@bastani/atomic 0.9.10 → 0.9.11-alpha.2

package/dist/builtin/workflows/src/durable/completed-catalog.ts

@@ -1,5 +1,5 @@
 import type { RunSnapshot, StageSnapshot } from "../shared/store-types.js";
-import type { WorkflowInputValues } from "../shared/types.js";
+import type { WorkflowChildResult, WorkflowInputValues, WorkflowOutputValues, WorkflowSerializableValue } from "../shared/types.js";
 import { isReopenableSessionTranscript } from "../shared/session-transcript.js";
 import type { DurableWorkflowBackend } from "./backend.js";
 import {
@@ -9,6 +9,7 @@ import {
   type ResumableWorkflowEntry,
 } from "./types.js";
 import { resolveDurableEntry } from "./resume-runtime.js";
+import { priorRunElapsedMs } from "./run-timing.js";
 
 export type CompletedWorkflowResolution =
   | { readonly kind: "found"; readonly entry: ResumableWorkflowEntry; readonly snapshot: RunSnapshot }
@@ -76,24 +77,52 @@ export function completedWorkflowSnapshot(
   backend: DurableWorkflowBackend,
   entry: ResumableWorkflowEntry,
 ): RunSnapshot | undefined {
+  const runs = completedWorkflowRunSnapshots(backend, entry);
+  const root = runs.find((run) => run.id === entry.workflowId);
+  if (root === undefined || !runs.some((run) => run.stages.some((stage) => stage.sessionFile !== undefined))) return undefined;
+  return root;
+}
+
+/** Rebuild the root plus every nested child run required by graph expansion. */
+export function completedWorkflowRunSnapshots(
+  backend: DurableWorkflowBackend,
+  entry: ResumableWorkflowEntry,
+): readonly RunSnapshot[] {
   const handle = backend.getWorkflow(entry.workflowId);
-  if (handle === undefined || handle.status !== "completed") return undefined;
+  if (handle === undefined || handle.status !== "completed") return [];
   const checkpoints = backend.listCheckpoints(entry.workflowId);
-  if (checkpoints.length === 0) return undefined;
-  const stages = stageSnapshotsFromCheckpoints(checkpoints, handle.updatedAt).map(validatedStageTranscript);
-  if (!stages.some((stage) => stage.sessionFile !== undefined)) return undefined;
-
-  return {
-    id: handle.workflowId,
-    name: handle.name,
+  if (checkpoints.length === 0) return [];
+  const runs = runSnapshotsFromCheckpoints(checkpoints, handle.workflowId, handle.name, handle.updatedAt)
+    .map((run) => ({ ...run, stages: run.stages.map(validatedStageTranscript) }));
+  const rootIndex = runs.findIndex((run) => run.id === handle.workflowId);
+  if (rootIndex < 0) return [];
+  const rootDuration = priorRunElapsedMs(backend, handle.workflowId)
+    ?? Math.max(0, handle.updatedAt - handle.createdAt);
+  const root: RunSnapshot = {
+    ...runs[rootIndex]!,
     inputs: { ...handle.inputs } as WorkflowInputValues,
-    status: "completed",
-    stages,
     startedAt: handle.createdAt,
     endedAt: handle.updatedAt,
-    durationMs: Math.max(0, handle.updatedAt - handle.createdAt),
+    durationMs: rootDuration,
     resumable: false,
   };
+  return [root, ...runs.filter((_, index) => index !== rootIndex)];
+}
+
+/** Rebuild completed nested runs while a paused root is replaying cached boundaries. */
+export function durableNestedRunSnapshots(
+  backend: DurableWorkflowBackend,
+  rootWorkflowId: string,
+): readonly RunSnapshot[] {
+  const handle = backend.getWorkflow(rootWorkflowId);
+  if (handle === undefined) return [];
+  return runSnapshotsFromCheckpoints(
+    backend.listCheckpoints(rootWorkflowId),
+    rootWorkflowId,
+    handle.name,
+    handle.updatedAt,
+    false,
+  ).filter((run) => run.id !== rootWorkflowId);
 }
 
 function validatedStageTranscript(stage: StageSnapshot): StageSnapshot {
@@ -104,19 +133,109 @@ function validatedStageTranscript(stage: StageSnapshot): StageSnapshot {
 }
 
