@bastani/atomic 0.9.12 → 0.9.13-alpha.2

package/dist/builtin/workflows/README.md

@@ -7,6 +7,8 @@
 
 Default to workflows for non-trivial work and requests with inherent structure plus a verifiable objective; reserve direct chat for tiny deterministic low-risk work. Workflow-first is not builtin-only or monolithic: Atomic can author custom TypeScript `workflow({...})` definitions inline, import reusable project/package workflows or builtins from `@bastani/workflows/builtin`, and nest them with `ctx.workflow(...)`. Imported children may nest further workflows within `maxDepth`, so compose proven research, implementation, design, verification, and approval graphs rather than copying them. Custom parents can also use runtime classification, dynamic fan-out and synthesis, adversarial verification, candidate tournaments, HIL gates, and bounded convergence.
 
+Workflow stage sessions are created in process and receive a typed stage policy rather than inheriting subagent environment flags. Resource reload never mutates `process.env`; stage options carry the subagent management/fanout policy directly, so concurrent stage creation is race-free while existing tool allowlists and orchestration depth limits remain authoritative. Legacy child environment keys are only a compatibility path for older hosts.
+
 <p align="center">
   <a href="#authoring-api">Authoring API</a>
   &nbsp;·&nbsp;
@@ -43,19 +45,27 @@ After Atomic is running, use `/workflow reload` or the workflow tool's `reload`
 
 ### Workflow lifecycle notifications
 
-Workflow lifecycle notices are enabled by default. They send steer prompts into the main chat/model context when a run completes, fails, or ends blocked. Awaiting-input prompts are tracked for dedupe/restore, but they do not wake the main chat agent. Configure lifecycle tracking in the same extension config file:
+Workflow lifecycle notices are enabled by default. They send steer prompts into the main chat/model context when a run completes, fails, or ends blocked, and when a user starts, pauses, quits, or resumes one. Awaiting-input prompts are tracked for dedupe/restore, but they do not wake the main chat agent. Configure lifecycle tracking in the same extension config file:
 
 ```json
 {
   "workflowNotifications": {
     "enabled": true,
-    "notifyOn": ["completed", "failed", "blocked", "awaiting_input"]
+    "notifyOn": ["started", "completed", "failed", "blocked", "awaiting_input", "paused", "quit", "resumed"]
   }
 }
 ```
 
 Set `enabled` to `false` to disable all lifecycle notices, or narrow `notifyOn` to a non-empty list of selected events. Completion, failure, and blocked lifecycle notices are emitted for top-level workflow runs, use steer delivery, and wake an idle model so the lifecycle update enters the model context when it happens. When a fulfilled workflow body leaves admitted tool failures, the engine promotes the first admission and persists that exact tool origin for the failed notice. Ordinary body rejections retain their original error and failed graph nodes without claiming a tool origin because transparent native promises do not expose the source promise; this prevents a caught tool rejection from being misattributed when body code later throws the same object or primitive. Nested child workflow completion/failure is reflected inside the expanded parent graph instead of producing separate top-level completion cards. Awaiting-input states are tracked for dedupe/restore, but workflows do not enqueue main-chat `/workflow connect` cards for them; prompt state remains visible through workflow status/connect surfaces, avoiding stale actionable cards if a prompt resolves while the main chat is streaming.
 
+Control notices report deliberate actions on a top-level run: `/workflow <name>` produces a `WORKFLOW STARTED` card (`▶`), `/workflow pause` a `WORKFLOW PAUSED` card (`⏸`, warning tone), `/workflow quit` a `WORKFLOW QUIT` card (`⏹`, warning tone, plus a `resumable` field), and `/workflow resume` a `WORKFLOW RESUMED` card (`▶`). All four travel the same steer delivery, capped-backoff retry, and card path as the failure notice. The paused and quit text says the stop was deliberate and user-requested and instructs the model not to resume the run or take the work over unless asked, hinting `/workflow resume <run-id>`; the resumed text does not, since the run is progressing again.
+
+Only user actions notify. The matching `workflow({ action: "run" | "pause" | "quit" | "resume" })` tool calls stay silent, because the tool result already reports them to the agent, and `/workflow interrupt` raises nothing. Engine-internal transitions stay silent too — a notice exists only when a control path named an actor — which is what keeps answering a human-in-the-loop prompt, per-stage control, and the resume-acknowledgement pass from flooding the chat.
+
+Each notice carries two attributions. *Origin* is who launched the run and renders on every kind as "which you started" or "which the user started"; it is recorded once at dispatch, persisted through session restore and durable resume, and inherited by a continuation from the run it continues. *Actor* is who performed this one event ("The user paused"). A run with no recorded origin omits the clause rather than guessing one.
+
+One request produces one notice. A whole-run pause or resume reports at run scope; a stage-scoped pause or resume that leaves siblings paused reports at stage scope, and one that stops or restarts the whole run reports the run instead. A quit reports the quit alone, never the pause it publishes on the way. Because control actions are reversible, they are deduplicated by run id together with the occurrence timestamp (`pausedAt`/`quitAt`/`resumedAt`), so pause → resume → pause → resume notifies four times while repeated snapshot invalidations at one unchanged state notify once. Resuming reports a resume and never a start, whoever asked for it. Resuming a failed or blocked run launches a continuation under a fresh run id and its notice names both; resuming a quit run reuses the original workflow id so durable checkpoints replay, so that notice names the one id. A run already started, paused, or quit when notifications install (restore, replay, `/reload`, session-preserving reinstall) is seeded as delivered and stays silent, and nested child runs never notify at top level.
+
 When a stage human-in-the-loop prompt is answered from the workflow TUI/stage chat, workflows also emits a separate display-only `workflows:hil-answer-notice` custom message. It records the answer for user-visible audit, but it does not wake the main agent, enter LLM context, or authorize answering later workflow prompts. Answers sent by the main-chat `workflow` tool do not emit this notice because the tool result already tells the main agent what happened.
 
