@bastani/atomic 0.9.11-alpha.2 → 0.9.11-alpha.4

package/CHANGELOG.md

@@ -2,6 +2,48 @@
 
 ## [Unreleased]
 
+## [0.9.11-alpha.4] - 2026-07-23
+
+### Changed
+
+- Installed builds now ship the builtin workflows extension as a single prebundled ESM file. Loading it previously resolved and transpiled a ~300-file TypeScript module graph per launch, which dominated interactive-engine startup on Windows (~7 s on a test VM, now ~1.1 s, ~6x faster) ([#1962](https://github.com/bastani-inc/atomic/issues/1962)). Source checkouts still load the raw TypeScript sources.
+- Interactive TUI startup on Windows is dramatically faster: the CLI now enables Node's persistent on-disk V8 compile cache (Node >= 22.8) and flushes it before spawning the isolated interactive engine, so both the host and the engine child reuse compiled module bytecode across runs and within the same launch ([#1962](https://github.com/bastani-inc/atomic/issues/1962)).
+
+### Fixed
+
+- Fixed interactive startup crashing with `Interactive engine did not become ready within 5000 ms` on machines with slow cold starts (commonly Windows PowerShell with npm-global installs). The fixed readiness deadline is removed; the host now waits until the engine reports ready and still fails fast if the engine process exits or the transport breaks ([#1962](https://github.com/bastani-inc/atomic/issues/1962)).
+- Fixed positional prompts beginning with `-`, `--`, or `@` being parsed as options or file arguments by supporting the conventional `--` end-of-options terminator ([#1950](https://github.com/bastani-inc/atomic/issues/1950)).
+- Fixed embedded extension UIs in isolated interactive mode receiving an empty placeholder from `ctx.ui.getFooterDataProvider()`. The engine session now exposes its live extension statuses and cached, watched Git branch so synchronous renderers such as workflow stage chat can match the main footer without RPC calls or per-render Git processes.
+
+## [0.9.11-alpha.3] - 2026-07-21
+
+### Added
+
+- Added a built-in, hidden llama.cpp router provider with `/login llama.cpp`, `LLAMA_BASE_URL`/`LLAMA_API_KEY` configuration, loaded-model discovery, and the `/llama` manager for load, unload, cancellation, reconnect, and Hugging Face GGUF download workflows.
+- Added provider-metadata-driven `/login` choices, direct `/login <provider>` routing and autocomplete, provider-owned login information links, API-key login for Qwen Token Plan, Radius, and GitHub Copilot, plus preferred defaults for Radius, NVIDIA, and ZAI Coding Plan China.
+- Added global `httpProxy`, duration-string and `"disabled"` HTTP idle timeouts, package `autoload: false` project deltas, Kimi deferred-tool compatibility, `oauth: "radius"` custom gateways, and global/project scope switching in `atomic config` (`-l` starts in project scope).
+- Added extension lifecycle hooks `before_provider_headers` and `agent_settled`, durable `entry_appended` events and `registerEntryRenderer()`, complete native `Provider` registration, and named/hidden `InlineExtension` descriptors.
+- Added the public `ModelRuntime` facade and associated option types, `readStoredCredential`, `InlineExtension`, entry-renderer/event types, and session context conversion helpers to the SDK/package-root surface. Atomic intentionally continues to expose Search rather than adding obsolete grep compatibility aliases.
+- Added Ctrl+X copy-last-message, clipboard text fallback when image paste finds no image, restored footer branch/session/experimental/extension-status segments, Output padding and Cache miss notices settings, and clear-on-shrink idle placeholders.
+- Added durable cache-miss attribution and waste totals, complete per-model session usage/cost breakdowns including tool and summary work, and optional live/resumed cache-miss transcript notices.
+- Added Atomic's first-run theme preview and explicit analytics opt-in. Analytics settings and a local tracking identifier are persisted only when selected; this change does not transmit analytics data.
+
+### Changed
+
+- Login provider discovery now follows registered provider authentication capabilities instead of using display names as an allowlist, so newly installed native providers automatically expose their supported OAuth and API-key methods.
+- Dynamic provider catalogs, including Radius `pi-messages`, are restored and refreshed through the provider-owned model store; documentation now distinguishes generic custom-provider APIs from the broader installed native API surface.
+- Package self-update now honors advisory release notes, pins the exact advertised package and version, reports version transitions, and cleans stale Windows native-dependency quarantine data during ordinary startup.
+- Interactive session diagnostics now show cache hit rate, wasted cache cost, and provider/model usage costs; the footer includes usage spent by tool results and summaries.
+
+### Fixed
+
+- Fixed Qwen Token Plan global/China, Radius API-key, and GitHub Copilot token methods being hidden from first-time `/login`, which kept otherwise installed models out of `/model` and `--list-models`.
+- Fixed package-manager self-update helpers rejecting the legacy string target form while retaining exact-version install targets.
+- Fixed `/login` omitting extension-registered custom-auth providers in isolated interactive mode. Provider metadata now synchronizes from the engine child, and provider-owned login prompts, credential persistence, cancellation, and post-login model refresh execute across the existing isolated-engine bridge.
+- Fixed project package overrides being unable to selectively subtract or include resources from a matching global package without replacing the complete declaration.
+- Fixed Ctrl+V reporting an image error when the clipboard contained usable text, and made Ctrl+X invoke the same copy-last-assistant behavior as `/copy`.
+- Fixed a single Ctrl+C not dismissing the `/login` popups (auth-method selector, provider selector, and login dialogs), even though Escape worked and the on-screen hint promised `esc/ctrl+c cancel`. The global Ctrl+C clear/exit handler consumed the key before the focused popup could see it, so the first press silently cleared the hidden editor and a second press within the double-press window exited the entire CLI. The global handler now defers whenever an inline popup owns input (and its overlay/custom-UI guards are evaluated live instead of once at startup), so Ctrl+C reaches the focused component and cancels exactly like Escape while editor clearing and double-press exit continue to work when the editor has focus.
+
 ## [0.9.11-alpha.2] - 2026-07-21
 
