@abelxiaoxing/cadence 1.4.0 → 1.4.1

package/src/durable-workflow.ts

@@ -1,260 +1,59 @@
-import { compareCanonicalStrings } from "./canonical.ts";
-import { configureSqlite, ensureSqliteSchema } from "./sqlite-schema.ts";
-import { ROUTE_HEALTH_SCHEMA } from "./storage-schema.ts";
-import { hasVerificationLifecycle } from "./workflow-policy.ts";
-
-interface DurableResourceInput {
-  runId: string;
-  deliveryRevision: number;
-  plan?: ImplementPlan;
-  baselineRevisionId?: string;
-  currentWorkspaceRevisionId?: string;
+import {
+  ChangeVerification,
+  parseVerificationBaseline,
+  sha256Bytes,
+  verificationBaselineFact,
+} from "./change-verification.ts";
+import type {
+  DurableExecutionResources,
+  DurablePhaseFact,
+  DurableResourceInput,
+  DurableWorkflowEngineOptions,
+} from "./durable-contracts.ts";
+import { PhaseExecution } from "./phase-execution.ts";
+
+export type {
+  DurableChangeVerificationResult,
+  DurablePhaseVerificationResult,
+  DurableWorkflowEngineOptions,
+} from "./durable-contracts.ts";
+
+interface DurableRunResources extends DurableExecutionResources {
+  transactions: ApplyTransaction;
+  closed: boolean;
 }
 
-import { spawn } from "node:child_process";
-import { createHash, randomUUID } from "node:crypto";
-import {
-  lstatSync,
-  mkdirSync,
-  mkdtempSync,
-  readFileSync,
-  rmSync,
-} from "node:fs";
+import { lstatSync, mkdirSync, readFileSync, rmSync } from "node:fs";
 import path from "node:path";
 import { DatabaseSync } from "node:sqlite";
-import {
-  ApplyTransaction,
-  verifyCumulativeRevision,
-} from "./apply-transaction.ts";
+import { ApplyTransaction } from "./apply-transaction.ts";
 import { ArtifactStore } from "./artifact-store.ts";
-import {
-  diffWritePaths,
-  type StructuredVerificationContract,
-} from "./contracts.ts";
+import { compareCanonicalStrings } from "./canonical.ts";
 import type { ImplementPlan, PlanTaskDraft } from "./delivery-compiler.ts";
-import type { RoutePolicy, WorkerRoutePolicy } from "./route-policy.ts";
+import type { RoutePolicy } from "./route-policy.ts";
 import { observeSafePath } from "./safe-path.ts";
-import type { ResolvedStateRoot } from "./state-root.ts";
-import type { CandidateArtifactSubmission } from "./submit-tool.ts";
-import {
-  type BeginCandidateInput,
-  TASK_LEDGER_LIMITS,
-  TaskLedger,
-  type VerifiedTaskEvent,
-} from "./task-ledger.ts";
+import { configureSqlite, ensureSqliteSchema } from "./sqlite-schema.ts";
+import { ROUTE_HEALTH_SCHEMA } from "./storage-schema.ts";
+import { TaskLedger } from "./task-ledger.ts";
 import { type RouteHealthStore, RunWorkerBroker } from "./worker-broker.ts";
 import {
-  type DependencyContractEntry,
-  DependencyManifestError,
-  type DurableCandidateProposal,
-  type DurableVerificationScope,
-  decideRecoveryAction,
   deliveryBoundPaths,
   deliveryTrackingPath,
-  dependencyContract,
-  emitWorkflowActivity,
-  expectedClassification,
   hash,
-  hasUnapprovedDependencyChange,
+  hasVerificationLifecycle,
   IDENTIFIER,
   implementationRouteRequirements,
   isRecord,
-  LOCKFILES,
-  type RedArtifactCorrection,
   SHA256,
-  semanticRouteFailure,
   type WorkflowApplication,
   type WorkflowApplicationContext,
-  type WorkflowAttemptOutcome,
   type WorkflowChangeVerifier,
-  type WorkflowContextRequest,
-  type WorkflowDeliverySource,
-  type WorkflowRecoveryFeedback,
-  type WorkflowRouteFacts,
   type WorkflowRunLifecycle,
   type WorkflowWorker,
   workspaceEntryEqual,
 } from "./workflow-policy.ts";
 import { WorkflowEngine } from "./workflow-state-machine.ts";
 import { type WorkspaceRevision, WorkspaceStore } from "./workspace-store.ts";
-export type DurablePhaseVerificationResult =
-  | {
-      ok: true;
-      exitCode: number;
-      classification: "expected-red" | "expected-green" | "expected-refactor";
-      diagnostic: { kind: "assertion" | "compiler"; id: string };
-    }
-  | {
-      ok: false;
-      kind: "paused" | "retryable" | "approval-needed";
-      code: string;
-    };
-
-export type DurableChangeVerificationResult =
-  | {
-      ok: true;
-      exitCode: 0;
-      classification: string;
-      failureIdentities?: string[];
-    }
-  | {
-      ok: false;
-      kind:
-        | "artifact"
-        | "environment"
-        | "verification"
-        | "verification-adapter"
-        | "approval-boundary"
-        | "cancelled";
-      code: string;
-      failureIdentities?: string[];
-    };
-
-interface DurableVerificationObservation {
-  status: "passed" | "failed";
-  verificationId: string;
-  failureIdentities: string[];
-  code?: string;
-}
-
-interface DurableVerificationBaseline {
-  revisionId: string;
-  targetContracts: Array<{
-    taskId: string;
-    verificationId: string;
-    expectedFailure: string;
-  }>;
-  affected: Array<{
-    taskId: string;
-    observation: DurableVerificationObservation;
-  }>;
-  fullSuite: DurableVerificationObservation;
-}
-
-type DurableObservedVerification =
-  | { ok: true; observation: DurableVerificationObservation }
-  | {
-      ok: false;
-      outcome:
-        | { kind: "paused"; code: string }
-        | { kind: "approval-needed"; code: string }
-        | { kind: "operation-cancelled"; code: "cancelled" };
-    };
-
-type DurableBaselineResult =
-  | { ok: true; baseline: DurableVerificationBaseline }
-  | Extract<DurableObservedVerification, { ok: false }>;
-
-type DurableAffectedResult =
-  | { kind: "verified"; attribution: "none" | "pre-existing" }
-  | {
-      kind: "repairable";
-      attribution: "introduced";
-      failureIdentities: string[];
-    }
-  | Extract<DurableObservedVerification, { ok: false }>["outcome"];
-
-export interface DurableWorkflowEngineOptions {
-  consumerRoot: string;
-  stateRoot: ResolvedStateRoot;
-  deliverySource: WorkflowDeliverySource;
-  routePolicy: RoutePolicy;
-  proposeCandidate(input: {
-    runId: string;
-    operationId: string;
-    deliveryRevision: number;
-    taskId: string;
-    phase: "red" | "green" | "refactor";
-    task: PlanTaskDraft;
-    workspaceRoot: string;
-    ledgerProjection: unknown;
-    candidateArtifact: CandidateArtifactSubmission;
-    route: WorkerRoutePolicy;
-    repair?: {
-      attempt: number;
-      attribution: "introduced";
-      failureIdentities: string[];
-    };
-    artifactCorrection?: RedArtifactCorrection;
-    contextRequest?: WorkflowContextRequest;
-    contextReadPaths?: string[];
-    recoveryFeedback?: WorkflowRecoveryFeedback;
-    signal: AbortSignal;
-    onHeaders(): void;
-    onProgress(): void;
-  }): Promise<DurableCandidateProposal>;
-  verifyPhase(input: {
-    executionWritePaths?: readonly string[];
-    runId: string;
-    deliveryRevision: number;
-    taskId: string;
-    phase: "red" | "green" | "refactor";
-    root: string;
-    verification: StructuredVerificationContract;
-    signal: AbortSignal;
-  }): Promise<DurablePhaseVerificationResult>;
-  verifyChange(input: {
-    runId: string;
-    deliveryRevision: number;
-    root: string;
-    plan: ImplementPlan;
-    scope?: DurableVerificationScope;
-    verification?: StructuredVerificationContract;
-    taskId?: string;
-    signal: AbortSignal;
-  }): Promise<DurableChangeVerificationResult>;
-  now?: () => number;
-  leaseTtlMs?: number;
-  workHardLimit?: number;
-  verificationPolicy?: string;
-  verificationEnvironment?(
-    plan: ImplementPlan,
-    signal: AbortSignal,
-  ): Promise<string>;
-}
-
-interface DurableRunResources {
-  runId: string;
-  root: string;
-  plan: ImplementPlan;
-  deliveryRevision: number;
-  artifacts: ArtifactStore;
-  workspaces: WorkspaceStore;
-  ledgers: Map<number, TaskLedger>;
-  transactions: ApplyTransaction;
-  baselineRevisionId: string;
-  currentRevisionId: string;
-  mergeTail: Promise<void>;
-  verificationFact?: object;
-  baselinePromises: Map<number, Promise<DurableBaselineResult>>;
-  environmentIdentity?: string;
-  closed: boolean;
-}
-
-interface DurablePhaseFact {
-  kind: "phase-verified" | "repair-verified";
-  phase: "red" | "green" | "refactor";
-  isolatedRevisionId: string;
-  outputFacts: Array<
-    | { path: string; kind: "absent" }
-    | { path: string; kind: "file"; hash: string; bytes: number }
-  >;
-}
-
-interface DurableCandidateCommit {
-  artifactHash: string;
-  isolatedRevisionId: string;
-  exitCode: number;
-  classification: "expected-red" | "expected-green" | "expected-refactor";
-  diagnostic: { kind: "assertion" | "compiler"; id: string };
-  outputFacts: DurablePhaseFact["outputFacts"];
-  routeId: string;
-  routeFingerprint: string;
-}
-
-type DurableRepairResult =
-  | { kind: "repair-committed"; commit: DurableCandidateCommit }
-  | Exclude<WorkflowAttemptOutcome, { kind: "phase-committed" }>;
 
 type DurableRouteHealth = Parameters<RouteHealthStore["set"]>[1];
 
@@ -390,166 +189,6 @@ function ensurePrivateRunDirectory(directory: string): void {
   }
 }
 
-function sha256Bytes(bytes: Uint8Array): string {
-  return createHash("sha256").update(bytes).digest("hex");
-}
-
-function verificationIdentities(
-  result: DurableChangeVerificationResult,
-  verification: StructuredVerificationContract,
-  scope: DurableVerificationScope,
-): string[] {
-  // Keep the complete comparison set; only Worker/status summaries are bounded.
-  const supplied = result.failureIdentities;
-  if (
-    Array.isArray(supplied) &&
-    supplied.every(
-      (identity) => typeof identity === "string" && SHA256.test(identity),
-    )
-  ) {
-    return [...new Set(supplied)].sort();
-  }
-  if (result.ok) return [];
-  return [hash("verification-failure", scope, verification.id, result.code)];
-}
-
-function verificationBaselineFact(
-  baseline: DurableVerificationBaseline,
-  artifacts: ArtifactStore,
-) {
-  // Complete private evidence must not inherit the bounded model projection limits.
-  const artifact = artifacts.put(Buffer.from(JSON.stringify(baseline)));
-  return {
-    revisionId: baseline.revisionId,
-    baselineArtifactHash: artifact.hash,
-  };
-}
-
-function parseVerificationBaseline(
-  value: unknown,
-  artifacts: ArtifactStore,
-): DurableVerificationBaseline {
-  if (isRecord(value) && typeof value.baselineArtifactHash === "string") {
-    const revisionId = value.revisionId;
-    value = JSON.parse(
-      Buffer.from(artifacts.read(value.baselineArtifactHash)).toString("utf8"),
-    );
-    if (!isRecord(value) || value.revisionId !== revisionId)
-      throw new Error("workflow-verification-baseline-conflict");
-  }
-  if (
-    !isRecord(value) ||
-    typeof value.revisionId !== "string" ||
-    !SHA256.test(value.revisionId) ||
-    !Array.isArray(value.targetContracts) ||
-    !Array.isArray(value.affected) ||
-    !isRecord(value.fullSuite)
-  ) {
-    throw new Error("workflow-verification-baseline-invalid");
-  }
-  const baseline = structuredClone(
-    value,
-  ) as unknown as DurableVerificationBaseline;
-  const validObservation = (observation: DurableVerificationObservation) =>
-    (observation.status === "passed" || observation.status === "failed") &&
-    typeof observation.verificationId === "string" &&
-    IDENTIFIER.test(observation.verificationId) &&
-    Array.isArray(observation.failureIdentities) &&
-    observation.failureIdentities.every((identity) => SHA256.test(identity)) &&
-    (observation.code === undefined || typeof observation.code === "string");
-  if (
-    !baseline.targetContracts.every(
-      (entry) =>
-        isRecord(entry) &&
-        typeof entry.taskId === "string" &&
-        typeof entry.verificationId === "string" &&
-        typeof entry.expectedFailure === "string",
-    ) ||
-    !baseline.affected.every(
-      (entry) =>
-        isRecord(entry) &&
-        typeof entry.taskId === "string" &&
-        isRecord(entry.observation) &&
-        validObservation(entry.observation),
-    ) ||
-    !validObservation(baseline.fullSuite)
-  ) {
-    throw new Error("workflow-verification-baseline-invalid");
-  }
-  return baseline;
-}
-
-function runGitApply(
-  root: string,
-  diff: Uint8Array,
-  checkOnly: boolean,
-  signal: AbortSignal,
-): Promise<"ok" | "failed" | "cancelled"> {
-  if (signal.aborted) return Promise.resolve("cancelled");
-  return new Promise((resolve) => {
-    let settled = false;
-    const settle = (value: "ok" | "failed" | "cancelled") => {
-      if (settled) return;
-      settled = true;
-      signal.removeEventListener("abort", abort);
-      resolve(value);
-    };
-    const child = spawn(
-      "git",
-      [
-        "apply",
-        ...(checkOnly ? ["--check"] : []),
-        "--recount",
-        "--whitespace=nowarn",
-        "-",
-      ],
-      { cwd: root, shell: false, stdio: ["pipe", "ignore", "ignore"] },
-    );
-    const abort = () => {
-      child.kill("SIGTERM");
-      settle("cancelled");
-    };
-    signal.addEventListener("abort", abort, { once: true });
-    child.once("error", () => settle(signal.aborted ? "cancelled" : "failed"));
-    child.once("close", (code) =>
-      settle(signal.aborted ? "cancelled" : code === 0 ? "ok" : "failed"),
-    );
-    child.stdin.on("error", () => undefined);
-    child.stdin.end(Buffer.from(diff));
-  });
-}
-
-function revisionChanges(
-  root: string,
-  paths: readonly string[],
-): Record<
-  string,
-  { kind: "absent" } | { kind: "file"; bytes: Uint8Array; mode: number }
-> {
-  const changes: Record<
-    string,
-    { kind: "absent" } | { kind: "file"; bytes: Uint8Array; mode: number }
-  > = {};
-  for (const relative of [...new Set(paths)].sort()) {
-    const observation = observeSafePath(root, relative);
-    if (observation.kind === "absent") {
-      changes[relative] = { kind: "absent" };
-      continue;
-    }
-    if (observation.kind !== "file") {
-      throw new Error("workflow-candidate-path-unsafe");
-    }
-    const target = path.join(root, ...relative.split("/"));
-    const stat = lstatSync(target);
-    changes[relative] = {
-      kind: "file",
-      bytes: readFileSync(target),
-      mode: stat.mode & 0o777,
-    };
-  }
-  return changes;
-}
-
 class DurableWorkflowComposition
   implements
     WorkflowWorker,
@@ -557,6 +196,8 @@ class DurableWorkflowComposition
     WorkflowApplication,
     WorkflowRunLifecycle
 {
+  readonly #phase: PhaseExecution;
+  readonly #verification: ChangeVerification;
   readonly #options: DurableWorkflowEngineOptions;
   readonly #routeHealth: DurableRouteHealthStore;
   #broker: RunWorkerBroker;
@@ -571,121 +212,34 @@ class DurableWorkflowComposition
       ...(options.now ? { now: options.now } : {}),
       healthStore: this.#routeHealth,
     });
+    this.#verification = new ChangeVerification(options, {
+      prepareResources: (input, signal) =>
+        this.#prepareResources(input, signal),
+      ledger: (resources, revision) => this.#ledger(resources, revision),
+      run: (runId) => this.#runs.get(runId),
+      revalidatePhasePolicy: (...args) =>
+        this.#phase.revalidatePhasePolicy(...args),
+    });
+    this.#phase = new PhaseExecution(options, this.#broker, {
+      prepareResources: (input, signal) =>
+        this.#prepareResources(input, signal),
+      ledger: (resources, revision) => this.#ledger(resources, revision),
+      ensureVerificationBaseline: (input) =>
+        this.#verification.ensureVerificationBaseline(input),
+      verifyTaskAffected: (input) =>
+        this.#verification.verifyTaskAffected(input),
+      verifyPhase: (input) => this.#verification.verifyPhase(input),
+    });
   }
 
   updateRoutePolicy(policy: RoutePolicy): void {
     this.#broker.updatePolicy(policy);
   }
 
