@bastani/atomic 0.9.13-alpha.1 → 0.9.13-alpha.3

package/dist/builtin/workflows/CHANGELOG.md

@@ -6,6 +6,63 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.9.13-alpha.3] - 2026-08-13
+
+### Changed
+
+- Workflow model fallback attempt metadata now includes per-attempt input/output tokens, cache reads/writes, provider-reported total cost, and meaningful assistant-turn counts when usage is available ([#2197](https://github.com/bastani-inc/atomic/issues/2197)).
+
+### Fixed
+
+- Corrected stale README claims that `workflow` tool `runId`/`stageId` targets and expanded-graph stage identifiers accept prefixes; run ids require the full 36-character UUID and stage ids/names match whole, matching `resolveRunId` and `stageMatchesExpandedIdentifier` behavior.
+- Fixed exact workflow inspection returning `Run not found` after process loss even when DBOS retained a stale running, resumable root. `workflow` status/stages/stage/transcript actions with an explicit full run id and `/workflow status <id>` now hydrate only that DBOS root on a local miss, reconstruct its authoritative checkpoint DAG as read-only state, report stale owners as `crashed` with explicit resume guidance, protect fresh foreign owners, distinguish absent/deleted/malformed records, and reject cyclic or nonreciprocal topology without claiming, transitioning, dispatching, or auto-resuming the run. Status without an id remains current-session-only.
+- Fixed long model turns losing their active stage session identity and root liveness when the process died between turn boundaries. Atomic now records stage start before the first session checkpoint, waits for that identity to persist before the first model use, and runs serialized, unref'd 30-second checkpoints for root and nested scoped stages. Heartbeats stop on every exit, refresh root metadata without status transitions, and surface persistent storage or MCP cleanup faults instead of dropping them in detached promise handlers. A checkpoint still in flight when the stage shuts down is drained rather than abandoned, so a late durability failure is never silently discarded, and a stage whose final durability checkpoint fails is recorded as failed instead of completed while its caller still receives the error and its concurrency slot is still released; explicit resume still replays completed effects exactly once.
+
+## [0.9.13-alpha.2] - 2026-08-12
+
+### Breaking Changes
+
+- Custom workflow UI components must return `true` when they consume input and `false` when they do not. In fullscreen mode, an unhandled result lets the transcript process matching viewport navigation keys instead of swallowing them.
+- Added `failed` to the `ctx.exit()` status union. Author-initiated failed exits persist their reason and partial declared outputs, return the discriminated `{ exited: true, status: "failed" }` child result instead of throwing, and default to non-resumable unless `resumable: true` is set. Downstream exhaustive switches over `WorkflowExitStatus` must handle the new failed-exit case ([#2242](https://github.com/bastani-inc/atomic/issues/2242)).
+
+### Changed
+
+- Updated the Ralph research stage model configuration. The primary model moves from `openai-codex/gpt-5.6-luna:max` to `anthropic/claude-opus-5:high`, and the fallback chain is rebuilt around high/xhigh thinking levels: GPT-5.6 Sol at `xhigh` replaces the Luna variants, Claude Fable 5 and Claude Opus 4.8 step up from `low`/`medium` to `high`, GPT-5.5 and GLM-5.2 step up to `xhigh`, and Kimi K3 (`kimi-coding`, `moonshotai`, `moonshotai-cn`, and OpenRouter) plus `openrouter/sakana/fugu-ultra:high` join the chain.
+- Extended workflow-authoring guidance with a stacked implementation-slices starter pattern: authors target roughly 100–500 changed lines between verification points by default, route each slice through a child lifecycle, explicitly create or check out each named branch before its child because `base_branch` and `git_worktree_dir` alone do not create feature branches, stack each verified branch and worktree, and stop at the first failed gate while preserving earlier verification ([#2262](https://github.com/bastani-inc/atomic/issues/2262)).
+- Updated authored-workflow model guidance to treat benchmark thinking levels as measurement settings, assign effort by stage role and failure cost, require a compact `Stage | Model | Thinking | Role` declaration before launch, reserve `max` for high-cost-of-error roles or explicit user requests, and apply catalog-aware role policy to primary and fallback attempts ([#2203](https://github.com/bastani-inc/atomic/issues/2203)).
+- Added bounded constructive-quorum deliberation to Goal and Ralph reviewer prompts: reviewers form independent preliminary verdicts, exchange evidence once over Intercom, and record evidence-backed verdict changes before the existing reducer counts final votes ([#2237](https://github.com/bastani-inc/atomic/issues/2237)).
+
+- Rebuilt the workflow graph overlay on pi-tui 0.84.1's `VStack` and `ScrollView` layout primitives. The graph body now adapts to terminal height and resize, supports vertical wheel scrolling and a draggable scrollbar, and keeps wide-graph horizontal panning and existing prompt/navigation key handling ([#2223](https://github.com/bastani-inc/atomic/issues/2223)).
+- Retired the legacy terminal-row callback thread from graph and stage-chat views. The two fullscreen-frame consumers still read `terminal.rows` directly: GraphView uses it for the overlay frame, and StageChatView uses it for the chat line count, falling back to the unhosted `VIEW_LINE_COUNT = 32` frame when no host is present. `PiCustomComponent.render` supplies only a width, so the #2223 viewport-row criterion remains partial at those call paths ([#2223](https://github.com/bastani-inc/atomic/issues/2223)).
+
+- Workflow command, worktree Git/setup-hook, and Playwright CLI subprocesses now receive `AI_AGENT=atomic` for generic child-process attribution without mutating caller-supplied environment objects.