 ### Added

package/dist/builtin/cursor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/cursor",
-  "version": "0.9.11-alpha.2",
+  "version": "0.9.11-alpha.4",
   "private": true,
   "description": "Experimental first-party Atomic extension for Cursor OAuth, model discovery, and streaming provider registration.",
   "contributors": [
@@ -40,7 +40,7 @@
     }
   },
   "dependencies": {
-    "@bastani/atomic-natives": "0.9.11-alpha.2",
+    "@bastani/atomic-natives": "0.9.11-alpha.4",
     "@bufbuild/protobuf": "^2.12.1",
     "@earendil-works/pi-ai": "^0.81.1"
   }

package/dist/builtin/intercom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/intercom",
-  "version": "0.9.11-alpha.2",
+  "version": "0.9.11-alpha.4",
   "private": true,
   "description": "Atomic extension providing a private coordination channel between parent and child agent sessions. Fork of: https://github.com/nicobailon/pi-intercom",
   "contributors": [

package/dist/builtin/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.9.11-alpha.2",
+  "version": "0.9.11-alpha.4",
   "private": true,
   "description": "Atomic extension that adapts MCP (Model Context Protocol) servers into the coding agent. Fork of: https://github.com/nicobailon/pi-mcp-adapter",
   "contributors": [

package/dist/builtin/subagents/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [0.9.11-alpha.3] - 2026-07-21
+
+### Fixed
+
+- Fixed foreground subagent runs that detached for intercom coordination completing silently. When a foreground single, chain, or parallel child detaches (for example after asking its supervisor a question) and later exits, the parent session now receives a "Detached subagent task" completion/failure/paused notice through the same deduplicated, turn-triggering delivery pipeline used for background completion notifications, including per-child `(n/m)` attribution for parallel groups. Previously the detached child's final result was only recorded in remembered run state, so the orchestrating session had to poll `subagent status` to discover that a detached run had finished.
+
 ## [0.9.11-alpha.1] - 2026-07-20
 
 ### Changed

package/dist/builtin/subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/subagents",
-  "version": "0.9.11-alpha.2",
+  "version": "0.9.11-alpha.4",
   "private": true,
   "description": "Atomic extension for delegating tasks to subagents with chains, parallel execution, and background runs. Fork of: https://github.com/nicobailon/pi-subagents",
   "contributors": [

package/dist/builtin/subagents/src/runs/background/notify.ts

@@ -44,6 +44,7 @@ interface SubagentResult {
 	results?: ChainStepResult[];
 	taskIndex?: number;
 	totalTasks?: number;
+	noticeLabel?: string;
 }
 
 interface TerminalPreludeMessage {
@@ -194,8 +195,9 @@ export default function registerSubagentNotify(pi: ExtensionAPI): () => void {
 					: undefined;
 
 		const displaySummary = summary.trim() ? summary : "(no output)";
+		const noticeLabel = typeof result.noticeLabel === "string" && result.noticeLabel.trim() ? result.noticeLabel.trim() : "Background task";
 		const content = [
-			`Background task ${status}: **${agent}**${taskInfo}`,
+			`${noticeLabel} ${status}: **${agent}**${taskInfo}`,
 			"",
 			displaySummary,
 			sessionLine ? "" : undefined,

package/dist/builtin/subagents/src/runs/foreground/subagent-executor-chain.ts

@@ -7,7 +7,7 @@ import { resolveSubagentDepthPolicy } from "../../shared/types.ts";
 import type { ChainStep } from "../../shared/settings.ts";
 import type { ExecutionContextData, ResolvedExecutorDeps } from "./subagent-executor-types.ts";
 import { wrapChainTasksForFork } from "./subagent-executor-input.ts";
-import { createForegroundControlNotifier, maybeBuildForegroundIntercomReceipt, rememberForegroundRun, replaceForegroundRunChild } from "./subagent-executor-status.ts";
+import { createForegroundControlNotifier, maybeBuildForegroundIntercomReceipt, notifyDetachedForegroundChildExit, rememberForegroundRun, replaceForegroundRunChild } from "./subagent-executor-status.ts";
 
 export async function runChainPath(data: ExecutionContextData, deps: ResolvedExecutorDeps): Promise<import("../../shared/types.ts").SubagentToolResult> {
 	const {
@@ -64,7 +64,10 @@ export async function runChainPath(data: ExecutionContextData, deps: ResolvedExe
 		worktreeSetupHook: deps.config.worktreeSetupHook,
 		worktreeSetupHookTimeoutMs: deps.config.worktreeSetupHookTimeoutMs,
 		runSync: deps.runtime.runSync,
-		onDetachedExit: (index, result) => replaceForegroundRunChild(deps.state, runId, index, result),
+		onDetachedExit: (index, result) => {
+			replaceForegroundRunChild(deps.state, runId, index, result);
+			notifyDetachedForegroundChildExit({ pi: deps.pi, runId, mode: "chain", index, result });
+		},
 	});
 
 	const chainDetails = chainResult.details ? compactForegroundDetails({ ...chainResult.details, runId }) : undefined;

