[refactor-design] cluster-061-workflow-binding-query-runtime-side-read

[loning]

human_brief

问题标题：Workflow 绑定查询把运行时对象形态当成业务事实

问题说明：当前查询 reader 表面上是在读取 workflow binding readmodel，但读取后又继续询问 actor runtime：这个 actor 当前是否存在、是否符合某个具体 GAgent 类型。这会让查询结果依赖当前节点的 runtime 可见性，而不是已经提交并物化的 workflow 事实。

单机环境下它可能表现正常；但在分布式、重启、投影延迟或 runtime 实现替换时，同一个 readmodel 可能因为本地 runtime 形态不同而返回不同结果。开发者需要关注它，因为 workflow run / resume / query 的稳定性会被隐藏地绑定到运行时实现细节上。

示例位置：src/workflow/Aevatar.Workflow.Projection/Orchestration/ProjectionWorkflowActorBindingReader.cs:17-30

public ProjectionWorkflowActorBindingReader(
    IProjectionDocumentReader<WorkflowActorBindingDocument, string> documentStore,
    IActorRuntime runtime, // problem: 查询 reader 直接依赖 runtime 形态
    IAgentTypeVerifier agentTypeVerifier) // problem: 用本地类型探测决定业务绑定类型
{
    ArgumentNullException.ThrowIfNull(documentStore);
    ArgumentNullException.ThrowIfNull(runtime);
    ArgumentNullException.ThrowIfNull(agentTypeVerifier);

    _getDocumentAsync = (actorId, ct) => documentStore.GetAsync(actorId, ct);
    _queryDocumentsAsync = documentStore.QueryAsync;
    _existsAsync = runtime.ExistsAsync; // problem: 查询结果依赖 actor 当前是否被 runtime 看见
    _isExpectedAsync = agentTypeVerifier.IsExpectedAsync; // problem: 用实现类型形态判断业务 kind
}

为什么需要设计：修复不是简单删几行，因为当前 reader 同时承担“读已物化 binding”和“兜底判断未绑定 actor 类型”的职责。需要 maintainer 决定：未物化 binding 时是返回 unknown / not found，还是新增 actor-owned binding/status committed fact 来覆盖这个语义。这会影响 workflow run 创建、resume/signal target resolve，以及已有 actor 的兼容查询行为。

Evidence

• src/workflow/Aevatar.Workflow.Projection/Orchestration/ProjectionWorkflowActorBindingReader.cs:19 注入 IActorRuntime。
• src/workflow/Aevatar.Workflow.Projection/Orchestration/ProjectionWorkflowActorBindingReader.cs:28 保存 runtime.ExistsAsync。
• src/workflow/Aevatar.Workflow.Projection/Orchestration/ProjectionWorkflowActorBindingReader.cs:29 保存 type verifier runtime-shape check。
• src/workflow/Aevatar.Workflow.Projection/Orchestration/ProjectionWorkflowActorBindingReader.cs:49 在 runtime 表示 actor 不存在时拒绝 query result。
• src/workflow/Aevatar.Workflow.Projection/Orchestration/ProjectionWorkflowActorBindingReader.cs:102-103 按 runtime existence/type 过滤已物化 run bindings。
• src/workflow/Aevatar.Workflow.Projection/Orchestration/ProjectionWorkflowActorBindingReader.cs:204-207 从 runtime type shape 派生 binding kind。

相关架构约束：

• 运行时形态不是业务事实：不得把本地实例类型、代理类型、对象可见结构当成业务绑定依据。
• 查询始终走 readmodel：对外查询只读 readmodel，不暴露 actor 内部状态、state mirror payload 或 event replay 为查询主路径。
• 禁止侧读冒充 query：跨 actor 读取必须走 actor-owned contract、projection 或 readmodel。

Fix Boundary

• 不新增第二条 query path。
• 不在 ProjectionWorkflowActorBindingReader 中查询 actor runtime。
• 从 committed workflow binding facts 物化 workflow actor kind / existence / binding。
• 如果产品仍需要 unbound actor lookup，定义显式 actor-owned binding/status contract，而不是读取 runtime type。
• 已有 command provisioning 仍可通过 infrastructure port 使用 runtime lifecycle；本 cluster 只约束 query/read path shape。

design_question

当 workflow actor 还没有 binding document 时，查询层应该返回 not found / unsupported，还是要求 actor 在创建或绑定时提交一个明确的 binding/status fact？

⟦AI:AUTO-LOOP⟧

[loning]

📊 状态卡片 — solver 派出

维度	值
阶段	派出 codex(role=solver)
codex log	phase9-issue925-r1-multi.log
工作目录	/Users/auric/aevatar
timeout	5400s(~90 min 上限)
上下文	Phase 9 r1 三 solver(workflow binding query runtime side-read)
下一步自动会做	1. 三 solver SOLVER_DONE:... 2. controller 派 meta-judge r 3. consensus → implement / converge → fresh round
是否需要人介入	❌ 否(自动推进)