 ---
@@ -288,6 +298,44 @@ import openClaudeDesignWorkflow from "@bastani/workflows/builtin/open-claude-des
 
 Only `workflow({...})` definitions can be passed to `ctx.workflow(...)`; registry names, strings, and path objects are intentionally not supported for child workflow calls. Missing or invalid module imports fail when the workflow file itself is loaded. A parent receives the child's declared `outputs` from the child `run()` return object. Missing required outputs, schema type mismatches, returning an undeclared output, and non-JSON-serializable returned child values fail the child call before the parent continues.
 
+### Early exit with `ctx.exit()`
+
+Use `ctx.exit()` when the workflow intentionally ends before its normal `run()` return. It accepts `completed | skipped | cancelled | blocked | failed`, an optional reason, partial declared outputs, and `resumable` for an author-initiated failed outcome.
+
+```typescript
+if (allRejected) {
+  return ctx.exit({
+    status: "failed",
+    reason: "The upstream API rejected every candidate",
+    outputs: { attempted: candidates.length },
+    resumable: true, // failed exits default to false
+  });
+}
+```
+
+Choose the status by the outcome:
+
+- `completed` means the objective was met and declared outputs are complete and trustworthy.
+- `skipped` means a precondition made the run a valid no-op; no work was needed.
+- `cancelled` means the work is no longer wanted; it is a decision, not a defect.
+- `blocked` means valid progress needs a changed condition or a later decision. A bounded reviewer or repair loop that does not converge is blocked, not failed.
+- `failed` means required work was attempted and definitively could not complete. Do not use it for a non-converged reviewer loop. Failed exits are non-resumable by default; set `resumable: true` when a later durable retry is intended. `resumable` is valid only with `failed`; another status records a non-resumable authoring failure.
+
+`reason` from a valid author exit is persisted and shown in status and lifecycle notices. An exit rejected during validation is finalized as an ordinary failed run rather than an accepted author exit. `outputs` may be a partial subset of the declared `outputs` contract, but every provided key must be declared, schema-valid, and JSON-serializable. Missing required keys are allowed only on the exit path. A durable retry re-dispatches the workflow with completed checkpoints replayed. The low-level `resumeRun()` helper only inspects terminal runs and reports the durable retry path; it does not silently claim that it resumed one.
+
+When a child uses `ctx.exit()`, `ctx.workflow(child)` returns a discriminated result instead of throwing. Check `child.exited` before reading a required output:
+
+```typescript
+const child = await ctx.workflow(researchWorkflow);
+if (child.exited === true) {
+  // child.status includes failed; outputs may be partial.
+  return ctx.exit({ status: child.status, reason: child.exitReason ?? "research stopped early" });
+}
+return { report: child.outputs.report };
+```
+
+An author-initiated failed exit returns `{ exited: true, status: "failed" }` to its parent with its reason and partial outputs. An unintentional child failure still throws, so `exited` remains an intent discriminator.
+
 ### Reusable Git worktrees
 
 Use `gitWorktreeDir` when a workflow should run in a reusable Git worktree instead of the invoking checkout. The executor creates the worktree if it is missing, reuses it when it already exists as a same-repository worktree root, defaults workflow `ctx.cwd` to the matching path inside that worktree for `worktreeFromInputs`, and defaults stage/task `cwd` to that worktree path.
@@ -415,6 +463,8 @@ export default workflow({
 
 Set `model` and `fallbackModels` on the authored stage/task/chain/parallel item that needs them.
 
+For authored workflows, choose thinking effort by stage role and failure cost rather than copying a benchmark's level onto every stage. Before launch, record each model stage's role, failure cost, primary model, thinking level, and fallback policy, then print a compact `Stage | Model | Thinking | Role` assignment with a short rationale. Reserve `max` for high-cost-of-error roles or an explicit user request; use `high` for demanding analysis, planning, and repair; use `medium` for user-impact review and reporting; and keep deterministic checks as tool nodes with no model call. Apply the same role policy independently to every fallback, not a mechanical `max` inheritance. Use only levels listed in the configured catalog's `availableThinkingLevels`; if a level is unsupported, choose another catalog model or leave the stage unpinned rather than inventing a suffix.
+
 When pi exposes its model registry, workflow runs validate user-specified `model` / `fallbackModels` before starting model-backed work and report all unavailable or ambiguous IDs together. Bare model IDs are accepted only when they resolve uniquely or match the current provider; otherwise use `provider/model`. Fallback attempts may send the same prompt/context to a different provider, so choose fallbacks that fit your cost, privacy, and data-handling requirements.
 