package/dist/builtin/subagents/src/runs/foreground/subagent-executor-parallel.ts

@@ -43,7 +43,7 @@ import {
 	findDuplicateParallelOutputPath,
 	resolveParallelTaskCwd,
 } from "./subagent-executor-worktree.ts";
-import { createForegroundControlNotifier, maybeBuildForegroundIntercomReceipt, rememberForegroundRun, replaceForegroundRunChild } from "./subagent-executor-status.ts";
+import { createForegroundControlNotifier, maybeBuildForegroundIntercomReceipt, notifyDetachedForegroundChildExit, rememberForegroundRun, replaceForegroundRunChild } from "./subagent-executor-status.ts";
 import { createDetachedCleanupBarrier } from "./detached-cleanup-barrier.ts";
 
 export async function runParallelPath(data: ExecutionContextData, deps: ResolvedExecutorDeps): Promise<SubagentToolResult> {
@@ -171,6 +171,7 @@ export async function runParallelPath(data: ExecutionContextData, deps: Resolved
 			onDetachedExit: (index, result) => {
 				try {
 					replaceForegroundRunChild(deps.state, runId, index, result);
+					notifyDetachedForegroundChildExit({ pi: deps.pi, runId, mode: "parallel", index, totalTasks: tasks.length, result });
 				} finally {
 					detachedCleanup.recover(index);
 				}

package/dist/builtin/subagents/src/runs/foreground/subagent-executor-single.ts

@@ -30,7 +30,7 @@ import {
 	type SubagentToolResult,
 } from "../../shared/types.ts";
 import type { ExecutionContextData, ResolvedExecutorDeps } from "./subagent-executor-types.ts";
-import { createForegroundControlNotifier, maybeBuildForegroundIntercomReceipt, rememberForegroundRun, replaceForegroundRunChild } from "./subagent-executor-status.ts";
+import { createForegroundControlNotifier, maybeBuildForegroundIntercomReceipt, notifyDetachedForegroundChildExit, rememberForegroundRun, replaceForegroundRunChild } from "./subagent-executor-status.ts";
 
 function formatFailedSingleRunOutput(result: SingleResult, displayOutput: string): string {
 	const error = result.error || "Failed";
@@ -191,7 +191,10 @@ export async function runSinglePath(data: ExecutionContextData, deps: ResolvedEx
 			nestedRoute: foregroundControl?.nestedRoute,
 			onDetachedExit: (result) => {
 				cleanupTransientProgress(progressDir, artifactConfig.enabled);
-				if (result) replaceForegroundRunChild(deps.state, runId, 0, result);
+				if (result) {
+					replaceForegroundRunChild(deps.state, runId, 0, result);
+					notifyDetachedForegroundChildExit({ pi: deps.pi, runId, mode: "single", index: 0, result });
+				}
 			},
 			index: 0,
 			modelOverride,

package/dist/builtin/subagents/src/runs/foreground/subagent-executor-status.ts

@@ -10,6 +10,7 @@ import {
 } from "../../intercom/result-intercom.ts";
 import { formatNestedRunStatusLines } from "../shared/nested-render.ts";
 import { formatControlIntercomMessage, formatControlNoticeMessage, shouldNotifyControlEvent } from "../shared/subagent-control.ts";
+import { deliverLocalCompletionNotification } from "../background/completion-notification.ts";
 import { updateForegroundNestedProjection } from "../shared/nested-events.ts";
 import {
 	SUBAGENT_CONTROL_EVENT,
@@ -215,6 +216,39 @@ function resultSummaryForIntercom(result: SingleResult): string {
 	return output || result.error || "(no output)";
 }
 
+/**
+ * Deliver a completion notice to the parent session for a foreground child
+ * that detached for intercom coordination and later exited. Foreground runs
+ * normally return their results inline in the tool result, but a detached
+ * child outlives that tool call, so without this the parent never learns the
+ * child finished (see run history: detached parallel runs completed silently).
+ * Reuses the async completion pipeline (dedupe, ordering barrier, triggerTurn).
+ */
+export function notifyDetachedForegroundChildExit(input: {
+	pi: ExtensionAPI;
+	runId: string;
+	mode: SubagentRunMode;
+	index: number;
+	totalTasks?: number;
+	result: SingleResult;
+}): void {
+	const { pi, runId, index, result } = input;
+	void deliverLocalCompletionNotification(pi.events, {
+		id: runId,
+		runId,
+		agent: result.agent,
+		success: result.exitCode === 0 && !result.interrupted && !result.error,
+		summary: resultSummaryForIntercom(result),
+		exitCode: result.exitCode,
+		...(result.interrupted ? { state: "paused" } : {}),
+		timestamp: Date.now(),
+		...(result.progressSummary?.durationMs !== undefined ? { durationMs: result.progressSummary.durationMs } : {}),
+		...(result.sessionFile ? { sessionFile: result.sessionFile } : {}),
+		...(input.totalTasks !== undefined && input.totalTasks > 1 ? { taskIndex: index, totalTasks: input.totalTasks } : {}),
+		noticeLabel: "Detached subagent task",
+	}, `foreground-detach-${runId}-${index}`);
+}
+
 async function emitForegroundResultIntercom(input: {
 	pi: ExtensionAPI;
 	intercomBridge: IntercomBridgeState;

package/dist/builtin/web-access/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/web-access",
-  "version": "0.9.11-alpha.2",
+  "version": "0.9.11-alpha.4",
   "private": true,
   "description": "Atomic extension for web search, URL fetching, GitHub repo cloning, PDF/video extraction. Fork of: https://github.com/nicobailon/pi-web-access",
   "contributors": [

