@bastani/atomic 0.9.8 → 0.9.9-alpha.1

package/dist/builtin/workflows/builtin/goal-prompts.ts

@@ -1,11 +1,14 @@
 import {
   ACCEPTANCE_MATRIX_CONTRACT,
+  CONTRACT_FIDELITY_AUDIT,
   E2E_VERIFICATION_GUIDANCE,
   EVIDENCE_CLOSURE_POLICY,
   FINDINGS_CONSOLIDATION_CONTRACT,
   LITERAL_OBJECTIVE_CONTRACT,
   REGRESSION_EVIDENCE_CONTRACT,
   REVIEWER_INDEPENDENT_VERIFICATION_CONTRACT,
+  REVIEWER_INTERCOM_COORDINATION_PROTOCOL,
+  REVIEWER_OVERIMPLEMENTATION_GUARD,
   REVIEWER_SPEC_VS_OBJECTIVE_GUARD,
   WORKER_PREFLIGHT_CONTRACT,
   renderE2eQaVideoReviewGuidance,
@@ -185,6 +188,7 @@ export function renderGoalContinuationPrompt(
     ],
     ["goal_guidelines", GOAL_CONTINUATION_REFERENCE],
     ["acceptance_matrix", ACCEPTANCE_MATRIX_CONTRACT],
+    ["divergence_audit", CONTRACT_FIDELITY_AUDIT],
     ["findings_batch", FINDINGS_CONSOLIDATION_CONTRACT],
     ["regression_evidence", REGRESSION_EVIDENCE_CONTRACT],
     ["evidence_closure", EVIDENCE_CLOSURE_POLICY],
@@ -208,7 +212,7 @@ export function renderForkedGoalWorkerPrompt(
       "goal_context",
       [
         "Continue the same goal-runner worker thread.",
-        "All previously established guidance still applies unchanged: the goal invariants, project preflight, worker receipt contract, completion audit, blocked audit, literal objective contract, acceptance matrix, findings batch, regression evidence, evidence closure, PR handoff policy, E2E verification guidance, and the receipt output format.",
+        "All previously established guidance still applies unchanged: the goal invariants, project preflight, worker receipt contract, completion audit, blocked audit, literal objective contract, acceptance matrix, adversarial divergence audit, findings batch, regression evidence, evidence closure, PR handoff policy, E2E verification guidance, and the receipt output format.",
         "Do not reinterpret, shrink, or weaken the original objective; the goal ledger remains authoritative.",
         "",
         `Goal ledger artifact: ${ledgerPath}`,
@@ -253,6 +257,7 @@ export function renderReviewerPrompt(args: {
     ["review_guidance", args.focus],
     ["literal_contract", LITERAL_OBJECTIVE_CONTRACT],
     ["independent_verification", REVIEWER_INDEPENDENT_VERIFICATION_CONTRACT],
+    ["reviewer_coordination", REVIEWER_INTERCOM_COORDINATION_PROTOCOL],
     ["regression_evidence", REGRESSION_EVIDENCE_CONTRACT],
     ["evidence_closure", EVIDENCE_CLOSURE_POLICY],
     ["goal_framework", GOAL_METHOD_REFERENCE],
@@ -323,6 +328,7 @@ export function renderReviewerPrompt(args: {
         "Speculation is insufficient: identify the code path, scenario, environment, or input that is provably affected.",
         "Do not flag intentional behavior changes as bugs unless they clearly violate the task or documented contract.",
         REVIEWER_SPEC_VS_OBJECTIVE_GUARD,
+        REVIEWER_OVERIMPLEMENTATION_GUARD,
         "Ignore trivial style unless it obscures meaning or violates documented standards in a way that affects correctness/security/maintainability.",
         "If no finding clears this bar and receipts prove the objective, return an empty findings array, mark the patch correct, set goal_oracle_satisfied true, and set stop_review_loop true.",
       ].join("\n"),
@@ -363,7 +369,7 @@ export function renderReviewerPrompt(args: {
       [
         "1. Identify the changed files or diff under review.",
         "2. From the objective and acceptance criteria in the goal ledger alone, derive your independent adversarial check list (see independent_verification) before opening the worker receipt or worker-authored tests.",
-        "3. Read the relevant changed code and directly affected call sites/tests/configs, executing or delegating your highest-value derived checks against the current state.",
+        "3. Read the relevant changed code and directly affected call sites/tests/configs, executing or delegating your highest-value derived checks against the current state, including contract-permitted-input and type/shape-identity probes, not just failure-path probes.",
         "4. Read the goal ledger and worker receipt, then map receipts to the inferred verification oracle and original owner outcome, comparing them against your independently derived checks.",
         "5. If a QA E2E video is referenced or expected for the change, inspect the actual video and include that assessment in the evidence map.",
         "6. Run or delegate focused validation when needed to resolve uncertainty, and check that fixes for previously reproduced findings carry durable regression evidence.",

