434, #435, and #437.

Ready for review. Do not merge without explicit instruction.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 3c966163-2f23-4616-84a5-39164392f8b3

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}