FE-1112: Reconcile run-local executor promotion

[kostandinang]

What

Adds run-local executor promotion.

execute_promotion_prepare now commits verified changes inside the executor run worktree and records the sandbox commit SHA in promotion.json and run.json.

This does not apply changes back to the host project branch. Host promotion is handled by FE-1118.

Verification

npm run verify

[kostandinang]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• FE-1118: Reconcile host executor promotion #282
• FE-1112: Reconcile run-local executor promotion #279 👈 (View in Graphite)
• FE-1111: Reconcile executor agent runner #278
• FE-1109: Reconcile executor sandbox worktrees and test runner ports #275
• FE-1089: Reconcile executor with alpha branch #274
• next

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cursor]

PR Summary

High Risk
Introduces the first real git mutation on the cook execution path (run-local commits); recovery logic must stay correct to avoid stuck or falsely-advanced runs.

Overview
Run-local executor promotion replaces the descriptive-only promotion step with real git commits inside the run worktree, wired through the same injected-port pattern as worktree, agent, and test runners.

GitLandPort is defined in executor core (currentHead, promote) and implemented in src/app/git-land-port.ts (status, add, commit, rev-parse in the worktree only). preparePromotion calls the port, writes promotion.json with land.commitSha, and stores promotionBaseSha / promotionCommitSha on run.json. Failures and true no-changes leave run status at petri_exported; a special no-changes path can still finish metadata when HEAD already advanced past the recorded base.

Idempotent recovery handles commit-before-persist races: if promotion.json or run.json lags a successful worktree commit, retry reconciles from HEAD (and rejects stale report SHAs).

Pi wiring: default composition injects createGitLandPort(); execute_status now reports pending tools: none for run-local promotion while noting host promotion is deferred. PLAN/SPEC/invariant I56-L and scope cards document FE-1112 completion.

^{Reviewed by Cursor Bugbot for commit 3e8bb5b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[lunelson]

The run-local promotion boundary is scoped well: the git mutation stays inside the run worktree and host promotion remains out of scope.

One thing to consider before FE-1118: promotion.json records the commit SHA, but not changed files or diff stats. Since host promotion will need to explain what is being carried forward, it may be useful for this report to include a small audit summary. Not blocking this PR.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit fc35e8d. Configure here.}

[cursor]

False promotion on stale report

Medium Severity

When promotion.json is present but recoverPreparedPromotion rejects it, preparePromotion skips persisting promotionBaseSha. On a clean worktree, GitLandPort.promote returns no_changes with the current HEAD, and the check land.commitSha !== promotionMetadata.promotionBaseSha succeeds because promotionBaseSha is undefined. The run can reach promotion_prepared without any promotion commit.

Additional Locations (1)

• src/executor/promotion.ts#L88-L109

 

^{Reviewed by Cursor Bugbot for commit fc35e8d. Configure here.}