-  async #refreshEnvironment(
-    resources: DurableRunResources,
-    signal: AbortSignal,
-  ): Promise<void> {
-    if (!this.#options.verificationEnvironment) return;
-    const identity = await this.#options.verificationEnvironment(
-      resources.plan,
-      signal,
-    );
-    if (identity !== resources.environmentIdentity) {
-      resources.environmentIdentity = identity;
-      resources.baselinePromises.clear();
-      resources.verificationFact = undefined;
-    }
-  }
-
-  async #environmentCurrent(
-    runId: string,
-    signal: AbortSignal,
-    expected?: string,
-  ): Promise<boolean> {
-    if (!this.#options.verificationEnvironment) return true;
-    const resources = this.#runs.get(runId);
-    if (!resources) return false;
-    try {
-      const identity = await this.#options.verificationEnvironment(
-        resources.plan,
-        signal,
-      );
-      resources.environmentIdentity ??= identity;
-      return identity === (expected ?? resources.environmentIdentity);
-    } catch {
-      signal.throwIfAborted();
-      return false;
-    }
-  }
-
-  async #verifyPhase(
-    input: Parameters<DurableWorkflowEngineOptions["verifyPhase"]>[0],
-  ): Promise<DurablePhaseVerificationResult> {
-    if (await this.#environmentCurrent(input.runId, input.signal)) {
-      const identity = this.#runs.get(input.runId)?.environmentIdentity;
-      const result = await this.#options.verifyPhase(input);
-      if (await this.#environmentCurrent(input.runId, input.signal, identity))
-        return result;
-    }
-    return {
-      ok: false,
-      kind: "paused",
-      code: "verification-environment-changed",
-    };
-  }
-
-  async #verifyChange(
-    input: Parameters<DurableWorkflowEngineOptions["verifyChange"]>[0],
-  ): Promise<DurableChangeVerificationResult> {
-    if (await this.#environmentCurrent(input.runId, input.signal)) {
-      const identity = this.#runs.get(input.runId)?.environmentIdentity;
-      const result = await this.#options.verifyChange(input);
-      if (await this.#environmentCurrent(input.runId, input.signal, identity))
-        return result;
-    }
-    return {
-      ok: false,
-      kind: "environment",
-      code: "verification-environment-changed",
-    };
-  }
-
   routePolicyStatus(): Record<string, unknown> {
     return this.#broker.status();
   }
 
-  #recordCorrection(
-    ledger: TaskLedger,
-    input: {
-      runId: string;
-      operationId: string;
-      taskId: string;
-      phase: "red" | "green" | "refactor";
-    },
-    identity: BeginCandidateInput,
-    correction: {
-      category: "artifact" | "stale" | "verification" | "checkpoint";
-      code: string;
-      stage: string;
-    },
-  ): void {
-    ledger.commitVerifiedEvent({
-      runId: input.runId,
-      taskId: input.taskId,
-      eventId: `correction-${hash(
-        input.operationId,
-        identity.candidateId,
-        correction.category,
-        correction.code,
-        correction.stage,
-      ).slice(0, 40)}`,
-      kind: "artifact-correction",
-      phase: input.phase,
-      correctionCategory: correction.category,
-      safeFailure: { code: correction.code, stage: correction.stage },
-      candidateId: identity.candidateId,
-      attemptId: identity.attemptId,
-      routeId: identity.routeId,
-      routeFingerprint: identity.routeFingerprint,
-    });
-  }
-
   #runRoot(runId: string): string {
     if (!IDENTIFIER.test(runId)) throw new Error("workflow-run-id-invalid");
     const dataRoot = path.join(this.#options.stateRoot.rootDir, "run-data");
@@ -720,62 +274,6 @@ class DurableWorkflowComposition
     );
   }
 
-  async #verifyPostApply(
-    resources: DurableRunResources,
-    root: string,
-    signal: AbortSignal,
-    transactionId: string,
-  ): Promise<{ ok: true } | { ok: false; code: string }> {
-    if (this.#options.verificationEnvironment) {
-      const fact = this.#ledger(
-        resources,
-        resources.deliveryRevision,
-      ).durableFact(`apply-environment-${hash(transactionId).slice(0, 40)}`);
-      if (!isRecord(fact) || typeof fact.identity !== "string")
-        return { ok: false, code: "verification-environment-changed" };
-      resources.environmentIdentity = fact.identity;
-      if (
-        !(await this.#environmentCurrent(
-          resources.runId,
-          signal,
-          fact.identity,
-        ))
-      )
-        return { ok: false, code: "verification-environment-changed" };
-    }
-    if (
-      resources.plan.outputs.some(
-        (output) => observeSafePath(root, output.path).kind !== "file",
-      )
-    ) {
-      return { ok: false, code: "producer-output-unavailable" };
-    }
-    const lifecycle = hasVerificationLifecycle(resources.plan);
-    const result = await this.#verifyChange({
-      runId: resources.runId,
-      deliveryRevision: resources.deliveryRevision,
-      root,
-      plan: structuredClone(resources.plan),
-      ...(lifecycle
-        ? {
-            scope: "post-apply" as const,
-            verification: structuredClone(
-              resources.plan.verification.change.postApply,
-            ),
-          }
-        : {}),
-      signal,
-    });
-    return result.ok &&
-      result.exitCode === 0 &&
-      result.classification.length > 0
-      ? { ok: true }
-      : {
-          ok: false,
-          code: result.ok ? "post-apply-verification-invalid" : result.code,
-        };
-  }
-
   readonly #initializing = new Map<string, Promise<DurableRunResources>>();
 
   async #prepareResources(
@@ -869,7 +367,7 @@ class DurableWorkflowComposition
       workspaces,
       hooks: {
         postApply: ({ transactionId, root: verificationRoot, signal }) =>
-          this.#verifyPostApply(
+          this.#verification.verifyPostApply(
             resources,
             verificationRoot,
             signal,
@@ -905,7 +403,7 @@ class DurableWorkflowComposition
   }
 
   #ledger(
-    resources: DurableRunResources,
+    resources: DurableExecutionResources,
     deliveryRevision: number,
   ): TaskLedger {
     const existing = resources.ledgers.get(deliveryRevision);
@@ -922,701 +420,56 @@ class DurableWorkflowComposition
     return ledger;
   }
 