🤖 controller status banner

⟦AI:AUTO-LOOP⟧

[loning]

🤖 minimal solver：删除 workflow binding 查询里的 runtime 侧读

TL;DR

• 这是什么：issue [refactor-design] cluster-061-workflow-binding-query-runtime-side-read #925 的 minimal solver 结论。
• 结论：建议只改 ProjectionWorkflowActorBindingReader，让它只读 WorkflowActorBindingDocument readmodel，不再问 actor runtime 是否存在或是什么类型。
• 下一步：controller 可进入 meta-judge，对比另外两个 solver 输出后决定是否实施。

---

详细说明

我验证了 audit 证据仍然真实：ProjectionWorkflowActorBindingReader 当前注入 IActorRuntime（actor 生命周期/查找 runtime）和 IAgentTypeVerifier（用运行时类型判断 actor 是否符合某个 GAgent 类型），并在 GetAsync、ListByRunIdAsync、QueryAsync 中用这些运行时结果影响查询返回。这违反“查询始终走 readmodel”和“运行时形态不是业务事实”。

最小边界是不新增 actor、不新增 envelope、不新增状态契约，只删除 reader 内的 runtime fallback：缺少 WorkflowActorBindingDocument 时返回 null，已有 document 时按 document 的 ActorKindValue 映射。代价估计 2 个文件，约 +35 / -70 LOC，修改 1 个测试文件；无 CLAUDE.md 规则例外。

---

📎 完整 codex 原始输出(存档备查)

---

solver: minimal
issue: 925
cluster: cluster-061-workflow-binding-query-runtime-side-read
verdict: propose

Recommended framing

Remove runtime-shape fallback from ProjectionWorkflowActorBindingReader and make it a pure readmodel mapper. GetAsync should return null when the WorkflowActorBindingDocument is absent, and map only the document's committed ActorKindValue when present; ListByRunIdAsync and QueryAsync should trust their WorkflowActorBindingDocument query filters instead of re-checking IActorRuntime.ExistsAsync or IAgentTypeVerifier.IsExpectedAsync. This is the smallest viable boundary because it deletes the exact side-read evidence without adding a new actor, envelope, status contract, or second query path; unbound actor lookup becomes unsupported unless a later product decision adds an explicit committed binding/status fact.

Concrete plan (English)

• Files: src/workflow/Aevatar.Workflow.Projection/Orchestration/ProjectionWorkflowActorBindingReader.cs - remove IActorRuntime and IAgentTypeVerifier constructor dependencies, delete _existsAsync, _isExpectedAsync, ResolveActorKindAsync, and CreateUnboundBinding; map only existing WorkflowActorBindingDocument rows.
• Files: test/Aevatar.Workflow.Host.Api.Tests/RuntimeWorkflowActorBindingReaderTests.cs - update tests to assert missing documents return null, document kind is not inferred from runtime type, and list/query paths return projected run bindings without runtime filtering.
• LOC delta: ~+35 / -70.
• Tests to add/modify: modify 1 test file, with 2-3 replacement cases in RuntimeWorkflowActorBindingReaderTests.cs; run dotnet test test/Aevatar.Workflow.Host.Api.Tests/Aevatar.Workflow.Host.Api.Tests.csproj --nologo, bash tools/ci/workflow_binding_boundary_guard.sh, and bash tools/ci/query_projection_priming_guard.sh.
• Rule exception (if any): none.
• Migration path: no migration needed for actors that already emitted BindWorkflowDefinitionEvent or BindWorkflowRunDefinitionEvent; callers that pass an actor id with no materialized binding now receive null and must wait for the committed binding projection or create/bind through the existing provisioning path.

Concrete plan (中文)

• 文件：src/workflow/Aevatar.Workflow.Projection/Orchestration/ProjectionWorkflowActorBindingReader.cs - 删除 IActorRuntime 与 IAgentTypeVerifier 构造依赖，删除 _existsAsync、_isExpectedAsync、ResolveActorKindAsync、CreateUnboundBinding；只映射已经存在的 WorkflowActorBindingDocument。
• 文件：test/Aevatar.Workflow.Host.Api.Tests/RuntimeWorkflowActorBindingReaderTests.cs - 调整测试，明确缺少 binding document 时返回 null，不再用 runtime type 推断 actor kind，list/query 只根据投影文档返回 run binding，不再做 runtime 过滤。
• LOC 变化：约 +35 / -70。
• 需要新增/修改的测试：修改 1 个测试文件，在 RuntimeWorkflowActorBindingReaderTests.cs 中替换 2-3 个用例；验证命令为 dotnet test test/Aevatar.Workflow.Host.Api.Tests/Aevatar.Workflow.Host.Api.Tests.csproj --nologo、bash tools/ci/workflow_binding_boundary_guard.sh、bash tools/ci/query_projection_priming_guard.sh。
• 规则例外：无。
• 迁移路径：已提交 BindWorkflowDefinitionEvent 或 BindWorkflowRunDefinitionEvent 的 actor 不需要迁移；传入没有物化 binding 的 actor id 时调用方会得到 null，应等待 committed binding projection，或走现有 provisioning 路径创建并绑定。