+
+### Fixed
+- Fixed completed `ctx.exit()` runs losing the reserved returned-status convention, legacy child replay records losing their exit discriminator, and failed author-exit resume surfaces falling back to snapshot inspection instead of durable retry.
+- Fixed workflow graph node cards appending the Codex `fast` marker to dependency metadata; cards now show only topology details such as `root`, `1 dep`, or `<n> deps` while fast-mode state remains available to the stage and its model label ([#2337](https://github.com/bastani-inc/atomic/issues/2337)).
+
+- Fixed the workflow graph overlay statusline echoing the `i-have-adhd` extension's `ADHD Mode` badge. The badge remains in the main-chat footer while other extension statuses continue to render in the overlay ([#2341](https://github.com/bastani-inc/atomic/issues/2341)).
+
+- Fixed fullscreen workflow graph and stage-chat mouse routing. Focused workflow overlays now receive SGR/X10 wheel and click press/release sequences through the host's bounded custom-input reply channel before pi-tui's alternate-screen viewport, restoring graph scrolling and click-to-attach without a workflow-owned TTY-tracking seam; the fullscreen route also mirrors consumed left-button events into pi-tui's application-owned selection path ([#2303](https://github.com/bastani-inc/atomic/issues/2303)).
+- Fixed graph overlay rendering to keep its live vertical position in pi-tui's `ScrollView` and preserve OSC-8 hyperlink terminators when normalizing layout rows.
+
+- Fixed switcher wheel input scrolling an obscured graph and the scrollbar covering the final graph column; overflow now reserves its scrollbar column and the switcher owns wheel selection ([#2223](https://github.com/bastani-inc/atomic/issues/2223)).
+- Restored natural graph geometry for unhosted overlays by removing the fixed-height fallback and kept pi-tui's layout metadata aligned with sparse, deeply scrolled content, so large graphs track their natural geometry without corrupting OSC-8 rows ([#2223](https://github.com/bastani-inc/atomic/issues/2223)).
+
+- Fixed the inline workflow form editor not inheriting the host's `autocompleteMaxVisible` setting when Atomic installs it as a custom editor.
+- Fixed late workflow messages and MCP scope cleanup that finish after an extension reload. Stale event-bus calls now stop without retrying through stale APIs, while active routes keep their normal fallback behavior.
+- Fixed workflow stale-context guards by consuming the host's exported predicate instead of copying its error-message marker.
+- Fixed late-message routing to reject stale drops consistently for Intercom and generic batches, so a resolved route means delivery was accepted instead of silently treating a dropped message as routed; non-stale failures still propagate.
+
+- Fixed the `DISPATCHED` confirmation panel being torn apart by any workflow input containing a newline. Input values were truncated by visible width, which a control character does not have, so an embedded newline survived truncation and emitted extra physical lines that no border ever wrapped — the box was destroyed from that row down. Multi-line inputs are ordinary, so this fired for most real launches: a `prompt` or an `acceptance_criteria` block reliably reproduced it. String values and the object/array JSON projection now collapse control characters, `U+2028`, and `U+2029` to single spaces before truncation, so a run card stays one row per value. `U+2028`/`U+2029` are included because `JSON.stringify` does not escape them and some terminals still break lines on them. As a side effect, escape sequences in an input value can no longer inject ANSI styling into the chat surface.
+- Fixed workflow stages being unable to use the `subagent` tool at all. The stage policy set `managementActions: "full"` and `fanoutAuthorized: false` together, which contradict: stages could neither delegate nor, because of the companion subagents defect, run read-only management such as `subagent list`. Workflow stages are top-level sessions rather than subagent children, so the policy now sets `fanoutAuthorized: true`, restoring the delegation the workflow docs already describe. Nesting remains bounded by the typed in-process depth policy and Rust admission’s five-level ceiling ([#2220](https://github.com/bastani-inc/atomic/pull/2220), regression from [#2205](https://github.com/bastani-inc/atomic/pull/2205)).
+- Fixed nested subagents in workflow-stage sessions losing the bundled `subagent` extension. In-process child resource loading now carries the bundled package roots and disables only the workflow extension's repeated stage lifecycle, so a stage can delegate and its nested child receives the bundled tools instead of only the base built-in ones ([#2220](https://github.com/bastani-inc/atomic/pull/2220), regression from [#2205](https://github.com/bastani-inc/atomic/pull/2205)).
+- Fixed a stage chat opened on a stage that was already mid-turn showing an empty transcript. The stage's assistant message joins the handle's message list only when its turn ends, and streaming updates now carry a delta rather than the message so far, so a chat mounted after the stream started had nothing to draw and nothing that would restate it — a stage held mid-turn stayed blank for the whole turn. The chat now seeds itself from the stage session's in-flight assistant message when it mounts, and the deltas that arrive after that continue the same message.
+
+### Removed
+
+- Removed workflow-owned mouse-scroll reporting and attached-stage copy mode. Fullscreen pi-tui now keeps application-owned drag and multi-click selection available over workflow overlays, and `ctrl+t` is left to the host keybindings. Copy still uses OSC 52; terminals that refuse OSC 52 writes require the modifier-drag bypass (Shift/Option, as provided by the terminal).
+
 ## [0.9.13-alpha.1] - 2026-08-05
 