-  async #observeVerification(input: {
-    resources: DurableRunResources;
-    revisionId: string;
-    scope: DurableVerificationScope;
-    verification: StructuredVerificationContract;
-    signal: AbortSignal;
-    taskId?: string;
-  }): Promise<DurableObservedVerification> {
-    if (input.signal.aborted) {
-      return {
-        ok: false,
-        outcome: { kind: "operation-cancelled", code: "cancelled" },
-      };
-    }
-    const root = mkdtempSync(path.join(input.resources.root, "verification-"));
-    try {
-      await input.resources.workspaces.materializeAsync(
-        input.revisionId,
-        root,
-        input.signal,
-      );
-      const result = await this.#verifyChange({
-        runId: input.resources.runId,
-        deliveryRevision: input.resources.deliveryRevision,
-        root,
-        plan: structuredClone(input.resources.plan),
-        scope: input.scope,
-        verification: structuredClone(input.verification),
-        ...(input.taskId ? { taskId: input.taskId } : {}),
-        signal: input.signal,
-      });
-      if (result.ok) {
-        return {
-          ok: true,
-          observation: {
-            status: "passed",
-            verificationId: input.verification.id,
-            failureIdentities: verificationIdentities(
-              result,
-              input.verification,
-              input.scope,
-            ),
-          },
-        };
-      }
-      if (result.kind === "verification") {
-        return {
-          ok: true,
-          observation: {
-            status: "failed",
-            verificationId: input.verification.id,
-            failureIdentities: verificationIdentities(
-              result,
-              input.verification,
-              input.scope,
-            ),
-            code: result.code,
-          },
-        };
-      }
-      if (result.kind === "approval-boundary") {
-        return {
-          ok: false,
-          outcome: { kind: "approval-needed", code: result.code },
-        };
-      }
-      if (result.kind === "cancelled" || input.signal.aborted) {
-        return {
-          ok: false,
-          outcome: { kind: "operation-cancelled", code: "cancelled" },
-        };
-      }
-      return {
-        ok: false,
-        outcome: { kind: "paused", code: result.code },
-      };
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  }
-
-  async #captureVerificationBaseline(input: {
-    resources: DurableRunResources;
-    ledger: TaskLedger;
-    signal: AbortSignal;
-  }): Promise<DurableBaselineResult> {
-    const environmentIdentity = input.resources.environmentIdentity;
-    const stored = input.ledger.durableFact(
-      this.#baselineFactKey(input.resources),
-    );
-    if (stored !== undefined) {
-      const baseline = parseVerificationBaseline(
-        stored,
-        input.resources.artifacts,
-      );
-      if (baseline.revisionId !== input.resources.baselineRevisionId) {
-        throw new Error("workflow-verification-baseline-conflict");
-      }
-      return { ok: true, baseline };
-    }
-    const plan = input.resources.plan;
-    const affected: DurableVerificationBaseline["affected"] = [];
-    for (const task of plan.tasks) {
-      const observed = await this.#observeVerification({
-        resources: input.resources,
-        revisionId: input.resources.baselineRevisionId,
-        scope: "baseline-task-affected",
-        verification: task.affectedVerification,
-        taskId: task.taskId,
-        signal: input.signal,
-      });
-      if (!observed.ok) return observed;
-      affected.push({
-        taskId: task.taskId,
-        observation: observed.observation,
-      });
-    }
-    const fullSuite = await this.#observeVerification({
-      resources: input.resources,
-      revisionId: input.resources.baselineRevisionId,
-      scope: "baseline-full-suite",
-      verification: plan.verification.baseline.fullSuite,
-      signal: input.signal,
-    });
-    if (!fullSuite.ok) return fullSuite;
-    const baseline: DurableVerificationBaseline = {
-      revisionId: input.resources.baselineRevisionId,
-      targetContracts: plan.tasks
-        .filter(
-          (task) =>
-            !task.verificationMode || task.verificationMode === "behavior",
-        )
-        .map((task) => ({
-          taskId: task.taskId,
-          verificationId: task.phases.red.verification.id,
-          expectedFailure:
-            "expectedFailure" in task.phases.red.verification
-              ? (task.phases.red.verification.expectedFailure ??
-                task.phases.red.verification.id)
-              : task.phases.red.verification.id,
-        })),
-      affected,
-      fullSuite: fullSuite.observation,
-    };
-    if (environmentIdentity !== input.resources.environmentIdentity)
-      return {
-        ok: false,
-        outcome: { kind: "paused", code: "verification-environment-changed" },
-      };
-    input.ledger.putDurableFact(
-      this.#baselineFactKey(input.resources),
-      verificationBaselineFact(baseline, input.resources.artifacts),
-    );
-    return { ok: true, baseline };
-  }
-
-  async #ensureVerificationBaseline(input: {
-    resources: DurableRunResources;
-    ledger: TaskLedger;
-    signal: AbortSignal;
-  }): Promise<DurableBaselineResult> {
-    try {
-      await this.#refreshEnvironment(input.resources, input.signal);
-    } catch {
-      return {
-        ok: false,
-        outcome: {
-          kind: "paused",
-          code: "verification-environment-unavailable",
-        },
-      };
-    }
-    const existing = input.resources.baselinePromises.get(
-      input.resources.deliveryRevision,
-    );
-    if (existing) return existing;
-    const pending = this.#captureVerificationBaseline(input).then((result) => {
-      if (!result.ok) {
-        input.resources.baselinePromises.delete(
-          input.resources.deliveryRevision,
-        );
-      }
-      return result;
-    });
-    input.resources.baselinePromises.set(
-      input.resources.deliveryRevision,
-      pending,
-    );
-    return pending;
-  }
-
-  async #verifyTaskAffected(input: {
-    resources: DurableRunResources;
-    baseline: DurableVerificationBaseline;
-    task: PlanTaskDraft;
-    revisionId: string;
-    signal: AbortSignal;
-  }): Promise<DurableAffectedResult> {
-    const baseline = input.baseline.affected.find(
-      (entry) => entry.taskId === input.task.taskId,
-    );
-    if (!baseline) throw new Error("workflow-task-baseline-unavailable");
-    const current = await this.#observeVerification({
-      resources: input.resources,
-      revisionId: input.revisionId,
-      scope: "task-affected",
-      verification: input.task.affectedVerification,
-      taskId: input.task.taskId,
-      signal: input.signal,
-    });
-    if (!current.ok) return current.outcome;
-    if (current.observation.status === "passed") {
-      return { kind: "verified", attribution: "none" };
-    }
-    const prior = new Set(baseline.observation.failureIdentities);
-    const introduced = current.observation.failureIdentities.filter(
-      (identity) => !prior.has(identity),
-    );
-    if (introduced.length === 0) {
-      return { kind: "verified", attribution: "pre-existing" };
-    }
-    return {
-      kind: "repairable",
-      attribution: "introduced",
-      failureIdentities: introduced.slice(0, 256),
-    };
-  }
-
-  #completeTracking(
+  #expandedBaseline(
     resources: DurableRunResources,
-    taskId: string,
+    plan: ImplementPlan,
   ): WorkspaceRevision {
-    const current = resources.workspaces.getRevision(
-      resources.currentRevisionId,
-    );
-    const trackingPath = deliveryTrackingPath(resources.plan);
-    if (!trackingPath) return current;
-    const entry = current.entries[trackingPath];
-    if (!entry || entry.kind === "absent") return current;
-    const text = new TextDecoder("utf-8", { fatal: true }).decode(
-      resources.artifacts.read(entry.hash),
+    const baseline = resources.workspaces.getRevision(
+      resources.baselineRevisionId,
     );
-    const escaped = taskId.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
-    const taskIdentity = new RegExp(
-      `(?:^|[^A-Za-z0-9._:-])${escaped}(?![A-Za-z0-9._:-])`,
-      "u",
+    const candidates = new Map<string, boolean>(
+      deliveryBoundPaths(plan).map((relative) => [relative, false]),
     );
-    let matches = 0;
-    let changed = false;
-    const updated = text
-      .split(/(?<=\n)/u)
-      .map((segment) => {
-        const line = segment.endsWith("\n") ? segment.slice(0, -1) : segment;
-        if (!/^\s*-\s+\[[ xX]\]/u.test(line) || !taskIdentity.test(line)) {
-          return segment;
+    for (const task of plan.tasks) {
+      for (const phase of Object.values(task.phases)) {
+        for (const relative of phase.read) candidates.set(relative, false);
+        for (const relative of [...phase.write, ...phase.delete]) {
+          candidates.set(relative, true);
         }
-        matches += 1;
-        if (/^\s*-\s+\[[xX]\]/u.test(line)) return segment;
-        changed = true;
-        return segment.replace(/^(\s*-\s+)\[ \]/u, "$1[x]");
-      })
-      .join("");
-    if (matches !== 1) throw new Error("workflow-tracking-task-mismatch");
-    if (!changed) return current;
-    const next = resources.workspaces.createRevision({
-      parentRevisionId: current.revisionId,
-      changes: {
-        [trackingPath]: {
-          kind: "file",
-          bytes: new TextEncoder().encode(updated),
-          mode: entry.mode,
-        },
-      },
-    });
-    resources.currentRevisionId = next.revisionId;
-    return next;
-  }
-
-  #agentsManagedParts(
-    text: string,
-  ): { prefix: string; suffix: string } | undefined {
-    const startMarker = "<!-- ABEL:AGENTS-INDEX:START -->";
-    const endMarker = "<!-- ABEL:AGENTS-INDEX:END -->";
-    const lines = text.split("\n");
-    const starts: Array<{ line: number; start: number }> = [];
-    const ends: Array<{ line: number; end: number }> = [];
-    let offset = 0;
-    for (const [line, value] of lines.entries()) {
-      if (value === startMarker) starts.push({ line, start: offset });
-      if (value === endMarker) {
-        ends.push({ line, end: offset + value.length });
       }
-      offset += value.length + 1;
     }
+    for (const output of plan.outputs) candidates.set(output.path, true);
+    for (const task of plan.tasks) {
+      if (task.agents.impact === "none" || !task.agents.target) continue;
+      candidates.set(task.agents.target, task.agents.impact === "create-index");
+    }
+    const trackingPath = deliveryTrackingPath(plan);
     if (
-      starts.length !== 1 ||
-      ends.length !== 1 ||
-      starts[0].line >= ends[0].line
+      trackingPath &&
+      (Object.hasOwn(baseline.entries, trackingPath) ||
+        observeSafePath(this.#options.consumerRoot, trackingPath).kind ===
+          "file")
     ) {
-      return undefined;
+      candidates.set(trackingPath, false);
     }
-    return {
-      prefix: text.slice(0, starts[0].start),
-      suffix: text.slice(ends[0].end),
-    };
-  }
-
-  #applyAgentsCheckpoint(
-    resources: DurableRunResources,
-  ): { ok: true; revision: WorkspaceRevision } | { ok: false; code: string } {
-    const checkpoint = resources.plan.verification.agentsCheckpoint;
-    const current = resources.workspaces.getRevision(
-      resources.currentRevisionId,
-    );
-    if (!checkpoint.required) return { ok: true, revision: current };
     const changes: Record<
       string,
       { kind: "absent" } | { kind: "file"; bytes: Uint8Array; mode: number }
     > = {};
-    for (const operation of checkpoint.operations) {
-      const entry = current.entries[operation.target];
-      let before: string | null;
-      if (!entry || entry.kind === "absent") {
-        before = null;
-      } else {
-        try {
-          before = new TextDecoder("utf-8", { fatal: true }).decode(
-            resources.artifacts.read(entry.hash),
-          );
-        } catch {
-          return { ok: false, code: "agents-checkpoint-contract-stale" };
-        }
-      }
-      if (operation.impact === "create-index") {
-        if (operation.managedBlock === null) {
-          throw new Error("workflow-agents-checkpoint-invalid");
-        }
-        const desired = `${operation.managedBlock}\n`;
-        if (before !== null && before !== desired) {
-          return { ok: false, code: "agents-checkpoint-contract-stale" };
-        }
-        if (before === null) {
-          changes[operation.target] = {
-            kind: "file",
-            bytes: new TextEncoder().encode(desired),
-            mode: 0o644,
-          };
-        }
+    for (const [relative, mayBeAbsent] of [...candidates].sort(
+      ([left], [right]) => compareCanonicalStrings(left, right),
+    )) {
+      if (relative === ".") continue;
+      const observation = observeSafePath(this.#options.consumerRoot, relative);
+      if (observation.kind === "absent") {
+        if (baseline.entries[relative]?.kind === "absent") continue;
+        if (!mayBeAbsent)
+          throw new Error("workflow-baseline-input-unavailable");
+        changes[relative] = { kind: "absent" };
         continue;
       }
-      if (operation.impact === "remove-index") {
-        if (operation.managedBlock !== null) {
-          throw new Error("workflow-agents-checkpoint-invalid");
-        }
-        if (before === null) continue;
-        const parts = this.#agentsManagedParts(before);
-        if (!parts) {
-          return { ok: false, code: "agents-checkpoint-contract-stale" };
-        }
-        const after = `${parts.prefix}${parts.suffix}`;
-        changes[operation.target] =
-          after.trim().length === 0
-            ? { kind: "absent" }
-            : {
-                kind: "file",
-                bytes: new TextEncoder().encode(after),
-                mode: entry?.kind === "file" ? entry.mode : 0o644,
-              };
-        continue;
-      }
-      if (operation.managedBlock === null || before === null) {
-        return { ok: false, code: "agents-checkpoint-contract-stale" };
-      }
-      const parts = this.#agentsManagedParts(before);
-      if (!parts) {
-        return { ok: false, code: "agents-checkpoint-contract-stale" };
-      }
-      const after = `${parts.prefix}${operation.managedBlock}${parts.suffix}`;
-      if (after !== before) {
-        changes[operation.target] = {
-          kind: "file",
-          bytes: new TextEncoder().encode(after),
-          mode: entry?.kind === "file" ? entry.mode : 0o644,
-        };
-      }
-    }
-    if (Object.keys(changes).length === 0) {
-      return { ok: true, revision: current };
-    }
-    return {
-      ok: true,
-      revision: resources.workspaces.createRevision({
-        parentRevisionId: current.revisionId,
-        changes,
-      }),
-    };
-  }
-
-  #openTask(
-    resources: DurableRunResources,
-    ledger: TaskLedger,
-    input: Parameters<WorkflowWorker["runAttempt"]>[0],
-  ): void {
-    const revision = resources.workspaces.getRevision(
-      resources.baselineRevisionId,
-    );
-    const contextRefs = [...new Set(input.task.phases.red.read)]
-      .sort()
-      .flatMap((relative) => {
-        const entry = revision.entries[relative];
-        return entry?.kind === "file"
-          ? [{ kind: "path" as const, path: relative, hash: entry.hash }]
-          : [];
-      });
-    ledger.openTask({
-      runId: input.runId,
-      deliveryRevision: input.deliveryRevision,
-      taskId: input.taskId,
-      boundaryHash: hash("durable-task-boundary", JSON.stringify(input.task)),
-      objective: input.task.objective,
-      contextRefs,
-      initialPhase:
-        input.task.verificationMode &&
-        input.task.verificationMode !== "behavior"
-          ? "green"
-          : "red",
-    });
-  }
-
-  #executionWritePaths(resources: DurableRunResources): string[] {
-    return [
-      ...new Set(
-        resources.plan.tasks.flatMap((task) =>
-          Object.values(task.phases).flatMap((phase) => [
-            ...phase.write,
-            ...phase.delete,
-          ]),
-        ),
-      ),
-    ];
-  }
-
-  #baselineFactKey(resources: DurableRunResources): string {
-    return this.#options.verificationPolicy || resources.environmentIdentity
-      ? `verification-baseline-${hash(this.#options.verificationPolicy ?? "legacy", resources.environmentIdentity ?? "legacy").slice(0, 24)}`
-      : "verification-baseline";
-  }
-
-  #policyFactKey(
-    resources: DurableRunResources,
-    event: Record<string, unknown>,
-  ): string {
-    return `verified-policy-${hash(this.#options.verificationPolicy ?? "legacy", resources.environmentIdentity ?? "legacy", JSON.stringify({ kind: event.kind, phase: event.phase, commandId: event.commandId, artifactHash: event.artifactHash, isolatedRevisionId: event.isolatedRevisionId, exitCode: event.exitCode, actualClassification: event.actualClassification })).slice(0, 40)}`;
-  }
-
-  async #revalidatePhasePolicy(
-    resources: DurableRunResources,
-    ledger: TaskLedger,
-    task: PlanTaskDraft,
-    signal: AbortSignal,
-  ): Promise<WorkflowAttemptOutcome | undefined> {
-    if (
-      !this.#options.verificationPolicy &&
-      !this.#options.verificationEnvironment
-    )
-      return undefined;
-    const projection = ledger.projection({
-      runId: resources.runId,
-      taskId: task.taskId,
-      nextPhase: "green",
-    }) as { history: Array<Record<string, unknown>> };
-    for (const event of projection.history.filter(
-      (event) =>
-        event.kind === "phase-verified" || event.kind === "repair-verified",
-    )) {
-      const key = this.#policyFactKey(resources, event);
-      if (ledger.durableFact(key) !== undefined) continue;
-      const phase = event.phase as "red" | "green" | "refactor";
-      const boundary = task.phases[phase];
-      const repair = event.kind === "repair-verified";
-      const verification = repair
-        ? task.repairVerification
-        : boundary?.verification;
-      const expected = repair
-        ? "expected-green"
-        : expectedClassification(phase);
-      if (
-        !boundary ||
-        !verification ||
-        typeof event.isolatedRevisionId !== "string"
-      )
-        throw new Error("workflow-ledger-phase-invalid");
-      const root = mkdtempSync(
-        path.join(resources.root, "policy-verification-"),
-      );
-      try {
-        await resources.workspaces.materializeAsync(
-          event.isolatedRevisionId,
-          root,
-          signal,
-        );
-        const result = await this.#verifyPhase({
-          executionWritePaths: this.#executionWritePaths(resources),
-          runId: resources.runId,
-          deliveryRevision: resources.deliveryRevision,
-          taskId: task.taskId,
-          phase,
-          root,
-          verification,
-          signal,
-        });
-        if (!result.ok)
-          return {
-            kind: "paused",
-            code:
-              result.kind === "paused"
-                ? result.code
-                : "verification-policy-rejected",
-          };
-        if (
-          result.classification !== expected ||
-          (expected === "expected-red"
-            ? result.exitCode === 0
-            : result.exitCode !== 0)
-        )
-          return { kind: "paused", code: "verification-policy-rejected" };
-        ledger.putDurableFact(key, {
-          policy: this.#options.verificationPolicy ?? "legacy",
-        });
-      } finally {
-        rmSync(root, { recursive: true, force: true });
-      }
-    }
-    return undefined;
-  }
-
-  #pendingCandidate(
-    ledger: TaskLedger,
-    key: string,
-    baseRevisionId: string,
-  ):
-    | {
-        identity: BeginCandidateInput;
-        proposal: Extract<
-          DurableCandidateProposal,
-          { kind: "sealed-candidate" }
-        >;
-      }
-    | undefined {
-    const value = ledger.durableFact(key);
-    if (
-      !isRecord(value) ||
-      !isRecord(value.identity) ||
-      !isRecord(value.proposal) ||
-      value.identity.isolatedRevisionId !== baseRevisionId
-    )
-      return undefined;
-    return value as unknown as {
-      identity: BeginCandidateInput;
-      proposal: Extract<DurableCandidateProposal, { kind: "sealed-candidate" }>;
-    };
-  }
-
-  #savePendingCandidate(ledger: TaskLedger, key: string, value: unknown): void {
-    const previous = ledger.durableFact(key);
-    if (previous === undefined) ledger.putDurableFact(key, value);
-    else ledger.replaceDurableFact(key, previous, value);
-  }
-
-  #replayedPhase(
-    resources: DurableRunResources,
-    ledger: TaskLedger,
-    input: Parameters<WorkflowWorker["runAttempt"]>[0],
-  ): WorkflowAttemptOutcome | undefined {
-    if (input.artifactCorrection?.code === "red-artifact-constraint") {
-      return undefined;
-    }
-    const projection = ledger.projection({
-      runId: input.runId,
-      taskId: input.taskId,
-      nextPhase: input.phase,
-    }) as {
-      history: Array<Record<string, unknown>>;
-    };
-    const event = projection.history.find(
-      (candidate) =>
-        candidate.kind === "phase-verified" && candidate.phase === input.phase,
-    );
-    if (!event) return undefined;
-    if (
-      typeof event.artifactHash !== "string" ||
-      !SHA256.test(event.artifactHash) ||
-      typeof event.isolatedRevisionId !== "string" ||
-      !SHA256.test(event.isolatedRevisionId) ||
-      typeof event.exitCode !== "number" ||
-      event.actualClassification !== expectedClassification(input.phase)
-    ) {
-      throw new Error("workflow-ledger-phase-invalid");
-    }
-    let isolatedRevisionId = event.isolatedRevisionId;
-    const finalPhase = input.task.phases.refactor ? "refactor" : "green";
-    if (hasVerificationLifecycle(input.plan) && input.phase === finalPhase) {
-      const fact = ledger.durableFact(
-        `task-final-${hash(input.taskId).slice(0, 40)}`,
-      );
-      if (
-        !isRecord(fact) ||
-        fact.taskId !== input.taskId ||
-        fact.phase !== input.phase ||
-        typeof fact.isolatedRevisionId !== "string" ||
-        !SHA256.test(fact.isolatedRevisionId)
-      ) {
-        throw new Error("workflow-task-completion-fact-invalid");
-      }
-      isolatedRevisionId = fact.isolatedRevisionId;
-    }
-    resources.workspaces.getRevision(isolatedRevisionId);
-    if (
-      this.#revisionDescendsFrom(
-        resources,
-        resources.currentRevisionId,
-        isolatedRevisionId,
-      )
-    ) {
-      isolatedRevisionId = resources.currentRevisionId;
-    } else if (
-      !this.#revisionDescendsFrom(
-        resources,
-        isolatedRevisionId,
-        resources.currentRevisionId,
-      )
-    ) {
-      throw new Error("workspace-revision-stale");
-    }
-    resources.currentRevisionId = isolatedRevisionId;
-    return {
-      kind: "phase-committed",
-      artifactHash: event.artifactHash,
-      isolatedRevisionId,
-      exitCode: event.exitCode,
-      classification: expectedClassification(input.phase),
-      baselineRevisionId: resources.baselineRevisionId,
-    };
-  }
-
-  #expandedBaseline(
-    resources: DurableRunResources,
-    plan: ImplementPlan,
-  ): WorkspaceRevision {
-    const baseline = resources.workspaces.getRevision(
-      resources.baselineRevisionId,
-    );
-    const candidates = new Map<string, boolean>(
-      deliveryBoundPaths(plan).map((relative) => [relative, false]),
-    );
-    for (const task of plan.tasks) {
-      for (const phase of Object.values(task.phases)) {
-        for (const relative of phase.read) candidates.set(relative, false);
-        for (const relative of [...phase.write, ...phase.delete]) {
-          candidates.set(relative, true);
-        }
-      }
-    }
-    for (const output of plan.outputs) candidates.set(output.path, true);
-    for (const task of plan.tasks) {
-      if (task.agents.impact === "none" || !task.agents.target) continue;
-      candidates.set(task.agents.target, task.agents.impact === "create-index");
-    }
-    const trackingPath = deliveryTrackingPath(plan);
-    if (
-      trackingPath &&
-      (Object.hasOwn(baseline.entries, trackingPath) ||
-        observeSafePath(this.#options.consumerRoot, trackingPath).kind ===
-          "file")
-    ) {
-      candidates.set(trackingPath, false);
-    }
-    const changes: Record<
-      string,
-      { kind: "absent" } | { kind: "file"; bytes: Uint8Array; mode: number }
-    > = {};
-    for (const [relative, mayBeAbsent] of [...candidates].sort(
-      ([left], [right]) => compareCanonicalStrings(left, right),
-    )) {
-      if (relative === ".") continue;
-      const observation = observeSafePath(this.#options.consumerRoot, relative);
-      if (observation.kind === "absent") {
-        if (baseline.entries[relative]?.kind === "absent") continue;
-        if (!mayBeAbsent)
-          throw new Error("workflow-baseline-input-unavailable");
-        changes[relative] = { kind: "absent" };
-        continue;
-      }
-      if (observation.kind !== "file") {
-        throw new Error("workflow-baseline-path-unsafe");
+      if (observation.kind !== "file") {
+        throw new Error("workflow-baseline-path-unsafe");
       }
       const target = path.join(
         this.#options.consumerRoot,
@@ -1884,7 +737,9 @@ class DurableWorkflowComposition
       );
       for (const deliveryRevision of retainedRevisions) {
         const ledger = this.#ledger(resources, deliveryRevision);
-        const stored = ledger.durableFact(this.#baselineFactKey(resources));
+        const stored = ledger.durableFact(
+          this.#verification.baselineFactKey(resources),
+        );
         resources.baselinePromises.delete(deliveryRevision);
         if (stored === undefined) continue;
         const baseline = parseVerificationBaseline(stored, resources.artifacts);
@@ -1893,7 +748,7 @@ class DurableWorkflowComposition
           throw new Error("workflow-verification-baseline-conflict");
         }
         ledger.replaceDurableFact(
-          this.#baselineFactKey(resources),
+          this.#verification.baselineFactKey(resources),
           stored,
           verificationBaselineFact(
             {
@@ -1910,7 +765,7 @@ class DurableWorkflowComposition
     if (hasVerificationLifecycle(input.plan)) {
       for (const task of input.tasks) {
         if (task.state === "verified" && !invalidated.has(task.taskId)) {
-          this.#completeTracking(resources, task.taskId);
+          this.#phase.completeTracking(resources, task.taskId);
         }
       }
     }
@@ -1921,2347 +776,61 @@ class DurableWorkflowComposition
     };
   }
 