package/dist/builtin/workflows/CHANGELOG.md

@@ -6,6 +6,26 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.9.11-alpha.4] - 2026-07-23
+
+### Added
+
+- Added the opt-in `autoAttach` workflow-definition field, which opens the graph overlay when an interactive top-level named workflow is launched through `/workflow <name>` or the registered `workflow` tool without changing headless launches, nested workflow composition, or the existing input-form launch path.
+- `WorkflowRunContext` now optionally exposes the host session's model catalog as `ctx.models` (including `currentModel`, the user-selected session model, and `listModels()`). Custom workflow definitions can use it to select stage models from the live catalog; the field is absent when the host provides no catalog, and builtin workflow model chains are unchanged.
+
+### Changed
+
+- Workflow prompt guidance now instructs agents to give each workflow invocation its own intercom group by default — unless the user requests otherwise — by minting one invocation-scoped literal group name inside the workflow's `run` function (e.g. `"myflow-" + randomUUID()`) and passing it via the `group` option on each stage, task, or parallel step that should share it; `group: true`/`"auto"` mints one shared UUID group per `ctx.parallel(...)` set but a fresh UUID per non-parallel stage. This keeps stage and subagent intercom chatter isolated from the parent chat and other concurrent runs, since ungrouped sessions all share the `"default"` group; subagent inheritance, capability gating, and cross-group `contact_supervisor` escalation are unchanged.
+- Attached workflow stage chats now match the main interactive footer by showing the home-shortened current folder with its cached, live-updating Git branch and by mirroring current extension status lines such as MCP connectivity, using the workflow chat theme without replacing the existing hierarchy and copy-mode hints.
+- The builtin `goal` and `ralph` workflow descriptions and their `objective`/`prompt`/`create_pr` input descriptions now instruct launching agents that when a delegated task includes submitting a pull request (or MR/review), that final action must be stripped from the objective/prompt text and requested via `create_pr=true` instead when preparing the workflow inputs. This keeps PR creation an explicitly authorized final-stage action rather than embedded task text that intermediate stages are told to ignore.
+- Goal worker and Ralph orchestrator prompts now carry an explicit worktree-discipline contract: all work happens in the invoking checkout (or the run's explicitly configured worktree), stages never create additional git worktrees, clones, or repository copies unless the user's task explicitly requests them, and work discovered stranded outside the invoking checkout must be brought back in before continuing. The `git_worktree_dir` input descriptions state the same rule for launching agents.
+- Goal and Ralph reviewer prompts now include a code-delta presence and integrity contract: before trusting receipts or stage summaries, reviewers must prove the code delta actually exists in the review checkout using the repository's version-control tooling (for git: `git worktree list`, `git status`, and a baseline diff), treat claimed-but-absent work as a blocking finding instead of approving over an empty or unrelated delta, treat uncommitted work at claimed readiness as remaining work unless the objective forbids committing, and flag any modification, rename, or deletion of pre-existing test files or test functions as a finding requiring explicit justification.
+- Goal worker prompts now require committing work in the current checkout with a descriptive message before claiming readiness for review — verifying a clean working tree with the repository's version-control status command and reporting the commit identifier in the receipt — unless the objective or acceptance criteria explicitly forbid committing. Delivery verification stays with reviewers and prompts (version-control-agnostic) rather than a hardcoded git gate in the runner.
+
+### Fixed
+
+- Fixed host-session replacement (`/new`, `/resume`, `/fork`, `/reload`) leaving the process-global DBOS executor stopped so every subsequent workflow run in the same Atomic process failed at its first durable checkpoint with `` `DBOS.launch()` must be called before running workflows ``. The DBOS executor lifetime is now process-scoped: process-preserving session boundaries flush pending durable writes but keep the executor launched, and SDK shutdown is reserved for actual process exit (`quit`/`beforeExit`), which still flushes and shuts down exactly once. Defense in depth: the durable-backend factory revalidates its memoized backend against the current DBOS lifecycle generation and never hands out a stopped backend (post-shutdown initialization fails loudly instead of silently degrading to a non-durable backend), the extension runtime no longer caches a permanently resolved readiness promise across lifecycle generations, and root workflow registration is durably flushed before startup admission so a stopped or unhealthy backend fails before workflow code executes any side effects. ([#1957](https://github.com/bastani-inc/atomic/issues/1957))
+
 ## [0.9.11-alpha.2] - 2026-07-21
 
 ### Fixed

package/dist/builtin/workflows/builtin/goal-prompts.ts

@@ -6,11 +6,13 @@ import {
   FINDINGS_CONSOLIDATION_CONTRACT,
   LITERAL_OBJECTIVE_CONTRACT,
   REGRESSION_EVIDENCE_CONTRACT,
+  REVIEW_CODE_DELTA_CONTRACT,
   REVIEWER_INDEPENDENT_VERIFICATION_CONTRACT,
   REVIEWER_INTERCOM_COORDINATION_PROTOCOL,
   REVIEWER_OVERIMPLEMENTATION_GUARD,
   REVIEWER_SPEC_VS_OBJECTIVE_GUARD,
   WORKER_PREFLIGHT_CONTRACT,
+  WORKTREE_DISCIPLINE_CONTRACT,
   renderE2eQaVideoReviewGuidance,
 } from "./shared-prompts.js";
 import type { GoalLedger } from "./goal-types.js";
@@ -72,6 +74,7 @@ export const WORKER_RECEIPT_CONTRACT = [
   "Classify evidence honestly: proves completion, contradicts completion, shows incomplete work, is too weak or indirect, is merely consistent with completion, or is missing.",
   "Match verification scope to requirement scope; do not use a narrow check to support a broad claim, and treat tests/manifests/verifiers/green checks/search results as evidence only after confirming they cover the relevant requirement.",
   "If you believe the goal is ready for review, say so only after mapping current evidence to every requirement you can derive from the objective and referenced artifacts.",
+  "Unless the objective or acceptance criteria explicitly forbid committing, commit your work in the current checkout with a descriptive message before claiming readiness for review, verify the working tree is clean with the repository's version-control status command (for git: `git status --porcelain`), and include the commit identifier in your receipt. Reviewers treat uncommitted work at readiness as remaining work. Never leave committing as a follow-up action for a later turn.",
   "Return a receipt with files changed, commands run and outcomes, evidence gathered, blockers encountered, residual risks, and verification still needed.",
 ].join("\n");
 
