⚛️ Atomically publish Workspace effects

[taras]

Why

Issue #365 requires one live Workspace expansion to publish its filesystem mutation, immutable root, current-root pointer, and durable Yield through one caller-owned WorkflowRun transaction. This is slice 6 only and does not close #365.

Exact base: aa47442

What changes

Before:

Workspace roots, transaction fences, durable coordination, and explicit journal routing existed as separate private foundations. No Deno provider coordinator joined them into one atomic live Workspace effect.

After:

The Deno adapter binds an authorized Workspace proof effect to its exact WorkflowRun database and guarded journal identity. A successful mutation, retained root, current pointer, filtered Yield, and commit become visible together. Known domain failures retain the prior root and commit one failed Yield. Infrastructure failures and cancellation roll back the outer transaction and publish nothing.

How it works

Workspace proof effect
  → exact database/executor/publication authority
  → WorkflowRunDatabase.transact (BEGIN IMMEDIATE)
  → operation savepoint + mutation-scope teardown
  → release on success, rollback on known domain failure
  → capture/retain root and publish current_root on success
  → existing secret guard/filter
  → terminal exact-token journal route
  → transaction.journal
  → COMMIT
  → caller resumes

Infrastructure failure activates the existing durable fail-stop boundary and preserves the first failure identity. Cancellation is never serialized as a durable failed Result.

Review guide

Start with: packages/workflow/src/deno/workspace/effect.ts and packages/workflow/tests/workspace-effect-transaction.test.ts

Then review:

1. Opaque publication identity in packages/durable-streams
2. Adapter-private Workspace executor ownership and synchronous proof filesystem
3. Root capture/current-root publication and exact journal routing
4. WAC conformance and architecture/specification updates

Look carefully at:

• Exact selected-journal provenance is checked before mutation.
• Mutation children tear down before savepoint release, rollback, or root capture.
• Known operation failures remain distinct from infrastructure failures and cancellation.
• No raw stream, SQLite, DOFS, connection, or transaction authority crosses the shared API.

What must stay true

• One expansion is one durable effect and one top-level SQLite transaction — enforced by the provider-owned coordinator and exact journal provenance.
• Secret filtering stays before transactional insertion — enforced by the existing guarded stream and publication-local journal route.
• Infrastructure failures are fail-stop — enforced by the durable failure continuation and tested against caught later Workspace and ordinary operations.
• Replay and ordinary durable operations retain their established behavior.

How to verify it

• deno task setup — passed.
• deno task lint — passed.
• deno task check — passed.
• deno task check:jsr — passed.
• deno task test --changed=origin/main — 308 passed, 2297 steps, 0 failed.
• deno task verify — passed all nine applicable commands from committed clean HEAD: vendor 2.3s, lint 2.2s, check 0.8s, test 464.7s, check:jsr 0.9s, tsc 17.6s, test:node 215.4s, test:bun 304.1s, docs 15.1s. The verifier confirmed the tracked tree was unchanged.
• git diff --check origin/main...HEAD — passed.

Scope

Included

• Provider-level atomic Workspace proof effects
• Opaque durable publication identity and adapter-private executor ownership
• Known-domain failure publication and infrastructure fail-stop activation
• Cancellation, concurrency, secret-filter, routing, rollback, and authority regressions
• Architecture, Workspace storage, and WAC conformance updates

Intentionally unchanged

• Slice 7 SIGKILL and second-process crash/restart proof remains unbuilt.
• Public workflow start/resume and public File integration remain unbuilt.
• History/fork, Worker Shell, Repository/Git, FUSE, workerd, subprocess bridges, GC, and schema/root-format redesign remain out of scope.

New abstractions

• The infrastructure-failure continuation extends live durable coordination so a provider can activate the existing fail-stop state without runtime-specific knowledge in durable-streams.

• Opaque publication identity proves the selected guarded journal without exposing stream capabilities.

• createWorkspaceProofEffect is an adapter-private proof seam and is not the public filesystem effect.

• Each new abstraction has multiple concrete uses or a clear justification.

• No speculative functionality is included.