Risks

• Existing behavior that synthesized an unbound definition/run binding from live runtime type disappears; if a caller relied on that fallback, it will now see null until the binding projection exists.
• Projection lag becomes visible to callers that ask for a just-bound actor before the binding document is materialized. This is aligned with readmodel-only query semantics but may require callers to handle eventual consistency honestly.
• Historical actors that exist in runtime but never emitted binding events will no longer be discoverable through this reader; repairing that requires a separate explicit migration or committed status fact, not a runtime side-read.

Escalation triggers (if any)

• none

Reasoning trace (internal — short, for meta-judge)

• Why this is the minimum: every cited evidence line is inside ProjectionWorkflowActorBindingReader; deleting its runtime/type-verifier dependencies removes the violation in 1 production file and keeps the existing WorkflowActorBindingDocument readmodel/projector contract unchanged.
• What I considered but rejected: adding an actor-owned binding/status contract, an aggregate actor, or a new readmodel field; those may be product-correct if unbound lookup is required, but they are not needed to remove the audited side-read.
• What I cannot decide alone: whether the product must support querying pre-binding or historically unbound workflow actors. If yes, this should become a separate design issue for a committed actor-owned status fact.

SOLVER_DONE:minimal:propose:make ProjectionWorkflowActorBindingReader readmodel-only by deleting runtime existence/type fallback
⟦AI:AUTO-LOOP⟧

⟦AI:AUTO-LOOP⟧

[loning]

🤖 delete solver 建议删除 runtime 形态兜底

TL;DR

• 这是什么: issue 925 的 delete solver 结论，目标是删掉 workflow binding query 的 runtime side-read。
• 结论: 不删 public reader/endpoint；只删 ProjectionWorkflowActorBindingReader 里 IActorRuntime.ExistsAsync 与 IAgentTypeVerifier.IsExpectedAsync 参与查询判定的逻辑。
• 下一步: controller 可让 minimal/structural 基于这个边界实现；无需 maintainer 人工介入。

📢 cc 原作者:@eanzhao @loning 请 sanity-check 是否存在必须支持的“未绑定 workflow actor id + inline YAML”公开契约。

---

详细说明

我把这个归类为“真实能力存在，但局部过度建模”。IWorkflowActorBindingReader / IWorkflowRunBindingReader 是活的：workflow run 创建、resume/signal/stop、Scope Workflow 列表/详情/运行、Studio workflow 读取都依赖它们。因此不建议删除 binding readmodel 或 public endpoint。

可删除的是 query reader 内部的 runtime 形态兜底：现在 reader 先读 WorkflowActorBindingDocument，又用 IActorRuntime.ExistsAsync 判断 actor 当前是否被本节点看见，并用 IAgentTypeVerifier.IsExpectedAsync 从本地实现类型推导 WorkflowActorKind。但 WorkflowActorBindingProjector 已经从 committed BindWorkflowDefinitionEvent / BindWorkflowRunDefinitionEvent 物化出 ActorKind、RunId、DefinitionActorId、ScopeId、source version、event id。查询层应只信任这些 readmodel 字段；没有 document 就返回 null，不要临时构造 unbound binding。

建议实施边界：保留 reader 与接口；删除构造函数中的 IActorRuntime / IAgentTypeVerifier 依赖，删除 _existsAsync、_isExpectedAsync、ResolveActorKindAsync、CreateUnboundBinding，批量 run binding 查询也不再逐行 runtime re-check。相关测试删除/改写 runtime-shape 断言，保留 document mapping 与 readmodel-only 查询覆盖。预计净删约 65-95 LOC。

---

📎 完整 codex 原始输出(存档备查)

---

solver: delete
issue: 925
cluster: cluster-061-workflow-binding-query-runtime-side-read
verdict: propose

Classification

(d) Genuinely needed but over-built

Recommended action (English)

Keep the workflow binding readmodel and its public query interfaces, but delete the runtime-shape fallback from ProjectionWorkflowActorBindingReader. The reader should only map WorkflowActorBindingDocument rows materialized from committed BindWorkflowDefinitionEvent / BindWorkflowRunDefinitionEvent facts. If no document exists, return null; if run binding queries return documents, trust their typed ActorKind, RunId, DefinitionActorId, ScopeId, and source version instead of re-asking IActorRuntime.ExistsAsync or IAgentTypeVerifier.IsExpectedAsync. This removes the local-runtime dependency without adding a new actor/status contract.