 ### `createRegistry` — grouping workflows
@@ -585,7 +635,7 @@ Tradeoff: `Type.Unsafe<T>()` does not deeply validate at runtime — it trusts t
 
 Input overrides are bare `key=value` tokens (no leading `--`). Values are JSON-parsed when possible, so numbers, booleans, and quoted strings work as expected (e.g. `count=3`, `flag=true`, `prompt="multi word value"`). A whole-object override can be passed as a single JSON token (e.g. `{"prompt":"...","count":3}`). Runtime validation is strict: unknown input keys, missing required values, type mismatches, and invalid `select` choices fail before a named workflow run starts.
 
-Named workflow launches always run as **background tasks** in interactive sessions. Run `/workflow connect <run>` to see agents working and chat with and steer each stage. Foreground launches are reserved for explicit user requests or technical requirements, with notice before launch. Press **F2** to open the same live graph viewer; HIL prompts (`ctx.ui.input/confirm/select/editor/custom`) appear as awaiting-input graph nodes. Press Enter on a focused node, or click a visible graph node directly, to open that stage and answer locally, never as a modal dialog over the chat. `ctrl+x` is the workflow hierarchy chord: attached stage chats show **ctrl+x return to graph**, while graph surfaces show **ctrl+x leave graph · return to main chat**. Workflow surfaces consume it before configurable editor/tool actions. Composer and prompt drafts survive leaving a stage, and pending custom questions remain pending for reattachment. `ctrl+d` and `q` are not workflow navigation controls; ordinary editor/prompt Ctrl+D behavior and printable prompt `q` remain available. Existing `esc`, `ctrl+c`, and graph `h` close/hide behavior is unchanged. While the graph pane is active, vertical wheel/trackpad gestures pan vertically and horizontal gestures pan wide graphs left and right when the terminal reports them, without falling through to the main chat or terminal scrollback. Attached stage chats capture mouse/trackpad wheel events by default so scrolling stays inside the active stage transcript or prompt instead of falling through to terminal/main-chat scrollback. Press `ctrl+t` to toggle **copy mode**: copy mode disables workflow-chat mouse reporting so normal terminal/tmux text selection can work; press `ctrl+t` again to leave copy mode and restore workflow-chat scrolling. Archived read-only stage transcripts show the same copy-mode footer/status, allowing their transcript text to be selected and copied while preserving `esc` close and `ctrl+x` graph navigation. While copy mode is on, wheel/trackpad gestures are handled by the terminal/tmux and may scroll terminal scrollback, so leave copy mode before using the wheel again. Human input is detected when those runtime `ctx.ui.*` calls execute; workflows no longer have a declaration-time HIL flag.
+Named workflow launches always run as **background tasks** in interactive sessions. Run `/workflow connect <run>` to see agents working and chat with and steer each stage. Foreground launches are reserved for explicit user requests or technical requirements, with notice before launch. Press **F2** to open the same live graph viewer; HIL prompts (`ctx.ui.input/confirm/select/editor/custom`) appear as awaiting-input graph nodes. Press Enter on a focused node, or click a visible graph node directly, to open that stage and answer locally, never as a modal dialog over the chat. `ctrl+x` is the workflow hierarchy chord: attached stage chats show **ctrl+x return to graph**, while graph surfaces show **ctrl+x leave graph · return to main chat**. Workflow surfaces consume it before configurable editor/tool actions. Composer and prompt drafts survive leaving a stage, and pending custom questions remain pending for reattachment. `ctrl+d` and `q` are not workflow navigation controls; ordinary editor/prompt Ctrl+D behavior and printable prompt `q` remain available. Existing `esc`, `ctrl+c`, and graph `h` close/hide behavior is unchanged. While the graph pane is active, vertical wheel/trackpad gestures pan vertically and horizontal gestures pan wide graphs left and right when the terminal reports them, without falling through to the main chat or terminal scrollback. Focused graph and stage-chat overlays receive those gestures through the fullscreen application route. Fullscreen pi-tui owns application selection, so drag and multi-click selection also work over workflow overlays; copied text uses OSC 52, and terminals that refuse OSC 52 writes rely on the modifier-drag bypass (Shift/Option, as provided by the terminal). `ctrl+t` is not a workflow control: focused workflow overlays leave it to the host `app.thinking.toggle` action, while inline tree selectors keep `app.tree.filter.noTools`. Human input is detected when those runtime `ctx.ui.*` calls execute; workflows no longer have a declaration-time HIL flag.
 
 Typing into an attached stage chat and pressing Enter steers: the message is consumed after the current assistant response finishes its tool batch and before the next model request, matching normal session steering. Ctrl+F queues a follow-up, consumed only when the agent would otherwise stop. Queued entries belong to the stage session rather than the pane, so leaving the stage and reattaching restores the pending `Steering:` / `Follow-up:` rows, and a detached stage node carries a `✉ N queued` badge in the graph.
 