-  async #mergeCandidate(
-    resources: DurableRunResources,
-    input: Parameters<WorkflowWorker["runAttempt"]>[0],
-    baseRevisionId: string,
-    candidateRevisionId: string,
-    boundPaths?: string[],
-  ) {
-    let release!: () => void;
-    const prior = resources.mergeTail;
-    resources.mergeTail = new Promise<void>((resolve) => {
-      release = resolve;
-    });
-    await prior;
-    try {
-      const phase = input.task.phases[input.phase];
-      if (!phase) throw new Error("workflow-task-phase-invalid");
-      const merged = resources.workspaces.mergeRevision({
-        baseRevisionId,
-        currentRevisionId: resources.currentRevisionId,
-        candidateRevisionId,
-        boundPaths: [
-          ...new Set([
-            ...(boundPaths ?? [...phase.read, ...phase.write, ...phase.delete]),
-            ...(input.contextReadPaths ?? []),
-          ]),
-        ],
-      });
-      resources.currentRevisionId = merged.revisionId;
-      return merged;
-    } finally {
-      release();
-    }
+  isContextReadAvailable(
+    input: Parameters<NonNullable<WorkflowWorker["isContextReadAvailable"]>>[0],
+  ): boolean {
+    const resources = this.#resources(input);
+    const revision = resources.workspaces.getRevision(
+      input.currentWorkspaceRevisionId,
+    );
+    return revision.entries[input.path]?.kind === "file";
   }
 
-  async #rollbackWorkspacePaths(input: {
-    resources: DurableRunResources;
-    baseRevisionId: string;
-    rejectedRevisionId: string;
-    paths: readonly string[];
-  }): Promise<void> {
-    const { resources } = input;
-    let release!: () => void;
-    const prior = resources.mergeTail;
-    resources.mergeTail = new Promise<void>((resolve) => {
-      release = resolve;
+  rebind(input: Parameters<WorkflowWorker["rebind"]>[0]) {
+    const rebound = this.#broker.rebind({
+      runId: input.runId,
+      taskId: input.taskId,
+      role: input.role,
+      routeId: input.routeId,
+      requirements: implementationRouteRequirements({ task: input.task }),
     });
-    await prior;
-    try {
-      const base = resources.workspaces.getRevision(input.baseRevisionId);
-      const rejected = resources.workspaces.getRevision(
-        input.rejectedRevisionId,
-      );
-      const current = resources.workspaces.getRevision(
-        resources.currentRevisionId,
-      );
-      const changes: Record<
-        string,
-        { kind: "absent" } | { kind: "file"; bytes: Uint8Array; mode: number }
-      > = {};
-      for (const relative of [...new Set(input.paths)].sort()) {
-        const before = base.entries[relative];
-        const rejectedEntry = rejected.entries[relative];
-        if (workspaceEntryEqual(before, rejectedEntry)) continue;
-        const latest = current.entries[relative];
-        if (workspaceEntryEqual(latest, before)) continue;
-        if (!workspaceEntryEqual(latest, rejectedEntry)) {
-          throw new Error("workspace-revision-stale");
+    return rebound.ok
+      ? {
+          ok: true as const,
+          routeId: rebound.route.id,
+          routeFingerprint: rebound.route.fingerprint,
         }
-        changes[relative] =
-          before?.kind === "file"
-            ? {
-                kind: "file",
-                bytes: resources.artifacts.read(before.hash),
-                mode: before.mode,
-              }
-            : { kind: "absent" };
-      }
-      if (Object.keys(changes).length === 0) return;
-      const rolledBack = resources.workspaces.createRevision({
-        parentRevisionId: current.revisionId,
-        changes,
-      });
-      resources.currentRevisionId = rolledBack.revisionId;
-    } finally {
-      release();
-    }
+      : { ok: false as const, code: rebound.code };
   }
 