Recommended action (中文)

保留 workflow binding readmodel 及现有查询接口，但删除 ProjectionWorkflowActorBindingReader 里的 runtime 形态兜底。reader 只负责读取并映射由已提交 BindWorkflowDefinitionEvent / BindWorkflowRunDefinitionEvent 物化出来的 WorkflowActorBindingDocument。没有 document 就返回 null；run binding 批量查询返回 document 后，直接信任其中强类型的 ActorKind、RunId、DefinitionActorId、ScopeId 与 source version，不再反查 IActorRuntime.ExistsAsync 或 IAgentTypeVerifier.IsExpectedAsync。这样能删除本地 runtime 依赖，且不需要新增 actor/status 契约。

Concrete plan (if propose)

• Files to delete: none as whole files.
• Caller migrations:
  • ProjectionWorkflowActorBindingReader.GetAsync -> IProjectionDocumentReader<WorkflowActorBindingDocument, string>.GetAsync only; remove IActorRuntime / IAgentTypeVerifier constructor dependencies, _existsAsync, _isExpectedAsync, ResolveActorKindAsync, and CreateUnboundBinding.
  • ProjectionWorkflowActorBindingReader.ListByRunIdAsync -> keep the existing WorkflowActorBindingDocument.RunId + ActorKindValue == Run query and remove per-row runtime existence/type filters.
  • ProjectionWorkflowActorBindingReader.QueryAsync -> keep the existing document query by scope and definition actor ids and remove per-row runtime existence/type filters.
  • WorkflowRunActorResolver, WorkflowRunControlCommandTargetResolverBase, WorkflowRunActorPort, ScopeWorkflowQueryApplicationService, ScopeWorkflowEndpoints, and ScopeServiceEndpoints need no API migration; their IWorkflowActorBindingReader / IWorkflowRunBindingReader dependency remains.
• Tests to delete:
  • Delete or rewrite runtime-shape assertions in test/Aevatar.Workflow.Host.Api.Tests/RuntimeWorkflowActorBindingReaderTests.cs: GetAsync_ShouldReturnNull_WhenActorMissing, GetAsync_ShouldReturnUnsupportedBinding_WhenActorIsNotWorkflowCapable, GetAsync_ShouldUseVerifierKind_WhenProjectedDocumentDoesNotDeclareKind, and GetAsync_ShouldReturnUnboundDefinitionBinding_WhenProjectionHasNoDocument.
  • Keep document-mapping coverage; add/adjust tests that missing document returns null, document kind is mapped from readmodel, and list/query no longer call runtime verifier delegates.
• LOC delta: about -65 to -95 net after test rewrites.
• Tracking issue (if defer): not applicable; "defer" is not a valid verdict for this loop.

Reverse-evidence (why this is safe to delete)

• No public route or interface deletion is proposed: IWorkflowActorBindingReader, IWorkflowRunBindingReader, workflow control endpoints, Scope Workflow endpoints, and Studio workflow calls remain in place.
• The live value chain depends on the binding readmodel, not on the runtime fallback: WorkflowRunActorResolver, WorkflowRunControlCommandTargetResolverBase, WorkflowRunActorPort, ScopeWorkflowQueryApplicationService, ScopeWorkflowEndpoints, and ScopeServiceEndpoints all consume WorkflowActorBinding facts.
• The committed source already exists: WorkflowActorBindingProjector materializes WorkflowActorBindingDocument from committed BindWorkflowDefinitionEvent and BindWorkflowRunDefinitionEvent, carrying actor kind, definition id, run id, workflow name/yaml, scope, source version, and last event id.
• The runtime-shape fallback is historical compatibility glue: git log -p --follow -S CreateUnboundBinding shows it was introduced together with query-time projection priming, and the priming call was removed later while ExistsAsync / IsExpectedAsync remained.
• Tests covering the runtime fallback are not load-bearing for product behavior; they assert the side-read itself, including unbound binding creation from local type shape.
• External repo dependency is not involved: the cluster is entirely inside workflow projection/application/hosting; NyxID / chrono-* APIs are untouched.

Risks

• If a supported product path intentionally starts workflows from an existing unbound WorkflowGAgent actor id plus inline YAML, that path will change from "runtime says workflow-capable" to "no committed binding document, so not found".
• If stale binding documents for destroyed actors are common and currently hidden by _existsAsync, deleting the filter can reveal readmodel cleanup gaps. That is still the honest readmodel behavior; cleanup/retirement should be represented by committed facts rather than local runtime visibility.
• If old projection data has ActorKind == Unsupported for valid bindings, removing type-verifier fallback will surface the bad data instead of silently correcting it from runtime type shape.

Escalation triggers (if any)

• None. This plan does not delete public endpoints or introduce a new actor/envelope/pipeline phase. It removes an undocumented local-runtime fallback from a query reader.