 
-function stageSnapshotsFromCheckpoints(
+function runSnapshotsFromCheckpoints(
   checkpoints: readonly DurableCheckpoint[],
+  rootRunId: string,
+  rootRunName: string,
   fallbackCompletedAt: number,
-): StageSnapshot[] {
+  strict = true,
+): RunSnapshot[] {
   const drafts = new Map<string, StageDraft>();
   for (const checkpoint of checkpoints) {
     if (checkpoint.kind !== "stage") continue;
     const existing = drafts.get(checkpoint.replayKey);
     drafts.set(checkpoint.replayKey, mergeStageDraft(existing, checkpoint));
   }
-  const ordered = [...drafts.values()].sort((a, b) => a.firstCompletedAt - b.firstCompletedAt);
-  if (ordered.length === 0) return [syntheticCheckpointStage(checkpoints.length, fallbackCompletedAt)];
-  return stageSnapshotsFromDrafts(ordered);
+  const ordered = [...drafts.values()]
+    .filter((draft) => !strict || draft.topology?.run === undefined || draft.endedAt !== undefined || draft.output !== undefined)
+    .sort((a, b) => a.firstCompletedAt - b.firstCompletedAt);
+  if (ordered.length === 0) return [syntheticRun(rootRunId, rootRunName, checkpoints.length, fallbackCompletedAt)];
+
+  const grouped = new Map<string, StageDraft[]>();
+  for (const draft of ordered) {
+    if (draft.topology?.version !== DURABLE_STAGE_TOPOLOGY_VERSION) {
+      if (strict) return [];
+      continue;
+    }
+    const runId = draft.topology.run?.runId ?? rootRunId;
+    const group = grouped.get(runId) ?? [];
+    group.push(draft);
+    grouped.set(runId, group);
+  }
+  retainReachableRunGroups(grouped, rootRunId);
+  const idMaps = new Map<string, Map<string, string>>();
+  for (const [runId, runDrafts] of grouped) {
+    const ids = new Map<string, string>();
+    runDrafts.forEach((draft, index) => {
+      const sourceId = draft.topology!.stageId;
+      if (!ids.has(sourceId)) ids.set(sourceId, `completed-stage-${index + 1}`);
+    });
+    if (ids.size !== runDrafts.length) {
+      if (strict) return [];
+      grouped.delete(runId);
+      continue;
+    }
+    idMaps.set(runId, ids);
+  }
+
+  const runs: RunSnapshot[] = [];
+  for (const [runId, runDrafts] of grouped) {
+    const ids = idMaps.get(runId)!;
+    if (runDrafts.some((draft) => draft.topology!.parentIds.some((parentId) => !ids.has(parentId)))) {
+      if (strict) return [];
+      continue;
+    }
+    const stages = runDrafts.map((draft) => stageSnapshotFromDraft(
+      draft,
+      ids.get(draft.topology!.stageId)!,
+      draft.topology!.parentIds.map((parentId) => ids.get(parentId)!),
+    ));
+    const run = runDrafts.find((draft) => draft.topology?.run !== undefined)?.topology?.run;
+    const startedAt = Math.min(...stages.map((stage) => stage.startedAt ?? fallbackCompletedAt));
+    const endedAt = Math.max(...stages.map((stage) => stage.endedAt ?? fallbackCompletedAt));
+    const parentRunId = run?.parentRunId ?? rootRunId;
+    const boundarySourceId = grouped.get(parentRunId)?.find((draft) =>
+      workflowChildFromOutput(draft.output)?.runId === runId
+    )?.topology?.stageId;
+    const declaredParentStageId = run?.parentStageId === undefined
+      ? undefined
+      : idMaps.get(parentRunId)?.get(run.parentStageId);
+    const parentStageId = declaredParentStageId
+      ?? (boundarySourceId === undefined ? undefined : idMaps.get(parentRunId)?.get(boundarySourceId));
+    runs.push({
+      id: runId,
+      name: run?.runName ?? rootRunName,
+      inputs: {},
+      status: "completed",
+      stages,
+      startedAt,
+      endedAt,
+      durationMs: Math.max(0, endedAt - startedAt),
+      ...(run?.parentRunId !== undefined ? { parentRunId: run.parentRunId } : {}),
+      ...(parentStageId !== undefined ? { parentStageId } : {}),
+      ...(run?.rootRunId !== undefined ? { rootRunId: run.rootRunId } : {}),
+      resumable: false,
+    });
+  }
+  return runs;
+}
+
+function retainReachableRunGroups(grouped: Map<string, StageDraft[]>, rootRunId: string): void {
+  const reachable = new Set([rootRunId]);
+  const pending = [rootRunId];
+  while (pending.length > 0) {
+    const drafts = grouped.get(pending.pop()!);
+    if (drafts === undefined) continue;
+    for (const draft of drafts) {
+      const childRunId = workflowChildFromOutput(draft.output)?.runId;
+      if (childRunId === undefined || reachable.has(childRunId) || !grouped.has(childRunId)) continue;
+      reachable.add(childRunId);
+      pending.push(childRunId);
+    }
+  }
+  for (const runId of grouped.keys()) {
+    if (!reachable.has(runId)) grouped.delete(runId);
+  }
 }
 