 ### Added

package/dist/builtin/workflows/README.md

@@ -246,7 +246,7 @@ The child executes as a nested workflow behind a parent boundary stage named `wo
 
 For durable runs, Atomic writes and awaits a versioned boundary-start identity before child code can run. That record fixes the boundary id, child run id, owning root/parent, source order and parents, replay scope, alias, workflow, and a deterministic fingerprint of the child definition plus exact validated inputs across pause, process restart, cached replay, and completed inspection. Distinct-input parallel calls therefore keep their own cache even when restart reverses dispatch order; repeated identical calls share the fingerprint but retain a per-invocation ordinal. A completed child boundary and its `ctx.tool` side effects replay exactly once from the root's scoped checkpoints; only incomplete work continues.
 
-If no valid child graph can stand in for the boundary—including a failed or skipped boundary, a missing or empty child graph, stale or mismatched ownership metadata, or a recursive link that cannot produce a valid expansion—the expanded graph keeps the boundary summary instead of flattening an unrelated or invalid child. Exact expanded ids resolve first; a local id, prefix, or stage name is accepted only when it identifies one visible stage. Inputs are strictly validated against the child workflow before it starts: unknown keys, missing required values, type mismatches, and invalid `select` choices fail before the child body runs. The parent receives the child's declared `outputs` on `child.outputs` after those outputs pass their declared runtime type checks.
+If no valid child graph can stand in for the boundary—including a failed or skipped boundary, a missing or empty child graph, stale or mismatched ownership metadata, or a recursive link that cannot produce a valid expansion—the expanded graph keeps the boundary summary instead of flattening an unrelated or invalid child. Exact expanded ids resolve first; a local id or stage name is accepted only when it identifies one visible stage, and identifiers always match whole—a stage id is never truncated, so a prefix never selects a stage. Inputs are strictly validated against the child workflow before it starts: unknown keys, missing required values, type mismatches, and invalid `select` choices fail before the child body runs. The parent receives the child's declared `outputs` on `child.outputs` after those outputs pass their declared runtime type checks.
 
 For workflows intended to be called as children, declare an `outputs` entry for every non-default field a parent should rely on. `outputs` is only the schema/contract: use normal TypeScript in `run()` to gather values from any stage/task/child workflow and return those keys.
 
@@ -298,6 +298,44 @@ import openClaudeDesignWorkflow from "@bastani/workflows/builtin/open-claude-des
 
 Only `workflow({...})` definitions can be passed to `ctx.workflow(...)`; registry names, strings, and path objects are intentionally not supported for child workflow calls. Missing or invalid module imports fail when the workflow file itself is loaded. A parent receives the child's declared `outputs` from the child `run()` return object. Missing required outputs, schema type mismatches, returning an undeclared output, and non-JSON-serializable returned child values fail the child call before the parent continues.
 
+### Early exit with `ctx.exit()`
+
+Use `ctx.exit()` when the workflow intentionally ends before its normal `run()` return. It accepts `completed | skipped | cancelled | blocked | failed`, an optional reason, partial declared outputs, and `resumable` for an author-initiated failed outcome.
+
+```typescript
+if (allRejected) {
+  return ctx.exit({
+    status: "failed",
+    reason: "The upstream API rejected every candidate",
+    outputs: { attempted: candidates.length },
+    resumable: true, // failed exits default to false
+  });
+}
+```
+
+Choose the status by the outcome:
+
+- `completed` means the objective was met and declared outputs are complete and trustworthy.
+- `skipped` means a precondition made the run a valid no-op; no work was needed.
+- `cancelled` means the work is no longer wanted; it is a decision, not a defect.
+- `blocked` means valid progress needs a changed condition or a later decision. A bounded reviewer or repair loop that does not converge is blocked, not failed.
+- `failed` means required work was attempted and definitively could not complete. Do not use it for a non-converged reviewer loop. Failed exits are non-resumable by default; set `resumable: true` when a later durable retry is intended. `resumable` is valid only with `failed`; another status records a non-resumable authoring failure.
+
+`reason` from a valid author exit is persisted and shown in status and lifecycle notices. An exit rejected during validation is finalized as an ordinary failed run rather than an accepted author exit. `outputs` may be a partial subset of the declared `outputs` contract, but every provided key must be declared, schema-valid, and JSON-serializable. Missing required keys are allowed only on the exit path. A durable retry re-dispatches the workflow with completed checkpoints replayed. The low-level `resumeRun()` helper only inspects terminal runs and reports the durable retry path; it does not silently claim that it resumed one.
+
+When a child uses `ctx.exit()`, `ctx.workflow(child)` returns a discriminated result instead of throwing. Check `child.exited` before reading a required output:
+
+```typescript
+const child = await ctx.workflow(researchWorkflow);
+if (child.exited === true) {
+  // child.status includes failed; outputs may be partial.
+  return ctx.exit({ status: child.status, reason: child.exitReason ?? "research stopped early" });
+}
+return { report: child.outputs.report };
+```
+
+An author-initiated failed exit returns `{ exited: true, status: "failed" }` to its parent with its reason and partial outputs. An unintentional child failure still throws, so `exited` remains an intent discriminator.
+
 ### Reusable Git worktrees
 
 Use `gitWorktreeDir` when a workflow should run in a reusable Git worktree instead of the invoking checkout. The executor creates the worktree if it is missing, reuses it when it already exists as a same-repository worktree root, defaults workflow `ctx.cwd` to the matching path inside that worktree for `worktreeFromInputs`, and defaults stage/task `cwd` to that worktree path.
@@ -425,6 +463,8 @@ export default workflow({
 
 Set `model` and `fallbackModels` on the authored stage/task/chain/parallel item that needs them.
 