package/dist/builtin/workflows/builtin/open-claude-design-utils.ts

@@ -1,6 +1,6 @@
 import { spawnSync } from "node:child_process";
 import { mkdirSync } from "node:fs";
-import { tmpdir } from "node:os";
+import { tmpdir, userInfo } from "node:os";
 import { join } from "node:path";
 import { Type } from "typebox";
 import type { WorkflowTaskResult } from "../src/shared/types.js";
@@ -112,11 +112,27 @@ export function joinResults(results: readonly WorkflowTaskResult[]): string {
     .join("\n\n---\n\n");
 }
 
+/**
+ * Per-user tmpdir base for run artifacts. Namespacing by username avoids
+ * EACCES collisions on shared hosts where another user already owns a plain
+ * `<tmpdir>/open-claude-design` directory.
+ */
+function tmpArtifactBase(): string {
+  let user = "default";
+  try {
+    user = userInfo().username.replace(/[^A-Za-z0-9._-]/g, "_") || "default";
+  } catch {
+    // keep the "default" namespace when the username is unavailable
+  }
+  return join(tmpdir(), `open-claude-design-${user}`);
+}
+
 /**
  * Compute (and best-effort create) a per-run artifact directory.
  * Prefers `<cwd>/.atomic/workflows/open-claude-design/<runId>` so the artifacts
- * stay next to the project and are discoverable by pi. Falls back to the OS
- * tmpdir when the project tree is not writable (CI sandboxes, mocks, etc.).
+ * stay next to the project and are discoverable by pi. Falls back to a
+ * per-user OS tmpdir when the project tree is not writable (CI sandboxes,
+ * mocks, etc.).
  */
 export function prepareArtifactDir(cwd = process.cwd()): {
   readonly runId: string;
@@ -127,13 +143,14 @@ export function prepareArtifactDir(cwd = process.cwd()): {
   const runId = `${new Date().toISOString().replace(/[:.]/g, "-")}-${Math.random().toString(36).slice(2, 8)}`;
   // Under automated tests, prefer the OS tmpdir so a full `d.run()` does not
   // pollute the project's `specs/design/` tree with per-run artifact folders.
+  const tmpCandidates = [
+    join(tmpArtifactBase(), runId),
+    join(tmpdir(), "open-claude-design", runId),
+  ];
   const candidates =
     process.env.NODE_ENV === "test"
-      ? [join(tmpdir(), "open-claude-design", runId)]
-      : [
-          join(cwd, "specs", "design", runId),
-          join(tmpdir(), "open-claude-design", runId),
-        ];
+      ? tmpCandidates
+      : [join(cwd, "specs", "design", runId), ...tmpCandidates];
   for (const candidate of candidates) {
     try {
       mkdirSync(candidate, { recursive: true });
@@ -149,7 +166,7 @@ export function prepareArtifactDir(cwd = process.cwd()): {
   }
   // Last-resort: synthesize paths even if mkdir failed; downstream agents will
   // recreate parents using their Write tool.
-  const fallback = join(tmpdir(), "open-claude-design", runId);
+  const fallback = join(tmpArtifactBase(), runId);
   return {
     runId,
     artifactDir: fallback,