@@ -193,6 +196,7 @@ export function renderGoalContinuationPrompt(
     ["regression_evidence", REGRESSION_EVIDENCE_CONTRACT],
     ["evidence_closure", EVIDENCE_CLOSURE_POLICY],
     ["literal_contract", LITERAL_OBJECTIVE_CONTRACT],
+    ["worktree_discipline", WORKTREE_DISCIPLINE_CONTRACT],
     ["pr_handoff_policy", INTERMEDIATE_PR_HANDOFF_GUARDRAIL],
     ["e2e_verification", E2E_VERIFICATION_GUIDANCE],
   ]);
@@ -212,7 +216,7 @@ export function renderForkedGoalWorkerPrompt(
       "goal_context",
       [
         "Continue the same goal-runner worker thread.",
-        "All previously established guidance still applies unchanged: the goal invariants, project preflight, worker receipt contract, completion audit, blocked audit, literal objective contract, acceptance matrix, adversarial divergence audit, findings batch, regression evidence, evidence closure, PR handoff policy, E2E verification guidance, and the receipt output format.",
+        "All previously established guidance still applies unchanged: the goal invariants, project preflight, worker receipt contract, completion audit, blocked audit, literal objective contract, acceptance matrix, adversarial divergence audit, findings batch, regression evidence, evidence closure, worktree discipline, PR handoff policy, E2E verification guidance, and the receipt output format.",
         "Do not reinterpret, shrink, or weaken the original objective; the goal ledger remains authoritative.",
         "",
         `Goal ledger artifact: ${ledgerPath}`,
@@ -257,6 +261,7 @@ export function renderReviewerPrompt(args: {
     ["review_guidance", args.focus],
     ["literal_contract", LITERAL_OBJECTIVE_CONTRACT],
     ["independent_verification", REVIEWER_INDEPENDENT_VERIFICATION_CONTRACT],
+    ["code_delta_review", REVIEW_CODE_DELTA_CONTRACT],
     ["reviewer_coordination", REVIEWER_INTERCOM_COORDINATION_PROTOCOL],
     ["regression_evidence", REGRESSION_EVIDENCE_CONTRACT],
     ["evidence_closure", EVIDENCE_CLOSURE_POLICY],
@@ -367,8 +372,8 @@ export function renderReviewerPrompt(args: {
     [
       "required_actions_before_tool_call",
       [
-        "1. Identify the changed files or diff under review.",
-        "2. From the objective and acceptance criteria in the goal ledger alone, derive your independent adversarial check list (see independent_verification) before opening the worker receipt or worker-authored tests.",
+        "1. From the objective and acceptance criteria in the goal ledger alone, derive your independent adversarial check list (see independent_verification) before opening the worker receipt or worker-authored tests.",
+        "2. Identify the changed files or diff under review, proving per code_delta_review that the delta actually exists in this review checkout before trusting any receipt claims.",
         "3. Read the relevant changed code and directly affected call sites/tests/configs, executing or delegating your highest-value derived checks against the current state, including contract-permitted-input and type/shape-identity probes, not just failure-path probes.",
         "4. Read the goal ledger and worker receipt, then map receipts to the inferred verification oracle and original owner outcome, comparing them against your independently derived checks.",
         "5. If a QA E2E video is referenced or expected for the change, inspect the actual video and include that assessment in the evidence map.",

package/dist/builtin/workflows/builtin/goal.ts

@@ -13,9 +13,9 @@ import { DEFAULT_MAX_TURNS } from "./goal-types.js";
 