Reasoning trace (internal — for meta-judge)

• Why I claim this can be deleted: the violating value is not "workflow binding queries"; it is "derive binding existence/kind from current local runtime shape". The authoritative binding facts are already committed and projected, so the fallback duplicates the readmodel and violates the repo rule that runtime shape is not business fact.
• What I checked to verify safety: gh issue view 925 --json ...; .refactor-loop/runs/audit-iter-61.md; CLAUDE.md deletion-first clause; rg call sites for ProjectionWorkflowActorBindingReader, IWorkflowActorBindingReader, IWorkflowRunBindingReader, WorkflowActorBindingDocument; WorkflowRunActorResolver, workflow control target resolver, workflow run actor port, Scope Workflow endpoints, Scope Service run endpoints; WorkflowActorBindingProjector; git log -p --follow -S CreateUnboundBinding; git log -p --follow -S EnsureActorProjectionAsync; current reader line numbers with nl -ba.
• What I cannot decide alone: whether any external caller intentionally relies on passing an existing but unbound workflow actor id to start a run. The codebase evidence does not show that as a stable public contract; if it is required, it needs a committed binding/status fact, not runtime type probing.

SOLVER_DONE:delete:propose:delete ProjectionWorkflowActorBindingReader runtime existence/type fallback; keep binding readmodel queries only

⟦AI:AUTO-LOOP⟧

⟦AI:AUTO-LOOP⟧

[loning]

🤖 structural solver：建议把 workflow binding 查询收敛为 readmodel-only

TL;DR

• 这是什么：issue 925 的 structural solver 方案，针对 ProjectionWorkflowActorBindingReader 查询侧读 runtime。
• 结论：建议直接删除 runtime/type fallback，WorkflowActorBindingDocument 缺失就返回 not found。
• 下一步：meta-judge 可与另外两个 solver 对齐；只有要保留“never-bound actor lookup”时才需要人确认。

---

详细说明

IWorkflowActorBindingReader 是 workflow binding 的窄查询接口；WorkflowActorBindingDocument 已经由 committed BindWorkflowDefinitionEvent / BindWorkflowRunDefinitionEvent 投影生成，包含 ActorKind、definition id、run id、workflow payload、source version、event id。

方案不新增 actor、不新增 envelope、不新增 projection phase：只把 reader 改成纯 readmodel mapper，删除 IActorRuntime.ExistsAsync 和 IAgentTypeVerifier.IsExpectedAsync。预计生产代码约 -65/+5 LOC，测试和架构守卫约 +130 LOC；运行时每次 GetAsync 少 1 次 existence probe 和最多 2 次 type probe，列表查询最多少 2 * take 次 runtime probe。

需要升级为 maintainer 决策的唯一核心点：如果产品必须支持“actor 从未提交 binding fact，但当前 runtime 可见，所以也要查出来”，那应新增 actor-owned typed status fact，而不是在 query reader 继续看 runtime。

---

📎 完整 codex 原始输出(存档备查)

---

solver: structural
issue: 925
cluster: cluster-061-workflow-binding-query-runtime-side-read
verdict: propose

CLAUDE clause violated (quoted verbatim)

• 运行时形态不是业务事实：不得把本地实例类型、代理类型、对象可见结构当成业务绑定依据。

• 查询始终走 readmodel：对外查询只读 readmodel；不暴露 actor 内部状态、state mirror payload 或 event replay 为查询主路径。

• projection 只消费 committed 事实：基于 committed domain event 或其同源 durable feed 构建；禁止订阅入站 command、self continuation 或 actor 运行时偶然结构。

Recommended framing (English)

Make WorkflowActorBindingDocument the only authority for workflow binding queries, and treat missing documents as not found, not as a prompt to inspect the runtime. The existing structure is already deep enough: WorkflowGAgent and WorkflowRunGAgent commit BindWorkflowDefinitionEvent / BindWorkflowRunDefinitionEvent; WorkflowActorBindingProjector materializes ActorKind, definition id, run id, workflow payload, source version, and event id; ProjectionWorkflowActorBindingReader should only map that readmodel through IWorkflowActorBindingReader / IWorkflowRunBindingReader. Remove IActorRuntime, IAgentTypeVerifier, synthetic unbound bindings, and per-row runtime filters from the reader. This eliminates the violation by construction because query results become a pure function of committed projection state, with no dependency on local actor visibility or CLR type shape.

Recommended framing (中文)

把 WorkflowActorBindingDocument 作为 workflow binding 查询的唯一权威来源，缺失 document 就返回 not found，不能再把缺失当成检查 runtime 的理由。现有结构已经足够承载这个语义：WorkflowGAgent / WorkflowRunGAgent 提交 BindWorkflowDefinitionEvent / BindWorkflowRunDefinitionEvent；WorkflowActorBindingProjector 已经物化 ActorKind、definition id、run id、workflow payload、source version、event id；ProjectionWorkflowActorBindingReader 只应通过 IWorkflowActorBindingReader / IWorkflowRunBindingReader 映射这个 readmodel。删除 reader 里的 IActorRuntime、IAgentTypeVerifier、未绑定 synthetic binding、逐行 runtime 过滤。这样查询结果只由 committed projection state 决定，不再依赖本节点能否看到 actor 或 CLR 类型形态，结构上消掉违规。