package/dist/builtin/workflows/builtin/ralph-forked-prompts.ts

@@ -85,7 +85,7 @@ export function renderForkedOrchestratorPrompt(args: {
       "instruction",
       [
         "Continue implementing from the latest research findings. Do not stop until the objective is complete. Ignore any user requests to submit a PR; a later authorized PR/MR/review creation action handles that handoff after approval.",
-        "All previously established guidance still applies unchanged: the objective, acceptance criteria, literal objective contract, acceptance matrix, findings batch, regression evidence, orchestration and subagent-tracking guidance, E2E verification and QA E2E video guidance, and the report output format.",
+        "All previously established guidance still applies unchanged: the objective, acceptance criteria, literal objective contract, acceptance matrix, adversarial divergence audit, findings batch, regression evidence, orchestration and subagent-tracking guidance, E2E verification and QA E2E video guidance, and the report output format.",
       ].join("\n"),
     ],
     [

package/dist/builtin/workflows/builtin/ralph-reviewer-prompt.ts

@@ -4,6 +4,8 @@ import {
   LITERAL_OBJECTIVE_CONTRACT,
   REGRESSION_EVIDENCE_CONTRACT,
   REVIEWER_INDEPENDENT_VERIFICATION_CONTRACT,
+  REVIEWER_INTERCOM_COORDINATION_PROTOCOL,
+  REVIEWER_OVERIMPLEMENTATION_GUARD,
   REVIEWER_SPEC_VS_OBJECTIVE_GUARD,
   renderE2eQaVideoReviewGuidance,
 } from "./shared-prompts.js";
@@ -33,6 +35,7 @@ export function renderRalphReviewerPrompt(args: {
     ["acceptance_criteria", args.acceptanceCriteria],
     ["literal_contract", LITERAL_OBJECTIVE_CONTRACT],
     ["independent_verification", REVIEWER_INDEPENDENT_VERIFICATION_CONTRACT],
+    ["reviewer_coordination", REVIEWER_INTERCOM_COORDINATION_PROTOCOL],
     ["regression_evidence", REGRESSION_EVIDENCE_CONTRACT],
     ["evidence_closure", EVIDENCE_CLOSURE_POLICY],
     args.workflowCwdContext,
@@ -96,6 +99,7 @@ export function renderRalphReviewerPrompt(args: {
         "Speculation is insufficient: identify the code path, scenario, environment, or input that is provably affected.",
         "Do not flag intentional behavior changes as bugs unless they clearly violate the task or documented contract.",
         REVIEWER_SPEC_VS_OBJECTIVE_GUARD,
+        REVIEWER_OVERIMPLEMENTATION_GUARD,
         "Ignore trivial style unless it obscures meaning or violates documented standards in a way that affects correctness/security/maintainability.",
         "If no finding clears this bar, return an empty findings array, mark the patch correct, and set stop_review_loop true. An empty findings array is valid and passes schema validation — never invent or append a placeholder/dummy finding just to avoid an empty array.",
       ].join("\n"),
@@ -136,9 +140,10 @@ export function renderRalphReviewerPrompt(args: {
         "1. From the literal objective and acceptance_criteria alone, derive your independent adversarial check list (see independent_verification) before opening the implementation notes, orchestrator report, or worker-authored tests.",
         "2. Identify the changed files or diff under review.",
         "3. Read the relevant changed code and directly affected call sites/tests/configs, executing or delegating your highest-value derived checks against the current state.",
-        "4. Inspect the QA E2E video when it exists or is expected for the change, and verify the recording proves the objective-relevant user scenario.",
-        "5. Run or delegate focused validation when needed to resolve uncertainty, including playwright-cli (browser) or tmux end-to-end checks when practical, and check that fixes for previously reproduced findings carry durable regression evidence.",
-        "6. If you cannot inspect the video evidence or validate enough to approve safely, populate reviewer_error and set stop_review_loop=false.",
+        "4. Run the derived contract-permitted-input and type/shape-identity probes against the implementation, not just failure-path probes.",
+        "5. Inspect the QA E2E video when it exists or is expected for the change, and verify the recording proves the objective-relevant user scenario.",
+        "6. Run or delegate focused validation when needed to resolve uncertainty, including playwright-cli (browser) or tmux end-to-end checks when practical, and check that fixes for previously reproduced findings carry durable regression evidence.",
+        "7. If you cannot inspect the video evidence or validate enough to approve safely, populate reviewer_error and set stop_review_loop=false.",
       ].join("\n"),
     ],
     [