 function mergeStageDraft(
@@ -138,10 +257,21 @@ function mergeStageDraft(
     ...valueOrExisting("fastMode", checkpoint, existing),
     ...valueOrExisting("attemptedModels", checkpoint, existing),
     ...valueOrExisting("modelAttempts", checkpoint, existing),
-    ...valueOrExisting("topology", checkpoint, existing),
+    ...preferredTopology(checkpoint, existing),
   };
 }
 
+function preferredTopology(
+  checkpoint: DurableStageCheckpoint,
+  existing: StageDraft | undefined,
+): Pick<StageDraft, "topology"> | object {
+  const current = checkpoint.topology;
+  const prior = existing?.topology;
+  if (current?.run !== undefined) return { topology: current };
+  if (prior?.run !== undefined) return { topology: prior };
+  return current !== undefined ? { topology: current } : prior !== undefined ? { topology: prior } : {};
+}
+
 function valueOrExisting<
   K extends keyof Omit<StageDraft, "replayKey" | "name" | "firstCompletedAt">
 >(key: K, checkpoint: DurableStageCheckpoint, existing: StageDraft | undefined): Pick<StageDraft, K> | object {
@@ -151,21 +281,25 @@ function valueOrExisting<
   return existingValue === undefined ? {} : { [key]: existingValue } as Pick<StageDraft, K>;
 }
 
-function stageSnapshotsFromDrafts(drafts: readonly StageDraft[]): StageSnapshot[] {
-  const reconstructedIds = drafts.map((_, index) => `completed-stage-${index + 1}`);
-  const sourceToReconstructed = new Map<string, string>();
-  for (let index = 0; index < drafts.length; index += 1) {
-    const topology = drafts[index]!.topology;
-    if (topology?.version !== DURABLE_STAGE_TOPOLOGY_VERSION
-      || sourceToReconstructed.has(topology.stageId)) return [];
-    sourceToReconstructed.set(topology.stageId, reconstructedIds[index]!);
-  }
-  if (drafts.some((draft) => draft.topology!.parentIds.some((parentId) => !sourceToReconstructed.has(parentId)))) return [];
-  return drafts.map((draft, index) => stageSnapshotFromDraft(
-    draft,
-    reconstructedIds[index]!,
-    draft.topology!.parentIds.map((parentId) => sourceToReconstructed.get(parentId)!),
-  ));
+function workflowChildFromOutput(output: WorkflowSerializableValue | undefined): StageSnapshot["workflowChild"] | undefined {
+  if (!isWorkflowChildResult(output)) return undefined;
+  return {
+    alias: output.workflow,
+    workflow: output.workflow,
+    runId: output.runId,
+    status: output.status,
+    ...(output.exited !== undefined ? { exited: output.exited } : {}),
+    outputs: output.outputs,
+    ...(typeof output.exitReason === "string" ? { exitReason: output.exitReason } : {}),
+  };
+}
+
+function isWorkflowChildResult(value: WorkflowSerializableValue | undefined): value is WorkflowChildResult<WorkflowOutputValues> {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const item = value as Record<string, WorkflowSerializableValue | undefined>;
+  return typeof item["workflow"] === "string" && typeof item["runId"] === "string"
+    && typeof item["status"] === "string" && typeof item["outputs"] === "object"
+    && item["outputs"] !== null && !Array.isArray(item["outputs"]);
 }
 
