feat: complete durable query parity

CHANGELOG.md

@@ -28,7 +28,7 @@ The project is in `0.x` development and does not yet have a public product relea
 - Durable application dispatcher that reloads authoritative persisted state for each supported command, reuses the canonical runtime semantics, and commits through explicit persistence methods without a retained in-memory fallback.
 - Deferred `ClaimTask` receipt construction so the persisted/replayed response contains the fencing token allocated by the persistence transaction rather than a speculative runtime token.
 - First durable command loop for `RegisterAgent`, `StartSession`, `CreateGoal`, `CreateTask`, `ClaimTask`, `RecordCheckpoint`, `RequestPermission`, `RecordPermissionDecision`, and `CompleteTask`.
-- Explicit durable query ports and bounded query support for `GetWorkspace`, `GetGoal`, `GetTask`, `GetLease`, `GetAgent`, `GetSession`, `GetPermissionRequest`, `ListTaskCheckpoints`, `ListPendingHumanPermissions`, `ListPermissionDecisions`, and advisory `ListClaimableTasks`.
+- Explicit durable query ports and bounded query support for the complete ADR-0005 v0.1 surface: `GetWorkspace`, `ListGoals`, `GetGoal`, `ListGoalTasks`, `GetTask`, `GetTaskExecutionView`, `ListClaimableTasks`, `GetLease`, `GetAgent`, `GetSession`, `ListTaskCheckpoints`, `GetPermissionRequest`, `ListPendingHumanPermissions`, and `ListPermissionDecisions`.
 - Bounded HTTP and MCP adapters over one application/protocol surface, preserving protocol error/idempotency envelopes and avoiding generic shell/filesystem/browser/action authority tools.
 - In-memory application dispatcher for all ADR-0005 commands plus bounded queries.
 - HTTP/application end-to-end regression covering `RegisterAgent -> StartSession -> CreateGoal -> CreateTask -> ClaimTask -> RecordCheckpoint -> RequestPermission(repository.write) -> RecordPermissionDecision(ALLOW) -> CompleteTask`, followed by HTTP verification of final Task, Goal, Lease, and checkpoint state.
@@ -59,7 +59,7 @@ The project is in `0.x` development and does not yet have a public product relea
 - Admitted terminal semantic failures in the supported durable command loop now persist immutable `outcomeKind: error` command receipts and replay after restart instead of re-executing the command.
 - Durable Session/Lease liveness composition now supports `HeartbeatSession`, `EndSession`, `RenewLease`, and `ReleaseLease` with atomic mutation receipts, restart-safe replay, stable renewal fencing, and recoverable released/revoked execution authority.
 - Durable task-outcome persistence now revalidates execution/revision authority at commit time and stores failure/block transitions and their released Lease plus Checkpoint in one batch; `ResumeTask` recomputes dependency readiness and removes the blocking reason without granting a Lease.
-- D1 mutation batches now use transaction-aborting guard rows for conditional mutation races. Task creation/retry revalidate an active parent Goal inside the database batch; Goal cancellation terminalizes the Goal only after its cancellable Tasks/Leases and only when no cancellable work remains; claim/cancellation share fencing-counter and Task-state predicates so neither can return success with execution authority beneath cancelled state.
+- D1 mutation batches now use transaction-aborting guard rows for conditional mutation races. Task creation/retry revalidate an active parent Goal inside the database batch; Goal cancellation terminalizes the Goal only after its cancellable Tasks/Leases and only when no cancellable work remains; claim/cancellation share fencing-counter and Task-state predicates so neither can return success with execution authority beneath cancelled state. `GetTaskExecutionView` now derives Task, effective Lease, and latest Checkpoint in one D1 statement so the read projection cannot mix separate database snapshots.
 
