fabro/lib
Scott Werner 856e2fadd8 Harden run-intent workflow-closure lowering
Cap closure expansion at 256 distinct workflow mounts. Mounts are keyed
by rebased path, so a small chain of stored versions that mounts a
shared dependency along two paths per level expands exponentially; a
single authenticated create request could stall the server before any
error was returned. The check also bounds the recursion depth.

Resolve file-form run goals through the certified version: expose
ValidatedWorkflowVersion::resolved_goal_file_content, which reuses the
exact grammar store validation certified, and drop the parallel
resolution (and its unreachable-for-stored-versions error variants) the
server had re-implemented. The certified entrypoint-presence invariant
replaces the MissingEntrypoint error the same way.

Destructure both environment layer types without `..` when pinning
server environment authority, so a new server-owned field becomes a
compile-time decision instead of silently escaping the pin.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-24 13:02:50 -04:00
..
apps Harden run-intent workflow-closure lowering 2026-08-24 13:02:50 -04:00
components Harden run-intent workflow-closure lowering 2026-08-24 13:02:50 -04:00
foundation Validate Git-target branches on the bare branch name 2026-08-24 13:02:32 -04:00
packages/fabro-api-client Preserve run creation error context 2026-08-24 12:22:38 -04:00