 function stageSnapshotFromDraft(
@@ -187,6 +321,7 @@ function stageSnapshotFromDraft(
     replayKey: draft.replayKey,
     toolEvents: [],
     attachable: false,
+    ...(workflowChildFromOutput(draft.output) !== undefined ? { workflowChild: workflowChildFromOutput(draft.output) } : {}),
     ...(draft.sessionId !== undefined ? { sessionId: draft.sessionId } : {}),
     ...(draft.sessionFile !== undefined ? { sessionFile: draft.sessionFile } : {}),
     ...(draft.model !== undefined ? { model: draft.model } : {}),
@@ -202,6 +337,20 @@ function stageResult(draft: StageDraft): string | undefined {
   return typeof draft.output === "string" ? draft.output : JSON.stringify(draft.output);
 }
 
+function syntheticRun(runId: string, runName: string, checkpointCount: number, completedAt: number): RunSnapshot {
+  return {
+    id: runId,
+    name: runName,
+    inputs: {},
+    status: "completed",
+    stages: [syntheticCheckpointStage(checkpointCount, completedAt)],
+    startedAt: completedAt,
+    endedAt: completedAt,
+    durationMs: 0,
+    resumable: false,
+  };
+}
+
 function syntheticCheckpointStage(checkpointCount: number, completedAt: number): StageSnapshot {
   return {
     id: "completed-checkpoints",

package/dist/builtin/workflows/src/durable/completed-inspection.ts

@@ -10,6 +10,7 @@ import {
 import type { DurableWorkflowBackend } from "./backend.js";
 import {
   listOpenableCompletedWorkflows,
+  completedWorkflowRunSnapshots,
   resolveCompletedWorkflow,
 } from "./completed-catalog.js";
 import type { ResumableWorkflowEntry } from "./types.js";
@@ -69,10 +70,14 @@ export function openCompletedDurableWorkflow(
       `Workflow ${resolved.snapshot.id.slice(0, 8)} is already active in this session; attach with /workflow connect ${resolved.snapshot.id.slice(0, 8)} instead.`,
     );
   }
-  const snapshot = resolved.snapshot;
-  if (existing !== undefined) deps.store.removeRun(existing.id);
-  deps.store.recordRunStart(snapshot);
-  registerCompletedChatHandles(snapshot, deps);
+  const snapshots = completedWorkflowRunSnapshots(deps.durableBackend, resolved.entry);
+  const snapshot = snapshots.find((run) => run.id === resolved.snapshot.id) ?? resolved.snapshot;
+  for (const restored of snapshots) {
+    const previous = deps.store.runs().find((run) => run.id === restored.id);
+    if (previous !== undefined) deps.store.removeRun(previous.id);
+    deps.store.recordRunStart(restored);
+    registerCompletedChatHandles(restored, deps);
+  }
   return {
     ok: true,
     runId: snapshot.id,

