Record, read and clean up prose workflow state in Go #886

Problem

Slice 01 of #327 under #588 makes workflow evidence available to Go before any caller changes. The existing state and baseline operations are at packages/agents/source/skills/fix-prose/shared/scripts/check-suppressions.sh:155 and packages/agents/source/skills/fix-prose/shared/scripts/check-suppressions.sh:242; diff and cleanup are at packages/agents/source/skills/fix-prose/shared/scripts/check-suppressions.sh:339 and packages/agents/source/skills/fix-prose/shared/scripts/check-suppressions.sh:384.

Acceptance criteria

1. AC1: Baseline creation returns 0, reports the target's state path and retains the original document.
2. AC2: A second baseline for an active target returns 2 with cleanup guidance.
3. AC3: Two different targets receive distinct state directories.
4. AC4: An operation supplied with another target returns 2 with the target-mismatch diagnostic.
5. AC5: An invalid state path created by the unchanged shell returns 2 with the invalid-state diagnostic.
6. AC6: A changed target produces the original unified diff and status 0.
7. AC7: Cleanup removes only the named workflow, including an accepted legacy state.
8. AC8: Non-functional: state-only edits do not make target-only verification fail.
9. AC9: Non-functional: native state coverage passes on macOS, Linux and Windows.
10. AC10: Given workflow state created by the Go commands, the unchanged shell's baseline-dependent operations (verify, diff, cleanup) accept it and act on that workflow's evidence, with the same results as for shell-created state.

Scope and non-goals

Go state, baseline, diff and cleanup under agentrepo prose check-suppressions. Non-goal: sanction suffix, verification findings, caller switches, test retirement or any frozen-file relocation. No new shell logic. Canonical sources generate the packages and deployments; generated copies are never edited by hand. No edits to shared libraries, guard scripts, merge scripts, ownership rules, workflow files or harness configuration.

Approach

Reuse the existing agentrepo tree. Keep target identity, state layout and compatibility with old-created evidence. Before coding, run the unchanged shell for dirty/staged/untracked/ignored and non-ASCII targets, read-only Git metadata, missing originals and legacy evidence; record results rather than assuming canonicalization behavior.

Observed oracle: baseline DRAFT.md returned 0/state; a duplicate returned 2/active-workflow cleanup guidance; OTHER.md got a different state. Verify with OTHER.md against DRAFT.md state returned 2/target mismatch; invalid state returned 2. Diff printed -first draft/+second draft and exited 0. Cleaning the second state left the first; cleanup of an absolute legacy state succeeded. Run-note edits remained compatible with silent target-only verification.

Dependencies

No build/merge blocker: additive Go only. Consume #321's applicable context contract without implementing its library here. #753 is rollout-only protection, required before #891 switches enforcement; #333/#544 are also rollout-only installation prerequisites.

Size

M. Existing shared suppression implementation: 263 scc code lines; this slice owns state, baseline, diff and cleanup, not a second copy of all 263 lines. Counts use scc 4.1.0; generated package/deployment output and token metadata are excluded, while source, tests, fixtures and frozen copies count. One PR with fewer than 800 changed code lines and at most 2,000 prose lines. No unbuilt Go size is claimed: measure the actual staged diff before publication and split again if the cap is exceeded.

Verify plan

• AC1, AC2, AC3, AC4, AC5, AC7: go test ./internal/agentrepo -run '^TestProseState' -count=1 -v compares status, both streams and evidence against shell fixtures. Named TestProseState subcases cover Baseline (AC1: baseline an existing target, assert exit 0, stdout reporting its state path and a byte-identical original in that state), DuplicateBaseline (AC2: baseline the same active target again, assert exit 2 and the shell's cleanup guidance), DistinctTargets (AC3: baseline two different targets, assert distinct state directories), TargetMismatch (AC4: supply the other target to verify and diff, assert exit 2 and the shell's target-mismatch diagnostic), InvalidShellCreatedState (AC5: fixtures detailed beside AC6 below) and CleanupIsolation (AC7: create two workflows, clean one, assert only the named state is removed and the other is intact; repeat with an accepted legacy state as the cleaned workflow).
• AC8: go test ./internal/agentrepo -run '^TestProseStateWorkflowStateOnlyEdits$' -count=1 -v will create a baseline, edit only a workflow run-note under .fix-prose/, leave the target unchanged and confirm target-only verification still returns 0 with empty stdout and stderr. This checks the workflow-state exclusion from the shell digest at packages/agents/source/skills/fix-prose/shared/scripts/check-suppressions.sh:228.
• AC5, AC6: TestProseState/InvalidShellCreatedState, run by the state command above, starts with unchanged-shell-created state and tests malformed state paths, copies under a wrong root and a mismatched supplied target. Run Go and the unchanged shell on the same fixtures; assert exit 2, matching stdout and the shell's exact stderr diagnostic for each fixture: check-suppressions: invalid workflow state: <state> for malformed paths and wrong roots, and check-suppressions: state belongs to <expected>, not <supplied> for target mismatch. go test ./internal/agentrepo -run '^TestProseDiff' -count=1 -v covers named subcases ChangedTarget (AC6: change the target after baseline, assert the original unified diff and exit 0), UnchangedTarget (empty diff, exit 0) and MissingOriginal (exit 2 and the shell's missing-original diagnostic), comparing both streams and normalizing only roots and timestamps. Diff also consumes valid shell-created state from both the current .fix-prose/run.* and legacy <git-dir>/fix-prose/run.* roots accepted at packages/agents/source/skills/fix-prose/shared/scripts/check-suppressions.sh:102-103,167-173. Apply exact dictionary sanctions in Go #888 adds the sanction suffix separately.
• AC10: go test ./internal/agentrepo -run '^TestProseStateGoCreatedShellOperations$' -count=1 -v uses paired Go-created and shell-created baselines for the same initial target bytes. Its named subcases VerifyUnchanged (unchanged target: shell verify exits 0 with empty stdout and stderr), DiffChanged (edit the target: shell diff exits 0 and prints the unified diff against each state's retained original) and CleanupIsolation (shell cleanup removes that workflow while preserving a second workflow) compare exit status, both streams and filesystem effects between the paired fixtures, normalizing only roots and timestamps. Run these shell-comparison cases in the Unix environments named under AC9. Cover the current .fix-prose/run.* root only, since Go never creates legacy state.
• AC9: run all three native test entry points, TestProseState (including its named subcases above), TestProseStateWorkflowStateOnlyEdits and TestProseDiff, on macOS, Linux and Windows and require passing native state assertions on each platform. Use recorded shell fixtures for native assertions where the shell is unavailable; run live shell comparisons, including AC10, on macOS and Linux and record those environments separately.

At the merged head, record each AC command and result, native platform execution and any skips. Required checks must pass without weakening gates. Obtain independent review of the exact head and record findings dispositions; use signed commits with Assisted-by trailers and the provenance:agent-assisted label. Match documentation to behavior, scan issue/PR text before any later publication, and record the final merge commit and closing reference. This draft authorizes no publication.

Risks

Changed state identity could clean another workflow or admit overlapping writers. Undo: revert this unused Go addition; original entry files and active evidence remain intact.

Operator authority

None