 ### Verification
 
@@ -78,16 +78,15 @@ The project is in `0.x` development and does not yet have a public product relea
 - Permanent Quality run `33274903333` passed the restart-safe durable HTTP E2E tree with **29/29 test files and 123/123 tests**, plus `pnpm test:coverage`. Overall coverage reported 85.3% statements, 73.3% branches, 96.15% functions, and 86.95% lines.
 - Final correctness-review RED run `33275182068` failed exactly the two new terminal-error-receipt and recovery-discovery regressions while the previous 123 tests passed. Review-fix run `33275312677` then passed focused regressions, full `pnpm check`, and coverage with **30/30 test files and 125/125 tests**; overall coverage was 85.43% statements, 73.5% branches, 96.18% functions, and 87.07% lines.
 - Durable task-outcome RED run `33278105807` preserved the previous 130 passing tests while the new FailTask/BlockTask regressions failed at the expected unsupported boundary. Review/atomicity run `33278493339` passed **32/32 test files and 133/133 tests**, plus coverage at 84.99% statements, 74.15% branches, 96.36% functions, and 86.73% lines, including a forced mid-batch rollback followed by successful exact retry.
-- Durable retry/cancellation hardening run `33283962742` passed **33/33 test files and 143/143 tests**, full `pnpm check`, and coverage at 85.0% statements, 74.3% branches, 96.51% functions, and 86.71% lines after transaction-CAS, stale Goal admission, no-Lease cancellation, mid-batch rollback, false-receipt, and cancellation-versus-recovery claim regressions were made green.
+- Durable retry/cancellation hardening run `33283962742` passed **33/33 test files and 143/143 tests**, full `pnpm check`, and coverage at 85.0% statements, 74.3% branches, 96.51% functions, and 86.71% lines after transaction-CAS, stale Goal admission, no-Lease cancellation, mid-batch rollback, false-receipt, and cancellation-versus-recovery claim regressions were made green. Durable query-parity RED Quality run `33284893955` preserved those **143 passing tests** while exactly three new query regressions failed on `UNSUPPORTED_OPERATION`; hardening run `33285112259` then passed **34/34 test files and 146/146 tests**, full `pnpm check`, and coverage at 85.1% statements, 74.51% branches, 96.79% functions, and 86.86% lines.
 - Frozen installation resolves `@mindrail/contracts 0.0.0 <- packages/contracts`, confirming the root runtime uses the workspace contract package.
 - No new third-party runtime dependency was introduced for schema admission, protocol admission, bootstrap, transport, permission, persistence composition, rehydration, or durable query semantics.
 
 ### Known limitations
 
 - `Quality` is not yet enforced as a required `main` merge gate; repository protection remains tracked separately in issue #3.
 - The durable application composition is verified against the local SQLite D1-like test harness, not a deployed Cloudflare Worker/Durable Object/D1 environment.
-- The durable dispatcher supports the complete ADR-0005 v0.1 command surface. The remaining explicit durable application gaps are read-side: `ListGoals`, `ListGoalTasks`, and `GetTaskExecutionView`.
-- Durable application queries `ListGoals`, `ListGoalTasks`, and `GetTaskExecutionView` remain explicitly unsupported.
+- The durable dispatcher supports the complete ADR-0005 v0.1 command and query surface against the local SQLite D1-like reference harness; this does not imply deployed Cloudflare verification.
 - MindRail does not yet expose a verified deployed Cloudflare control-plane service, GitHub adapter, real Codex/ChatGPT integration, or unattended continuation of a real external agent across host/platform termination.
 - The deterministic v0.1 permission policy is intentionally small and is not an IAM system, credential manager, arbitrary policy DSL, or model-based authority mechanism.
 - MindRail-specific BUSL parameters and external-contribution licensing mechanics still require professional legal review before material reliance.

docs/CURRENT_STATE.md

@@ -1,6 +1,6 @@
 # Current State
 
-**Last reconciled:** 2026-08-29
+**Last reconciled:** 2026-08-30
 
 This document describes what exists, not what is intended. Roadmap items are never evidence of implementation.
 
