ThothII/.superpowers/sdd/task-3-report.md

Task 3 report — workflow repository migration

RED

• harness/tests/test_session_repository_workflow.py initially failed at collection: persist_verified_finalization did not exist.
• The new gate test initially failed because write_cte_sql and write_final_sql were not registered. Its first run also exposed the worktree-local missing Node dependency (typebox); npm ci installed the lockfile dependency.
• After the principal/legacy policy was clarified, the resolver tests initially failed because resolve_principal did not exist.

GREEN evidence

• Focused Python regression set: 66 passed: test_session_repository_workflow, test_session_repository, session mutation/list/ documents/schema-linking, CTE plan/next, decision phase gate, and phase requirement tests.
• Gate suite: 127 passed, including session-repository-writes.test.js.
• Changed-source Ruff checks pass. git diff --check passes.

Implemented boundary

• Added resolve_principal: PostgreSQL session storage requires trusted THT_PRINCIPAL_ISSUER and THT_PRINCIPAL_SUBJECT, optional display name, and strict admin parsing (1/true). It fails closed and never substitutes a local identity. Filesystem storage uses local_principal().
• Filesystem repository creates UUIDv4 sessions only and permits safe historical timestamp IDs (YYYY-MM-DD-HHMMSS) for read/mutate compatibility. PostgreSQL remains UUIDv4 only.
• Phase helpers fold SessionSnapshot ledger/artifacts; decision, phase, CTE, session mutation/list/document paths, retrieval-pack persistence, SQL promotion lookup, and task-doc/CTE test helpers gained repository/snapshot paths.
• Finalization now publishes report, evidence, and finalized manifest through repository.finalize: one PostgreSQL transaction; filesystem writes artifacts before the finalized manifest commit marker. Solved-question indexing stays best-effort after this durable write.
• Added tht cte save --session --name --file - and tht sql set-final --session --file -; Pi tools and SKILL.md now use them.

Outstanding in-scope migration work

Do not treat this task as complete yet. Remaining direct session path consumers are:

• harness/tht/cli/memory_cmd.py: lines 60, 93, 165, 400, 458.
• harness/tht/cli/sql_cmd.py: _session_sql_file at line 254 remains a legacy Path-returning bridge for preview/save/export.
• harness/tht/cli/session_cmd.py:session_dir remains only as a compatibility bridge for the out-of-scope datamart command and the still-unmigrated memory/ SQL consumers; workflow mutations in session_cmd do not call it.

The full Python suite has not been conclusively re-run to completion after the latest changes. An earlier root-directory invocation failed only because a pre-existing test expects workflow.yaml relative to harness/. Full gate tests are green. Full-repo Ruff currently fails on pre-existing test-file lint findings; changed-source Ruff passes.