+For authored workflows, choose thinking effort by stage role and failure cost rather than copying a benchmark's level onto every stage. Before launch, record each model stage's role, failure cost, primary model, thinking level, and fallback policy, then print a compact `Stage | Model | Thinking | Role` assignment with a short rationale. Reserve `max` for high-cost-of-error roles or an explicit user request; use `high` for demanding analysis, planning, and repair; use `medium` for user-impact review and reporting; and keep deterministic checks as tool nodes with no model call. Apply the same role policy independently to every fallback, not a mechanical `max` inheritance. Use only levels listed in the configured catalog's `availableThinkingLevels`; if a level is unsupported, choose another catalog model or leave the stage unpinned rather than inventing a suffix.
+
 When pi exposes its model registry, workflow runs validate user-specified `model` / `fallbackModels` before starting model-backed work and report all unavailable or ambiguous IDs together. Bare model IDs are accepted only when they resolve uniquely or match the current provider; otherwise use `provider/model`. Fallback attempts may send the same prompt/context to a different provider, so choose fallbacks that fit your cost, privacy, and data-handling requirements.
 
 ### `createRegistry` — grouping workflows
@@ -595,7 +635,7 @@ Tradeoff: `Type.Unsafe<T>()` does not deeply validate at runtime — it trusts t
 
 Input overrides are bare `key=value` tokens (no leading `--`). Values are JSON-parsed when possible, so numbers, booleans, and quoted strings work as expected (e.g. `count=3`, `flag=true`, `prompt="multi word value"`). A whole-object override can be passed as a single JSON token (e.g. `{"prompt":"...","count":3}`). Runtime validation is strict: unknown input keys, missing required values, type mismatches, and invalid `select` choices fail before a named workflow run starts.
 
-Named workflow launches always run as **background tasks** in interactive sessions. Run `/workflow connect <run>` to see agents working and chat with and steer each stage. Foreground launches are reserved for explicit user requests or technical requirements, with notice before launch. Press **F2** to open the same live graph viewer; HIL prompts (`ctx.ui.input/confirm/select/editor/custom`) appear as awaiting-input graph nodes. Press Enter on a focused node, or click a visible graph node directly, to open that stage and answer locally, never as a modal dialog over the chat. `ctrl+x` is the workflow hierarchy chord: attached stage chats show **ctrl+x return to graph**, while graph surfaces show **ctrl+x leave graph · return to main chat**. Workflow surfaces consume it before configurable editor/tool actions. Composer and prompt drafts survive leaving a stage, and pending custom questions remain pending for reattachment. `ctrl+d` and `q` are not workflow navigation controls; ordinary editor/prompt Ctrl+D behavior and printable prompt `q` remain available. Existing `esc`, `ctrl+c`, and graph `h` close/hide behavior is unchanged. While the graph pane is active, vertical wheel/trackpad gestures pan vertically and horizontal gestures pan wide graphs left and right when the terminal reports them, without falling through to the main chat or terminal scrollback. Attached stage chats capture mouse/trackpad wheel events by default so scrolling stays inside the active stage transcript or prompt instead of falling through to terminal/main-chat scrollback. Press `ctrl+t` to toggle **copy mode**: copy mode disables workflow-chat mouse reporting so normal terminal/tmux text selection can work; press `ctrl+t` again to leave copy mode and restore workflow-chat scrolling. Archived read-only stage transcripts show the same copy-mode footer/status, allowing their transcript text to be selected and copied while preserving `esc` close and `ctrl+x` graph navigation. While copy mode is on, wheel/trackpad gestures are handled by the terminal/tmux and may scroll terminal scrollback, so leave copy mode before using the wheel again. Human input is detected when those runtime `ctx.ui.*` calls execute; workflows no longer have a declaration-time HIL flag.
+Named workflow launches always run as **background tasks** in interactive sessions. Run `/workflow connect <run>` to see agents working and chat with and steer each stage. Foreground launches are reserved for explicit user requests or technical requirements, with notice before launch. Press **F2** to open the same live graph viewer; HIL prompts (`ctx.ui.input/confirm/select/editor/custom`) appear as awaiting-input graph nodes. Press Enter on a focused node, or click a visible graph node directly, to open that stage and answer locally, never as a modal dialog over the chat. `ctrl+x` is the workflow hierarchy chord: attached stage chats show **ctrl+x return to graph**, while graph surfaces show **ctrl+x leave graph · return to main chat**. Workflow surfaces consume it before configurable editor/tool actions. Composer and prompt drafts survive leaving a stage, and pending custom questions remain pending for reattachment. `ctrl+d` and `q` are not workflow navigation controls; ordinary editor/prompt Ctrl+D behavior and printable prompt `q` remain available. Existing `esc`, `ctrl+c`, and graph `h` close/hide behavior is unchanged. While the graph pane is active, vertical wheel/trackpad gestures pan vertically and horizontal gestures pan wide graphs left and right when the terminal reports them, without falling through to the main chat or terminal scrollback. Focused graph and stage-chat overlays receive those gestures through the fullscreen application route. Fullscreen pi-tui owns application selection, so drag and multi-click selection also work over workflow overlays; copied text uses OSC 52, and terminals that refuse OSC 52 writes rely on the modifier-drag bypass (Shift/Option, as provided by the terminal). `ctrl+t` is not a workflow control: focused workflow overlays leave it to the host `app.thinking.toggle` action, while inline tree selectors keep `app.tree.filter.noTools`. Human input is detected when those runtime `ctx.ui.*` calls execute; workflows no longer have a declaration-time HIL flag.
 
 Typing into an attached stage chat and pressing Enter steers: the message is consumed after the current assistant response finishes its tool batch and before the next model request, matching normal session steering. Ctrl+F queues a follow-up, consumed only when the agent would otherwise stop. Queued entries belong to the stage session rather than the pane, so leaving the stage and reattaching restores the pending `Steering:` / `Follow-up:` rows, and a detached stage node carries a `✉ N queued` badge in the graph.
 