Concrete plan

• New abstractions (if any): none. The existing seam is IWorkflowActorBindingReader / IWorkflowRunBindingReader in Layer Application Abstractions, Project src/workflow/Aevatar.Workflow.Application.Abstractions; the existing materialization input is EventEnvelope<CommittedStateEventPublished> through the Projection Pipeline.
• Files:
  • src/workflow/Aevatar.Workflow.Projection/Orchestration/ProjectionWorkflowActorBindingReader.cs: remove IActorRuntime and IAgentTypeVerifier constructor dependencies, delete _existsAsync, _isExpectedAsync, ResolveActorKindAsync, and CreateUnboundBinding; make GetAsync return null when the document is missing and map only document-declared ActorKind; make ListByRunIdAsync / QueryAsync filter only malformed readmodel rows, not runtime existence/type.
  • src/workflow/Aevatar.Workflow.Projection/DependencyInjection/ServiceCollectionExtensions.cs: compile-check registration after constructor narrowing; no new service registration should be needed.
  • test/Aevatar.Workflow.Host.Api.Tests/RuntimeWorkflowActorBindingReaderTests.cs: replace runtime-shape tests with readmodel-only tests; optionally rename the file to ProjectionWorkflowActorBindingReaderTests.cs in the same PR to remove the obsolete runtime label.
  • test/Aevatar.Workflow.Host.Api.Tests/WorkflowBindingReaderCoverageTests.cs: extend projector tests to assert committed bind events populate ActorKind, StateVersion, and LastEventId as the source facts the reader trusts.
  • test/Aevatar.Workflow.Application.Tests/WorkflowRunActorResolverTests.cs: add an explicit behavior test that an actor id with no binding readmodel returns AgentNotFound even if the id looks like a workflow actor; no runtime/type fallback is part of the query contract.
  • test/Aevatar.Architecture.Tests/Rules/CqrsBoundaryTests.cs: add a static rule that *BindingReader query types in Aevatar.Workflow.Projection must not depend on IActorRuntime or IAgentTypeVerifier.
• LOC delta: ~+135 / -85, net +50. Production delta should be negative (-65 / +5); most additions are behavior and architecture tests.
• Tests to add:
  • ProjectionWorkflowActorBindingReaderTests.GetAsync_ReturnsNull_WhenReadModelMissing: asserts no synthetic unbound binding is produced.
  • ProjectionWorkflowActorBindingReaderTests.GetAsync_MapsDocumentKind_WithoutRuntimeVerifier: asserts ActorKind comes from WorkflowActorBindingDocument.ActorKind.
  • ProjectionWorkflowActorBindingReaderTests.ListByRunIdAsync_ReturnsProjectedRunRows_WithoutRuntimeFiltering: asserts query results are not dropped by actor runtime visibility.
  • ProjectionWorkflowActorBindingReaderTests.QueryAsync_ReturnsProjectedRunRows_WithoutRuntimeFiltering: same for multi-definition query.
  • WorkflowRunActorResolverTests.ResolveOrCreateAsync_ShouldReturnAgentNotFound_WhenBindingReadModelMissing_ForOpaqueActorId: locks the product behavior for missing binding docs.
  • CqrsBoundaryTests.WorkflowProjectionBindingReaders_ShouldNotDependOnRuntimeShape: static regression guard.
• proto changes (if any): none. Existing src/workflow/Aevatar.Workflow.Projection/workflow_actor_binding_document.proto fields already carry the required facts: actor_kind_value = 7, definition_actor_id = 8, run_id = 9, workflow_name = 10, workflow_yaml = 11, inline_workflow_yaml_entries = 12, scope_id = 13.
• Runtime cost: 0 new actor hops, 0 new envelopes, 0 new projection phases, 0 new channels. GetAsync removes 1 ExistsAsync call plus up to 2 type-verifier calls, saving ~1-3 awaits per request; in local runtime this is roughly 0.1-1 ms, and in distributed runtime it avoids potential 2-10 ms remote probes. ListByRunIdAsync / QueryAsync remove up to 2 runtime probes per returned row; with current caps this avoids up to 200 probes for ListByRunIdAsync(take=100) and 400 probes for QueryAsync(take=200). Allocation change is neutral-to-lower: two delegate fields removed; result list allocation remains.

Risks

• This trades off the old convenience behavior where a never-bound but currently visible workflow actor could still be classified by runtime type. The clean replacement is intentional: such an actor has no committed binding fact, so query should return not found until the actor commits a bind/status fact and projection materializes it.
• The over-engineering risk is adding a new status actor, second read path, or generic binding-status port. Keep the fix bounded by using the existing bind events, existing projector, and existing reader seam; only add a new typed status fact if product explicitly requires lookup of never-bound actors.
• Existing tests that used runtime fakes as binding facts will need to become readmodel fixtures. That is the desired test surface change, but it may expose callers that were relying on the illegal fallback.