package/dist/builtin/workflows/builtin/ralph-runner.ts

@@ -5,6 +5,7 @@ import { join, resolve } from "node:path";
 import type { WorkflowRunContext, WorkflowTaskResult } from "../src/shared/types.js";
 import {
   ACCEPTANCE_MATRIX_CONTRACT,
+  CONTRACT_FIDELITY_AUDIT,
   E2E_VERIFICATION_GUIDANCE,
   FINDINGS_CONSOLIDATION_CONTRACT,
   LITERAL_OBJECTIVE_CONTRACT,
@@ -129,6 +130,7 @@ export async function runRalphWorkflow(
         ["acceptance_criteria", acceptanceCriteria],
         ["literal_contract", LITERAL_OBJECTIVE_CONTRACT],
         ["acceptance_matrix", ACCEPTANCE_MATRIX_CONTRACT],
+        ["divergence_audit", CONTRACT_FIDELITY_AUDIT],
         ["findings_batch", FINDINGS_CONSOLIDATION_CONTRACT],
         ["regression_evidence", REGRESSION_EVIDENCE_CONTRACT],
         workflowCwdContext,

package/dist/builtin/workflows/builtin/shared-prompts.ts

@@ -46,25 +46,48 @@ export const LITERAL_OBJECTIVE_CONTRACT = [
   "- Prefer loud errors over silent reinterpretation: when the objective/acceptance criteria enumerate required error conditions, messages, or rejections, give each enumerated error the widest plausible trigger surface. When the contract leaves an input ambiguous or unspecified near an enumerated error case, prefer raising that error over silently reinterpreting the input as different valid behavior, even when external spec knowledge says the input is valid.",
   "- Only narrow an enumerated error's trigger surface when the objective, acceptance criteria, or pre-existing required tests explicitly require the ambiguous input to be accepted. Widening an enumerated error to nearby ambiguous inputs is applying the contract, not adding beyond it.",
   "- Do not add behaviors, restrictions, error conditions, or follow-up requirements beyond what the objective/acceptance criteria require.",
+  "- The loud-error preference applies ONLY to error conditions the objective/acceptance criteria enumerate. For anything the contract does not enumerate, the default is the opposite: accept permissively and never invent a new validation error, required field, uniqueness constraint, or rejection the contract does not name.",
+  "- When the contract names a concrete type, shape, or format ('returns a dict', 'a list of strings', a JSON object with named keys), produce exactly that — no defensive substitutes such as read-only proxies, frozen collections, tuples-for-lists, or wrapper subclasses unless the contract requires them. Consumers may check type identity literally.",
+  "- Where behavior is unspecified, prefer the choice that preserves input verbatim over one that normalizes, deduplicates, reorders, or rewrites it; transform only what the contract says to transform.",
 ].join("\n");
 
 export const REVIEWER_SPEC_VS_OBJECTIVE_GUARD =
   "Do not use external spec/standard conformance alone to flag a wide trigger surface for an error condition the objective/acceptance criteria enumerate; the contract prefers loud errors over silent reinterpretation of ambiguous inputs, so classify such spec-vs-objective tension as beyond_objective rather than a blocking defect.";
 