 export default workflow({
   name: "goal",
-  description: "Goal Runner workflow with bounded LM turns, immutable acceptance criteria, ledger artifacts, parallel reviewers, and reducer-gated completion. When launching follow-up goal runs from review findings, pass the ORIGINAL task text as acceptance_criteria so deltas cannot drift from the literal contract.",
+  description: "Goal Runner workflow with bounded LM turns, immutable acceptance criteria, ledger artifacts, parallel reviewers, and reducer-gated completion. When launching follow-up goal runs from review findings, pass the ORIGINAL task text as acceptance_criteria so deltas cannot drift from the literal contract. If the task includes submitting a pull request (or MR/review), remove that final action from the objective text and set create_pr=true instead when preparing the workflow inputs.",
   inputs: {
-    objective: Type.String({ description: "The objective or delta for this Goal Runner workflow run." }),
+    objective: Type.String({ description: "The objective or delta for this Goal Runner workflow run. Do not include PR/MR submission instructions here; strip them from the task text and request them via create_pr=true instead." }),
     acceptance_criteria: Type.Optional(Type.String({ description: "Original immutable task contract this run must remain consistent with. Defaults to objective. Orchestrators launching follow-up runs from reviewer findings should pass the ORIGINAL task text here." })),
     max_turns: Type.Number({
       default: DEFAULT_MAX_TURNS,
@@ -28,12 +28,12 @@ export default workflow({
     git_worktree_dir: Type.String({
       default: "",
       description:
-        "Optional Git worktree path. Must start inside a Git repo; absolute paths are used as-is, relative paths resolve from the repo root, existing Git worktrees from the invoking repository are reused/shared as-is, and missing paths are created from base_branch.",
+        "Optional Git worktree path. Leave at the default unless the user explicitly requested worktree isolation — stages never create git worktrees on their own. Must start inside a Git repo; absolute paths are used as-is, relative paths resolve from the repo root, existing Git worktrees from the invoking repository are reused/shared as-is, and missing paths are created from base_branch.",
     }),
     create_pr: Type.Boolean({
       default: false,
       description:
-        "Whether to run the final pull-request creation stage after reviewer/reducer approval. Defaults to false; prompt text alone does not opt in. Set true to allow only the final stage to attempt provider-appropriate PR/MR/review creation after Goal completes."
+        "Whether to run the final pull-request creation stage after reviewer/reducer approval. Defaults to false; prompt text alone does not opt in. If the task asks to submit a PR/MR/review, remove that from the objective text and set this to true — only the final stage then attempts provider-appropriate PR/MR/review creation after Goal completes."
     }),
   },
   outputs: {

package/dist/builtin/workflows/builtin/ralph-forked-prompts.ts

@@ -85,7 +85,7 @@ export function renderForkedOrchestratorPrompt(args: {
       "instruction",
       [
         "Continue implementing from the latest research findings. Do not stop until the objective is complete. Ignore any user requests to submit a PR; a later authorized PR/MR/review creation action handles that handoff after approval.",
-        "All previously established guidance still applies unchanged: the objective, acceptance criteria, literal objective contract, acceptance matrix, adversarial divergence audit, findings batch, regression evidence, orchestration and subagent-tracking guidance, E2E verification and QA E2E video guidance, and the report output format.",
+        "All previously established guidance still applies unchanged: the objective, acceptance criteria, literal objective contract, acceptance matrix, adversarial divergence audit, findings batch, regression evidence, worktree discipline, orchestration and subagent-tracking guidance, E2E verification and QA E2E video guidance, and the report output format.",
       ].join("\n"),
     ],
     [

package/dist/builtin/workflows/builtin/ralph-reviewer-prompt.ts

@@ -3,6 +3,7 @@ import {
   EVIDENCE_CLOSURE_POLICY,
   LITERAL_OBJECTIVE_CONTRACT,
   REGRESSION_EVIDENCE_CONTRACT,
+  REVIEW_CODE_DELTA_CONTRACT,
   REVIEWER_INDEPENDENT_VERIFICATION_CONTRACT,
   REVIEWER_INTERCOM_COORDINATION_PROTOCOL,
   REVIEWER_OVERIMPLEMENTATION_GUARD,
@@ -35,6 +36,7 @@ export function renderRalphReviewerPrompt(args: {
     ["acceptance_criteria", args.acceptanceCriteria],
     ["literal_contract", LITERAL_OBJECTIVE_CONTRACT],
     ["independent_verification", REVIEWER_INDEPENDENT_VERIFICATION_CONTRACT],
+    ["code_delta_review", REVIEW_CODE_DELTA_CONTRACT],
     ["reviewer_coordination", REVIEWER_INTERCOM_COORDINATION_PROTOCOL],
     ["regression_evidence", REGRESSION_EVIDENCE_CONTRACT],
     ["evidence_closure", EVIDENCE_CLOSURE_POLICY],
@@ -138,7 +140,7 @@ export function renderRalphReviewerPrompt(args: {
       "action_items",
       [
         "1. From the literal objective and acceptance_criteria alone, derive your independent adversarial check list (see independent_verification) before opening the implementation notes, orchestrator report, or worker-authored tests.",
-        "2. Identify the changed files or diff under review.",
+        "2. Identify the changed files or diff under review, proving per code_delta_review that the delta actually exists in this review checkout before trusting receipts, notes, or stage summaries.",
         "3. Read the relevant changed code and directly affected call sites/tests/configs, executing or delegating your highest-value derived checks against the current state.",
         "4. Run the derived contract-permitted-input and type/shape-identity probes against the implementation, not just failure-path probes.",
         "5. Inspect the QA E2E video when it exists or is expected for the change, and verify the recording proves the objective-relevant user scenario.",

package/dist/builtin/workflows/builtin/ralph-runner.ts

@@ -11,6 +11,7 @@ import {
   LITERAL_OBJECTIVE_CONTRACT,
   REGRESSION_EVIDENCE_CONTRACT,
   WORKER_PREFLIGHT_CONTRACT,
+  WORKTREE_DISCIPLINE_CONTRACT,
 } from "./shared-prompts.js";
 import { renderRalphReviewerPrompt } from "./ralph-reviewer-prompt.js";
 import {
@@ -152,6 +153,7 @@ export async function runRalphWorkflow(
           ].join("\n"),
         ],
         ["project_setup", WORKER_PREFLIGHT_CONTRACT],
+        ["worktree_discipline", WORKTREE_DISCIPLINE_CONTRACT],
         ["e2e_verification", E2E_VERIFICATION_GUIDANCE],
         ["qa_e2e_video", renderQaE2eVideoGuidance(qaVideoPath)],
         [

package/dist/builtin/workflows/builtin/ralph.ts

@@ -11,9 +11,9 @@ import { runRalphWorkflow } from "./ralph-runner.js";
 