-  async #runRepairCandidate(input: {
-    resources: DurableRunResources;
-    ledger: TaskLedger;
-    attempt: Parameters<WorkflowWorker["runAttempt"]>[0];
-    repairAttempt: number;
-    failureIdentities: string[];
-  }): Promise<DurableRepairResult> {
-    const { resources, ledger } = input;
-    const request = input.attempt;
-    if (request.signal.aborted) {
-      return { kind: "operation-cancelled", code: "cancelled" };
+  async prepare(
+    input: Parameters<WorkflowApplication["begin"]>[0],
+  ): Promise<Record<string, unknown>> {
+    if (!input.baselineRevisionId || !input.currentWorkspaceRevisionId) {
+      return { state: "paused", code: "workspace-revision-unavailable" };
     }
-    const phase = request.task.phases[request.phase];
-    if (!phase) throw new Error("workflow-task-phase-invalid");
-    const allPhases = Object.values(request.task.phases);
-    const approvedWritePaths = [
-      ...new Set(allPhases.flatMap((boundary) => boundary.write)),
-    ].sort();
-    const approvedDeletePaths = [
-      ...new Set(allPhases.flatMap((boundary) => boundary.delete)),
-    ].sort();
-    const approvedPaths = [
-      ...new Set([...approvedWritePaths, ...approvedDeletePaths]),
-    ].sort();
-    const boundPaths = [
-      ...new Set(
-        allPhases.flatMap((boundary) => [
-          ...boundary.read,
-          ...boundary.write,
-          ...boundary.delete,
-        ]),
-      ),
-    ].sort();
-    if (approvedPaths.length === 0) {
-      return { kind: "approval-needed", code: "task-write-set-empty" };
+    const resources = await this.#prepareResources(
+      {
+        runId: input.runId,
+        deliveryRevision: input.deliveryRevision,
+        plan: input.plan,
+        baselineRevisionId: input.baselineRevisionId,
+        currentWorkspaceRevisionId: input.currentWorkspaceRevisionId,
+      },
+      input.signal,
+    );
+    if (!resources.verificationFact) {
+      return { state: "paused", code: "verification-fact-unavailable" };
     }
-    const baseRevisionId = resources.currentRevisionId;
-    const pendingKey = `pending-${hash(request.taskId, request.phase, request.task.repairVerification.id).slice(0, 40)}`;
-    const pending = this.#pendingCandidate(ledger, pendingKey, baseRevisionId);
-    const proposalRoot = mkdtempSync(path.join(resources.root, "repair-"));
-    try {
-      await resources.workspaces.materializeAsync(
-        baseRevisionId,
-        proposalRoot,
-        request.signal,
-      );
-      if (request.routeId && !pending) {
-        const rebound = this.#broker.resumeBinding({
-          runId: request.runId,
-          taskId: request.taskId,
-          role: "implementation-worker",
-          routeId: request.routeId,
-          ...(request.routeFingerprint
-            ? { expectedFingerprint: request.routeFingerprint }
-            : {}),
-          requirements: implementationRouteRequirements({
-            task: request.task,
-            ...(request.artifactCorrection
-              ? { artifactCorrection: request.artifactCorrection }
-              : {}),
-            repair: { failureIdentities: input.failureIdentities },
-          }),
-        });
-        if (!rebound.ok) return { kind: "paused", code: rebound.code };
-      }
-      const ledgerProjection = ledger.projection({
-        runId: request.runId,
-        taskId: request.taskId,
-        nextPhase: request.phase,
-      });
-      const repair = {
-        attempt: input.repairAttempt,
-        attribution: "introduced" as const,
-        failureIdentities: [...input.failureIdentities],
-      };
-      let identity: BeginCandidateInput | undefined = pending?.identity;
-      const routed = pending
-        ? {
-            ok: true as const,
-            value: pending.proposal,
-            routeId: pending.identity.routeId,
-            routeFingerprint: pending.identity.routeFingerprint,
-          }
-        : await this.#broker.run({
-            runId: request.runId,
-            taskId: request.taskId,
-            operationId: `${request.operationId}:${request.taskId}:repair:${input.repairAttempt}`,
-            role: "implementation-worker",
-            requirements: implementationRouteRequirements({
-              task: request.task,
-              ...(request.artifactCorrection
-                ? { artifactCorrection: request.artifactCorrection }
-                : {}),
-              repair: { failureIdentities: input.failureIdentities },
-            }),
-            signal: request.signal,
-            ...(request.onActivity ? { onActivity: request.onActivity } : {}),
-            classifyResult: semanticRouteFailure,
-            execute: async (attempt) => {
-              identity = {
-                candidateId: `candidate-${randomUUID()}`,
-                runId: request.runId,
-                deliveryRevision: request.deliveryRevision,
-                taskId: request.taskId,
-                phase: request.phase,
-                attemptId: `repair-${hash(
-                  request.operationId,
-                  request.taskId,
-                  String(input.repairAttempt),
-                  attempt.route.fingerprint,
-                ).slice(0, 40)}`,
-                approvedPaths,
-                isolatedRevisionId: baseRevisionId,
-                verificationId: request.task.repairVerification.id,
-                routeId: attempt.route.id,
-                routeFingerprint: attempt.route.fingerprint,
-              };
-              if (request.reserveCandidate && !request.reserveCandidate())
-                return {
-                  kind: "paused" as const,
-                  code:
-                    request.additionalAttempt || request.verificationOnly
-                      ? "repair-attempts-exhausted"
-                      : "change-work-budget-exhausted",
-                };
-              return this.#options.proposeCandidate({
-                runId: request.runId,
-                operationId: request.operationId,
-                deliveryRevision: request.deliveryRevision,
-                taskId: request.taskId,
-                phase: request.phase,
-                task: structuredClone(request.task),
-                contextReadPaths: request.contextReadPaths,
-                workspaceRoot: proposalRoot,
-                ledgerProjection,
-                candidateArtifact: {
-                  ledger,
-                  identity,
-                  workspaceRoot: proposalRoot,
-                  writePaths: approvedWritePaths,
-                  deletePaths: approvedDeletePaths,
-                },
-                route: attempt.route,
-                repair,
-                ...(request.artifactCorrection
-                  ? { artifactCorrection: request.artifactCorrection }
-                  : {}),
-                ...(request.contextRequest
-                  ? { contextRequest: request.contextRequest }
-                  : {}),
-                ...(request.recoveryFeedback
-                  ? { recoveryFeedback: request.recoveryFeedback }
-                  : {}),
-                signal: attempt.signal,
-                onHeaders: attempt.onHeaders,
-                onProgress: attempt.onProgress,
-              });
-            },
-          });
-      if (!routed.ok) {
-        return routed.state === "cancelled" || request.signal.aborted
-          ? { kind: "operation-cancelled", code: "cancelled" }
-          : { kind: "paused", code: routed.code };
-      }
-      if (!identity || identity.routeId !== routed.routeId) {
-        throw new Error("candidate-route-identity-invalid");
-      }
-      const correctionIdentity = identity;
-      const withRoute = <T extends object>(outcome: T) => ({
-        ...outcome,
-        routeId: correctionIdentity.routeId,
-        routeFingerprint: correctionIdentity.routeFingerprint,
-      });
-      let uncommittedRevisionId: string | undefined;
-      const reject = async <T extends object>(
-        outcome: T,
-        correction: {
-          category: "artifact" | "stale" | "verification" | "checkpoint";
-          code: string;
-          stage: string;
-        },
-        rollback = false,
-      ): Promise<T> => {
-        if (rollback && uncommittedRevisionId) {
-          await this.#rollbackWorkspacePaths({
-            resources,
-            baseRevisionId,
-            rejectedRevisionId: uncommittedRevisionId,
-            paths: approvedPaths,
-          });
-        }
-        this.#recordCorrection(ledger, request, correctionIdentity, correction);
-        return withRoute({ ...outcome, retryPolicy: correction.category });
-      };
-      const proposal = routed.value;
-      if (
-        proposal.kind !== "candidate" &&
-        proposal.kind !== "sealed-candidate"
-      ) {
-        return proposal.kind === "operation-cancelled" ||
-          proposal.kind === "paused" ||
-          proposal.kind === "approval-needed"
-          ? withRoute(proposal)
-          : reject(proposal, {
-              category: "artifact",
-              code: proposal.code,
-              stage: "candidate-submit",
-            });
-      }
-      emitWorkflowActivity(request.onActivity, { state: "validating" });
-      ledger.beginCandidate(identity);
-      let bytes: Buffer;
-      if (proposal.kind === "sealed-candidate") {
-        if (
-          proposal.candidateId !== identity.candidateId ||
-          !SHA256.test(proposal.artifactHash) ||
-          !Number.isSafeInteger(proposal.bytes) ||
-          proposal.bytes < 1 ||
-          !Array.isArray(proposal.paths)
-        ) {
-          return reject(
-            { kind: "retryable", code: "candidate-diff-invalid" },
-            {
-              category: "artifact",
-              code: "candidate-diff-invalid",
-              stage: "candidate-seal",
-            },
-          );
-        }
-        bytes = Buffer.from(ledger.readSealedCandidate(identity.candidateId));
-        if (
-          bytes.length !== proposal.bytes ||
-          sha256Bytes(bytes) !== proposal.artifactHash
-        ) {
-          throw new Error("candidate-seal-integrity-invalid");
-        }
-      } else {
-        if (
-          !(proposal.bytes instanceof Uint8Array) ||
-          proposal.bytes.length === 0
-        ) {
-          return reject(
-            { kind: "retryable", code: "candidate-diff-invalid" },
-            {
-              category: "artifact",
-              code: "candidate-diff-invalid",
-              stage: "candidate-submit",
-            },
-          );
-        }
-        bytes = Buffer.from(proposal.bytes);
-      }
-      let candidatePaths: string[];
-      try {
-        candidatePaths = diffWritePaths(
-          new TextDecoder("utf-8", { fatal: true }).decode(bytes),
-        ).paths;
-      } catch {
-        return reject(
-          { kind: "retryable", code: "candidate-diff-invalid" },
-          {
-            category: "artifact",
-            code: "candidate-diff-invalid",
-            stage: "candidate-diff",
-          },
-        );
-      }
-      if (
-        candidatePaths.some((relative) => !approvedPaths.includes(relative))
-      ) {
-        return reject(
-          {
-            kind: "approval-needed",
-            code: "repair-boundary-expansion",
-          },
-          {
-            category: "artifact",
-            code: "repair-boundary-expansion",
-            stage: "candidate-boundary",
-          },
-        );
-      }
-      if (proposal.kind === "sealed-candidate") {
-        if (
-          JSON.stringify([...proposal.paths].sort()) !==
-          JSON.stringify([...candidatePaths].sort())
-        ) {
-          return reject(
-            { kind: "retryable", code: "candidate-diff-invalid" },
-            {
-              category: "artifact",
-              code: "candidate-diff-invalid",
-              stage: "candidate-seal",
-            },
-          );
-        }
-      }
-      const dependencySensitive = candidatePaths.some(
-        (relative) => relative === "package.json" || LOCKFILES.has(relative),
-      );
-      let dependenciesBefore: Map<string, DependencyContractEntry> | undefined;
-      if (dependencySensitive) {
-        try {
-          dependenciesBefore = dependencyContract(proposalRoot);
-        } catch (error) {
-          if (!(error instanceof DependencyManifestError)) throw error;
-          return reject(
-            { kind: "retryable", code: error.message },
-            {
-              category: "artifact",
-              code: error.message,
-              stage: "candidate-dependency",
-            },
-          );
-        }
-      }
-
-      const checked = await runGitApply(
-        proposalRoot,
-        bytes,
-        true,
-        request.signal,
-      );
-      if (checked !== "ok") {
-        return checked === "cancelled"
-          ? withRoute({ kind: "operation-cancelled", code: "cancelled" })
-          : reject(
-              { kind: "retryable", code: "candidate-diff-invalid" },
-              {
-                category: "artifact",
-                code: "candidate-diff-invalid",
-                stage: "candidate-check",
-              },
-            );
-      }
-      const applied = await runGitApply(
-        proposalRoot,
-        bytes,
-        false,
-        request.signal,
-      );
-      if (applied !== "ok") {
-        return applied === "cancelled"
-          ? withRoute({ kind: "operation-cancelled", code: "cancelled" })
-          : reject(
-              { kind: "retryable", code: "candidate-diff-invalid" },
-              {
-                category: "artifact",
-                code: "candidate-diff-invalid",
-                stage: "candidate-apply",
-              },
-            );
-      }
-      if (dependenciesBefore) {
-        let dependenciesAfter: Map<string, DependencyContractEntry>;
-        try {
-          dependenciesAfter = dependencyContract(proposalRoot);
-        } catch (error) {
-          if (!(error instanceof DependencyManifestError)) throw error;
-          return reject(
-            { kind: "retryable", code: error.message },
-            {
-              category: "artifact",
-              code: error.message,
-              stage: "candidate-dependency",
-            },
-          );
-        }
-        if (
-          hasUnapprovedDependencyChange(
-            dependenciesBefore,
-            dependenciesAfter,
-            request.task.approvedDependencies,
-            candidatePaths.some((relative) => LOCKFILES.has(relative)),
-          )
-        ) {
-          return reject(
-            { kind: "approval-needed", code: "unapproved-dependency-change" },
-            {
-              category: "artifact",
-              code: "unapproved-dependency-change",
-              stage: "candidate-dependency",
-            },
-          );
-        }
-      }
-
-      let artifactHash: string;
-      if (proposal.kind === "sealed-candidate") {
-        artifactHash = proposal.artifactHash;
-      } else {
-        let sequence = 0;
-        for (
-          let offset = 0;
-          offset < bytes.length;
-          offset += TASK_LEDGER_LIMITS.maxSegmentBytes
-        ) {
-          const segment = bytes.subarray(
-            offset,
-            Math.min(offset + TASK_LEDGER_LIMITS.maxSegmentBytes, bytes.length),
-          );
-          const accepted = ledger.appendCandidateSegment({
-            ...identity,
-            sequence,
-            bytes: segment,
-            segmentHash: sha256Bytes(segment),
-          });
-          if (!accepted.ok) {
-            return reject(
-              { kind: "paused", code: accepted.code },
-              {
-                category: "artifact",
-                code: accepted.code,
-                stage: "candidate-segment",
-              },
-            );
-          }
-          sequence += 1;
-        }
-        const sealed = ledger.sealCandidate({
-          ...identity,
-          segmentCount: sequence,
-          totalBytes: bytes.length,
-          candidateHash: sha256Bytes(bytes),
-        });
-        if (!sealed.ok) {
-          return reject(
-            { kind: "retryable", code: sealed.code },
-            {
-              category: "artifact",
-              code: sealed.code,
-              stage: "candidate-seal",
-            },
-          );
-        }
-        artifactHash = sealed.artifactHash;
-      }
-      const candidate = resources.workspaces.createRevision({
-        parentRevisionId: baseRevisionId,
-        changes: revisionChanges(proposalRoot, approvedPaths),
-      });
-      const requiredOutputs = request.plan.outputs.filter(
-        (output) =>
-          output.producer.taskId === request.taskId &&
-          (!request.artifactCorrection || output.producer.phase !== "refactor"),
-      );
-      if (
-        requiredOutputs.some(
-          (output) => candidate.entries[output.path]?.kind !== "file",
-        )
-      ) {
-        return reject(
-          { kind: "retryable", code: "producer-output-unavailable" },
-          {
-            category: "artifact",
-            code: "producer-output-unavailable",
-            stage: "candidate-output",
-          },
-        );
-      }
-      emitWorkflowActivity(request.onActivity, { state: "verifying" });
-      this.#savePendingCandidate(ledger, pendingKey, {
-        identity,
-        proposal: {
-          kind: "sealed-candidate",
-          candidateId: identity.candidateId,
-          artifactHash,
-          bytes: bytes.length,
-          paths: candidatePaths,
-        },
-      });
-      const verified = await this.#verifyPhase({
-        executionWritePaths: this.#executionWritePaths(resources),
-        runId: request.runId,
-        deliveryRevision: request.deliveryRevision,
-        taskId: request.taskId,
-        phase: request.phase,
-        root: proposalRoot,
-        verification: structuredClone(request.task.repairVerification),
-        signal: request.signal,
-      });
-      if (!verified.ok) {
-        if (verified.kind === "paused") return verified;
-        this.#savePendingCandidate(ledger, pendingKey, null);
-        return reject(verified, {
-          category: "verification",
-          code: verified.code,
-          stage: "phase-verification",
-        });
-      }
-      if (
-        verified.classification !== "expected-green" ||
-        verified.exitCode !== 0
-      ) {
-        return reject(
-          { kind: "retryable", code: "verification-rejected" },
-          {
-            category: "verification",
-            code: "verification-rejected",
-            stage: "phase-verification",
-          },
-        );
-      }
-      let merged: ReturnType<WorkspaceStore["mergeRevision"]>;
-      try {
-        merged = await this.#mergeCandidate(
-          resources,
-          request,
-          baseRevisionId,
-          candidate.revisionId,
-          boundPaths,
-        );
-        uncommittedRevisionId = merged.revisionId;
-      } catch (error) {
-        if (
-          error instanceof Error &&
-          error.message === "workspace-revision-stale"
-        ) {
-          return reject(
-            { kind: "retryable", code: "workspace-revision-stale" },
-            {
-              category: "stale",
-              code: "workspace-revision-stale",
-              stage: "candidate-merge",
-            },
-          );
-        }
-        throw error;
-      }
-      if (
-        requiredOutputs.some(
-          (output) => merged.entries[output.path]?.kind !== "file",
-        )
-      ) {
-        return reject(
-          { kind: "retryable", code: "producer-output-unavailable" },
-          {
-            category: "artifact",
-            code: "producer-output-unavailable",
-            stage: "candidate-output",
-          },
-          true,
-        );
-      }
-      const outputFacts = approvedPaths.map((relative) => {
-        const entry = merged.entries[relative];
-        return entry?.kind === "file"
-          ? {
-              path: relative,