@@ -802,7 +852,7 @@ Config-based discovery (`~/.atomic/agent/extensions/workflow/config.json` or `.a
   },
   "workflowNotifications": {
     "enabled": true,
-    "notifyOn": ["completed", "failed", "blocked", "awaiting_input"]
+    "notifyOn": ["started", "completed", "failed", "blocked", "awaiting_input", "paused", "quit", "resumed"]
   }
 }
 ```

package/dist/builtin/workflows/builtin/open-claude-design-utils.ts

@@ -3,6 +3,7 @@ import { mkdirSync } from "node:fs";
 import { tmpdir, userInfo } from "node:os";
 import { join } from "node:path";
 import { Type } from "typebox";
+import { createChildProcessEnvironment } from "@bastani/atomic";
 import type { WorkflowTaskResult } from "../src/shared/types.js";
 
 
@@ -229,6 +230,7 @@ export function ensurePlaywrightCli(): PlaywrightCliStatus {
         stdio: "ignore",
         timeout: 15_000,
         shell: isWindows,
+        env: createChildProcessEnvironment(),
       });
       return probe.status === 0;
     } catch {
@@ -265,6 +267,7 @@ export function ensurePlaywrightCli(): PlaywrightCliStatus {
       stdio: "ignore",
       timeout: 180_000,
       shell: isWindows,
+      env: createChildProcessEnvironment(),
     });
     if (install.status === 0) {
       return {

package/dist/builtin/workflows/builtin/ralph-models.ts

@@ -48,29 +48,34 @@ export const promptEngineerModelConfig = {
 };
 
 export const researchModelConfig = {
-    model: "openai-codex/gpt-5.6-luna:max",
+    model: "anthropic/claude-opus-5:high",
     fallbackModels: [
-      "github-copilot/gpt-5.6-luna:max",
-      "openai/gpt-5.6-luna:max",
-      "anthropic/claude-opus-5:low",
-      "github-copilot/claude-opus-5:low",
-      "anthropic/claude-fable-5:low",
-      "github-copilot/claude-fable-5:low",
-      "openai-codex/gpt-5.5:medium",
-      "github-copilot/gpt-5.5:medium",
-      "openai/gpt-5.5:medium",
-      "anthropic/claude-opus-4-8:medium",
-      "github-copilot/claude-opus-4.8:medium",
+      "github-copilot/claude-opus-5:high",
+      "openai-codex/gpt-5.6-sol:xhigh",
+      "github-copilot/gpt-5.6-sol:xhigh",
+      "openai/gpt-5.6-sol:xhigh",
+      "anthropic/claude-fable-5:high",
+      "github-copilot/claude-fable-5:high",
+      "kimi-coding/k3:max",
+      "moonshotai/kimi-k3:max",
+      "moonshotai-cn/kimi-k3:max",
+      "openai-codex/gpt-5.5:xhigh",
+      "github-copilot/gpt-5.5:xhigh",
+      "openai/gpt-5.5:xhigh",
+      "anthropic/claude-opus-4-8:high",
+      "github-copilot/claude-opus-4.8:high",
       "xai/grok-4.5:high",
-      "zai/glm-5.2:high",
-      "zai-coding-cn/glm-5.2:high",
-      "openrouter/openai/gpt-5.6-luna:max",
-      "openrouter/anthropic/claude-opus-5:low",
-      "openrouter/openai/gpt-5.5:medium",
-      "openrouter/anthropic/claude-fable-5:low",
-      "openrouter/anthropic/claude-opus-4-8:medium",
+      "zai/glm-5.2:xhigh",
+      "zai-coding-cn/glm-5.2:xhigh",
+      "openrouter/anthropic/claude-opus-5:high",
+      "openrouter/openai/gpt-5.6-sol:xhigh",
+      "openrouter/anthropic/claude-fable-5:high",
+      "openrouter/moonshotai/kimi-k3:max",
+      "openrouter/sakana/fugu-ultra:high",
+      "openrouter/openai/gpt-5.5:xhigh",
+      "openrouter/anthropic/claude-opus-4-8:high",
       "openrouter/x-ai/grok-4.5",
-      "openrouter/z-ai/glm-5.2:high"
+      "openrouter/z-ai/glm-5.2:xhigh"
     ],
     excludedTools: ["ask_user_question"],
 };

package/dist/builtin/workflows/builtin/shared-prompts.ts

@@ -117,10 +117,13 @@ export const CONTRACT_FIDELITY_AUDIT = [
 ].join("\n");
 
 export const REVIEWER_INTERCOM_COORDINATION_PROTOCOL = [
-  "Concurrent reviewer coordination:",
+  "Concurrent reviewer coordination (constructive quorum):",
   "- At review start, use Intercom to discover sibling reviewers and share validation plans and check ownership.",
   "- Claim, serialize, announce, and release expensive or conflicting shared-checkout/environment work such as suites, builds, package operations, browser/E2E sessions, migrations, and generated-artifact steps; share reusable command evidence.",
-  "- Coordination is operational only: inspect independently and return your own verdict rather than copying or deferring to sibling conclusions.",
+  "- First, inspect independently and form a preliminary assessment before reading or relying on sibling findings or verdicts. After the exchange, inspect independently and return your own verdict rather than copying or deferring to sibling conclusions.",
+  "- Then run exactly one bounded evidence-exchange round over Intercom: share your preliminary verdict, concise findings, and evidence; challenge blocking findings, surface defects a sibling missed, and correct objective/acceptance-criteria misreadings. Do not start a second round or continue substantive discussion.",