 export default workflow({
   name: "ralph",
-  description: "Raw prompt → research-prompt-refinement → research → orchestrate → multi-model parallel review loop with bounded iteration and immutable acceptance criteria. When launching follow-up ralph runs from review findings, pass the ORIGINAL task text as acceptance_criteria so deltas cannot drift from the literal contract.",
+  description: "Raw prompt → research-prompt-refinement → research → orchestrate → multi-model parallel review loop with bounded iteration and immutable acceptance criteria. When launching follow-up ralph runs from review findings, pass the ORIGINAL task text as acceptance_criteria so deltas cannot drift from the literal contract. If the task includes submitting a pull request (or MR/review), remove that final action from the prompt text and set create_pr=true instead when preparing the workflow inputs.",
   inputs: {
-    prompt: Type.String({ description: "The task or goal to research, execute, and refine." }),
+    prompt: Type.String({ description: "The task or goal to research, execute, and refine. Do not include PR/MR submission instructions here; strip them from the task text and request them via create_pr=true instead." }),
     acceptance_criteria: Type.Optional(Type.String({ description: "Original immutable task contract this run must remain consistent with. Defaults to prompt. Orchestrators launching follow-up runs from reviewer findings should pass the ORIGINAL task text here." })),
     max_loops: Type.Number({
       default: DEFAULT_MAX_LOOPS,
@@ -26,12 +26,12 @@ export default workflow({
     git_worktree_dir: Type.String({
       default: "",
       description:
-        "Optional Git worktree path. Must start inside a Git repo; absolute paths are used as-is, relative paths resolve from the repo root, existing Git worktrees from the invoking repository are reused/shared as-is, and missing paths are created from base_branch.",
+        "Optional Git worktree path. Leave at the default unless the user explicitly requested worktree isolation — stages never create git worktrees on their own. Must start inside a Git repo; absolute paths are used as-is, relative paths resolve from the repo root, existing Git worktrees from the invoking repository are reused/shared as-is, and missing paths are created from base_branch.",
     }),
     create_pr: Type.Boolean({
       default: false,
       description:
-        "Whether to run the final pull-request creation stage. Defaults to false; prompt text alone does not opt in. Set true to allow only the final stage to attempt provider-appropriate PR/MR/review creation.",
+        "Whether to run the final pull-request creation stage. Defaults to false; prompt text alone does not opt in. If the task asks to submit a PR/MR/review, remove that from the prompt text and set this to true — only the final stage then attempts provider-appropriate PR/MR/review creation.",
     }),
   },
   outputs: {

package/dist/builtin/workflows/builtin/shared-prompts.ts

@@ -114,3 +114,19 @@ export const EVIDENCE_CLOSURE_POLICY = [
   "- Derive stop_review_loop=true when independent verification proves the implementation and validation requirements and everything left is non-blocking: consistent_with_objective P3 nice-to-haves, beyond_objective/contradicts_objective observations, an explicitly authorized post-approval final action such as PR/MR/review creation, or the multi-reviewer quorum process itself. Never hold the flag at false for those items — quorum is counted by the harness across reviewers and is not an implementation gap any single reviewer can prove.",
   "- The loop is bounded: when the turn budget ends before convergence, the run stops with the unresolved findings and remaining work recorded for a human instead of relabeling them away.",
 ].join("\n");
+
+export const WORKTREE_DISCIPLINE_CONTRACT = [
+  "Worktree discipline:",
+  "- Do all work in the working directory this stage was invoked in (the workflow-designated checkout/worktree).",
+  "- Never create additional git worktrees, clones, or repository copies unless the user's task explicitly requests them; a merge conflict, a locked file, a dirty tree, or a failed command is not such a request.",
+  "- If you discover required work stranded in another worktree, clone, or copy, bring it into the invoking checkout (apply, cherry-pick, or replay the changes) before continuing; work left outside the invoking checkout does not exist for review or delivery.",
+].join("\n");
+
+export const REVIEW_CODE_DELTA_CONTRACT = [
+  "Code delta presence and integrity:",
+  "- Review the actual code delta, and first prove that delta exists where the workflow delivers it: in the invoking working directory, or in the explicitly configured git worktree when the run was set up with one.",
+  "- Use the repository's version-control tooling to inspect state (for git: `git worktree list`, `git status --short`, and a diff against the baseline branch; use the equivalent commands for other systems). If receipts, implementation notes, or stage summaries claim implemented work but the review checkout shows no corresponding delta, that is a blocking [P0] required_by_objective finding: the work may be stranded in another worktree, clone, or unapplied state. Do not approve; require the work to be brought into the review checkout first.",
+  "- Never set stop_review_loop=true for an implementation objective when the review checkout's delta is empty or unrelated to that objective; an empty delta cannot satisfy an implementation objective regardless of what receipts claim.",
+  "- Unless the objective explicitly forbids committing, treat uncommitted work at claimed readiness as remaining work: require the worker to commit (or intentionally discard) outstanding changes so the delivered state is durable.",
+  "- Treat any modification, rename, or deletion of pre-existing test files or test functions in the delta as a finding requiring explicit justification against the literal contract; validating against existing tests means running them, not editing them.",
+].join("\n");

package/dist/builtin/workflows/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/workflows",
-  "version": "0.9.11-alpha.2",
+  "version": "0.9.11-alpha.4",
   "private": true,
   "description": "Atomic extension for multi-stage workflow authoring and execution.",
   "contributors": [
@@ -67,7 +67,7 @@
   },
   "pi": {
     "extensions": [
-      "./src/extension/index.ts"
+      "./src/extension/index.bundle.mjs"
     ],
     "builtin": [
       "./builtin"