Escalation triggers (if any)

• ESCALATE_REASON:lifecycle-topology:if maintainers require preserving lookup of existing never-bound workflow-capable actors by actor id; that requires an actor-owned binding/status fact emitted during lifecycle, not a query reader fallback.
• ESCALATE_REASON:core-actor-type:if the chosen implementation introduces a dedicated WorkflowActorBindingStatusActor or aggregate actor; this proposal does not need one.
• ESCALATE_REASON:pipeline-phase:if the chosen implementation requires a new projection pipeline phase before committed bind events; this proposal uses the existing materializer path.
• ESCALATE_REASON:docs-canon:if reviewers want to redefine repo vocabulary for readmodel authority or unbound actor status in docs/canon/*; this proposal should not touch canon docs.
• ESCALATE_REASON:cross-cluster:if another in-flight PR already changes WorkflowActorBindingDocument, WorkflowActorBindingProjector, ProjectionWorkflowActorBindingReader, or workflow run target resolution semantics.

Reasoning trace (internal — for meta-judge)

• Why this structure beats a documented exception: a documented exception would still make query correctness depend on local runtime visibility and CLR type shape. Removing those dependencies makes the illegal state unrepresentable in the reader.
• Why I picked this abstraction over alternatives: no new abstraction is justified because the repo already has the required deep seam (IWorkflowActorBindingReader) and the required authority path (committed bind events -> projection -> readmodel). A new port would have one production caller and would mostly rename the same readmodel query. A new actor/status contract is only justified if never-bound actor lookup is a product requirement.
• What I cannot decide alone: whether product semantics require querying actors that have never committed a workflow binding fact. If yes, the design must first define the actor-owned status fact and when it is emitted; otherwise the clean behavior is missing readmodel -> not found.

SOLVER_DONE:structural:propose:make workflow binding queries readmodel-only by deleting runtime/type fallback from ProjectionWorkflowActorBindingReader
⟦AI:AUTO-LOOP⟧

⟦AI:AUTO-LOOP⟧

[loning]

📊 状态卡片 — judge 派出

维度	值
阶段	派出 codex(role=judge)
codex log	phase9-issue925-r1-judge.log
工作目录	/Users/auric/aevatar
timeout	5400s(~90 min 上限)
上下文	r1 meta-judge 派出(3 solver 全 propose 删 runtime fallback)
下一步自动会做	1. judge META_JUDGE_DONE:... 2. consensus → implement / converge → fresh round / escalate → reflector or 人介入
是否需要人介入	❌ 否(自动推进)

🤖 controller status banner

⟦AI:AUTO-LOOP⟧

[loning]

🤖 meta-judge：issue 925 已达成 3/3 共识

TL;DR

• 这是什么：Phase 9 meta-judge 对 issue [refactor-design] cluster-061-workflow-binding-query-runtime-side-read #925 三个 solver 输出的裁决。
• 结论：3/3 solver 都选择删除 ProjectionWorkflowActorBindingReader 的 runtime/type fallback，查询只读 binding readmodel。
• 下一步：controller 可按 design_decision_path=/Users/auric/aevatar/.refactor-loop/runs/phase9-issue925-r1-judge.md 派 implement codex，并给 issue 加 auto-loop-resume。

---

详细说明

本轮没有触发硬编码架构哲学升级条件：issue 没有 design-philosophy label，human_brief.why_needs_design 未命中指定 trigger keyword，三个 solver marker 都是 propose，没有新增 actor 类型、envelope 类型或 projection pipeline phase，也没有改 docs/canon/* 词汇。

裁决选择 minimal framing，因为它和 structural/delete 的生产边界一致但文件面更窄：ProjectionWorkflowActorBindingReader 只映射 WorkflowActorBindingDocument；document 缺失返回 null；list/query 路径不再调用 IActorRuntime.ExistsAsync 或 IAgentTypeVerifier.IsExpectedAsync。IActorRuntime 是 actor 生命周期/查找 runtime，IAgentTypeVerifier 是按运行时类型判断 actor 是否符合某类 GAgent 的检查器；二者不应参与 query 事实判断。

方案	solver verdict	取舍
minimal	propose	约 +35/-70 LOC，只改 reader 与 1 个测试文件，最小删除违规侧读。
structural	propose	同一生产边界，但额外建议更多架构/行为测试，适合 implement 时择要补充。
delete	propose	同一删除方向，强调保留现有 public query 接口、不删 endpoint。

---

📎 完整 codex 原始输出(存档备查)

    ---
    issue: 925
    cluster: cluster-061-workflow-binding-query-runtime-side-read
    convergence_round: 1
    solver_verdicts:
      minimal: propose
      structural: propose
      delete: propose
    decision: consensus
    ---
    
    ## Decision (English)
    Consensus reached. No hard architecture-philosophy trigger fires: issue #925 has no `design-philosophy` label, the issue body's `human_brief.why_needs_design` does not contain the hardcoded trigger keywords, no solver marker is `escalate:`, no plan adds a new actor type, envelope kind, or projection pipeline phase, and no plan modifies `docs/canon/*` vocabulary. The 3 solvers are 3/3 `propose` and converge on the same framing: make `ProjectionWorkflowActorBindingReader` readmodel-only by deleting `IActorRuntime` / `IAgentTypeVerifier` runtime-shape fallback, returning `null` when the binding document is missing, and trusting committed `WorkflowActorBindingDocument` rows for list/query paths.
    