package/dist/builtin/workflows/src/durable/dbos-embedded-postgres-root.ts

@@ -0,0 +1,173 @@
+/**
+ * Root-execution support for the embedded DBOS Postgres.
+ *
+ * PostgreSQL categorically refuses to run `initdb`/`postgres` as UID 0, so a
+ * root Atomic process (common in containers, CI sandboxes, and eval harnesses)
+ * cannot provision the embedded cluster directly. On Linux we instead resolve
+ * an unprivileged system account, keep the cluster under a root-safe base
+ * directory (`/root` is mode 0700 and untraversable by that account), and run
+ * every Postgres command with dropped privileges.
+ *
+ * Privilege dropping is strategy-probed at runtime: Node honors the child
+ * process `uid`/`gid` spawn options, but Bun currently ignores them, so we
+ * verify the drop actually happens (`id -u` must report the owner) and fall
+ * back to `setpriv`, `runuser`, or `su` wrappers when it does not.
+ *
+ * The embedded binaries themselves may also live under an untraversable
+ * prefix (for example a root-owned `~/.nvm` global install), so the caller can
+ * probe them as the unprivileged owner and fall back to a one-time copy into
+ * the cluster base directory.
+ */
+
+import { cpSync, existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { runLocalCommand, type LocalCommandResult } from "./local-command.js";
+
+export interface EmbeddedPostgresOwner {
+  readonly uid: number;
+  readonly gid: number;
+  readonly name: string;
+}
+
+export interface EmbeddedPostgresRunContext {
+  /** Directory that holds the cluster, log file, and setup locks. */
+  readonly baseDir: string;
+  /** Present only when commands must drop privileges (Linux root). */
+  readonly owner?: EmbeddedPostgresOwner;
+  /** Runs a command as the owner; identity pass-through when no owner. */
+  readonly runAsOwner: LocalCommandRunner;
+}
+
+export interface EmbeddedPostgresBinaryPaths {
+  readonly pg_ctl: string;
+  readonly initdb: string;
+}
+
+export type LocalCommandRunner = (
+  command: string,
+  args: readonly string[],
+  options?: { readonly uid?: number; readonly gid?: number },
+) => Promise<LocalCommandResult>;
+
+/** Root-safe cluster location: system path, traversable by system accounts. */
+export const ROOT_EMBEDDED_BASE_DIR = "/var/lib/atomic-postgres";
+
+/** Unprivileged accounts tried in order; `postgres` wins when present. */
+const OWNER_CANDIDATES = ["postgres", "nobody", "daemon"] as const;
+
+export function defaultEmbeddedBaseDir(): string {
+  return join(homedir(), ".atomic", "postgres");
+}
+
+/**
+ * Resolve where and as whom the embedded cluster should run. Non-root (and
+ * every non-Linux platform) keeps the historical home-directory layout. Linux
+ * root without a resolvable unprivileged account, or without any working
+ * privilege-drop mechanism, also falls through to the default context so
+ * PostgreSQL's own root refusal surfaces with full detail.
+ */
+export async function resolveEmbeddedRunContext(
+  runner: LocalCommandRunner = runLocalCommand,
+  euid: number | undefined = process.getuid?.(),
+  platform: NodeJS.Platform = process.platform,
+): Promise<EmbeddedPostgresRunContext> {
+  if (platform !== "linux" || euid !== 0) {
+    return { baseDir: defaultEmbeddedBaseDir(), runAsOwner: runner };
+  }
+  for (const name of OWNER_CANDIDATES) {
+    const owner = await lookupOwner(runner, name);
+    if (owner === undefined) continue;
+    const runAsOwner = await resolvePrivilegeDrop(runner, owner);
+    if (runAsOwner === undefined) continue;
+    return { baseDir: ROOT_EMBEDDED_BASE_DIR, owner, runAsOwner };
+  }
+  return { baseDir: defaultEmbeddedBaseDir(), runAsOwner: runner };
+}
+
+/**
+ * Return a runner that verifiably executes commands as the owner, or