-              kind: "file" as const,
-              hash: entry.hash,
-              bytes: entry.bytes,
-            }
-          : { path: relative, kind: "absent" as const };
-      });
-      return {
-        kind: "repair-committed",
-        commit: {
-          artifactHash,
-          isolatedRevisionId: merged.revisionId,
-          exitCode: verified.exitCode,
-          classification: verified.classification,
-          diagnostic: verified.diagnostic,
-          outputFacts,
-          routeId: identity.routeId,
-          routeFingerprint: identity.routeFingerprint,
-        },
-      };
-    } finally {
-      rmSync(proposalRoot, { recursive: true, force: true });
-    }
-  }
-
-  #revisionDescendsFrom(
-    resources: DurableRunResources,
-    descendantRevisionId: string,
-    ancestorRevisionId: string,
-  ): boolean {
-    let current = resources.workspaces.getRevision(descendantRevisionId);
-    const visited = new Set<string>();
-    for (;;) {
-      if (current.revisionId === ancestorRevisionId) return true;
-      if (
-        current.parentRevisionId === null ||
-        visited.has(current.revisionId)
-      ) {
-        return false;
-      }
-      visited.add(current.revisionId);
-      current = resources.workspaces.getRevision(current.parentRevisionId);
-    }
-  }
-
-  #verifiedPhaseReplay(
-    ledger: TaskLedger,
-    input: Parameters<WorkflowWorker["runAttempt"]>[0],
-  ): { artifactHash: string; exitCode: number; isolatedRevisionId: string } {
-    const projection = ledger.projection({
-      runId: input.runId,
-      taskId: input.taskId,
-      nextPhase: input.phase,
-    }) as { history: Array<Record<string, unknown>> };
-    const event = projection.history.find(
-      (candidate) =>
-        candidate.kind === "phase-verified" && candidate.phase === input.phase,
-    );
-    if (
-      !event ||
-      typeof event.artifactHash !== "string" ||
-      !SHA256.test(event.artifactHash) ||
-      typeof event.isolatedRevisionId !== "string" ||
-      !SHA256.test(event.isolatedRevisionId) ||
-      typeof event.exitCode !== "number" ||
-      event.actualClassification !== expectedClassification(input.phase)
-    ) {
-      throw new Error("workflow-ledger-phase-invalid");
-    }
-    return {
-      artifactHash: event.artifactHash,
-      exitCode: event.exitCode,
-      isolatedRevisionId: event.isolatedRevisionId,
-    };
-  }
-
-  async #runRedArtifactCorrection(input: {
-    resources: DurableRunResources;
-    ledger: TaskLedger;
-    baseline?: DurableVerificationBaseline;
-    attempt: Parameters<WorkflowWorker["runAttempt"]>[0];
-  }): Promise<WorkflowAttemptOutcome> {
-    const { resources, ledger } = input;
-    const request = input.attempt;
-    if (
-      request.phase !== "green" ||
-      request.artifactCorrection?.code !== "red-artifact-constraint"
-    ) {
-      throw new Error("workflow-red-artifact-correction-invalid");
-    }
-    const priorRed = this.#verifiedPhaseReplay(ledger, {
-      ...request,
-      phase: "red",
-    });
-    if (!hasVerificationLifecycle(request.plan)) {
-      return { kind: "paused", code: "red-artifact-constraint" };
-    }
-    const stableRevisionId = resources.currentRevisionId;
-    const correctionPaths = [
-      ...new Set(
-        Object.values(request.task.phases).flatMap((phase) => [
-          ...phase.write,
-          ...phase.delete,
-        ]),
-      ),
-    ];
-    const rejectCorrection = async <T extends WorkflowAttemptOutcome>(
-      outcome: T,
-    ): Promise<T> => {
-      if (resources.currentRevisionId !== stableRevisionId) {
-        await this.#rollbackWorkspacePaths({
-          resources,
-          baseRevisionId: stableRevisionId,
-          rejectedRevisionId: resources.currentRevisionId,
-          paths: correctionPaths,
-        });
-      }
-      return outcome;
-    };
-    const failureIdentities = [
-      hash(
-        "red-artifact-constraint",
-        request.taskId,
-        request.task.phases.red.verification.id,
-      ),
-    ];
-    const correctionAttemptUsed = request.artifactCorrection.attempt;
-    const correctionAction = {
-      kind: "red-correction" as const,
-      attempt:
-        request.additionalAttempt || request.verificationOnly
-          ? 1
-          : correctionAttemptUsed,
-    };
-    const correctionDecision =
-      request.recoveryDecision?.(correctionAction) ??
-      decideRecoveryAction(request.plan, correctionAction, request);
-    if (!correctionDecision.allowed)
-      return { kind: "paused", code: correctionDecision.code };
-    const repaired = await this.#runRepairCandidate({
-      resources,
-      ledger,
-      attempt: request,
-      repairAttempt: correctionAttemptUsed,
-      failureIdentities,
-    });
-    if (repaired.kind !== "repair-committed") {
-      return rejectCorrection(repaired);
-    }
-
-    const correctedRevision = resources.workspaces.getRevision(
-      repaired.commit.isolatedRevisionId,
-    );
-    const acceptedRedRevision = resources.workspaces.getRevision(
-      priorRed.isolatedRevisionId,
-    );
-    if (!acceptedRedRevision.parentRevisionId) {
-      throw new Error("workflow-ledger-revision-base-invalid");
-    }
-    const correctedRedChanges: Record<
-      string,
-      { kind: "absent" } | { kind: "file"; bytes: Uint8Array; mode: number }
-    > = {};
-    for (const relative of [
-      ...new Set([
-        ...request.task.phases.red.write,
-        ...request.task.phases.red.delete,
-      ]),
-    ]) {
-      const entry = correctedRevision.entries[relative];
-      correctedRedChanges[relative] =
-        entry?.kind === "file"
-          ? {
-              kind: "file",
-              bytes: resources.artifacts.read(entry.hash),
-              mode: entry.mode,
-            }
-          : { kind: "absent" };
-    }
-    const correctedRedRevision = resources.workspaces.createRevision({
-      parentRevisionId: acceptedRedRevision.parentRevisionId,
-      changes: correctedRedChanges,
-    });
-    const verifyCorrectedContract = async (input: {
-      phase: "red" | "green";
-      revisionId: string;
-      verification: StructuredVerificationContract;
-    }): Promise<DurablePhaseVerificationResult> => {
-      const root = mkdtempSync(path.join(resources.root, "correction-check-"));
-      try {
-        await resources.workspaces.materializeAsync(
-          input.revisionId,
-          root,
-          request.signal,
-        );
-        return await this.#verifyPhase({
-          executionWritePaths: this.#executionWritePaths(resources),
-          runId: request.runId,
-          deliveryRevision: request.deliveryRevision,
-          taskId: request.taskId,
-          phase: input.phase,
-          root,
-          verification: structuredClone(input.verification),
-          signal: request.signal,
-        });
-      } finally {
-        rmSync(root, { recursive: true, force: true });
-      }
-    };
-    emitWorkflowActivity(request.onActivity, { state: "verifying" });
-    const redVerification = await verifyCorrectedContract({
-      phase: "red",
-      revisionId: correctedRedRevision.revisionId,
-      verification: request.task.phases.red.verification,
-    });
-    if (!redVerification.ok) {
-      return rejectCorrection({
-        ...redVerification,
-        ...(redVerification.kind === "retryable"
-          ? { retryPolicy: "verification" as const }
-          : {}),
-      });
-    }
-    if (
-      redVerification.classification !== "expected-red" ||
-      redVerification.exitCode === 0
-    ) {
-      return rejectCorrection({
-        kind: "retryable",
-        code: "verification-rejected",
-        retryPolicy: "verification",
-      });
-    }
-    const greenVerification = await verifyCorrectedContract({
-      phase: "green",
-      revisionId: repaired.commit.isolatedRevisionId,
-      verification: request.task.phases.green.verification,
-    });
-    if (!greenVerification.ok) {
-      return rejectCorrection({
-        ...greenVerification,
-        ...(greenVerification.kind === "retryable"
-          ? { retryPolicy: "verification" as const }
-          : {}),
-      });
-    }
-    if (
-      greenVerification.classification !== "expected-green" ||
-      greenVerification.exitCode !== 0
-    ) {
-      return rejectCorrection({
-        kind: "retryable",
-        code: "verification-rejected",
-        retryPolicy: "verification",
-      });
-    }
-
-    const repairEvent: VerifiedTaskEvent = {
-      runId: request.runId,
-      taskId: request.taskId,
-      eventId: `red-artifact-correction-${hash(
-        request.operationId,
-        request.taskId,
-        repaired.commit.artifactHash,
-      ).slice(0, 40)}`,
-      kind: "repair-verified",
-      phase: request.phase,
-      attempt: correctionAttemptUsed,
-      commandId: request.task.repairVerification.id,
-      exitCode: 0,
-      diagnostic: repaired.commit.diagnostic,
-      artifactHash: repaired.commit.artifactHash,
-      isolatedRevisionId: repaired.commit.isolatedRevisionId,
-      outputFacts: repaired.commit.outputFacts,
-      attribution: "introduced",
-      failureIdentities: [
-        hash(
-          "red-artifact-constraint",
-          request.taskId,
-          request.task.phases.red.verification.id,
-        ),
-      ],
-      routeId: repaired.commit.routeId,
-      routeFingerprint: repaired.commit.routeFingerprint,
-    };
-    const greenPaths = new Set([
-      ...request.task.phases.green.write,
-      ...request.task.phases.green.delete,
-    ]);
-    const greenEvent: VerifiedTaskEvent = {
-      runId: request.runId,
-      taskId: request.taskId,
-      eventId: `green-corrected-${hash(
-        request.operationId,
-        request.taskId,
-        repaired.commit.artifactHash,
-      ).slice(0, 40)}`,
-      kind: "phase-verified",
-      phase: "green",
-      commandId: request.task.phases.green.verification.id,
-      exitCode: greenVerification.exitCode,
-      expectedClassification: "expected-green",
-      actualClassification: greenVerification.classification,
-      diagnostic: greenVerification.diagnostic,
-      artifactHash: repaired.commit.artifactHash,
-      isolatedRevisionId: repaired.commit.isolatedRevisionId,
-      outputFacts: repaired.commit.outputFacts.filter((fact) =>
-        greenPaths.has(fact.path),
-      ),
-      routeId: repaired.commit.routeId,
-      routeFingerprint: repaired.commit.routeFingerprint,
-    };
-    const events: VerifiedTaskEvent[] = [repairEvent, greenEvent];
-    if (input.baseline) {
-      const affected = await this.#verifyTaskAffected({
-        resources,
-        baseline: input.baseline,
-        task: request.task,
-        revisionId: repaired.commit.isolatedRevisionId,
-        signal: request.signal,
-      });
-      if (affected.kind === "repairable") {
-        return rejectCorrection({
-          kind: "retryable",
-          code: "red-artifact-constraint",
-          retryPolicy: "artifact",
-        });
-      }
-      if (affected.kind !== "verified") return rejectCorrection(affected);
-    }
-    if (request.task.phases.refactor) {
-      ledger.commitVerifiedEvents(events);
-      return {
-        kind: "phase-committed",
-        artifactHash: repaired.commit.artifactHash,
-        isolatedRevisionId: repaired.commit.isolatedRevisionId,
-        exitCode: greenVerification.exitCode,
-        classification: greenVerification.classification,
-        routeId: repaired.commit.routeId,
-        routeFingerprint: repaired.commit.routeFingerprint,
-      };
-    }
-    const completedRevision = this.#completeTracking(resources, request.taskId);
-    ledger.commitTaskCompletion({
-      events,
-      factKey: `task-final-${hash(request.taskId).slice(0, 40)}`,
-      fact: {
-        taskId: request.taskId,
-        phase: request.phase,
-        isolatedRevisionId: completedRevision.revisionId,
-        attribution: "introduced",
-        repairAttempts: correctionAttemptUsed,
-      },
-    });
-    return {
-      kind: "phase-committed",
-      artifactHash: repaired.commit.artifactHash,
-      isolatedRevisionId: completedRevision.revisionId,
-      exitCode: greenVerification.exitCode,
-      classification: greenVerification.classification,
-      routeId: repaired.commit.routeId,
-      routeFingerprint: repaired.commit.routeFingerprint,
-    };
-  }
-
-  async #runCumulativeRepair(input: {
-    resources: DurableRunResources;
-    ledger: TaskLedger;
-    baseline: DurableVerificationBaseline;
-    attempt: Parameters<WorkflowWorker["runAttempt"]>[0];
-  }): Promise<WorkflowAttemptOutcome> {
-    const { resources, ledger } = input;
-    const request = input.attempt;
-    const finalPhase = request.task.phases.refactor ? "refactor" : "green";
-    const requestedFailures = request.repair?.failureIdentities;
-    if (
-      request.phase !== finalPhase ||
-      request.repair?.attribution !== "introduced" ||
-      !Array.isArray(requestedFailures) ||
-      requestedFailures.length === 0 ||
-      requestedFailures.length > 256 ||
-      requestedFailures.some(
-        (identity) => typeof identity !== "string" || !SHA256.test(identity),
-      )
-    ) {
-      throw new Error("workflow-repair-context-invalid");
-    }
-    this.#verifiedPhaseReplay(ledger, request);
-    const projection = ledger.projection({
-      runId: request.runId,
-      taskId: request.taskId,
-      nextPhase: request.phase,
-    }) as { history: Array<Record<string, unknown>> };
-    const priorRepairs = projection.history.filter(
-      (event) =>
-        event.kind === "repair-verified" && event.phase === request.phase,
-    );
-    let stableRevisionId = resources.currentRevisionId;
-    let affected: DurableAffectedResult = {
-      kind: "repairable",
-      attribution: "introduced",
-      failureIdentities: [...new Set(requestedFailures)].sort(),
-    };
-    const replayedRepair = priorRepairs.at(-1);
-    if (replayedRepair) {
-      if (
-        typeof replayedRepair.artifactHash !== "string" ||
-        !SHA256.test(replayedRepair.artifactHash) ||
-        typeof replayedRepair.isolatedRevisionId !== "string" ||
-        !SHA256.test(replayedRepair.isolatedRevisionId)
-      ) {
-        throw new Error("workflow-ledger-phase-invalid");
-      }
-      if (
-        this.#revisionDescendsFrom(
-          resources,
-          replayedRepair.isolatedRevisionId,
-          stableRevisionId,
-        )
-      ) {
-        resources.currentRevisionId = replayedRepair.isolatedRevisionId;
-        stableRevisionId = replayedRepair.isolatedRevisionId;
-        const replayedAffected = await this.#verifyTaskAffected({
-          resources,
-          baseline: input.baseline,
-          task: request.task,
-          revisionId: stableRevisionId,
-          signal: request.signal,
-        });
-        if (replayedAffected.kind === "verified") {
-          return {
-            kind: "phase-committed",
-            artifactHash: replayedRepair.artifactHash,
-            isolatedRevisionId: stableRevisionId,
-            exitCode: 0,
-            classification: expectedClassification(request.phase),
-          };
-        }
-        if (replayedAffected.kind !== "repairable") return replayedAffected;
-        affected = replayedAffected;
-      }
-    }
-
-    const repairEvents: VerifiedTaskEvent[] = [];
-    let lastCommit: DurableCandidateCommit | undefined;
-    let repairAttempt = 0;
-    let uncommittedRevisionId: string | undefined;
-    const rollbackPaths = [
-      ...new Set(
-        Object.values(request.task.phases).flatMap((phase) => [
-          ...phase.write,
-          ...phase.delete,
-        ]),
-      ),
-    ];
-    const discardUncommitted = async <T extends WorkflowAttemptOutcome>(
-      outcome: T,
-    ): Promise<T> => {
-      if (uncommittedRevisionId) {
-        await this.#rollbackWorkspacePaths({
-          resources,
-          baseRevisionId: stableRevisionId,
-          rejectedRevisionId: uncommittedRevisionId,
-          paths: rollbackPaths,
-        });
-      }
-      return outcome;
-    };
-    while (affected.kind === "repairable") {
-      if (
-        !(
-          request.recoveryDecision?.({
-            kind: "cumulative-repair",
-            attempt: repairAttempt + 1,
-          }) ??
-          decideRecoveryAction(
-            request.plan,
-            { kind: "cumulative-repair", attempt: repairAttempt + 1 },
-            request,
-          )
-        ).allowed
-      ) {
-        return discardUncommitted({
-          kind: "paused",
-          code: "repair-attempts-exhausted",
-        });
-      }
-      repairAttempt += 1;
-      const failureIdentities = [...affected.failureIdentities];
-      const repair = await this.#runRepairCandidate({
-        resources,
-        ledger,
-        attempt: request,
-        repairAttempt,
-        failureIdentities,
-      });
-      if (repair.kind !== "repair-committed") {
-        return discardUncommitted(repair);
-      }
-      lastCommit = repair.commit;
-      uncommittedRevisionId = repair.commit.isolatedRevisionId;
-      repairEvents.push({
-        runId: request.runId,
-        taskId: request.taskId,
-        eventId: `cumulative-repair-${hash(
-          stableRevisionId,
-          request.taskId,
-          String(repairAttempt),
-        ).slice(0, 40)}`,
-        kind: "repair-verified",
-        phase: request.phase,
-        attempt: repairAttempt,
-        commandId: request.task.repairVerification.id,
-        exitCode: 0,
-        diagnostic: repair.commit.diagnostic,
-        artifactHash: repair.commit.artifactHash,
-        isolatedRevisionId: repair.commit.isolatedRevisionId,
-        outputFacts: repair.commit.outputFacts,
-        attribution: "introduced",
-        failureIdentities,
-        routeId: repair.commit.routeId,
-        routeFingerprint: repair.commit.routeFingerprint,
-      });
-      affected = await this.#verifyTaskAffected({
-        resources,
-        baseline: input.baseline,
-        task: request.task,
-        revisionId: repair.commit.isolatedRevisionId,
-        signal: request.signal,
-      });
-    }
-    if (affected.kind !== "verified") return discardUncommitted(affected);
-    if (!lastCommit || repairEvents.length === 0) {
-      throw new Error("workflow-repair-commit-unavailable");
-    }
-    ledger.commitVerifiedEvents(repairEvents);
-    return {
-      kind: "phase-committed",
-      artifactHash: lastCommit.artifactHash,
-      isolatedRevisionId: lastCommit.isolatedRevisionId,
-      exitCode: 0,
-      classification: expectedClassification(request.phase),
-      routeId: lastCommit.routeId,
-      routeFingerprint: lastCommit.routeFingerprint,
-    };
-  }
-
-  async hasPendingVerification(
-    input: Parameters<WorkflowWorker["runAttempt"]>[0],
-  ): Promise<boolean> {
-    if (!input.baselineRevisionId || !input.currentWorkspaceRevisionId)
-      return false;
-    const resources = await this.#prepareResources(input, input.signal);
-    const ledger = this.#ledger(resources, input.deliveryRevision);
-    const verificationIds = [
-      input.task.phases[input.phase]?.verification.id,
-      input.task.repairVerification?.id,
-    ];
-    return verificationIds.some(
-      (id) =>
-        id &&
-        this.#pendingCandidate(
-          ledger,
-          `pending-${hash(input.taskId, input.phase, id).slice(0, 40)}`,
-          resources.currentRevisionId,
-        ) !== undefined,
-    );
-  }
-
-  isContextReadAvailable(
-    input: Parameters<NonNullable<WorkflowWorker["isContextReadAvailable"]>>[0],
-  ): boolean {
-    const resources = this.#resources(input);
-    const revision = resources.workspaces.getRevision(
-      input.currentWorkspaceRevisionId,
-    );
-    return revision.entries[input.path]?.kind === "file";
-  }
-
-  async runAttempt(
-    input: Parameters<WorkflowWorker["runAttempt"]>[0],
-  ): Promise<WorkflowAttemptOutcome> {
-    if (input.signal.aborted) {
-      return { kind: "operation-cancelled", code: "cancelled" };