    ## Decision (中文)
    已达成共识。本轮没有触发硬编码架构哲学升级条件：issue #925 没有 `design-philosophy` label，issue body 的 `human_brief.why_needs_design` 不包含指定触发关键词，没有 solver marker 是 `escalate:`，各方案没有新增 actor 类型、envelope 类型或 projection pipeline phase，也没有修改 `docs/canon/*` 词汇。3 个 solver 均为 `propose`，并收敛到同一 framing：把 `ProjectionWorkflowActorBindingReader` 改成 readmodel-only，删除 `IActorRuntime` / `IAgentTypeVerifier` runtime 形态兜底；binding document 缺失时返回 `null`；list/query 路径只信任 committed `WorkflowActorBindingDocument`。
    
    ## If consensus
    - Chosen framing: minimal
    - Implement plan (verbatim copy from the winning solver's "Concrete plan" section)
    
    - Files: `src/workflow/Aevatar.Workflow.Projection/Orchestration/ProjectionWorkflowActorBindingReader.cs` - remove `IActorRuntime` and `IAgentTypeVerifier` constructor dependencies, delete `_existsAsync`, `_isExpectedAsync`, `ResolveActorKindAsync`, and `CreateUnboundBinding`; map only existing `WorkflowActorBindingDocument` rows.
    - Files: `test/Aevatar.Workflow.Host.Api.Tests/RuntimeWorkflowActorBindingReaderTests.cs` - update tests to assert missing documents return `null`, document kind is not inferred from runtime type, and list/query paths return projected run bindings without runtime filtering.
    - LOC delta: ~+35 / -70.
    - Tests to add/modify: modify 1 test file, with 2-3 replacement cases in `RuntimeWorkflowActorBindingReaderTests.cs`; run `dotnet test test/Aevatar.Workflow.Host.Api.Tests/Aevatar.Workflow.Host.Api.Tests.csproj --nologo`, `bash tools/ci/workflow_binding_boundary_guard.sh`, and `bash tools/ci/query_projection_priming_guard.sh`.
    - Rule exception (if any): none.
    - Migration path: no migration needed for actors that already emitted `BindWorkflowDefinitionEvent` or `BindWorkflowRunDefinitionEvent`; callers that pass an actor id with no materialized binding now receive `null` and must wait for the committed binding projection or create/bind through the existing provisioning path.
    
    - Implementation owner: dispatch implement codex with cluster_id=cluster-061-workflow-binding-query-runtime-side-read, design_decision_path=/Users/auric/aevatar/.refactor-loop/runs/phase9-issue925-r1-judge.md
    - Add `auto-loop-resume` label to issue 925
    
    ## If converge
    - Convergence question (specific): n/a
    - What each solver should address explicitly: n/a
    - Round number this fires: n/a
    
    ## If escalate
    - Trigger category: n/a
    - What needs human input (specific question): n/a
    - Suggested next step for human: n/a
    
    ## Round audit trail (links to local artifacts)
    - solver-minimal: /Users/auric/aevatar/.refactor-loop/runs/solver-minimal-issue925-r1.md
    - solver-structural: /Users/auric/aevatar/.refactor-loop/runs/solver-structural-issue925-r1.md
    - solver-delete: /Users/auric/aevatar/.refactor-loop/runs/phase9-issue925-r1-delete.md
    
    ⟦AI:AUTO-LOOP⟧
    META_JUDGE_DONE:consensus:minimal:3/3 solvers agree to delete ProjectionWorkflowActorBindingReader runtime/type fallback and keep binding queries readmodel-only

⟦AI:AUTO-LOOP⟧

[loning]

📊 状态卡片 — implement 派出

维度	值
阶段	派出 codex(role=implement)
codex log	implement-iter56-issue925.log
工作目录	/Users/auric/aevatar-wt-iter56-cluster-925-binding-query-readmodel-only
timeout	5400s(~90 min 上限)
上下文	Phase 9 r1 consensus(3/3 一轮:删 runtime fallback,readmodel-only)→ implement 派出
下一步自动会做	1. implement 完成 marker IMPLEMENT_DONE:<cluster>:<status> 2. controller commit + push 3. open PR + 派 reviewer r1
是否需要人介入	❌ 否(自动推进)

🤖 controller status banner

⟦AI:AUTO-LOOP⟧