+  "- Verdicts change only through concrete evidence, never through deference to a sibling's approval or rejection; inspect shared evidence yourself before deciding.",
+  "- In `overall_explanation`, record whether deliberation changed your preliminary verdict and, if it did, which concrete evidence caused the change. If it did not, say so; return your own structured decision even when dissent remains.",
 ].join("\n");
 
 export const REVIEWER_INDEPENDENT_VERIFICATION_CONTRACT = [

package/dist/builtin/workflows/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/workflows",
-  "version": "0.9.12",
+  "version": "0.9.13-alpha.2",
   "private": true,
   "description": "Atomic extension for multi-stage workflow authoring and execution.",
   "contributors": [
@@ -83,7 +83,7 @@
   },
   "peerDependencies": {
     "@bastani/atomic": "*",
-    "@earendil-works/pi-tui": "^0.83.0"
+    "@earendil-works/pi-tui": "^0.84.1"
   },
   "peerDependenciesMeta": {
     "@bastani/atomic": {

package/dist/builtin/workflows/src/durable/backend.ts

@@ -203,6 +203,11 @@ export class InMemoryDurableBackend implements DurableWorkflowBackend {
 				: existing?.handle.invocationCwd !== undefined
 					? { invocationCwd: existing.handle.invocationCwd }
 					: {}),
+			...(handle.origin !== undefined
+				? { origin: handle.origin }
+				: existing?.handle.origin !== undefined
+					? { origin: existing.handle.origin }
+					: {}),
 			...(handle.workflowCwd !== undefined
 				? { workflowCwd: handle.workflowCwd }
 				: existing?.handle.workflowCwd !== undefined
@@ -226,7 +231,7 @@ export class InMemoryDurableBackend implements DurableWorkflowBackend {
 			...(handle.rootWorkflowId !== undefined ? { rootWorkflowId: handle.rootWorkflowId } : {}),
 			...(handle.resumable !== undefined ? { resumable: handle.resumable } : {}),
 			...workflowFailureFields(
-				handle.error !== undefined ? handle : handle.status === "running" ? undefined : existing?.handle,
+				hasWorkflowFailureMetadata(handle) ? handle : handle.status === "running" ? undefined : existing?.handle,
 			),
 			...(handle.ownerExecutorId !== undefined
 				? { ownerExecutorId: handle.ownerExecutorId }
@@ -366,6 +371,8 @@ export class InMemoryDurableBackend implements DurableWorkflowBackend {
 		rec.handle = {
 			...rec.handle,
 			error: undefined,
+			exited: undefined,
+			exitReason: undefined,
 			failureKind: undefined,
 			failureCode: undefined,
 			failureRecoverability: undefined,
@@ -474,6 +481,7 @@ export class InMemoryDurableBackend implements DurableWorkflowBackend {
 			...(h.resumable !== undefined ? { resumable: h.resumable } : {}),
 			...workflowFailureFields(h),
 			...(h.invocationCwd !== undefined ? { invocationCwd: h.invocationCwd } : {}),
+			...(h.origin !== undefined ? { origin: h.origin } : {}),
 			...(h.workflowCwd !== undefined ? { workflowCwd: h.workflowCwd } : {}),
 			...(h.repositoryRoot !== undefined ? { repositoryRoot: h.repositoryRoot } : {}),
 			...(h.gitWorktreeRoot !== undefined ? { gitWorktreeRoot: h.gitWorktreeRoot } : {}),
@@ -521,12 +529,27 @@ function isHistoricalHandle(handle: DurableWorkflowHandle): boolean {
 	);
 }
 
+function hasWorkflowFailureMetadata(handle: Partial<DurableWorkflowHandle>): boolean {
+	return (
+		handle.error !== undefined ||
+		handle.exited !== undefined ||
+		handle.exitReason !== undefined ||
+		handle.failureKind !== undefined ||
+		handle.failureCode !== undefined ||
+		handle.failureRecoverability !== undefined ||
+		handle.failureDisposition !== undefined ||
+		handle.failedToolNodeId !== undefined
+	);
+}
+
 function workflowFailureFields(
 	handle: Partial<DurableWorkflowHandle> | undefined,
 ): Partial<DurableWorkflowFailureMetadata> {
 	if (handle === undefined) return {};
 	return {
 		...(handle.error !== undefined ? { error: handle.error } : {}),
+		...(handle.exited !== undefined ? { exited: handle.exited } : {}),
+		...(handle.exitReason !== undefined ? { exitReason: handle.exitReason } : {}),
 		...(handle.failureKind !== undefined ? { failureKind: handle.failureKind } : {}),
 		...(handle.failureCode !== undefined ? { failureCode: handle.failureCode } : {}),
 		...(handle.failureRecoverability !== undefined ? { failureRecoverability: handle.failureRecoverability } : {}),
@@ -554,6 +577,7 @@ function toResumableEntry(handle: DurableWorkflowHandle): ResumableWorkflowEntry
 		...(handle.resumable !== undefined ? { resumable: handle.resumable } : {}),
 		...workflowFailureFields(handle),
 		...(handle.invocationCwd !== undefined ? { invocationCwd: handle.invocationCwd } : {}),
+		...(handle.origin !== undefined ? { origin: handle.origin } : {}),
 		...(handle.workflowCwd !== undefined ? { workflowCwd: handle.workflowCwd } : {}),
 		...(handle.repositoryRoot !== undefined ? { repositoryRoot: handle.repositoryRoot } : {}),