@@ -32,30 +32,29 @@ The following facts are supported by repository state and executed GitHub Action
 - Durable task outcomes now preserve the same runtime semantics through persistence: `FailTask` and `BlockTask` atomically commit the Task transition, released Lease, terminal/blocked Checkpoint, and immutable command receipt; `ResumeTask` atomically commits the controller-authorized blocked-to-ready/pending Task transition and receipt without minting execution authority. `RetryTask`, `CancelTask`, and `CancelGoal` also commit through explicit durable mutations with controller authority, immutable receipts, Goal/Task/Lease revision checks, database-enforced Goal-versus-Task admission ordering, and fencing-counter guards that prevent recovery claims from surviving cancellation races.
 - Durable command replay first reads the persisted `(workspaceId, commandId)` receipt. Exact retries survive application/database-handle replacement, return `replayed: true`, preserve the immutable stored result/error snapshot, and reflect the current correlation id. Semantic command-id drift fails with `IDEMPOTENCY_CONFLICT`.
 - Admitted terminal semantic failures on the supported durable command loop are also persisted as immutable error receipts, so an exact retry after restart replays the original terminal error instead of silently re-executing the command.
-- Explicit durable read ports and application queries are implemented for `GetWorkspace`, `GetGoal`, `GetTask`, `GetLease`, `GetAgent`, `GetSession`, `GetPermissionRequest`, `ListTaskCheckpoints`, `ListPendingHumanPermissions`, `ListPermissionDecisions`, and advisory `ListClaimableTasks`. List queries use bounded deterministic cursor paging. `ListClaimableTasks` includes capability-compatible `ready` Tasks plus `running` Tasks whose prior Lease/Session authority is no longer effective at the authoritative server time; work acquisition still revalidates authority atomically at `ClaimTask`.
+- Explicit durable read ports and application queries cover the complete ADR-0005 v0.1 query surface: `GetWorkspace`, `ListGoals`, `GetGoal`, `ListGoalTasks`, `GetTask`, `GetTaskExecutionView`, `ListClaimableTasks`, `GetLease`, `GetAgent`, `GetSession`, `ListTaskCheckpoints`, `GetPermissionRequest`, `ListPendingHumanPermissions`, and `ListPermissionDecisions`. List queries use bounded deterministic cursor paging. `ListClaimableTasks` includes capability-compatible `ready` Tasks plus `running` Tasks whose prior Lease/Session authority is no longer effective at authoritative server time; work acquisition still revalidates authority atomically at `ClaimTask`. `GetTaskExecutionView` reads Task, effective Lease, and latest Checkpoint through one D1 statement so the projection is coherent at one database read snapshot.
 - HTTP and MCP adapters exist over the common application/protocol boundary. They preserve canonical error codes/idempotency envelopes, fail closed on authorization errors, enforce bounded structural admission, and do not expose generic shell/filesystem/browser/action authority tools.
 - The in-memory application dispatcher delegates all ADR-0005 v0.1 commands to the canonical runtime. A deterministic HTTP/application E2E covers the complete local bootstrap/execution/permission/completion path.
 - Durable HTTP E2E coverage runs the real HTTP adapter over the durable dispatcher and SQLite D1-like persistence file. It verifies: continuation of the same Lease/fence after closing and reopening the application/database handle; persistence of `HUMAN_REQUIRED` plus human decision history across restart; response-loss replay through a fresh dispatcher; and competing independent application instances preserving one effective Lease and advancing fencing from 1 to 2 after expiry/recovery.
 - Durable query Task 4 integration run `33274741762` passed focused query/persistence tests, full `pnpm check`, and coverage after temporary harness cleanup.
 - Permanent `Quality` run `33274903333` on the durable HTTP E2E tree passed formatting, lint, strict TypeScript, generated-contract drift checks, **29/29 test files and 123/123 tests**, and coverage. Reported overall coverage was 85.3% statements, 73.3% branches, 96.15% functions, and 86.95% lines.
 - Final correctness review RED run `33275182068` demonstrated both remaining defects: the two new regressions failed because terminal semantic errors had no durable receipt and recovery work discovery omitted a `running` Task after its effective Lease expired, while the previous **123 tests passed**. Review-fix run `33275312677` then passed focused regressions, full `pnpm check`, and coverage with **30/30 test files and 125/125 tests**. Overall coverage was 85.43% statements, 73.5% branches, 96.18% functions, and 87.07% lines.
 - Durable Session/Lease liveness RED Quality run `33276800987` passed formatting/lint/typecheck/contracts and the previous **125 tests**, while all four new HTTP E2E regressions failed exactly because `HeartbeatSession`, `EndSession`, `RenewLease`, and `ReleaseLease` returned `UNSUPPORTED_OPERATION`. GREEN run `33276973691` then passed the focused 4/4 liveness E2E tests, full `pnpm check` with **31/31 test files and 129/129 tests**, and coverage at 85.19% statements, 73.88% branches, 96.3% functions, and 86.83% lines.
-- Durable task-outcome RED Quality run `33278105807` kept the previous **130 tests green** while both new outcome regressions failed on the expected `UNSUPPORTED_OPERATION` boundary. GREEN run `33278271723` passed full `pnpm check` and coverage after self-cleaning the one-time implementation harness. Review-hardening run `33278367867` then proved persisted FailTask Lease state, lost-response BlockTask replay, durable blocked Checkpoint storage, and complete persisted ResumeTask state. Atomicity run `33278493339` added D1-like mid-batch fault injection and passed **32/32 test files and 133/133 tests** plus coverage at 84.99% statements, 74.15% branches, 96.36% functions, and 86.73% lines; the injected failure rolls back Checkpoint, Task, Lease, and receipt together before an exact retry succeeds. Durable retry/cancellation review hardening culminated in run `33283962742`, which passed **33/33 test files and 143/143 tests**, full `pnpm check`, and coverage at 85.0% statements, 74.3% branches, 96.51% functions, and 86.71% lines. The regressions cover lost-response replay, `CancelTask` without an effective Lease, `CancelGoal` mid-batch rollback, stale Goal task admission, false-success receipt prevention after a lost CAS, and recovery-`ClaimTask` races against both Task and Goal cancellation.
+- Durable task-outcome RED Quality run `33278105807` kept the previous **130 tests green** while both new outcome regressions failed on the expected `UNSUPPORTED_OPERATION` boundary. GREEN run `33278271723` passed full `pnpm check` and coverage after self-cleaning the one-time implementation harness. Review-hardening run `33278367867` then proved persisted FailTask Lease state, lost-response BlockTask replay, durable blocked Checkpoint storage, and complete persisted ResumeTask state. Atomicity run `33278493339` added D1-like mid-batch fault injection and passed **32/32 test files and 133/133 tests** plus coverage at 84.99% statements, 74.15% branches, 96.36% functions, and 86.73% lines; the injected failure rolls back Checkpoint, Task, Lease, and receipt together before an exact retry succeeds. Durable retry/cancellation review hardening culminated in run `33283962742`, which passed **33/33 test files and 143/143 tests**, full `pnpm check`, and coverage at 85.0% statements, 74.3% branches, 96.51% functions, and 86.71% lines. The regressions cover lost-response replay, `CancelTask` without an effective Lease, `CancelGoal` mid-batch rollback, stale Goal task admission, false-success receipt prevention after a lost CAS, and recovery-`ClaimTask` races against both Task and Goal cancellation. Durable query-parity RED Quality run `33284893955` kept those **143 tests green** while exactly three new query regressions failed on the expected `UNSUPPORTED_OPERATION` boundary. Query hardening run `33285112259` then passed **34/34 test files and 146/146 tests**, full `pnpm check`, and coverage at 85.1% statements, 74.51% branches, 96.79% functions, and 86.86% lines after `ListGoals`, `ListGoalTasks`, and the single-statement `GetTaskExecutionView` projection were made durable.
 - Runtime Surface PR #20 merged with post-merge Quality PASS. Persistence PR #24 merged with post-merge Quality #248 PASS. HTTP/MCP Transport PR #25 merged at `e142c1399aed5de3d8df53ad876499583728a6b4`; permanent Quality #249 and post-merge Quality #250 both passed full quality and coverage gates.
 - Permanent `Quality` CI remains least-privilege and uses pinned GitHub-owned action commits.
 