@@ -623,8 +663,8 @@ Raw stage-chat prompt answer replay is live-memory only. `StageSnapshot.promptAn
     "workflow": "string (optional) — workflow ID or normalized name",
     "inputs": "object (optional) — key/value map of workflow inputs",
     "action": "'run' | 'list' | 'get' | 'inputs' | 'models' | 'status' | 'stages' | 'stage' | 'transcript' | 'send' | 'pause' | 'interrupt' | 'quit' | 'resume' | 'reload'",
-    "runId": "optional run id or unique prefix; control actions default to the active run where safe; use '--all' or all:true for pause/interrupt/quit all",
-    "stageId": "optional stage id, prefix, or name for stage-scoped actions; cannot be combined with all:true",
+    "runId": "optional full 36-character run id; prefixes are rejected; control actions default to the active run where safe; use '--all' or all:true for pause/interrupt/quit all",
+    "stageId": "optional exact stage id or exact stage name for stage-scoped actions; prefixes and partial names are rejected; cannot be combined with all:true",
     "statusFilter": "optional filter for stages or the no-runId status run listing: pending/running/awaiting_input/paused/blocked/completed/failed/skipped/cancelled/killed/all; for the status listing, run statuses match directly and awaiting_input selects runs with a pending human prompt",
     "format": "optional agent-facing output format: text or json",
     "limit": "transcript-only explicit maximum number of recent entries; omitted with tail omitted uses the path-only default when sessionFile/transcriptPath exists",

package/dist/builtin/workflows/builtin/open-claude-design-utils.ts

@@ -3,6 +3,7 @@ import { mkdirSync } from "node:fs";
 import { tmpdir, userInfo } from "node:os";
 import { join } from "node:path";
 import { Type } from "typebox";
+import { createChildProcessEnvironment } from "@bastani/atomic";
 import type { WorkflowTaskResult } from "../src/shared/types.js";
 
 
@@ -229,6 +230,7 @@ export function ensurePlaywrightCli(): PlaywrightCliStatus {
         stdio: "ignore",
         timeout: 15_000,
         shell: isWindows,
+        env: createChildProcessEnvironment(),
       });
       return probe.status === 0;
     } catch {
@@ -265,6 +267,7 @@ export function ensurePlaywrightCli(): PlaywrightCliStatus {
       stdio: "ignore",
       timeout: 180_000,
       shell: isWindows,
+      env: createChildProcessEnvironment(),
     });
     if (install.status === 0) {
       return {

package/dist/builtin/workflows/builtin/ralph-models.ts

@@ -48,29 +48,34 @@ export const promptEngineerModelConfig = {
 };
 
 export const researchModelConfig = {
-    model: "openai-codex/gpt-5.6-luna:max",
+    model: "anthropic/claude-opus-5:high",
     fallbackModels: [
-      "github-copilot/gpt-5.6-luna:max",
-      "openai/gpt-5.6-luna:max",
-      "anthropic/claude-opus-5:low",
-      "github-copilot/claude-opus-5:low",
-      "anthropic/claude-fable-5:low",
-      "github-copilot/claude-fable-5:low",
-      "openai-codex/gpt-5.5:medium",
-      "github-copilot/gpt-5.5:medium",
-      "openai/gpt-5.5:medium",
-      "anthropic/claude-opus-4-8:medium",
-      "github-copilot/claude-opus-4.8:medium",
+      "github-copilot/claude-opus-5:high",
+      "openai-codex/gpt-5.6-sol:xhigh",
+      "github-copilot/gpt-5.6-sol:xhigh",
+      "openai/gpt-5.6-sol:xhigh",
+      "anthropic/claude-fable-5:high",
+      "github-copilot/claude-fable-5:high",
+      "kimi-coding/k3:max",
+      "moonshotai/kimi-k3:max",
+      "moonshotai-cn/kimi-k3:max",
+      "openai-codex/gpt-5.5:xhigh",
+      "github-copilot/gpt-5.5:xhigh",
+      "openai/gpt-5.5:xhigh",
+      "anthropic/claude-opus-4-8:high",
+      "github-copilot/claude-opus-4.8:high",
       "xai/grok-4.5:high",
-      "zai/glm-5.2:high",
-      "zai-coding-cn/glm-5.2:high",
-      "openrouter/openai/gpt-5.6-luna:max",
-      "openrouter/anthropic/claude-opus-5:low",
-      "openrouter/openai/gpt-5.5:medium",
-      "openrouter/anthropic/claude-fable-5:low",
-      "openrouter/anthropic/claude-opus-4-8:medium",
+      "zai/glm-5.2:xhigh",
+      "zai-coding-cn/glm-5.2:xhigh",
+      "openrouter/anthropic/claude-opus-5:high",
+      "openrouter/openai/gpt-5.6-sol:xhigh",
+      "openrouter/anthropic/claude-fable-5:high",
+      "openrouter/moonshotai/kimi-k3:max",
+      "openrouter/sakana/fugu-ultra:high",
+      "openrouter/openai/gpt-5.5:xhigh",
+      "openrouter/anthropic/claude-opus-4-8:high",
       "openrouter/x-ai/grok-4.5",
-      "openrouter/z-ai/glm-5.2:high"
+      "openrouter/z-ai/glm-5.2:xhigh"
     ],
     excludedTools: ["ask_user_question"],
 };

package/dist/builtin/workflows/builtin/shared-prompts.ts

@@ -117,10 +117,13 @@ export const CONTRACT_FIDELITY_AUDIT = [
 ].join("\n");
 