 		...(handle.gitWorktreeRoot !== undefined ? { gitWorktreeRoot: handle.gitWorktreeRoot } : {}),

package/dist/builtin/workflows/src/durable/completed-catalog-stage-groups.ts

@@ -119,15 +119,27 @@ export function validateRunGroups(
 	grouped: Map<string, StageDraft[]>,
 	rootRunId: string,
 	tools: readonly DurableToolCheckpoint[],
+	checkpoints: readonly DurableCheckpoint[],
 ): boolean {
 	const toolsFor = (runId: string) =>
 		tools.filter((checkpoint) => (checkpoint.topology?.run?.runId ?? rootRunId) === runId);
 	const owners = new Map<string, StageDraft>();
+	const syntheticChildIds = new Set<string>();
 	for (const [parentRunId, drafts] of grouped) {
 		for (const draft of drafts) {
 			const childRunId = childRunIdFromDraft(draft);
 			if (childRunId === undefined) continue;
-			if (!grouped.has(childRunId) || childRunId === parentRunId || owners.has(childRunId)) return false;
+			if (childRunId === parentRunId || owners.has(childRunId)) return false;
+			if (!grouped.has(childRunId)) {
+				if (
+					!isSyntheticExitedChild(draft, parentRunId, childRunId, rootRunId) ||
+					childScopedEvidenceExists(checkpoints, draft.replayKey, childRunId)
+				)
+					return false;
+				syntheticChildIds.add(childRunId);
+				owners.set(childRunId, draft);
+				continue;
+			}
 			const childRun = runTopologyFor(grouped.get(childRunId)!, toolsFor(childRunId));
 			if (
 				childRun?.parentRunId !== parentRunId ||
@@ -146,6 +158,7 @@ export function validateRunGroups(
 			return false;
 	}
 	for (const runId of owners.keys()) {
+		if (syntheticChildIds.has(runId)) continue;
 		const seen = new Set<string>();
 		let current: string | undefined = runId;
 		while (current !== undefined && current !== rootRunId) {
@@ -158,6 +171,48 @@ export function validateRunGroups(
 	return true;
 }
 
+export function isSyntheticExitedChild(
+	draft: StageDraft,
+	parentRunId: string,
+	childRunId: string,
+	rootRunId: string,
+): boolean {
+	const child = workflowChildFromDraft(draft);
+	const boundary = draft.topology?.boundary;
+	return (
+		child?.runId === childRunId &&
+		child.exited === true &&
+		boundary?.event === "terminal" &&
+		boundary.status === "completed" &&
+		boundary.child.runId === childRunId &&
+		boundary.child.parentRunId === parentRunId &&
+		boundary.child.parentStageId === draft.topology?.stageId &&
+		boundary.child.rootRunId === rootRunId
+	);
+}
+
+/** Raw scoped records disprove a zero-stage child reconstruction. */
+export function childScopedEvidenceExists(
+	checkpoints: readonly DurableCheckpoint[],
+	boundaryReplayKey: string,
+	childRunId: string,
+): boolean {
+	const prefix = `${boundaryReplayKey}:`;
+	return checkpoints.some((checkpoint) => {
+		const lookupIdentity =
+			checkpoint.kind === "tool"
+				? checkpoint.argsHash
+				: checkpoint.kind === "ui"
+					? checkpoint.promptHash
+					: checkpoint.replayKey;
+		return (
+			checkpoint.checkpointId.startsWith(prefix) ||
+			lookupIdentity.startsWith(prefix) ||
+			(checkpoint.kind !== "ui" && checkpoint.topology?.run?.runId === childRunId)
+		);
+	});
+}
+
 export function retainReachableRunGroups(grouped: Map<string, StageDraft[]>, rootRunId: string): void {
 	const reachable = new Set([rootRunId]);
 	const pending = [rootRunId];
@@ -267,14 +322,16 @@ function valueOrExisting<
 
 export function workflowChildFromDraft(draft: StageDraft): StageSnapshot["workflowChild"] | undefined {
 	const strict = parseWorkflowChildResult(draft.output);
-	const child = strict ?? (hasCurrentStageIdentity(draft) ? undefined : parseLegacyWorkflowChildResult(draft.output));
+	const legacy = hasCurrentStageIdentity(draft) ? undefined : parseLegacyWorkflowChildResult(draft.output);
+	const child = strict ?? legacy;
 	if (child === undefined) return undefined;
+	const exited = strict?.exited ?? false;
 	return {
 		alias: child.workflow,
 		workflow: child.workflow,
 		runId: child.runId,
 		status: child.status,
-		...(child.exited !== undefined ? { exited: child.exited } : {}),
+		exited,
 		outputs: child.outputs,
 		...(typeof child.exitReason === "string" ? { exitReason: child.exitReason } : {}),
 	};

package/dist/builtin/workflows/src/durable/completed-catalog.ts

@@ -7,7 +7,9 @@ import {
 	boundaryOwner,
 	childRunIdFromDraft,
 	childRunStatus,
+	childScopedEvidenceExists,
 	compareDraftSourceOrder,
+	isSyntheticExitedChild,
 	mergeStageDraft,
 	mergeStageGroup,
 	retainReachableRunGroups,
@@ -107,6 +109,8 @@ export function completedWorkflowRunSnapshots(
 		endedAt: handle.updatedAt,
 		durationMs: rootDuration,
 		...(handle.error !== undefined ? { error: handle.error } : {}),
+		...(handle.exited !== undefined ? { exited: handle.exited } : {}),
+		...(handle.exitReason !== undefined ? { exitReason: handle.exitReason } : {}),
 		...(handle.failureKind !== undefined ? { failureKind: handle.failureKind } : {}),