+ * `undefined` when no drop mechanism works. Each strategy is validated by
+ * running `id -u` through it and requiring the owner's uid on stdout — the
+ * spawn `uid`/`gid` options in particular are silently ignored by Bun.
+ */
+export async function resolvePrivilegeDrop(
+  runner: LocalCommandRunner,
+  owner: EmbeddedPostgresOwner,
+): Promise<LocalCommandRunner | undefined> {
+  const strategies: readonly LocalCommandRunner[] = [
+    (command, args) => runner(command, args, { uid: owner.uid, gid: owner.gid }),
+    (command, args) => runner("setpriv", [
+      `--reuid=${owner.uid}`, `--regid=${owner.gid}`, "--clear-groups", "--", command, ...args,
+    ]),
+    (command, args) => runner("runuser", ["-u", owner.name, "--", command, ...args]),
+    (command, args) => runner("su", ["-s", "/bin/sh", "-c", shellCommand(command, args), owner.name]),
+  ];
+  for (const strategy of strategies) {
+    const probe = await strategy("id", ["-u"]).catch(() => undefined);
+    if (probe !== undefined && probe.exitCode === 0 && probe.stdout.trim() === String(owner.uid)) {
+      return strategy;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Ensure the embedded binaries are executable by the drop-privilege owner.
+ * Probes `initdb --version` as the owner; on failure (typically an
+ * untraversable ancestor such as `/root`) copies the package's `native` tree
+ * into the cluster base directory once and reuses it afterwards.
+ */
+export async function prepareBinariesForOwner(
+  binaries: EmbeddedPostgresBinaryPaths,
+  context: EmbeddedPostgresRunContext,
+  runner: LocalCommandRunner = runLocalCommand,
+): Promise<EmbeddedPostgresBinaryPaths> {
+  const owner = context.owner;
+  if (owner === undefined) return binaries;
+
+  const probe = await context.runAsOwner(binaries.initdb, ["--version"]).catch(() => undefined);
+  if (probe !== undefined && probe.exitCode === 0) return binaries;
+
+  // `<packageRoot>/native/bin/initdb` → copy the whole `native` tree so the
+  // binaries keep their relative `../lib` runtime library references.
+  const nativeDir = dirname(dirname(binaries.initdb));
+  const copiedNativeDir = join(context.baseDir, "pg-runtime", "native");
+  const copied: EmbeddedPostgresBinaryPaths = {
+    pg_ctl: join(copiedNativeDir, "bin", "pg_ctl"),
+    initdb: join(copiedNativeDir, "bin", "initdb"),
+  };
+  if (!existsSync(copied.initdb)) {
+    cpSync(nativeDir, copiedNativeDir, { recursive: true });
+  }
+  const chown = await runner("chown", ["-R", `${owner.uid}:${owner.gid}`, join(context.baseDir, "pg-runtime")]);
+  if (chown.exitCode !== 0) {
+    throw new Error(
+      `Could not hand the copied embedded Postgres runtime to ${owner.name}: ${chown.stderr.trim() || chown.stdout.trim() || `exit ${chown.exitCode}`}`,
+    );
+  }
+  return copied;
+}
+
+async function lookupOwner(runner: LocalCommandRunner, name: string): Promise<EmbeddedPostgresOwner | undefined> {
+  const uid = await lookupId(runner, ["-u", name]);
+  const gid = await lookupId(runner, ["-g", name]);
+  if (uid === undefined || gid === undefined || uid === 0) return undefined;
+  return { uid, gid, name };
+}
+
+async function lookupId(runner: LocalCommandRunner, args: readonly string[]): Promise<number | undefined> {
+  try {
+    const result = await runner("id", args);
+    if (result.exitCode !== 0) return undefined;
+    const value = Number.parseInt(result.stdout.trim(), 10);
+    return Number.isInteger(value) && value > 0 ? value : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Single-quote a command line for `su -c`; arguments never embed user input. */
+function shellCommand(command: string, args: readonly string[]): string {
+  return [command, ...args].map((part) => `'${part.replaceAll("'", "'\\''")}'`).join(" ");
+}

