⚛️ Atomically publish Workspace effects

[taras]

Why

Issue #365 requires one live Workspace expansion to publish its filesystem mutation, immutable root, current-root pointer, and durable Yield through one caller-owned WorkflowRun transaction. This is slice 6 only and does not close #365.

Exact base: aa47442

What changes

Before:

Workspace roots, transaction fences, durable coordination, and explicit journal routing existed as separate private foundations. No Deno provider coordinator joined them into one atomic live Workspace effect.

After:

The Deno adapter binds an authorized Workspace proof effect to its exact WorkflowRun database and guarded journal identity. A successful mutation, retained root, current pointer, filtered Yield, and commit become visible together. Known domain failures retain the prior root and commit one failed Yield. Infrastructure failures and cancellation roll back the outer transaction and publish nothing.

How it works

Workspace proof effect
  → exact database/executor/publication authority
  → WorkflowRunDatabase.transact (BEGIN IMMEDIATE)
  → operation savepoint + mutation-scope teardown
  → release on success, rollback on known domain failure
  → capture/retain root and publish current_root on success
  → existing secret guard/filter
  → terminal exact-token journal route
  → transaction.journal
  → COMMIT
  → caller resumes

Infrastructure failure activates the existing durable fail-stop boundary and preserves the first failure identity. Cancellation is never serialized as a durable failed Result.

Review guide

Start with: packages/workflow/src/deno/workspace/effect.ts and packages/workflow/tests/workspace-effect-transaction.test.ts

Then review:

1. Opaque publication identity in packages/durable-streams
2. Adapter-private Workspace executor ownership and synchronous proof filesystem
3. Root capture/current-root publication and exact journal routing
4. WAC conformance and architecture/specification updates

Look carefully at:

• Exact selected-journal provenance is checked before mutation.
• Mutation children tear down before savepoint release, rollback, or root capture.
• Known operation failures remain distinct from infrastructure failures and cancellation.
• No raw stream, SQLite, DOFS, connection, or transaction authority crosses the shared API.

What must stay true

• One expansion is one durable effect and one top-level SQLite transaction — enforced by the provider-owned coordinator and exact journal provenance.
• Secret filtering stays before transactional insertion — enforced by the existing guarded stream and publication-local journal route.
• Infrastructure failures are fail-stop — enforced by the durable failure continuation and tested against caught later Workspace and ordinary operations.
• Replay and ordinary durable operations retain their established behavior.

How to verify it

• deno task setup — passed.
• deno task lint — passed.
• deno task check — passed.
• deno task check:jsr — passed.
• deno task test --changed=origin/main — 308 passed, 2297 steps, 0 failed.
• deno task verify — passed all nine applicable commands from committed clean HEAD: vendor 2.3s, lint 2.2s, check 0.8s, test 464.7s, check:jsr 0.9s, tsc 17.6s, test:node 215.4s, test:bun 304.1s, docs 15.1s. The verifier confirmed the tracked tree was unchanged.
• git diff --check origin/main...HEAD — passed.

Scope

Included

• Provider-level atomic Workspace proof effects
• Opaque durable publication identity and adapter-private executor ownership
• Known-domain failure publication and infrastructure fail-stop activation
• Cancellation, concurrency, secret-filter, routing, rollback, and authority regressions
• Architecture, Workspace storage, and WAC conformance updates

Intentionally unchanged

• Slice 7 SIGKILL and second-process crash/restart proof remains unbuilt.
• Public workflow start/resume and public File integration remain unbuilt.
• History/fork, Worker Shell, Repository/Git, FUSE, workerd, subprocess bridges, GC, and schema/root-format redesign remain out of scope.

New abstractions

• The infrastructure-failure continuation extends live durable coordination so a provider can activate the existing fail-stop state without runtime-specific knowledge in durable-streams.

• Opaque publication identity proves the selected guarded journal without exposing stream capabilities.

• createWorkspaceProofEffect is an adapter-private proof seam and is not the public filesystem effect.

• Each new abstraction has multiple concrete uses or a clear justification.

• No speculative functionality is included.

Risks and limitations

• This proves provider-level atomicity through an adapter-private mutation seam; it does not expose the public Workspace filesystem API.
• Crash/restart certification remains slice 7.

Scope confirmation

• Every changed file supports the purpose described above.
• Unrelated cleanup and formatting changes are excluded.
• Generated or mechanical changes are clearly identified.
• The description matches the final diff and test results.

[github-actions]

PR #415: ⚛️ Atomically publish Workspace effects

26 files, +2933 / -116

Scope

🔴 PR has 3049 lines changed. Split into focused PRs.

🟡 3049 lines changed. PRs under 400 receive more thorough review.

🟡 26 files changed. Are all changes related?

🟡 Changes span 7 directories.

🟡 PR mixes config and source changes.

Structural

🟡 Interface declarations with no consumers: WorkspaceCoordinationApi.

Symbol	Declared at	Refs in diff	Why flagged
WorkspaceCoordinationApi	packages/workflow/src/workspace/api.ts:3	1	referenced ≤1× within the added diff (pre-existing usages not counted)

Oxlint structural signals:

• no-empty-function ×3: packages/durable-streams/effect.ts, packages/workflow/src/deno/connections.ts, packages/workflow/src/deno/provider.ts
• no-unused-vars ×2: packages/durable-streams/effect.ts, packages/workflow/src/deno/provider.ts
• no-unnecessary-type-assertion ×1: packages/durable-streams/effect.ts
• no-redundant-type-constituents ×1: packages/workflow/src/deno/connections.ts

Slop

✅ Slop indicators look low.

Static Analysis

Oxlint: 18 diagnostics across 6 files (8 rules)
Density: 0.006 violations/added-line

no-unused-private-class-members (4): packages/durable-streams/guard.ts, packages/workflow/src/deno/connections.ts
consistent-function-scoping (3): packages/workflow/src/deno/workspace/filesystem.ts, packages/durable-streams/effect.ts
no-empty-function (3): packages/durable-streams/effect.ts, packages/workflow/src/deno/connections.ts, packages/workflow/src/deno/provider.ts
no-unused-vars (2): packages/durable-streams/effect.ts, packages/workflow/src/deno/provider.ts
unbound-method (2): packages/workflow/src/deno/workspace/effect.ts
no-floating-promises (2): packages/durable-streams/effect.ts
no-unnecessary-type-assertion (1): packages/durable-streams/effect.ts
no-redundant-type-constituents (1): packages/workflow/src/deno/connections.ts

Correctness

No extraneous code patterns detected.