 		...(handle.failureCode !== undefined ? { failureCode: handle.failureCode } : {}),
 		...(handle.failureRecoverability !== undefined ? { failureRecoverability: handle.failureRecoverability } : {}),
@@ -284,7 +288,26 @@ function runSnapshotsFromCheckpoints(
 	}
 	for (const group of grouped.values()) group.sort(compareDraftSourceOrder);
 	retainReachableRunGroups(grouped, rootRunId);
-	if (!validateRunGroups(grouped, rootRunId, toolCheckpoints)) return [];
+	if (!validateRunGroups(grouped, rootRunId, toolCheckpoints, checkpoints)) return [];
+	const syntheticChildren: Array<{
+		readonly parentRunId: string;
+		readonly owner: StageDraft;
+		readonly child: NonNullable<StageSnapshot["workflowChild"]>;
+	}> = [];
+	for (const [parentRunId, runDrafts] of grouped) {
+		for (const draft of runDrafts) {
+			const child = workflowChildFromDraft(draft);
+			if (child?.exited !== true || grouped.has(child.runId)) continue;
+			if (
+				!isSyntheticExitedChild(draft, parentRunId, child.runId, rootRunId) ||
+				childScopedEvidenceExists(checkpoints, draft.replayKey, child.runId)
+			) {
+				if (strict) return [];
+				continue;
+			}
+			syntheticChildren.push({ parentRunId, owner: draft, child });
+		}
+	}
 
 	const idMaps = new Map<string, Map<string, string>>();
 	for (const [runId, runDrafts] of grouped) {
@@ -321,6 +344,7 @@ function runSnapshotsFromCheckpoints(
 	}
 
 	const runs: RunSnapshot[] = [];
+	const emittedRunIds = new Set<string>();
 	for (const [runId, runDrafts] of grouped) {
 		const ids = idMaps.get(runId)!;
 		const ownedTools = toolCheckpoints.filter(
@@ -361,6 +385,7 @@ function runSnapshotsFromCheckpoints(
 		const parentStageId =
 			declaredParentStageId ??
 			(boundarySourceId === undefined ? undefined : idMaps.get(parentRunId)?.get(boundarySourceId));
+		const ownerChild = owner === undefined ? undefined : workflowChildFromDraft(owner);
 		runs.push({
 			id: runId,
 			name: run?.runName ?? rootRunName,
@@ -374,6 +399,47 @@ function runSnapshotsFromCheckpoints(
 			...(run?.parentRunId !== undefined ? { parentRunId: run.parentRunId } : {}),
 			...(parentStageId !== undefined ? { parentStageId } : {}),
 			...(run?.rootRunId !== undefined ? { rootRunId: run.rootRunId } : {}),
+			...(ownerChild?.exited === true
+				? {
+						result: ownerChild.outputs,
+						exited: true,
+						...(ownerChild.exitReason !== undefined ? { exitReason: ownerChild.exitReason } : {}),
+					}
+				: {}),
+			resumable: false,
+		});
+		emittedRunIds.add(runId);
+	}
+	for (const { parentRunId, owner, child } of syntheticChildren) {
+		if (!emittedRunIds.has(parentRunId)) {
+			if (strict) return [];
+			continue;
+		}
+		const topology = owner.topology!;
+		const boundary = topology.boundary!;
+		const parentStageId = idMaps.get(parentRunId)?.get(topology.stageId);
+		if (parentStageId === undefined) {
+			if (strict) return [];
+			continue;
+		}
+		const startedAt = owner.startedAt ?? owner.firstCompletedAt;
+		const endedAt = owner.endedAt ?? owner.firstCompletedAt;
+		runs.push({
+			id: child.runId,
+			name: boundary.child.runName,
+			inputs: {},
+			status: child.status,
+			stages: [],
+			toolNodes: [],
+			startedAt,
+			endedAt,
+			durationMs: Math.max(0, endedAt - startedAt),
+			parentRunId,
+			parentStageId,
+			rootRunId: boundary.child.rootRunId,
+			result: child.outputs,
+			exited: true,
+			...(child.exitReason !== undefined ? { exitReason: child.exitReason } : {}),
 			resumable: false,
 		});
 	}

package/dist/builtin/workflows/src/durable/completed-subtree.ts

@@ -1,6 +1,7 @@
 import type { RunSnapshot } from "../shared/store-types.js";
 import type { DurableWorkflowBackend } from "./backend.js";
 import { durableNestedRunSnapshots } from "./completed-catalog.js";
+import { parseWorkflowChildResult } from "./workflow-child-result.js";
 
 /** Return one cached boundary's exact subtree only when every selected node is fully terminal. */
 export function durableCompletedNestedRunSubtree(
@@ -10,6 +11,12 @@ export function durableCompletedNestedRunSubtree(
 ): readonly RunSnapshot[] | undefined {
 	const nested = durableNestedRunSnapshots(backend, rootWorkflowId);
 	if (!nested.some((run) => run.id === childRunId)) return undefined;
+	const intentionalExitStatuses = new Map<string, RunSnapshot["status"]>();
+	for (const checkpoint of backend.listCheckpoints(rootWorkflowId)) {
+		if (checkpoint.kind !== "stage") continue;
+		const child = parseWorkflowChildResult(checkpoint.output);
+		if (child?.exited === true) intentionalExitStatuses.set(child.runId, child.status);
+	}
 	const included = new Set([childRunId]);
 	let priorSize = -1;
 	while (priorSize !== included.size) {
@@ -20,16 +27,24 @@ export function durableCompletedNestedRunSubtree(
 	}
 	const subtree = nested.filter((run) => included.has(run.id));
 	const complete =