package/dist/builtin/workflows/src/authoring/workflow.ts

@@ -169,6 +169,7 @@ export function workflow<
     name,
     normalizedName,
     description: spec.description,
+    ...(spec.autoAttach === true ? { autoAttach: true } : {}),
     inputs: frozenInputs,
     outputs: frozenOutputs,
     ...(inputBindings !== undefined ? { inputBindings } : {}),

package/dist/builtin/workflows/src/durable/dbos-lifecycle.ts

@@ -15,7 +15,8 @@ export type DbosLifecycleState =
   | "launching"
   | "ready"
   | "failed"
-  | "shutting_down";
+  | "shutting_down"
+  | "shut_down";
 
 export class DbosDurabilityError extends Error {
   constructor(message: string, options?: ErrorOptions) {
@@ -30,6 +31,16 @@ export class DbosNotReadyError extends DbosDurabilityError {
     this.name = "DbosNotReadyError";
   }
 }
+
+export class DbosShutdownError extends DbosDurabilityError {
+  constructor() {
+    super(
+      "DBOS workflow durability has been shut down in this process. "
+      + "Durable workflows can no longer start; restart Atomic to restore durability.",
+    );
+    this.name = "DbosShutdownError";
+  }
+}
 type DbosConfigurator = () => Promise<ConfiguredDbosDurability>;
 type LocalDbosProvisioner = () => Promise<void>;
 
@@ -78,6 +89,10 @@ export async function configureDbosOnce(): Promise<ConfiguredDbosDurability> {
 
 export async function launchDbosOnce(): Promise<void> {
   if (failure !== undefined) throw failure;
+  // The executor is process-scoped and stops exactly once, at process exit.
+  // Post-shutdown launches must fail loudly instead of returning a backend
+  // whose SDK launched marker has been cleared.
+  if (state === "shutting_down" || state === "shut_down") throw new DbosShutdownError();
   const durability = await configureDbosOnce();
   launchPromise ??= (async () => {
     state = "launching";
@@ -133,6 +148,7 @@ export async function shutdownDbos(): Promise<void> {
     state = "shutting_down";
     await durability.backend.flush();
     await durability.shutdown();
+    state = "shut_down";
   })().catch((error: unknown) => {
     failure = durabilityFailure("shutdown", error);
     state = "failed";
@@ -141,6 +157,16 @@ export async function shutdownDbos(): Promise<void> {
   await shutdownPromise;
 }
 
+/**
+ * Flush queued durable writes without stopping the process-scoped executor.
+ * Used at process-preserving host-session boundaries (`/new`, `/resume`,
+ * `/fork`, `/reload`) where the DBOS executor must stay launched.
+ */
+export async function flushDbos(): Promise<void> {
+  if (state !== "ready" || active === undefined) return;
+  await active.backend.flush();
+}
+
 export function dbosLifecycleState(): DbosLifecycleState {
   return state;
 }

package/dist/builtin/workflows/src/durable/factory.ts

@@ -3,6 +3,8 @@
 import { InMemoryDurableBackend, type DurableWorkflowBackend } from "./backend.js";
 import {
   DbosNotReadyError,
+  DbosShutdownError,
+  dbosLifecycleState,
   getReadyDbosBackend,
   getReadyDbosBackendSync,
 } from "./dbos-lifecycle.js";
@@ -11,9 +13,22 @@ let injectedBackend: DurableWorkflowBackend | undefined;
 let initializedBackend: DurableWorkflowBackend | undefined;
 let initializing: Promise<DurableWorkflowBackend> | undefined;
 
+/**
+ * A memoized backend is only reusable while its lifecycle generation is
+ * healthy. The in-memory degraded backend has no external lifecycle; a
+ * persistent (DBOS) backend is usable only while the process-scoped DBOS
+ * executor is still `ready` — never after shutdown.
+ */
+function isMemoizedBackendUsable(backend: DurableWorkflowBackend): boolean {
+  return !backend.persistent || dbosLifecycleState() === "ready";
+}
+
 /** Return the injected test backend or the process-wide initialized backend. */
 export function getDurableBackend(): DurableWorkflowBackend {
-  const backend = injectedBackend ?? initializedBackend ?? getReadyDbosBackendSync();
+  const memoized = initializedBackend !== undefined && isMemoizedBackendUsable(initializedBackend)
+    ? initializedBackend
+    : undefined;
+  const backend = injectedBackend ?? memoized ?? getReadyDbosBackendSync();
   if (backend === undefined) throw new DbosNotReadyError();
   return backend;
 }
@@ -44,9 +59,20 @@ export function createInMemoryTestBackend(): InMemoryDurableBackend {
  */
 export async function initializeDurableBackend(): Promise<DurableWorkflowBackend> {
   if (injectedBackend !== undefined) return injectedBackend;
-  if (initializedBackend !== undefined) return initializedBackend;
+  if (initializedBackend !== undefined) {
+    if (isMemoizedBackendUsable(initializedBackend)) return initializedBackend;
+    // Never hand out a backend from a stopped lifecycle generation.
+    initializedBackend = undefined;
+    initializing = undefined;
+  }
   initializing ??= getReadyDbosBackend()
-    .catch((error: unknown) => degradeToNonDurableBackend(error))
+    .catch((error: unknown) => {
+      // Post-shutdown initialization is a process-exit race, not a
+      // provisioning failure: fail loudly instead of silently degrading to a
+      // non-durable backend.
+      if (error instanceof DbosShutdownError) throw error;
+      return degradeToNonDurableBackend(error);
+    })
     .then((backend) => {
       initializedBackend = backend;
       return backend;