 export const REVIEWER_INTERCOM_COORDINATION_PROTOCOL = [
-  "Concurrent reviewer coordination:",
+  "Concurrent reviewer coordination (constructive quorum):",
   "- At review start, use Intercom to discover sibling reviewers and share validation plans and check ownership.",
   "- Claim, serialize, announce, and release expensive or conflicting shared-checkout/environment work such as suites, builds, package operations, browser/E2E sessions, migrations, and generated-artifact steps; share reusable command evidence.",
-  "- Coordination is operational only: inspect independently and return your own verdict rather than copying or deferring to sibling conclusions.",
+  "- First, inspect independently and form a preliminary assessment before reading or relying on sibling findings or verdicts. After the exchange, inspect independently and return your own verdict rather than copying or deferring to sibling conclusions.",
+  "- Then run exactly one bounded evidence-exchange round over Intercom: share your preliminary verdict, concise findings, and evidence; challenge blocking findings, surface defects a sibling missed, and correct objective/acceptance-criteria misreadings. Do not start a second round or continue substantive discussion.",
+  "- Verdicts change only through concrete evidence, never through deference to a sibling's approval or rejection; inspect shared evidence yourself before deciding.",
+  "- In `overall_explanation`, record whether deliberation changed your preliminary verdict and, if it did, which concrete evidence caused the change. If it did not, say so; return your own structured decision even when dissent remains.",
 ].join("\n");
 
 export const REVIEWER_INDEPENDENT_VERIFICATION_CONTRACT = [

package/dist/builtin/workflows/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/workflows",
-  "version": "0.9.13-alpha.1",
+  "version": "0.9.13-alpha.3",
   "private": true,
   "description": "Atomic extension for multi-stage workflow authoring and execution.",
   "contributors": [
@@ -83,7 +83,7 @@
   },
   "peerDependencies": {
     "@bastani/atomic": "*",
-    "@earendil-works/pi-tui": "^0.83.0"
+    "@earendil-works/pi-tui": "^0.84.1"
   },
   "peerDependenciesMeta": {
     "@bastani/atomic": {

package/dist/builtin/workflows/src/durable/backend.ts

@@ -44,6 +44,10 @@ export type DurableInactiveDeleteResult =
 	| { readonly ok: true }
 	| { readonly ok: false; readonly reason: "not_found" | "running" };
 
+export type DurableWorkflowHydrationResult =
+	| { readonly kind: "current"; readonly handle: DurableWorkflowHandle }
+	| { readonly kind: "absent" | "deleted" | "malformed" };
+
 /** DBOS is the sole persistent implementation. In-memory is a test seam and the non-durable last-resort fallback. */
 export interface DurableWorkflowBackend {
 	/** Whether state survives the current process. */
@@ -154,6 +158,8 @@ export interface DurableWorkflowBackend {
 
 	/** Hydrate one workflow from persistent storage. */
 	hydrateWorkflow(workflowId: string): Promise<void>;
+	/** Optional exact, read-only hydration classification for targeted inspection. */
+	hydrateWorkflowForInspection?(workflowId: string): Promise<DurableWorkflowHydrationResult>;
 	/** Hydrate all catalog candidates from persistent storage. */
 	hydrateResumableWorkflows(): Promise<void>;
 	promptReservationScope(workflowId: string): { readonly rootWorkflowId: string; readonly scope: string };
@@ -231,7 +237,7 @@ export class InMemoryDurableBackend implements DurableWorkflowBackend {
 			...(handle.rootWorkflowId !== undefined ? { rootWorkflowId: handle.rootWorkflowId } : {}),
 			...(handle.resumable !== undefined ? { resumable: handle.resumable } : {}),
 			...workflowFailureFields(
-				handle.error !== undefined ? handle : handle.status === "running" ? undefined : existing?.handle,
+				hasWorkflowFailureMetadata(handle) ? handle : handle.status === "running" ? undefined : existing?.handle,
 			),
 			...(handle.ownerExecutorId !== undefined
 				? { ownerExecutorId: handle.ownerExecutorId }
@@ -352,6 +358,11 @@ export class InMemoryDurableBackend implements DurableWorkflowBackend {
 	}
 
 	async hydrateWorkflow(_workflowId: string): Promise<void> {}
+	async hydrateWorkflowForInspection(workflowId: string): Promise<DurableWorkflowHydrationResult> {
+		const handle = this.getLoadableWorkflow(workflowId);
+		if (handle !== undefined) return { kind: "current", handle };
+		return { kind: this.deletedWorkflowIds.has(workflowId) ? "deleted" : "absent" };
+	}
 
 	async hydrateResumableWorkflows(): Promise<void> {}
 
@@ -371,6 +382,8 @@ export class InMemoryDurableBackend implements DurableWorkflowBackend {
 		rec.handle = {
 			...rec.handle,
 			error: undefined,
+			exited: undefined,
+			exitReason: undefined,
 			failureKind: undefined,
 			failureCode: undefined,
 			failureRecoverability: undefined,
@@ -527,12 +540,27 @@ function isHistoricalHandle(handle: DurableWorkflowHandle): boolean {
 	);
 }
 