-		subtree.length === included.size &&
-		subtree.every(
-			(run) =>
-				run.status === "completed" &&
-				run.endedAt !== undefined &&
-				run.stages.every((stage) => isTerminalStage(stage.status) && stage.endedAt !== undefined),
-		);
+		subtree.length === included.size && subtree.every((run) => isCompleteCachedRun(run, intentionalExitStatuses));
 	return complete ? subtree : undefined;
 }
 
+function isCompleteCachedRun(
+	run: RunSnapshot,
+	intentionalExitStatuses: ReadonlyMap<string, RunSnapshot["status"]>,
+): boolean {
+	if (
+		run.endedAt === undefined ||
+		!run.stages.every((stage) => isTerminalStage(stage.status) && stage.endedAt !== undefined)
+	) {
+		return false;
+	}
+	if (run.status === "completed" || run.exited === true) return true;
+	return intentionalExitStatuses.get(run.id) === run.status;
+}
+
 function isTerminalStage(status: RunSnapshot["stages"][number]["status"]): boolean {
 	return status === "completed" || status === "failed" || status === "skipped";
 }

package/dist/builtin/workflows/src/durable/dbos-metadata.ts

@@ -1,3 +1,4 @@
+import type { WorkflowActor } from "../shared/store-types.js";
 import type { WorkflowSerializableValue } from "../shared/types.js";
 import {
 	isWorkflowFailureCode,
@@ -58,6 +59,8 @@ export function encodeMetadata(metadata: DurableWorkflowMetadata): WorkflowSeria
 			...(metadata.label !== undefined ? { label: metadata.label } : {}),
 			...(metadata.rootWorkflowId !== undefined ? { rootWorkflowId: metadata.rootWorkflowId } : {}),
 			...(metadata.resumable !== undefined ? { resumable: metadata.resumable } : {}),
+			...(metadata.exited !== undefined ? { exited: metadata.exited } : {}),
+			...(metadata.exitReason !== undefined ? { exitReason: metadata.exitReason } : {}),
 			...(metadata.error !== undefined ? { error: metadata.error } : {}),
 			...(metadata.failureKind !== undefined ? { failureKind: metadata.failureKind } : {}),
 			...(metadata.failureCode !== undefined ? { failureCode: metadata.failureCode } : {}),
@@ -66,6 +69,7 @@ export function encodeMetadata(metadata: DurableWorkflowMetadata): WorkflowSeria
 				: {}),
 			...(metadata.failureDisposition !== undefined ? { failureDisposition: metadata.failureDisposition } : {}),
 			...(metadata.failedToolNodeId !== undefined ? { failedToolNodeId: metadata.failedToolNodeId } : {}),
+			...(metadata.origin !== undefined ? { origin: metadata.origin } : {}),
 			...(metadata.invocationCwd !== undefined ? { invocationCwd: metadata.invocationCwd } : {}),
 			...(metadata.workflowCwd !== undefined ? { workflowCwd: metadata.workflowCwd } : {}),
 			...(metadata.repositoryRoot !== undefined ? { repositoryRoot: metadata.repositoryRoot } : {}),
@@ -154,6 +158,8 @@ function parseDurableWorkflowMetadata(
 		(metadata.label !== undefined && typeof metadata.label !== "string") ||
 		(metadata.rootWorkflowId !== undefined && typeof metadata.rootWorkflowId !== "string") ||
 		(metadata.resumable !== undefined && typeof metadata.resumable !== "boolean") ||
+		(metadata.exited !== undefined && typeof metadata.exited !== "boolean") ||
+		(metadata.exitReason !== undefined && typeof metadata.exitReason !== "string") ||
 		(metadata.error !== undefined && typeof metadata.error !== "string") ||
 		(metadata.failureKind !== undefined && !isWorkflowFailureKind(metadata.failureKind)) ||
 		(metadata.failureCode !== undefined && !isWorkflowFailureCode(metadata.failureCode)) ||
@@ -167,7 +173,15 @@ function parseDurableWorkflowMetadata(
 		(metadata.gitWorktreeRoot !== undefined && typeof metadata.gitWorktreeRoot !== "string")
 	)
 		return undefined;
-	return metadata as DurableWorkflowMetadata;
+	const { origin, ...metadataWithoutOrigin } = metadata;
+	return {
+		...metadataWithoutOrigin,
+		...(isWorkflowActor(origin) ? { origin } : {}),
+	} as DurableWorkflowMetadata;
+}
+
+function isWorkflowActor(value: WorkflowSerializableValue | undefined): value is WorkflowActor {
+	return value === "user" || value === "agent";
 }
 
 function isDurableWorkflowStatus(value: string): value is DurableWorkflowStatus {

package/dist/builtin/workflows/src/durable/local-command.ts

@@ -2,6 +2,7 @@
 
 import { spawn } from "node:child_process";
 import { connect } from "node:net";
+import { createChildProcessEnvironment } from "@bastani/atomic";
 
 export interface LocalCommandResult {
 	readonly exitCode: number;
@@ -27,7 +28,7 @@ export function runLocalCommand(
 		const child = spawn(command, [...args], {
 			stdio: ["ignore", "pipe", "pipe"],
 			windowsHide: true,
-			...(options?.env !== undefined ? { env: { ...process.env, ...options.env } } : {}),
+			env: createChildProcessEnvironment(options?.env ? { ...options.env } : undefined),
 			...(options?.uid !== undefined ? { uid: options.uid } : {}),
 			...(options?.gid !== undefined ? { gid: options.gid } : {}),
 		});