package/dist/builtin/workflows/src/durable/dbos-embedded-postgres.ts

@@ -10,12 +10,23 @@
  * is started with `pg_ctl`, which daemonizes the server into its own session:
  * it survives Atomic exiting and is shared by every concurrent Atomic session.
  * Atomic never stops it.
+ *
+ * PostgreSQL refuses to run as UID 0, so a root Atomic process (containers,
+ * CI sandboxes, eval harnesses) resolves an unprivileged system account, keeps
+ * the cluster under `/var/lib/atomic-postgres` instead (a root home directory
+ * is untraversable for that account), and runs every Postgres command with
+ * dropped privileges. See dbos-embedded-postgres-root.ts.
  */
 
-import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
-import { homedir, tmpdir } from "node:os";
+import { chmodSync, chownSync, copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { dirname, join, relative } from "node:path";
-import { commandFailureDetail, delay, runLocalCommand, tcpReachable } from "./local-command.js";
+import {
+  prepareBinariesForOwner,
+  resolveEmbeddedRunContext,
+  type EmbeddedPostgresRunContext,
+} from "./dbos-embedded-postgres-root.js";
+import { commandFailureDetail, delay, tcpReachable } from "./local-command.js";
 
 const EMBEDDED_HOST = "127.0.0.1";
 const EMBEDDED_PORT = 5439;
@@ -47,17 +58,20 @@ export function ensureEmbeddedDbosPostgres(): Promise<void> {
 
 async function ensure(): Promise<void> {
   if (await tcpReachable(EMBEDDED_HOST, EMBEDDED_PORT)) return;
-  const binaries = await loadEmbeddedPostgresBinaries();
-  hydrateBinaryLibraryLinks(binaries.pg_ctl);
-  const root = join(homedir(), ".atomic", "postgres");
+  const loaded = await loadEmbeddedPostgresBinaries();
+  hydrateBinaryLibraryLinks(loaded.pg_ctl);
+  const context = await resolveEmbeddedRunContext();
+  const root = context.baseDir;
   const dataDir = join(root, `v${EMBEDDED_PG_MAJOR}`);
   const logFile = join(root, `v${EMBEDDED_PG_MAJOR}.log`);
   mkdirSync(root, { recursive: true, mode: 0o700 });
+  if (context.owner !== undefined) chownSync(root, context.owner.uid, context.owner.gid);
+  const binaries = await prepareBinariesForOwner(loaded, context);
 
   await withSetupLock(join(root, `v${EMBEDDED_PG_MAJOR}.setup-lock`), async () => {
     if (await tcpReachable(EMBEDDED_HOST, EMBEDDED_PORT)) return;
-    if (!existsSync(join(dataDir, "PG_VERSION"))) await initializeCluster(binaries.initdb, dataDir);
-    await startCluster(binaries.pg_ctl, dataDir, logFile);
+    if (!existsSync(join(dataDir, "PG_VERSION"))) await initializeCluster(binaries.initdb, dataDir, context);
+    await startCluster(binaries.pg_ctl, dataDir, logFile, context);
   });
 
   for (let attempt = 0; attempt < READY_ATTEMPTS; attempt += 1) {
@@ -67,11 +81,16 @@ async function ensure(): Promise<void> {
   throw new Error(`Embedded Postgres started but never accepted connections on ${EMBEDDED_HOST}:${EMBEDDED_PORT}; see ${logFile}.`);
 }
 
-async function initializeCluster(initdb: string, dataDir: string): Promise<void> {
+async function initializeCluster(
+  initdb: string,
+  dataDir: string,
+  context: EmbeddedPostgresRunContext,
+): Promise<void> {
   const passwordFile = join(tmpdir(), `atomic-pg-pw-${process.pid}-${crypto.randomUUID().slice(0, 8)}`);
   writeFileSync(passwordFile, `${EMBEDDED_PASSWORD}\n`, { mode: 0o600 });
   try {
-    const result = await runLocalCommand(initdb, [
+    if (context.owner !== undefined) chownSync(passwordFile, context.owner.uid, context.owner.gid);
+    const result = await context.runAsOwner(initdb, [
       "-D", dataDir,
       "-U", EMBEDDED_USER,
       "-A", "password",
@@ -87,8 +106,13 @@ async function initializeCluster(initdb: string, dataDir: string): Promise<void>
   }
 }
 
-async function startCluster(pgCtl: string, dataDir: string, logFile: string): Promise<void> {
-  const result = await runLocalCommand(pgCtl, [
+async function startCluster(
+  pgCtl: string,
+  dataDir: string,
+  logFile: string,
+  context: EmbeddedPostgresRunContext,
+): Promise<void> {
+  const result = await context.runAsOwner(pgCtl, [
     "-D", dataDir,
     "-l", logFile,
     "-o", `-p ${EMBEDDED_PORT} -c listen_addresses=${EMBEDDED_HOST}`,

package/dist/builtin/workflows/src/durable/dbos-envelope.ts

@@ -62,12 +62,7 @@ export interface DbosCheckpointEnvelope extends WorkflowSerializableObject {
   readonly topology?: WorkflowSerializableValue;
 }
 