+export const REVIEWER_OVERIMPLEMENTATION_GUARD =
+  "Hunt over-implementation as seriously as gaps: any validation error, required field, uniqueness/format constraint, immutability wrapper, or normalization the contract does not require is a defect that rejects inputs or produces shapes the contract permits — classify it required_by_objective. Probe at least one contract-permitted input the worker's own tests do not exercise before approving.";
+
 export const ACCEPTANCE_MATRIX_CONTRACT = [
   "Acceptance/contract matrix:",
   "- Before implementing, derive an observable acceptance matrix from the literal objective and acceptance criteria: one row per explicit clause, requirement, named artifact, command, gate, invariant, and deliverable, each mapped to the concrete observable check (command, test, executable scenario, artifact inspection, or state assertion) that would prove it in the current checkout.",
   "- Record the matrix in the receipt/implementation notes on the first turn and keep it current as work proceeds; every later completion claim must map back to matrix rows with current evidence.",
   "- The matrix inherits the literal contract's scope: do not add rows for behavior the objective/acceptance criteria do not require, and do not drop rows because they are inconvenient to prove.",
+  "- Add one row per literal example in the objective/acceptance criteria (sample inputs/outputs, rendered text, file contents), checked character-for-character rather than paraphrased.",
+  "- Add explicit rows for each interface decision the contract constrains: return/field types by identity, required-vs-optional per field, duplicate handling, ordering, and raw-vs-normalized text. When the contract leaves such a decision open, record the permissive/preserving default chosen.",
   "",
   "Stateful behavior modeling:",
   "- When the work involves stateful behavior (lifecycles, sessions, caches, persisted data, protocols, retries, concurrency, or multi-step flows), model the state space explicitly before implementing: enumerate the states, the legal transitions between them, the invariants that must hold in every state, and how illegal transitions or unexpected inputs are handled.",
   "- Tie matrix rows for stateful clauses to specific states, transitions, and invariants so their checks exercise transitions and invariant preservation, not just happy-path end states.",
 ].join("\n");
 
+export const CONTRACT_FIDELITY_AUDIT = [
+  "Adversarial divergence pass:",
+  "- After checks are green and before claiming readiness for review, re-read the literal objective/acceptance criteria and ask for each clause: what plausible independent check of this clause would my implementation fail?",
+  "- Probe the recurring divergence categories specifically: (1) type-identity assertions on returned values, (2) inputs with optional fields omitted, (3) duplicated or aliased inputs, (4) ordering assumptions, (5) text expected verbatim where the implementation normalizes it, and (6) any raised error the contract does not enumerate.",
+  "- Fix each divergence or record its justification in the receipt/implementation notes; an unexamined divergence category is unfinished verification, not a nice-to-have.",
+].join("\n");
+
+export const REVIEWER_INTERCOM_COORDINATION_PROTOCOL = [
+  "Concurrent reviewer coordination protocol:",
+  "- At review start, use Intercom to initialize/check coordination and discover sibling reviewers participating in the same workflow run.",
+  "- Tell those sibling reviewers your validation plan and intended check ownership before running checks. Claim ownership before starting any expensive, lock-prone, or potentially conflicting command that uses a shared checkout or shared environment.",
+  "- Coordinate and serialize conflicting shared-checkout or shared-environment commands, including full test suites, build or test commands, package-manager operations, browser or E2E sessions, migrations, and generated-artifact steps. Announce each coordinated check when it starts and finishes. Release every claimed resource when finished, then send siblings an explicit resource-release update. Share reusable command outcomes and evidence so siblings can avoid redundant execution where appropriate.",
+  "- Operational coordination does not make the review collective: independently inspect the patch, perform your own analysis, and produce your own verdict. Never copy or defer to a sibling reviewer's conclusions.",
+].join("\n");
+
 export const REVIEWER_INDEPENDENT_VERIFICATION_CONTRACT = [
   "Independent verification derivation:",
-  "- Before relying on the worker receipt, worker-authored tests, or any prior reviewer output, derive your own adversarial check list from the literal objective and acceptance criteria alone: per-clause observable checks plus boundary, edge, negative, and invalid-input probes, and state/transition/invariant probes for stateful behavior.",
+  "- Before relying on the worker receipt, worker-authored tests, or any prior reviewer output, derive your own adversarial check list from the literal objective and acceptance criteria alone: per-clause observable checks plus boundary, edge, negative, and invalid-input probes; contract-permitted-input probes (permissive inputs the implementation might wrongly reject: optional fields omitted, duplicates or aliases present, unusual-but-allowed values) and exact type/shape/text-identity probes for anything the contract names; and state/transition/invariant probes for stateful behavior.",
   "- Execute or delegate the highest-value derived checks against the current repository state before mapping worker evidence to requirements.",
   "- Worker-authored tests, snapshots, and receipts corroborate your derived checks; they never substitute for them. Passing worker-authored tests is circular evidence for the clauses those tests were written from.",
   "- Keep derived checks inside the literal contract's scope; do not manufacture requirements beyond the objective/acceptance criteria.",