Risks and limitations

• This proves provider-level atomicity through an adapter-private mutation seam; it does not expose the public Workspace filesystem API.
• Crash/restart certification remains slice 7.

Scope confirmation

• Every changed file supports the purpose described above.
• Unrelated cleanup and formatting changes are excluded.
• Generated or mechanical changes are clearly identified.
• The description matches the final diff and test results.

[github-actions]

PR #415: ⚛️ Atomically publish Workspace effects

26 files, +3081 / -116

Scope

🔴 PR has 3197 lines changed. Split into focused PRs.

🟡 3197 lines changed. PRs under 400 receive more thorough review.

🟡 26 files changed. Are all changes related?

🟡 Changes span 7 directories.

🟡 PR mixes config and source changes.

Structural

🟡 Interface declarations with no consumers: WorkspaceCoordinationApi.

Symbol	Declared at	Refs in diff	Why flagged
WorkspaceCoordinationApi	packages/workflow/src/workspace/api.ts:3	1	referenced ≤1× within the added diff (pre-existing usages not counted)

Oxlint structural signals:

• no-empty-function ×3: packages/durable-streams/effect.ts, packages/workflow/src/deno/provider.ts, packages/workflow/src/deno/connections.ts
• no-unused-vars ×2: packages/durable-streams/effect.ts, packages/workflow/src/deno/provider.ts
• no-unnecessary-type-assertion ×1: packages/durable-streams/effect.ts
• no-redundant-type-constituents ×1: packages/workflow/src/deno/connections.ts

Slop

✅ Slop indicators look low.

Static Analysis

Oxlint: 18 diagnostics across 6 files (8 rules)
Density: 0.006 violations/added-line

no-unused-private-class-members (4): packages/durable-streams/guard.ts, packages/workflow/src/deno/connections.ts
consistent-function-scoping (3): packages/workflow/src/deno/workspace/filesystem.ts, packages/durable-streams/effect.ts
no-empty-function (3): packages/durable-streams/effect.ts, packages/workflow/src/deno/provider.ts, packages/workflow/src/deno/connections.ts
no-unused-vars (2): packages/durable-streams/effect.ts, packages/workflow/src/deno/provider.ts
unbound-method (2): packages/workflow/src/deno/workspace/effect.ts
no-floating-promises (2): packages/durable-streams/effect.ts
no-unnecessary-type-assertion (1): packages/durable-streams/effect.ts
no-redundant-type-constituents (1): packages/workflow/src/deno/connections.ts

Correctness

FILE: packages/durable-streams/guard.ts
PATTERN: no-unused-private-class-members
CONCERN: Private field #opaque in PublicationIdentity is never accessed.
QUESTION: Is PublicationIdentity intended to be a placeholder or is the field required for future expansion?

FILE: packages/durable-streams/effect.ts
PATTERN: no-empty-function
CONCERN: Empty noop() function provides no functionality and could be removed.
QUESTION: Is noop() used elsewhere in the codebase, or is it redundant?

FILE: packages/durable-streams/effect.ts
PATTERN: no-unused-vars
CONCERN: Unused variables activateFailure and publicationIdentity in test setup.
QUESTION: Are these variables accidentally left unimplemented or are they part of a larger test strategy?

FILE: packages/workflow/src/deno/workspace/filesystem.ts
PATTERN: no-empty-function
CONCERN: filesystemOperation wraps operation() but does not add meaningful behavior.
QUESTION: Is this function a placeholder or intended to be extended later?

FILE: packages/workflow/src/deno/workspace/effect.ts
PATTERN: signal clusters
CONCERN: Multiple Oxlint violations (no-unused-vars, no-empty-function, unbound-method) in the same file.
QUESTION: Are these issues due to unreviewed generated code or incomplete implementation?

FILE: packages/workflow/tests/workspace-effect-transaction.test.ts
PATTERN: signal clusters
CONCERN: Test includes complex setup with physicalWorkspaceCopy and loadedWorkspaceCopy that may exceed the scope of atomic Workspace effects.
QUESTION: Is this test verifying core functionality or introducing unnecessary complexity?

No extraneous code patterns detected.