+function hasWorkflowFailureMetadata(handle: Partial<DurableWorkflowHandle>): boolean {
+	return (
+		handle.error !== undefined ||
+		handle.exited !== undefined ||
+		handle.exitReason !== undefined ||
+		handle.failureKind !== undefined ||
+		handle.failureCode !== undefined ||
+		handle.failureRecoverability !== undefined ||
+		handle.failureDisposition !== undefined ||
+		handle.failedToolNodeId !== undefined
+	);
+}
+
 function workflowFailureFields(
 	handle: Partial<DurableWorkflowHandle> | undefined,
 ): Partial<DurableWorkflowFailureMetadata> {
 	if (handle === undefined) return {};
 	return {
 		...(handle.error !== undefined ? { error: handle.error } : {}),
+		...(handle.exited !== undefined ? { exited: handle.exited } : {}),
+		...(handle.exitReason !== undefined ? { exitReason: handle.exitReason } : {}),
 		...(handle.failureKind !== undefined ? { failureKind: handle.failureKind } : {}),
 		...(handle.failureCode !== undefined ? { failureCode: handle.failureCode } : {}),
 		...(handle.failureRecoverability !== undefined ? { failureRecoverability: handle.failureRecoverability } : {}),

package/dist/builtin/workflows/src/durable/completed-catalog-stage-groups.ts

@@ -1,10 +1,11 @@
 import type { RunSnapshot, StageSnapshot } from "../shared/store-types.js";
 import { boundaryTransitionError, resolveBoundaryLifecycle } from "./boundary-lifecycle.js";
-import type {
-	DurableCheckpoint,
-	DurableStageCheckpoint,
-	DurableStageRunTopology,
-	DurableToolCheckpoint,
+import {
+	DURABLE_TOOL_TOPOLOGY_VERSION,
+	type DurableCheckpoint,
+	type DurableStageCheckpoint,
+	type DurableStageRunTopology,
+	type DurableToolCheckpoint,
 } from "./types.js";
 import { parseLegacyWorkflowChildResult, parseWorkflowChildResult } from "./workflow-child-result.js";
 
@@ -28,7 +29,11 @@ export interface StageDraft {
 	readonly topology?: DurableStageCheckpoint["topology"];
 }
 
-export function validBoundaryRecordSet(checkpoints: readonly DurableCheckpoint[], strict: boolean): boolean {
+export function validBoundaryRecordSet(
+	checkpoints: readonly DurableCheckpoint[],
+	strict: boolean,
+	requireActiveFingerprint = false,
+): boolean {
 	const stages = checkpoints.filter((item): item is DurableStageCheckpoint => item.kind === "stage");
 	const boundaries = stages.filter((item) => item.topology?.boundary !== undefined);
 	const startsByReplay = new Map<string, DurableStageCheckpoint[]>();
@@ -47,27 +52,53 @@ export function validBoundaryRecordSet(checkpoints: readonly DurableCheckpoint[]
 		)
 	)
 		return false;
-	return [...startsByReplay.values()].every(
-		(starts) => boundaryTransitionError(starts[0]!, stages, strict) === undefined,
-	);
+	return [...startsByReplay.values()].every((starts) => {
+		const start = starts[0]!;
+		if (boundaryTransitionError(start, stages, strict) !== undefined) return false;
+		if (!requireActiveFingerprint || start.topology!.boundary!.invocationFingerprint !== undefined) return true;
+		return (
+			stages.some(
+				(stage) =>
+					stage.replayKey === start.replayKey &&
+					stage.topology?.boundary?.event === "terminal" &&
+					stage.topology.boundary.status === "completed",
+			) && boundaryTransitionError(start, stages, true) === undefined
+		);
+	});
 }
 
 export function validStageGroup(
 	drafts: readonly StageDraft[],
 	runId: string,
-	allowedNodeIds: ReadonlySet<string> = new Set(),
+	rootRunId: string,
+	tools: readonly DurableToolCheckpoint[] = [],
 ): boolean {
 	if (drafts.some((draft) => draft.topology!.stageId.length === 0)) return false;
-	const stageIds = new Set(drafts.map((draft) => draft.topology!.stageId));
-	if (stageIds.size !== drafts.length) return false;
-	const ids = new Set([...allowedNodeIds, ...stageIds]);
-	if (ids.size !== allowedNodeIds.size + stageIds.size) return false;
+	if (
+		tools.some(
+			(tool) =>
+				tool.topology !== undefined &&
+				(tool.topology.version !== DURABLE_TOOL_TOPOLOGY_VERSION || tool.topology.nodeId.length === 0),
+		)
+	)
+		return false;
+	const stageIds = drafts.map((draft) => draft.topology!.stageId);
+	const toolIds = tools.map((tool) => tool.topology?.nodeId ?? tool.checkpointId);
+	const ids = new Set([...stageIds, ...toolIds]);
+	if (ids.size !== stageIds.length + toolIds.length) return false;
 	const orders = drafts.flatMap((draft) =>
 		draft.topology!.sourceOrder === undefined ? [] : [draft.topology!.sourceOrder],
 	);
 	if (new Set(orders).size !== orders.length) return false;
-	if (drafts.some((draft) => draft.topology!.parentIds.some((parentId) => !ids.has(parentId)))) return false;
-	const runs = drafts.flatMap((draft) => (draft.topology?.run === undefined ? [] : [draft.topology.run]));
+	const parentEntries: ReadonlyArray<readonly [string, readonly string[]]> = [
+		...drafts.map((draft) => [draft.topology!.stageId, draft.topology!.parentIds] as const),
+		...tools.map((tool) => [tool.topology?.nodeId ?? tool.checkpointId, tool.topology?.parentIds ?? []] as const),
+	];
+	if (parentEntries.some(([, parentIds]) => parentIds.some((parentId) => !ids.has(parentId)))) return false;
+	const runs = [
+		...drafts.flatMap((draft) => (draft.topology?.run === undefined ? [] : [draft.topology.run])),
+		...tools.flatMap((tool) => (tool.topology?.run === undefined ? [] : [tool.topology.run])),
+	];
 	const first = runs[0];
 	if (
 		runs.some(
@@ -81,19 +112,26 @@ export function validStageGroup(
 		)
 	)
 		return false;
-	const parents = new Map(drafts.map((draft) => [draft.topology!.stageId, draft.topology!.parentIds]));
+	if (
+		runId === rootRunId &&
+		runs.some(
+			(run) => run.parentRunId !== undefined || run.parentStageId !== undefined || run.rootRunId !== undefined,
+		)
+	)
+		return false;
+	const parents = new Map(parentEntries);
 	const visiting = new Set<string>();
 	const visited = new Set<string>();
-	const cyclic = (stageId: string): boolean => {
-		if (visiting.has(stageId)) return true;
-		if (visited.has(stageId)) return false;
-		visiting.add(stageId);
-		if ((parents.get(stageId) ?? []).some(cyclic)) return true;
-		visiting.delete(stageId);
-		visited.add(stageId);
+	const cyclic = (nodeId: string): boolean => {
+		if (visiting.has(nodeId)) return true;
+		if (visited.has(nodeId)) return false;
+		visiting.add(nodeId);
+		if ((parents.get(nodeId) ?? []).some(cyclic)) return true;
+		visiting.delete(nodeId);
+		visited.add(nodeId);
 		return false;
 	};
-	return ![...stageIds].some(cyclic);
+	return ![...ids].some(cyclic);
 }
 
