From 7f9c5cc496c3d047ba6c7077bc23c92c3303a62f Mon Sep 17 00:00:00 2001
From: ezl-keygraph <ezhil@keygraph.io>
Date: Sat, 14 Feb 2026 01:20:42 +0530
Subject: [PATCH] fix: copy deliverables to audit-logs once at workflow end
 instead of per-agent

Moves the copyDeliverablesToAudit call from runAgentActivity (called after
every agent) to logWorkflowComplete (called once at workflow end). This
prevents intermediate agent runs from copying incomplete or rogue deliverables
into the audit trail.
---
 src/temporal/activities.ts | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/src/temporal/activities.ts b/src/temporal/activities.ts
index a7d5bda..5cf902f 100644
--- a/src/temporal/activities.ts
+++ b/src/temporal/activities.ts
@@ -258,13 +258,6 @@ async function runAgentActivity(
     });
     await commitGitSuccess(repoPath, agentName);
 
-    // 9.5. Copy deliverables to audit-logs (non-fatal)
-    try {
-      await copyDeliverablesToAudit(sessionMetadata, repoPath);
-    } catch (copyErr) {
-      console.error(`Failed to copy deliverables to audit-logs for ${agentName}:`, copyErr);
-    }
-
     // 10. Return metrics
     return {
       durationMs: Date.now() - startTime,
@@ -717,4 +710,11 @@ export async function logWorkflowComplete(
   await auditSession.initialize(workflowId);
   await auditSession.updateSessionStatus(summary.status);
   await auditSession.logWorkflowComplete(summary);
+
+  // Copy all deliverables to audit-logs once at workflow end (non-fatal)
+  try {
+    await copyDeliverablesToAudit(sessionMetadata, repoPath);
+  } catch (copyErr) {
+    console.error('Failed to copy deliverables to audit-logs:', copyErr);
+  }
 }