-    }
-    const resources = await this.#prepareResources(
-      {
-        runId: input.runId,
-        deliveryRevision: input.deliveryRevision,
-        plan: input.plan,
-        ...(input.baselineRevisionId
-          ? { baselineRevisionId: input.baselineRevisionId }
-          : {}),
-        ...(input.currentWorkspaceRevisionId
-          ? { currentWorkspaceRevisionId: input.currentWorkspaceRevisionId }
-          : {}),
-      },
-      input.signal,
-    );
-    let selectedRoute: Required<WorkflowRouteFacts> | undefined;
-    const retained = <T extends WorkflowAttemptOutcome>(outcome: T): T =>
-      ({
-        ...(selectedRoute ?? {}),
-        ...outcome,
-        baselineRevisionId: resources.baselineRevisionId,
-        currentWorkspaceRevisionId: resources.currentRevisionId,
-      }) as T;
-    const ledger = this.#ledger(resources, input.deliveryRevision);
-    let verificationBaseline: DurableVerificationBaseline | undefined;
-    if (hasVerificationLifecycle(input.plan)) {
-      emitWorkflowActivity(input.onActivity, { state: "verifying" });
-      const captured = await this.#ensureVerificationBaseline({
-        resources,
-        ledger,
-        signal: input.signal,
-      });
-      if (!captured.ok) {
-        const outcome = captured.outcome;
-        return retained(
-          outcome.kind === "paused"
-            ? {
-                ...outcome,
-                verification: {
-                  scope: "baseline",
-                  attribution: "environment",
-                },
-              }
-            : outcome,
-        );
-      }
-      verificationBaseline = captured.baseline;
-    }
-    this.#openTask(resources, ledger, input);
-    if (input.artifactCorrection?.code === "red-artifact-constraint") {
-      return retained(
-        await this.#runRedArtifactCorrection({
-          resources,
-          ledger,
-          ...(verificationBaseline ? { baseline: verificationBaseline } : {}),
-          attempt: input,
-        }),
-      );
-    }
-    if (input.repair) {
-      if (!verificationBaseline) {
-        throw new Error("workflow-verification-baseline-unavailable");
-      }
-      return retained(
-        await this.#runCumulativeRepair({
-          resources,
-          ledger,
-          baseline: verificationBaseline,
-          attempt: input,
-        }),
-      );
-    }
-    const policyFailure = await this.#revalidatePhasePolicy(
-      resources,
-      ledger,
-      input.task,
-      input.signal,
-    );
-    if (policyFailure) return retained(policyFailure);
-    const replay = this.#replayedPhase(resources, ledger, input);
-    if (replay) return retained(replay);
-    const phase = input.task.phases[input.phase];
-    if (!phase) throw new Error("workflow-task-phase-invalid");
-    const approvedPaths = [
-      ...new Set([...phase.write, ...phase.delete]),
-    ].sort();
-    const rollbackPaths = [
-      ...new Set(
-        Object.values(input.task.phases).flatMap((boundary) => [
-          ...boundary.write,
-          ...boundary.delete,
-        ]),
-      ),
-    ].sort();
-    if (approvedPaths.length === 0) {
-      return retained({
-        kind: "approval-needed",
-        code: "task-write-set-empty",
-      });
-    }
-    const baseRevisionId = resources.currentRevisionId;
-    const pendingKey = `pending-${hash(input.taskId, input.phase, phase.verification.id).slice(0, 40)}`;
-    const pending = this.#pendingCandidate(ledger, pendingKey, baseRevisionId);
-    const proposalRoot = mkdtempSync(path.join(resources.root, "attempt-"));
-    try {
-      await resources.workspaces.materializeAsync(
-        baseRevisionId,
-        proposalRoot,
-        input.signal,
-      );
-      if (input.routeId && !pending) {
-        const rebound = this.#broker.resumeBinding({
-          runId: input.runId,
-          taskId: input.taskId,
-          role: "implementation-worker",
-          routeId: input.routeId,
-          ...(input.routeFingerprint
-            ? { expectedFingerprint: input.routeFingerprint }
-            : {}),
-          requirements: implementationRouteRequirements({
-            task: input.task,
-            ...(input.artifactCorrection
-              ? { artifactCorrection: input.artifactCorrection }
-              : {}),
-            ...(input.repair ? { repair: input.repair } : {}),
-          }),
-        });
-        if (!rebound.ok) {
-          return retained({ kind: "paused", code: rebound.code });
-        }
-      }
-      const ledgerProjection = ledger.projection({
-        runId: input.runId,
-        taskId: input.taskId,
-        nextPhase: input.phase,
-      });
-      let identity: BeginCandidateInput | undefined = pending?.identity;
-      const routed = pending
-        ? {
-            ok: true as const,
-            value: pending.proposal,
-            routeId: pending.identity.routeId,
-            routeFingerprint: pending.identity.routeFingerprint,
-          }
-        : await this.#broker.run({
-            runId: input.runId,
-            taskId: input.taskId,
-            operationId: `${input.operationId}:${input.taskId}:${input.phase}`,
-            role: "implementation-worker",
-            requirements: implementationRouteRequirements({
-              task: input.task,
-              ...(input.artifactCorrection
-                ? { artifactCorrection: input.artifactCorrection }
-                : {}),
-              ...(input.repair ? { repair: input.repair } : {}),
-            }),
-            signal: input.signal,
-            ...(input.onActivity ? { onActivity: input.onActivity } : {}),
-            classifyResult: semanticRouteFailure,
-            execute: async (attempt) => {
-              identity = {
-                candidateId: `candidate-${randomUUID()}`,
-                runId: input.runId,
-                deliveryRevision: input.deliveryRevision,
-                taskId: input.taskId,
-                phase: input.phase,
-                attemptId: `attempt-${hash(
-                  input.operationId,
-                  input.taskId,
-                  input.phase,
-                  attempt.route.fingerprint,
-                ).slice(0, 40)}`,
-                approvedPaths,
-                isolatedRevisionId: baseRevisionId,
-                verificationId: phase.verification.id,
-                routeId: attempt.route.id,
-                routeFingerprint: attempt.route.fingerprint,
-              };
-              if (input.reserveCandidate && !input.reserveCandidate())
-                return {
-                  kind: "paused" as const,
-                  code:
-                    input.additionalAttempt || input.verificationOnly
-                      ? "repair-attempts-exhausted"
-                      : "change-work-budget-exhausted",
-                };
-              return this.#options.proposeCandidate({
-                runId: input.runId,
-                operationId: input.operationId,
-                deliveryRevision: input.deliveryRevision,
-                taskId: input.taskId,
-                phase: input.phase,
-                task: structuredClone(input.task),
-                contextReadPaths: input.contextReadPaths,
-                workspaceRoot: proposalRoot,
-                ledgerProjection,
-                candidateArtifact: {
-                  ledger,
-                  identity,
-                  workspaceRoot: proposalRoot,
-                  writePaths: phase.write,
-                  deletePaths: phase.delete,
-                },
-                route: attempt.route,
-                ...(input.contextRequest
-                  ? { contextRequest: input.contextRequest }
-                  : {}),
-                ...(input.recoveryFeedback
-                  ? { recoveryFeedback: input.recoveryFeedback }
-                  : {}),
-                signal: attempt.signal,
-                onHeaders: attempt.onHeaders,
-                onProgress: attempt.onProgress,
-              });
-            },
-          });
-      if (!routed.ok) {
-        return retained(
-          routed.state === "cancelled" || input.signal.aborted
-            ? { kind: "operation-cancelled", code: "cancelled" }
-            : { kind: "paused", code: routed.code },
-        );
-      }
-      if (!identity || identity.routeId !== routed.routeId) {
-        throw new Error("candidate-route-identity-invalid");
-      }
-      const correctionIdentity = identity;
-      selectedRoute = {
-        routeId: identity.routeId,
-        routeFingerprint: identity.routeFingerprint,
-      };
-      let uncommittedRevisionId: string | undefined;
-      const reject = async <T extends WorkflowAttemptOutcome>(
-        outcome: T,
-        correction: {
-          category: "artifact" | "stale" | "verification" | "checkpoint";
-          code: string;
-          stage: string;
-        },
-        rollback = false,
-      ): Promise<T> => {
-        if (rollback && uncommittedRevisionId) {
-          await this.#rollbackWorkspacePaths({
-            resources,
-            baseRevisionId,
-            rejectedRevisionId: uncommittedRevisionId,
-            paths: rollbackPaths,
-          });
-        }
-        this.#recordCorrection(ledger, input, correctionIdentity, correction);
-        return retained({ ...outcome, retryPolicy: correction.category });
-      };
-      const proposal = routed.value;
-      if (
-        proposal.kind !== "candidate" &&
-        proposal.kind !== "sealed-candidate"
-      ) {
-        return proposal.kind === "operation-cancelled" ||
-          proposal.kind === "paused" ||
-          proposal.kind === "approval-needed"
-          ? retained(proposal)
-          : reject(proposal, {
-              category: "artifact",
-              code: proposal.code,
-              stage: "candidate-submit",
-            });
-      }
-      emitWorkflowActivity(input.onActivity, { state: "validating" });
-      ledger.beginCandidate(identity);
-      let bytes: Buffer;
-      if (proposal.kind === "sealed-candidate") {
-        if (
-          proposal.candidateId !== identity.candidateId ||
-          !SHA256.test(proposal.artifactHash) ||
-          !Number.isSafeInteger(proposal.bytes) ||
-          proposal.bytes < 1 ||
-          !Array.isArray(proposal.paths)
-        ) {
-          return reject(
-            { kind: "retryable", code: "candidate-diff-invalid" },
-            {
-              category: "artifact",
-              code: "candidate-diff-invalid",
-              stage: "candidate-seal",
-            },
-          );
-        }
-        bytes = Buffer.from(ledger.readSealedCandidate(identity.candidateId));
-        if (
-          bytes.length !== proposal.bytes ||
-          sha256Bytes(bytes) !== proposal.artifactHash
-        ) {
-          throw new Error("candidate-seal-integrity-invalid");
-        }
-      } else {
-        if (
-          !(proposal.bytes instanceof Uint8Array) ||
-          proposal.bytes.length === 0
-        ) {
-          return reject(
-            { kind: "retryable", code: "candidate-diff-invalid" },
-            {
-              category: "artifact",
-              code: "candidate-diff-invalid",
-              stage: "candidate-submit",
-            },
-          );
-        }
-        bytes = Buffer.from(proposal.bytes);
-      }
-      let candidatePaths: string[];
-      try {
-        const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-        candidatePaths = diffWritePaths(text).paths;
-      } catch {
-        return reject(
-          { kind: "retryable", code: "candidate-diff-invalid" },
-          {
-            category: "artifact",
-            code: "candidate-diff-invalid",
-            stage: "candidate-diff",
-          },
-        );
-      }
-      if (
-        candidatePaths.some((relative) => !approvedPaths.includes(relative))
-      ) {
-        return reject(
-          { kind: "retryable", code: "write-set-mismatch" },
-          {
-            category: "artifact",
-            code: "write-set-mismatch",
-            stage: "candidate-boundary",
-          },
-        );
-      }
-      if (proposal.kind === "sealed-candidate") {
-        if (
-          JSON.stringify([...proposal.paths].sort()) !==
-          JSON.stringify([...candidatePaths].sort())
-        ) {
-          return reject(
-            { kind: "retryable", code: "candidate-diff-invalid" },
-            {
-              category: "artifact",
-              code: "candidate-diff-invalid",
-              stage: "candidate-seal",
-            },
-          );
-        }
-      }
-      const dependencySensitive = candidatePaths.some(
-        (relative) => relative === "package.json" || LOCKFILES.has(relative),
-      );
-      let dependenciesBefore: Map<string, DependencyContractEntry> | undefined;
-      if (dependencySensitive) {
-        try {
-          dependenciesBefore = dependencyContract(proposalRoot);
-        } catch (error) {
-          if (!(error instanceof DependencyManifestError)) throw error;
-          return reject(
-            { kind: "retryable", code: error.message },
-            {
-              category: "artifact",
-              code: error.message,
-              stage: "candidate-dependency",
-            },
-          );
-        }
-      }
-      const checked = await runGitApply(
-        proposalRoot,
-        bytes,
-        true,
-        input.signal,
-      );
-      if (checked !== "ok") {
-        return checked === "cancelled"
-          ? retained({ kind: "operation-cancelled", code: "cancelled" })
-          : reject(
-              { kind: "retryable", code: "candidate-diff-invalid" },
-              {
-                category: "artifact",
-                code: "candidate-diff-invalid",
-                stage: "candidate-check",
-              },
-            );
-      }
-      const applied = await runGitApply(
-        proposalRoot,
-        bytes,
-        false,
-        input.signal,
-      );
-      if (applied !== "ok") {
-        return applied === "cancelled"
-          ? retained({ kind: "operation-cancelled", code: "cancelled" })
-          : reject(
-              { kind: "retryable", code: "candidate-diff-invalid" },
-              {
-                category: "artifact",
-                code: "candidate-diff-invalid",
-                stage: "candidate-apply",
-              },
-            );
-      }
-      if (dependenciesBefore) {
-        let dependenciesAfter: Map<string, DependencyContractEntry>;
-        try {
-          dependenciesAfter = dependencyContract(proposalRoot);
-        } catch (error) {
-          if (!(error instanceof DependencyManifestError)) throw error;
-          return reject(
-            { kind: "retryable", code: error.message },
-            {
-              category: "artifact",
-              code: error.message,
-              stage: "candidate-dependency",
-            },
-          );
-        }
-        if (
-          hasUnapprovedDependencyChange(
-            dependenciesBefore,
-            dependenciesAfter,
-            input.task.approvedDependencies,
-            candidatePaths.some((relative) => LOCKFILES.has(relative)),
-          )
-        ) {
-          return reject(
-            { kind: "approval-needed", code: "unapproved-dependency-change" },
-            {
-              category: "artifact",
-              code: "unapproved-dependency-change",
-              stage: "candidate-dependency",
-            },
-          );
-        }
-      }
-      let artifactHash: string;
-      if (proposal.kind === "sealed-candidate") {
-        artifactHash = proposal.artifactHash;
-      } else {
-        let sequence = 0;
-        for (
-          let offset = 0;
-          offset < bytes.length;
-          offset += TASK_LEDGER_LIMITS.maxSegmentBytes
-        ) {
-          const segment = bytes.subarray(
-            offset,
-            Math.min(offset + TASK_LEDGER_LIMITS.maxSegmentBytes, bytes.length),
-          );
-          const accepted = ledger.appendCandidateSegment({
-            ...identity,
-            sequence,
-            bytes: segment,
-            segmentHash: sha256Bytes(segment),
-          });
-          if (!accepted.ok) {
-            return reject(
-              { kind: "paused", code: accepted.code },
-              {
-                category: "artifact",
-                code: accepted.code,
-                stage: "candidate-segment",
-              },
-            );
-          }
-          sequence += 1;
-        }
-        const sealed = ledger.sealCandidate({
-          ...identity,
-          segmentCount: sequence,
-          totalBytes: bytes.length,
-          candidateHash: sha256Bytes(bytes),
-        });
-        if (!sealed.ok) {
-          return reject(
-            { kind: "retryable", code: sealed.code },
-            {
-              category: "artifact",
-              code: sealed.code,
-              stage: "candidate-seal",
-            },
-          );
-        }
-        artifactHash = sealed.artifactHash;
-      }
-      const candidate = resources.workspaces.createRevision({
-        parentRevisionId: baseRevisionId,
-        changes: revisionChanges(proposalRoot, approvedPaths),
-      });
-      if (
-        candidatePaths.some((relative) => {
-          const entry = candidate.entries[relative];
-          return phase.delete.includes(relative)
-            ? entry?.kind !== "absent"
-            : entry?.kind !== "file";
-        })
-      ) {
-        return reject(
-          { kind: "retryable", code: "write-set-mismatch" },
-          {
-            category: "artifact",
-            code: "write-set-mismatch",
-            stage: "candidate-output",
-          },
-        );
-      }
-      const requiredOutputs = input.plan.outputs.filter(
-        (output) =>
-          output.producer.taskId === input.taskId &&
-          output.producer.phase === input.phase,
-      );
-      if (
-        requiredOutputs.some(
-          (output) => candidate.entries[output.path]?.kind !== "file",
-        )
-      ) {
-        return reject(
-          { kind: "retryable", code: "producer-output-unavailable" },
-          {
-            category: "artifact",
-            code: "producer-output-unavailable",
-            stage: "candidate-output",
-          },
-        );
-      }
-      emitWorkflowActivity(input.onActivity, { state: "verifying" });
-      this.#savePendingCandidate(ledger, pendingKey, {
-        identity,
-        proposal: {
-          kind: "sealed-candidate",
-          candidateId: identity.candidateId,
-          artifactHash,
-          bytes: bytes.length,
-          paths: candidatePaths,
-        },
-      });
-      const verified = await this.#verifyPhase({
-        executionWritePaths: this.#executionWritePaths(resources),
-        runId: input.runId,
-        deliveryRevision: input.deliveryRevision,
-        taskId: input.taskId,
-        phase: input.phase,
-        root: proposalRoot,
-        verification: structuredClone(phase.verification),
-        signal: input.signal,
-      });
-      if (!verified.ok) {
-        if (verified.kind === "paused") return retained(verified);
-        this.#savePendingCandidate(ledger, pendingKey, null);
-        return reject(verified, {
-          category: "verification",
-          code: verified.code,
-          stage: "phase-verification",
-        });
-      }
-      const expected = expectedClassification(input.phase);
-      if (
-        verified.classification !== expected ||
-        (input.phase === "red"
-          ? verified.exitCode === 0
-          : verified.exitCode !== 0)
-      ) {
-        return reject(
-          { kind: "retryable", code: "verification-rejected" },
-          {
-            category: "verification",
-            code: "verification-rejected",
-            stage: "phase-verification",
-          },
-        );
-      }
-      let merged: ReturnType<WorkspaceStore["mergeRevision"]>;
-      try {
-        merged = await this.#mergeCandidate(