 export function compareDraftSourceOrder(left: StageDraft, right: StageDraft): number {
@@ -119,15 +157,27 @@ export function validateRunGroups(
 	grouped: Map<string, StageDraft[]>,
 	rootRunId: string,
 	tools: readonly DurableToolCheckpoint[],
+	checkpoints: readonly DurableCheckpoint[],
 ): boolean {
 	const toolsFor = (runId: string) =>
 		tools.filter((checkpoint) => (checkpoint.topology?.run?.runId ?? rootRunId) === runId);
 	const owners = new Map<string, StageDraft>();
+	const syntheticChildIds = new Set<string>();
 	for (const [parentRunId, drafts] of grouped) {
 		for (const draft of drafts) {
 			const childRunId = childRunIdFromDraft(draft);
 			if (childRunId === undefined) continue;
-			if (!grouped.has(childRunId) || childRunId === parentRunId || owners.has(childRunId)) return false;
+			if (childRunId === parentRunId || owners.has(childRunId)) return false;
+			if (!grouped.has(childRunId)) {
+				if (
+					!isSyntheticExitedChild(draft, parentRunId, childRunId, rootRunId) ||
+					childScopedEvidenceExists(checkpoints, draft.replayKey, childRunId)
+				)
+					return false;
+				syntheticChildIds.add(childRunId);
+				owners.set(childRunId, draft);
+				continue;
+			}
 			const childRun = runTopologyFor(grouped.get(childRunId)!, toolsFor(childRunId));
 			if (
 				childRun?.parentRunId !== parentRunId ||
@@ -146,6 +196,7 @@ export function validateRunGroups(
 			return false;
 	}
 	for (const runId of owners.keys()) {
+		if (syntheticChildIds.has(runId)) continue;
 		const seen = new Set<string>();
 		let current: string | undefined = runId;
 		while (current !== undefined && current !== rootRunId) {
@@ -158,6 +209,48 @@ export function validateRunGroups(
 	return true;
 }
 
+export function isSyntheticExitedChild(
+	draft: StageDraft,
+	parentRunId: string,
+	childRunId: string,
+	rootRunId: string,
+): boolean {
+	const child = workflowChildFromDraft(draft);
+	const boundary = draft.topology?.boundary;
+	return (
+		child?.runId === childRunId &&
+		child.exited === true &&
+		boundary?.event === "terminal" &&
+		boundary.status === "completed" &&
+		boundary.child.runId === childRunId &&
+		boundary.child.parentRunId === parentRunId &&
+		boundary.child.parentStageId === draft.topology?.stageId &&
+		boundary.child.rootRunId === rootRunId
+	);
+}
+
+/** Raw scoped records disprove a zero-stage child reconstruction. */
+export function childScopedEvidenceExists(
+	checkpoints: readonly DurableCheckpoint[],
+	boundaryReplayKey: string,
+	childRunId: string,
+): boolean {
+	const prefix = `${boundaryReplayKey}:`;
+	return checkpoints.some((checkpoint) => {
+		const lookupIdentity =
+			checkpoint.kind === "tool"
+				? checkpoint.argsHash
+				: checkpoint.kind === "ui"
+					? checkpoint.promptHash
+					: checkpoint.replayKey;
+		return (
+			checkpoint.checkpointId.startsWith(prefix) ||
+			lookupIdentity.startsWith(prefix) ||
+			(checkpoint.kind !== "ui" && checkpoint.topology?.run?.runId === childRunId)
+		);
+	});
+}
+
 export function retainReachableRunGroups(grouped: Map<string, StageDraft[]>, rootRunId: string): void {
 	const reachable = new Set([rootRunId]);
 	const pending = [rootRunId];
@@ -267,14 +360,16 @@ function valueOrExisting<
 
 export function workflowChildFromDraft(draft: StageDraft): StageSnapshot["workflowChild"] | undefined {
 	const strict = parseWorkflowChildResult(draft.output);
-	const child = strict ?? (hasCurrentStageIdentity(draft) ? undefined : parseLegacyWorkflowChildResult(draft.output));
+	const legacy = hasCurrentStageIdentity(draft) ? undefined : parseLegacyWorkflowChildResult(draft.output);
+	const child = strict ?? legacy;
 	if (child === undefined) return undefined;
+	const exited = strict?.exited ?? false;
 	return {
 		alias: child.workflow,
 		workflow: child.workflow,
 		runId: child.runId,
 		status: child.status,
-		...(child.exited !== undefined ? { exited: child.exited } : {}),
+		exited,
 		outputs: child.outputs,
 		...(typeof child.exitReason === "string" ? { exitReason: child.exitReason } : {}),
 	};