Animus coding: fail closed and preserve reviewed code on non-fast-forward PR publication

[animus-launchapp-gitprovider]

Automated change for TASK-1071 via the Animus coding workflow (deterministic git on a shared ephemeral node).

[animus-launchapp-gitprovider]

VERDICT: CHANGES REQUESTED

1. src/workflow_execute.rs:execute_post_success_actions — if !crate::phase_git::is_git_repo(execution_cwd) and the subsequent publish_head_durably(execution_cwd, ...) execute host-local Git operations. For an environment-routed coding workflow, the repository exists inside the held node and execution_cwd is only a host path that HeldEnvironment::exec_command maps into that node. Consequently, a successful remote coding run reaches this gate, sees no host-local repository, is marked failed, and retains the node without ever publishing the reviewed commit. REQUIRED CHANGE: perform commit publication in the held environment (thread HeldEnvironment into post-success and execute the Git publication protocol through its raw-command/session interface), or move publication into the node-side coding phase and return a structured proof; do not inspect or push from the host execution_cwd for an env-routed run. Verification: add an integration test with a fake non-local HeldEnvironment whose repository exists only in its mapped workspace, run the coding workflow through post-success, and assert the exact commit reaches the remote ref, publication_durable is true, and teardown occurs.

2. src/workflow_session.rs:delegate_workflow_via_session — verify_publication_proof(&execution_cwd_owned, proof) repeats the same invalid host-filesystem assumption for whole-workflow delegation. The delegated checkout and its remote credentials live on the session node, so the parent cannot fetch or resolve the proof commit from its unrelated execution_cwd; this makes every otherwise-successful remote coding session report WorkflowStatus::Failed and skip teardown. REQUIRED CHANGE: revalidate the proof through the still-live environment session/node before deciding teardown (for example, add a protocol operation that runs the reachability/tree checks on the prepared handle), and bind the returned proof to the commit/tree produced by that workflow rather than calling local Git in the parent checkout. Verification: add a remote-animus-session test where the parent cwd is not a Git repository but the node publishes successfully; expect parent status Completed, a persisted publication_durable: true, and exactly one teardown. Add the negative counterpart with an unreachable/forged proof and expect Failed with no teardown.

The fail-closed intent is strong: the recovery ref avoids force-pushing concurrent work, bundle fallback is outside the disposable checkout, diagnostics are redacted, and the new same-head/collision tests cover the local helper well. The remaining blocker is wiring those semantics through the actual remote execution boundary. CI is currently configured but still in progress; this verdict is based on the functional remote-path defects above, not on the pending signal.

[animus-launchapp-gitprovider]

VERDICT: CHANGES REQUESTED

1. src/workflow_execute.rs:1189 (execute_workflow_with_hub) — execute_post_success_actions(&params.project_root, t, &workflow, &workflow_config, &execution_cwd).await still performs the publication gate against the host execution_cwd, even when every coding phase ran in held_environment and the repository exists only in that environment's mapped workspace. The synchronized commit only hardens ref verification; it does not fix this execution-location mismatch. REQUIRED CHANGE: thread held_environment into the post-success publication path and execute branch resolution, clean-worktree validation, push/recovery publication, and reachability proof through HeldEnvironment::exec_command against the node-side mapped checkout (or publish inside the node and return structured proof that the runner independently validates through that same held environment). Do not call host-local is_git_repo, current_branch, or publish_head_durably for an environment-routed run. Verification: add an integration test whose host execution_cwd is not a Git repository while the fake held environment contains the checkout; run a successful coding workflow and assert the exact node-side commit reaches the remote ref, publication_durable == true, the workflow completes, and teardown occurs exactly once.

2. src/workflow_session.rs:843 (delegated session completion thread) — .and_then(|proof| crate::phase_git::verify_publication_proof(&execution_cwd_owned, proof).ok()) still verifies a remote session's proof from the home runner's host-local cwd. In the production session topology that cwd need not contain the node's repository, remote configuration, or reviewed objects, so a valid remote workflow is changed to Failed; conversely, the check is not explicitly bound to the live session workspace that produced the result. REQUIRED CHANGE: verify the terminal proof before teardown through the still-live SessionEnvironmentClient/handle by executing the Git reachability and commit/tree checks in the session environment, and bind the verified commit/tree to the workflow-produced terminal proof. Keep teardown disabled when that node-side verification fails. Verification: add a remote-session integration test with a non-Git host parent cwd and a valid node-side proof, expecting Completed, durable publication, and exactly one teardown; add a forged or unreachable node-side proof case expecting Failed and zero teardown calls.

The new verify_ref-based commit/tree lookup is a good correction: it avoids accepting an unrelated pre-existing local object, and the added stale-proof test covers remote ref replacement well. The publication helpers also remain careful about credential redaction and non-force recovery refs. The two production environment paths above still prevent this P0 from being complete.

[Shooksie]

Addressed both requested remote-boundary blockers in 232cbd6. Environment-routed coding publication now resolves the branch, validates cleanliness, pushes, creates collision recovery refs/PRs, and verifies commit/tree reachability through HeldEnvironment::exec_command in the node checkout. Whole-workflow delegation now revalidates the terminal proof through the still-live SessionEnvironmentClient handle before teardown; the parent host cwd is no longer consulted. Added positive non-Git-host/node-checkout coverage and forged-proof/no-teardown coverage. Verification: cargo test --all-targets --features remote-animus-session (304 passed, 5 documented ignores), cargo check --all-targets --features remote-animus-session, cargo clippy --all-targets --features remote-animus-session -- -D warnings, and cargo fmt --all -- --check.

[animus-launchapp-gitprovider]

VERDICT: APPROVE

No blocking findings. The synchronize update resolves the two prior environment-boundary defects: per-phase environment publication now resolves the branch, pushes/recovery-publishes, and verifies reachability through the live HeldEnvironment, while delegated session completion independently verifies the terminal proof through the still-live SessionEnvironmentClient and handle rather than the host checkout. The new node-only/non-Git-host tests cover successful proof, forged proof rejection, and teardown gating, and the Rust quality gate is green at 232cbd69b923cdd99927e85acd5b4391fe2e69d0.

What is genuinely good: publication now fails closed, exact commit/tree reachability is server-backed, credentials are redacted from diagnostics, and environment teardown remains coupled to positive durable-publication evidence.