 ## Implemented but not yet fully deployed / externally integrated
 
 - The durable application composition is verified locally against the SQLite D1-like harness used by persistence tests. This is executable restart/concurrency evidence for the application/persistence contract, but it is **not** evidence of a deployed Cloudflare Worker, Durable Object, or production D1 environment.
-- Durable queries `ListGoals`, `ListGoalTasks`, and `GetTaskExecutionView` remain explicitly unsupported rather than inferred from retained application state.
+- The locally verified durable application composition now has command and query parity with the complete ADR-0005 v0.1 protocol surface; remaining product gaps are external integration and deployed-reference verification rather than retained in-memory fallbacks.
 - No deployed Cloudflare Worker/Durable Object service is claimed. Deployment configuration, environment provisioning, deployed-runtime restart verification, and real Cloudflare concurrency verification remain outstanding.
 - The v0.1 permission policy is intentionally small, explicit, hard-coded, and versioned. It is not a policy DSL, IAM system, credential manager, model judge, or arbitrary-code policy runtime.
 - `Quality` is executable on pull requests and `main`, but issue #3 still tracks repository-level enforcement as a required merge gate.
 
 ## Next implementation slices
 
 - Audit and harden any remaining conditional durable mutations against the same database-CAS/receipt and Goal-level concurrency invariants before treating the local persistence composition as complete.
-- Add the remaining bounded durable queries only where required by agent/human workflows.
 - Add GitHub integration while keeping GitHub as an adapter/projection rather than canonical state authority.
 - Add minimal real Codex, ChatGPT-compatible, generic MCP, and generic HTTP agent bootstrap/worker paths on top of the stable protocol/application boundary.
 - Deploy and verify the Cloudflare reference composition, including real Durable Object coordination and D1 restart/concurrency behavior, before making production-runtime claims.