-          resources,
-          input,
-          baseRevisionId,
-          candidate.revisionId,
-        );
-        uncommittedRevisionId = merged.revisionId;
-      } catch (error) {
-        if (
-          error instanceof Error &&
-          error.message === "workspace-revision-stale"
-        ) {
-          return reject(
-            { kind: "retryable", code: "workspace-revision-stale" },
-            {
-              category: "stale",
-              code: "workspace-revision-stale",
-              stage: "candidate-merge",
-            },
-          );
-        }
-        throw error;
-      }
-      const outputFacts = approvedPaths.map((relative) => {
-        const entry = merged.entries[relative];
-        return entry?.kind === "file"
-          ? {
-              path: relative,
-              kind: "file" as const,
-              hash: entry.hash,
-              bytes: entry.bytes,
-            }
-          : { path: relative, kind: "absent" as const };
-      });
-      if (
-        requiredOutputs.some(
-          (output) => merged.entries[output.path]?.kind !== "file",
-        )
-      ) {
-        return reject(
-          { kind: "retryable", code: "producer-output-unavailable" },
-          {
-            category: "artifact",
-            code: "producer-output-unavailable",
-            stage: "candidate-output",
-          },
-          true,
-        );
-      }
-      const phaseEvent: VerifiedTaskEvent = {
-        runId: input.runId,
-        taskId: input.taskId,
-        eventId: `${input.phase}-verified-r${input.deliveryRevision}`,
-        kind: "phase-verified",
-        phase: input.phase,
-        commandId: phase.verification.id,
-        exitCode: verified.exitCode,
-        expectedClassification: expected,
-        actualClassification: verified.classification,
-        diagnostic: verified.diagnostic,
-        artifactHash,
-        isolatedRevisionId: merged.revisionId,
-        outputFacts,
-        routeId: identity.routeId,
-        routeFingerprint: identity.routeFingerprint,
-      };
-      if (this.#options.verificationPolicy || resources.environmentIdentity)
-        ledger.putDurableFact(
-          this.#policyFactKey(
-            resources,
-            phaseEvent as unknown as Record<string, unknown>,
-          ),
-          { policy: this.#options.verificationPolicy ?? "legacy" },
-        );
-      const finalPhase = input.task.phases.refactor ? "refactor" : "green";
-      if (!verificationBaseline || input.phase !== finalPhase) {
-        ledger.commitVerifiedEvent(phaseEvent);
-        return retained({
-          kind: "phase-committed",
-          artifactHash,
-          isolatedRevisionId: merged.revisionId,
-          exitCode: verified.exitCode,
-          classification: verified.classification,
-          baselineRevisionId: resources.baselineRevisionId,
-        });
-      }
-
-      const completionEvents: VerifiedTaskEvent[] = [phaseEvent];
-      const discardUncommitted = async <T extends WorkflowAttemptOutcome>(
-        outcome: T,
-      ): Promise<T> => {
-        if (uncommittedRevisionId) {
-          await this.#rollbackWorkspacePaths({
-            resources,
-            baseRevisionId,
-            rejectedRevisionId: uncommittedRevisionId,
-            paths: rollbackPaths,
-          });
-        }
-        return retained(outcome);
-      };
-      let affected = await this.#verifyTaskAffected({
-        resources,
-        baseline: verificationBaseline,
-        task: input.task,
-        revisionId: merged.revisionId,
-        signal: input.signal,
-      });
-      let repairAttempts = 0;
-      let completionAttribution: "none" | "pre-existing" | "introduced" =
-        "none";
-      while (affected.kind === "repairable") {
-        completionAttribution = "introduced";
-        if (
-          !(
-            input.recoveryDecision?.({
-              kind: "affected-repair",
-              attempt: repairAttempts + 1,
-            }) ??
-            decideRecoveryAction(
-              input.plan,
-              { kind: "affected-repair", attempt: repairAttempts + 1 },
-              input,
-            )
-          ).allowed
-        ) {
-          return reject(
-            { kind: "paused", code: "repair-attempts-exhausted" },
-            {
-              category: "verification",
-              code: "repair-attempts-exhausted",
-              stage: "task-affected-verification",
-            },
-            true,
-          );
-        }
-        repairAttempts += 1;
-        const failureIdentities = [...affected.failureIdentities];
-        const repair = await this.#runRepairCandidate({
-          resources,
-          ledger,
-          attempt: input,
-          repairAttempt: repairAttempts,
-          failureIdentities,
-        });
-        if (repair.kind !== "repair-committed") {
-          return discardUncommitted(repair);
-        }
-        selectedRoute = {
-          routeId: repair.commit.routeId,
-          routeFingerprint: repair.commit.routeFingerprint,
-        };
-        uncommittedRevisionId = repair.commit.isolatedRevisionId;
-        completionEvents.push({
-          runId: input.runId,
-          taskId: input.taskId,
-          eventId: `repair-${repairAttempts}-verified-r${input.deliveryRevision}`,
-          kind: "repair-verified",
-          phase: input.phase,
-          attempt: repairAttempts,
-          commandId: input.task.repairVerification.id,
-          exitCode: 0,
-          diagnostic: repair.commit.diagnostic,
-          artifactHash: repair.commit.artifactHash,
-          isolatedRevisionId: repair.commit.isolatedRevisionId,
-          outputFacts: repair.commit.outputFacts,
-          attribution: "introduced",
-          failureIdentities,
-          routeId: repair.commit.routeId,
-          routeFingerprint: repair.commit.routeFingerprint,
-        });
-        affected = await this.#verifyTaskAffected({
-          resources,
-          baseline: verificationBaseline,
-          task: input.task,
-          revisionId: repair.commit.isolatedRevisionId,
-          signal: input.signal,
-        });
-      }
-      if (affected.kind !== "verified") {
-        return affected.kind === "operation-cancelled"
-          ? discardUncommitted(affected)
-          : reject(
-              affected,
-              {
-                category: "verification",
-                code: affected.code,
-                stage: "task-affected-verification",
-              },
-              true,
-            );
-      }
-      if (completionAttribution === "none") {
-        completionAttribution = affected.attribution;
-      }
-      let completedRevision: WorkspaceRevision;
-      try {
-        completedRevision = this.#completeTracking(resources, input.taskId);
-      } catch (error) {
-        if (
-          error instanceof Error &&
-          error.message === "workflow-tracking-task-mismatch"
-        ) {
-          return reject(
-            { kind: "paused", code: "tracking-contract-invalid" },
-            {
-              category: "checkpoint",
-              code: "tracking-contract-invalid",
-              stage: "tracking-checkpoint",
-            },
-            true,
-          );
-        }
-        throw error;
-      }
-      const factKey = `task-final-${hash(input.taskId).slice(0, 40)}`;
-      ledger.commitTaskCompletion({
-        events: completionEvents,
-        factKey,
-        fact: {
-          taskId: input.taskId,
-          phase: input.phase,
-          isolatedRevisionId: completedRevision.revisionId,
-          attribution: completionAttribution,
-          repairAttempts,
-        },
-      });
-      return retained({
-        kind: "phase-committed",
-        artifactHash,
-        isolatedRevisionId: completedRevision.revisionId,
-        exitCode: verified.exitCode,
-        classification: verified.classification,
-        baselineRevisionId: resources.baselineRevisionId,
-      });
-    } finally {
-      rmSync(proposalRoot, { recursive: true, force: true });
-    }
-  }
-
-  rebind(input: Parameters<WorkflowWorker["rebind"]>[0]) {
-    const rebound = this.#broker.rebind({
-      runId: input.runId,
-      taskId: input.taskId,
-      role: input.role,
-      routeId: input.routeId,
-      requirements: implementationRouteRequirements({ task: input.task }),
-    });
-    return rebound.ok
-      ? {
-          ok: true as const,
-          routeId: rebound.route.id,
-          routeFingerprint: rebound.route.fingerprint,
-        }
-      : { ok: false as const, code: rebound.code };
-  }
-
-  async verify(
-    input: Parameters<WorkflowChangeVerifier["verify"]>[0],
-  ): Promise<Awaited<ReturnType<WorkflowChangeVerifier["verify"]>>> {
-    if (!input.currentWorkspaceRevisionId) {
-      return { kind: "paused", code: "workspace-revision-unavailable" };
-    }
-    const resources = await this.#prepareResources(
-      {
-        runId: input.runId,
-        deliveryRevision: input.deliveryRevision,
-        plan: input.plan,
-        currentWorkspaceRevisionId: input.currentWorkspaceRevisionId,
-        baselineRevisionId:
-          input.baselineRevisionId ??
-          this.#runs.get(input.runId)?.baselineRevisionId,
-      },
-      input.signal,
-    );
-    try {
-      await this.#refreshEnvironment(resources, input.signal);
-    } catch {
-      return { kind: "paused", code: "verification-environment-unavailable" };
-    }
-    for (const reference of input.taskEvidence ?? []) {
-      const task = input.plan.tasks.find(
-        (task) => task.taskId === reference.taskId,
-      );
-      if (!task) throw new Error("workflow-ledger-task-invalid");
-      const failure = await this.#revalidatePhasePolicy(
-        resources,
-        this.#ledger(resources, reference.deliveryRevision),
-        task,
-        input.signal,
-      );
-      if (failure)
-        return {
-          kind: "paused",
-          code:
-            "code" in failure ? failure.code : "verification-policy-rejected",
-        };
-    }
-    const cumulativeRevision = resources.workspaces.getRevision(
-      resources.currentRevisionId,
-    );
-    if (
-      input.plan.outputs.some(
-        (output) => cumulativeRevision.entries[output.path]?.kind !== "file",
-      )
-    ) {
-      return { kind: "paused", code: "producer-output-unavailable" };
-    }
-    if (hasVerificationLifecycle(input.plan)) {
-      const ledger = this.#ledger(resources, input.deliveryRevision);
-      const captured = await this.#ensureVerificationBaseline({
-        resources,
-        ledger,
-        signal: input.signal,
-      });
-      if (!captured.ok) {
-        return captured.outcome.kind === "approval-needed"
-          ? captured.outcome
-          : captured.outcome.kind === "operation-cancelled"
-            ? { kind: "paused", code: "cancelled" }
-            : {
-                ...captured.outcome,
-                verification: {
-                  scope: "baseline",
-                  attribution: "environment",
-                },
-              };
-      }
-      for (const task of input.plan.tasks) {
-        const baseline = captured.baseline.affected.find(
-          (entry) => entry.taskId === task.taskId,
-        );
-        if (!baseline) throw new Error("workflow-task-baseline-unavailable");
-        const current = await this.#observeVerification({
-          resources,
-          revisionId: resources.currentRevisionId,
-          scope: "change-task-affected",
-          verification: task.affectedVerification,
-          taskId: task.taskId,
-          signal: input.signal,
-        });
-        if (!current.ok) {
-          return current.outcome.kind === "approval-needed"
-            ? current.outcome
-            : current.outcome.kind === "operation-cancelled"
-              ? { kind: "paused", code: "cancelled" }
-              : {
-                  ...current.outcome,
-                  verification: {
-                    scope: "change-task-affected",
-                    attribution: "environment",
-                    taskId: task.taskId,
-                  },
-                };
-        }
-        if (current.observation.status === "failed") {
-          const prior = new Set(baseline.observation.failureIdentities);
-          const introduced = current.observation.failureIdentities.filter(
-            (identity) => !prior.has(identity),
-          );
-          if (introduced.length > 0) {
-            return {
-              kind: "paused",
-              code: "verification-repair-required",
-              verification: {
-                scope: "change-task-affected",
-                attribution: "introduced",
-                taskId: task.taskId,
-                failureIdentities: introduced.slice(0, 256),
-              },
-            };
-          }
-        }
-      }
-      const fullSuite = await this.#observeVerification({
-        resources,
-        revisionId: resources.currentRevisionId,
-        scope: "change-full-suite",
-        verification: input.plan.verification.change.fullSuite,
-        signal: input.signal,
-      });
-      if (!fullSuite.ok) {
-        return fullSuite.outcome.kind === "approval-needed"
-          ? fullSuite.outcome
-          : fullSuite.outcome.kind === "operation-cancelled"
-            ? { kind: "paused", code: "cancelled" }
-            : {
-                ...fullSuite.outcome,
-                verification: {
-                  scope: "change-full-suite",
-                  attribution: "environment",
-                },
-              };
-      }
-      if (fullSuite.observation.status === "failed") {
-        const baselineFailures = new Set(
-          captured.baseline.fullSuite.failureIdentities,
-        );
-        const introduced = fullSuite.observation.failureIdentities.filter(
-          (identity) => !baselineFailures.has(identity),
-        );
-        if (introduced.length > 0) {
-          return {
-            kind: "paused",
-            code: "verification-attribution-unresolved",
-            verification: {
-              scope: "change-full-suite",
-              attribution: "unresolved",
-              failureIdentities: introduced.slice(0, 256),
-            },
-          };
-        }
-      }
-      const checkpoint = input.plan.verification.agentsCheckpoint;
-      if (checkpoint.required && checkpoint.verification) {
-        const applied = this.#applyAgentsCheckpoint(resources);
-        if (!applied.ok) {
-          return { kind: "paused", code: applied.code };
-        }
-        const observed = await this.#observeVerification({
-          resources,
-          revisionId: applied.revision.revisionId,
-          scope: "agents-checkpoint",
-          verification: checkpoint.verification,
-          signal: input.signal,
-        });
-        if (!observed.ok) {
-          return observed.outcome.kind === "approval-needed"
-            ? observed.outcome
-            : observed.outcome.kind === "operation-cancelled"
-              ? { kind: "paused", code: "cancelled" }
-              : {
-                  ...observed.outcome,
-                  verification: {
-                    scope: "agents-checkpoint",
-                    attribution: "environment",
-                  },
-                };
-        }
-        if (observed.observation.status === "failed") {
-          return {
-            kind: "paused",
-            code: "agents-checkpoint-verification-failed",
-            verification: {
-              scope: "agents-checkpoint",
-              attribution: "introduced",
-              failureIdentities: observed.observation.failureIdentities.slice(
-                0,
-                256,
-              ),
-            },
-          };
-        }
-        resources.currentRevisionId = applied.revision.revisionId;
-      }
-      const verificationId = `change-${hash(
-        input.plan.changeId,
-        String(input.deliveryRevision),
-        resources.currentRevisionId,
-        ...(resources.environmentIdentity
-          ? [resources.environmentIdentity]
-          : []),
-      ).slice(0, 40)}`;
-      const sealed = await verifyCumulativeRevision({
-        workspaceStore: resources.workspaces,
-        revisionId: resources.currentRevisionId,
-        verificationId,
-        signal: input.signal,
-        execute: async () => ({
-          ok: true as const,
-          exitCode: 0 as const,
-          classification: "lifecycle-verified",
-        }),
-      });
-      if (!sealed.ok) return { kind: "paused", code: sealed.code };
-      resources.verificationFact = sealed.fact;
-      return {
-        kind: "verified",
-        verificationId: sealed.verificationId,
-        currentWorkspaceRevisionId: resources.currentRevisionId,
-      };
-    }
-    const verificationId = `change-${hash(
-      input.plan.changeId,
-      String(input.deliveryRevision),
-      ...(resources.environmentIdentity ? [resources.environmentIdentity] : []),
-    ).slice(0, 40)}`;
-    const result = await verifyCumulativeRevision({
-      workspaceStore: resources.workspaces,
-      revisionId: resources.currentRevisionId,
-      verificationId,
-      signal: input.signal,
-      execute: ({ root, signal }) =>
-        this.#verifyChange({
-          runId: input.runId,
-          deliveryRevision: input.deliveryRevision,
-          root,
-          plan: structuredClone(input.plan),
-          signal: signal ?? input.signal,
-        }),
-    });
-    if (!result.ok) {
-      return {
-        kind:
-          result.kind === "approval-boundary"
-            ? "approval-needed"
-            : result.kind === "verification"
-              ? "retryable"
-              : "paused",
-        code: result.code,
-      };
-    }
-    resources.verificationFact = result.fact;
-    return { kind: "verified", verificationId: result.verificationId };
-  }
-
-  async prepare(
-    input: Parameters<WorkflowApplication["begin"]>[0],
-  ): Promise<Record<string, unknown>> {
-    if (!input.baselineRevisionId || !input.currentWorkspaceRevisionId) {
-      return { state: "paused", code: "workspace-revision-unavailable" };
-    }
-    const resources = await this.#prepareResources(
-      {
-        runId: input.runId,
-        deliveryRevision: input.deliveryRevision,
-        plan: input.plan,
-        baselineRevisionId: input.baselineRevisionId,
-        currentWorkspaceRevisionId: input.currentWorkspaceRevisionId,
-      },
-      input.signal,
-    );
-    if (!resources.verificationFact) {
-      return { state: "paused", code: "verification-fact-unavailable" };
-    }
-    if (this.#options.verificationEnvironment) {
-      if (!resources.environmentIdentity)
-        return {
-          state: "paused",
-          code: "verification-environment-unavailable",
-        };
-      this.#ledger(resources, resources.deliveryRevision).putDurableFact(
-        `apply-environment-${hash(input.transactionId).slice(0, 40)}`,
-        { identity: resources.environmentIdentity },
+    if (this.#options.verificationEnvironment) {
+      if (!resources.environmentIdentity)
+        return {
+          state: "paused",
+          code: "verification-environment-unavailable",
+        };
+      this.#ledger(resources, resources.deliveryRevision).putDurableFact(
+        `apply-environment-${hash(input.transactionId).slice(0, 40)}`,
+        { identity: resources.environmentIdentity },
       );
     }
     const prepared = await resources.transactions.prepare({
@@ -4360,6 +929,15 @@ class DurableWorkflowComposition
     this.#runs.clear();
     this.#routeHealth.close();
   }
+  runAttempt(input: Parameters<WorkflowWorker["runAttempt"]>[0]) {
+    return this.#phase.runAttempt(input);
+  }
+  hasPendingVerification(input: Parameters<WorkflowWorker["runAttempt"]>[0]) {
+    return this.#phase.hasPendingVerification(input);
+  }
+  verify(input: Parameters<WorkflowChangeVerifier["verify"]>[0]) {
+    return this.#verification.verify(input);
+  }
 }
 
 export function openDurableWorkflowEngine(