Fix FS3511 warnings in code and set Warnings-as-Errors

.beads/issues.jsonl

@@ -57,6 +57,7 @@
 {"id":"Grace-cca","title":"Review: deterministic chaptering + packet assembly","status":"closed","priority":2,"issue_type":"task","created_at":"2026-01-06T01:14:51.2457243-08:00","created_by":"Scott Arbeit","updated_at":"2026-01-06T02:30:30.9647007-08:00","closed_at":"2026-01-06T02:30:30.9647007-08:00","close_reason":"Closed"}
 {"id":"Grace-chq","title":"Server: Review endpoints","status":"closed","priority":2,"issue_type":"task","created_at":"2026-01-06T01:14:50.0836908-08:00","created_by":"Scott Arbeit","updated_at":"2026-01-06T01:56:02.1303505-08:00","closed_at":"2026-01-06T01:56:02.1303505-08:00","close_reason":"Closed"}
 {"id":"Grace-d6y","title":"Queue: gate framework + attestations","status":"closed","priority":2,"issue_type":"task","created_at":"2026-01-06T01:14:52.8430355-08:00","created_by":"Scott Arbeit","updated_at":"2026-01-06T02:46:56.9159633-08:00","closed_at":"2026-01-06T02:46:56.9159633-08:00","close_reason":"Closed"}
+{"id":"Grace-dcs","title":"Fix build errors in Grace.CLI and Grace.Server","status":"closed","priority":2,"issue_type":"task","created_at":"2026-01-10T12:54:09.3683809-08:00","created_by":"Scott Arbeit","updated_at":"2026-01-10T12:57:33.2944729-08:00","closed_at":"2026-01-10T12:57:33.2944729-08:00","close_reason":"Closed"}
 {"id":"Grace-dof","title":"CLI fallback to server OIDC config endpoint","status":"closed","priority":2,"issue_type":"task","created_at":"2026-01-08T01:49:50.4603822-08:00","created_by":"Scott Arbeit","updated_at":"2026-01-08T02:03:33.5007944-08:00","closed_at":"2026-01-08T02:03:33.5007944-08:00","close_reason":"Closed"}
 {"id":"Grace-dv3","title":"Show resolved implicit ids in verbose parse output","status":"open","priority":2,"issue_type":"task","created_at":"2026-01-09T00:34:41.3147349-08:00","created_by":"Scott Arbeit","updated_at":"2026-01-09T00:34:41.3147349-08:00"}
 {"id":"Grace-e10","title":"P2 Optional: CODEOWNERS + security scans","description":"Add CODEOWNERS and basic security scan config if desired; document required reviewers.","acceptance_criteria":"Guardrails added and documented; minimal overhead.","status":"open","priority":2,"issue_type":"task","created_at":"2026-01-09T12:32:04.8295523-08:00","created_by":"Scott Arbeit","updated_at":"2026-01-09T12:32:04.8295523-08:00"}

src/AGENTS.md

@@ -61,6 +61,68 @@ Optional: `pwsh ./scripts/install-githooks.ps1` to add a pre-commit
 - Format code with `dotnet tool run fantomas --recurse .` (from `./src`) and
   include comprehensive, copy/paste-ready snippets when sharing examples.
 
+### Avoid FS3511 in resumable computation expressions
+
+These rules apply to `task { }` and `backgroundTask { }`.
+
+1. **Do not define `let rec` inside `task { }`.**
+
+   Bad:
+
+   ```fsharp
+   task {
+       let rec poll () = task { return! poll () }
+       return! poll ()
+   }
+   ```
+
+   Good:
+
+   ```fsharp
+   task {
+       let mutable done_ = false
+       while not done_ do
+           done_ <- true
+   }
+   ```
+
+2. **Avoid `for ... in ... do` loops inside `task { }`.**
+
+   Bad:
+
+   ```fsharp
+   task {
+       for item in items do
+           useItem item
+   }
+   ```
+
+   Good:
+
+   ```fsharp
+   task {
+       items |> Seq.iter useItem
+   }
+   ```
+
+3. **Policy: treat FS3511 warnings as regressions (do not suppress).**
+
+   Bad:
+
+   ```xml
+   <PropertyGroup>
+     <NoWarn>FS3511</NoWarn>
+   </PropertyGroup>
+   ```
+
+   Good:
+
+   ```xml
+   <PropertyGroup>
+     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+   </PropertyGroup>
+   ```
+
 ## Agent-Friendly Context Practices
 
 - Start with the relevant `AGENTS.md` file(s) to load key patterns,

src/Directory.Build.props

@@ -5,6 +5,7 @@
         <SuppressNETCoreSdkPreviewMessage>true</SuppressNETCoreSdkPreviewMessage>
         <EnableNETAnalyzers>true</EnableNETAnalyzers>
         <AnalysisLevel>latest</AnalysisLevel>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
         <NoWarn>$(NoWarn);NETSDK1057</NoWarn>
         <PublishProfile>DefaultContainer</PublishProfile>
         <OtherFlags>$(OtherFlags) --test:GraphBasedChecking</OtherFlags>

src/Grace.Actors/AccessControl.Actor.fs

@@ -27,12 +27,11 @@ module AccessControl =
         match scope with
         | Scope.System -> "system"
         | Scope.Owner ownerId -> $"owner:{ownerId}"
-        | Scope.Organization(ownerId, organizationId) -> $"org:{ownerId}:{organizationId}"
-        | Scope.Repository(ownerId, organizationId, repositoryId) -> $"repo:{ownerId}:{organizationId}:{repositoryId}"
-        | Scope.Branch(ownerId, organizationId, repositoryId, branchId) -> $"branch:{ownerId}:{organizationId}:{repositoryId}:{branchId}"
+        | Scope.Organization (ownerId, organizationId) -> $"org:{ownerId}:{organizationId}"
+        | Scope.Repository (ownerId, organizationId, repositoryId) -> $"repo:{ownerId}:{organizationId}:{repositoryId}"
+        | Scope.Branch (ownerId, organizationId, repositoryId, branchId) -> $"branch:{ownerId}:{organizationId}:{repositoryId}:{branchId}"
 
-    type AccessControlActor([<PersistentState(StateName.AccessControl, Grace.Shared.Constants.GraceActorStorage)>] state: IPersistentState<AccessControlState>)
-        =
+    type AccessControlActor([<PersistentState(StateName.AccessControl, Grace.Shared.Constants.GraceActorStorage)>] state: IPersistentState<AccessControlState>) =
         inherit Grain()
 
         let log = loggerFactory.CreateLogger("AccessControl.Actor")
@@ -124,7 +123,7 @@ module AccessControl =
             member this.Handle command metadata =
                 match command with
                 | AccessControlCommand.GrantRole assignment -> this.GrantRole assignment metadata
-                | AccessControlCommand.RevokeRole(principal, roleId) -> this.RevokeRole principal roleId metadata
+                | AccessControlCommand.RevokeRole (principal, roleId) -> this.RevokeRole principal roleId metadata
                 | AccessControlCommand.ListAssignments principal -> this.ListAssignments principal metadata
 
             member this.GetAssignments principal correlationId =