-/**
- * Stage-kind checkpoints from older session-timing writers may omit
- * topology. The current format requires it, so default at every write
- * boundary — persisted records must match the normalized in-memory mirror or
- * a fresh process would reject them as foreign.
- */
+/** Add a compatibility root topology when a legacy/output-only writer omits it. */
 export function withCurrentStageTopology(cp: DurableCheckpoint): DurableCheckpoint {
   if (cp.kind !== "stage" || cp.topology !== undefined) return cp;
   return {
@@ -104,7 +99,12 @@ export function encodeCheckpoint(checkpoint: DurableCheckpoint): DbosCheckpointE
     ...base,
     name: s.name,
     replayKey: s.replayKey,
-    ...(s.topology !== undefined ? { topology: { version: s.topology.version, stageId: s.topology.stageId, parentIds: [...s.topology.parentIds] } } : {}),
+    ...(s.topology !== undefined ? { topology: {
+      version: s.topology.version,
+      stageId: s.topology.stageId,
+      parentIds: [...s.topology.parentIds],
+      ...(s.topology.run !== undefined ? { run: { ...s.topology.run } } : {}),
+    } } : {}),
     ...(s.sessionId !== undefined ? { sessionId: s.sessionId } : {}),
     ...(s.sessionFile !== undefined ? { sessionFile: s.sessionFile } : {}),
     ...(s.startedAt !== undefined ? { startedAt: s.startedAt } : {}),
@@ -227,7 +227,30 @@ function stageTopology(value: WorkflowSerializableValue | undefined): DurableSta
   const record = value as Record<string, WorkflowSerializableValue>;
   if (record["version"] !== DURABLE_STAGE_TOPOLOGY_VERSION
     || typeof record["stageId"] !== "string" || !isStringArray(record["parentIds"])) return undefined;
-  return { version: DURABLE_STAGE_TOPOLOGY_VERSION, stageId: record["stageId"], parentIds: record["parentIds"] };
+  const run = stageRunTopology(record["run"]);
+  if (record["run"] !== undefined && run === undefined) return undefined;
+  return {
+    version: DURABLE_STAGE_TOPOLOGY_VERSION,
+    stageId: record["stageId"],
+    parentIds: record["parentIds"],
+    ...(run !== undefined ? { run } : {}),
+  };
+}
+
+function stageRunTopology(value: WorkflowSerializableValue | undefined): NonNullable<DurableStageTopology["run"]> | undefined {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return undefined;
+  const run = value as Record<string, WorkflowSerializableValue>;
+  if (typeof run["runId"] !== "string" || typeof run["runName"] !== "string") return undefined;
+  for (const key of ["parentRunId", "parentStageId", "rootRunId"] as const) {
+    if (run[key] !== undefined && typeof run[key] !== "string") return undefined;
+  }
+  return {
+    runId: run["runId"],
+    runName: run["runName"],
+    ...(typeof run["parentRunId"] === "string" ? { parentRunId: run["parentRunId"] } : {}),
+    ...(typeof run["parentStageId"] === "string" ? { parentStageId: run["parentStageId"] } : {}),
+    ...(typeof run["rootRunId"] === "string" ? { rootRunId: run["rootRunId"] } : {}),
+  };
 }
 
 function isModelAttempts(value: WorkflowSerializableValue | undefined): boolean {

package/dist/builtin/workflows/src/durable/dbos-lifecycle.ts

@@ -119,10 +119,16 @@ export function getReadyDbosBackendSync(): DbosDurableBackend | undefined {
 
 export async function shutdownDbos(): Promise<void> {
   if (shutdownPromise !== undefined) return await shutdownPromise;
-  if (configured === undefined) return;
+  const configuredPromise = configured;
+  if (configuredPromise === undefined) return;
   shutdownPromise = (async () => {
-    const durability = await configured;
-    if (launchPromise !== undefined) await launchPromise;
+    // A backend that never reached "ready" has nothing to flush or stop.
+    // `configured`/`launchPromise` memoize rejections, so re-awaiting them
+    // unguarded would rethrow the original provisioning failure out of every
+    // session dispose — crashing otherwise-successful runs at process exit.
+    const durability = await configuredPromise.catch(() => undefined);
+    if (durability === undefined) return;
+    if (launchPromise !== undefined) await launchPromise.catch(() => undefined);
     if (state !== "ready") return;
     state = "shutting_down";
     await durability.backend.flush();