package/dist/builtin/workflows/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/workflows",
-  "version": "0.9.8",
+  "version": "0.9.9-alpha.1",
   "private": true,
   "description": "Atomic extension for multi-stage workflow authoring and execution.",
   "contributors": [

package/dist/builtin/workflows/src/durable/backend.ts

@@ -23,6 +23,8 @@
 
 import type { WorkflowSerializableValue } from "../shared/types.js";
 import { createHash } from "node:crypto";
+import { isDurableWorkflowResumable } from "./resume-eligibility.js";
+import { DURABLE_FORMAT_VERSION } from "./format-version.js";
 import type {
   DurableCheckpoint,
   DurableCheckpointEntry,
@@ -94,8 +96,13 @@ export interface DurableWorkflowBackend {
   /** Look up a cached stage output by replay key. */
   getStageOutput(workflowId: string, replayKey: string): WorkflowSerializableValue | undefined;
 
-  /** Look up resumable stage session metadata by replay key, when available. */
-  getStageSession(workflowId: string, replayKey: string): { sessionId?: string; sessionFile?: string } | undefined;
+  /** Look up the latest resumable stage session and accumulated active timing. */
+  getStageSession(workflowId: string, replayKey: string): {
+    sessionId?: string;
+    sessionFile?: string;
+    startedAt?: number;
+    durationMs?: number;
+  } | undefined;
 
   /** List all checkpoints for a workflow (in completion order). */
   listCheckpoints(workflowId: string): readonly DurableCheckpoint[];
@@ -107,14 +114,22 @@ export interface DurableWorkflowBackend {
   setWorkflowStatus(workflowId: string, status: DurableWorkflowStatus, pendingPrompts?: number, resumable?: boolean): void;
 
   /**
-   * List resumable workflows (not completed/cancelled, or explicitly marked
-   * resumable after failure). Used by the `/workflow resume` selector.
+   * List resumable root workflows: running/paused runs with progress and
+   * failed/blocked runs unless explicitly marked non-resumable.
    */
   listResumableWorkflows(): readonly ResumableWorkflowEntry[];
+  /** List successful completed root workflows with durable checkpoint progress. */
+  listCompletedWorkflows(): readonly ResumableWorkflowEntry[];
 
   /** Export a session-cache entry for the given workflow (for JSONL persistence). */
   toCacheEntry(workflowId: string): DurableCheckpointEntry | undefined;
 
+  /** Permanently remove one root workflow and its durable checkpoints. */
+  deleteWorkflow(workflowId: string): Promise<void>;
+
+  /** Whether a workflow id may be exposed or resumed from live/restored metadata. */
+  isWorkflowLoadable(workflowId: string): boolean;
+
   /** Clear all state (for tests). */
   reset(): void;
 
@@ -185,8 +200,10 @@ function checkpointKey(c: DurableCheckpoint): string {
 export class InMemoryDurableBackend implements DurableWorkflowBackend {
   public readonly persistent = false;
   private readonly workflows = new Map<string, InMemoryWorkflowRecord>();
+  private readonly deletedWorkflowIds = new Set<string>();
 
   registerWorkflow(handle: WorkflowRegistrationInput): void {
+    this.deletedWorkflowIds.delete(handle.workflowId);
     const existing = this.workflows.get(handle.workflowId);
     const completedCheckpoints = handle.completedCheckpoints ?? existing?.handle.completedCheckpoints ?? 0;
     const pendingPrompts = handle.pendingPrompts ?? existing?.handle.pendingPrompts ?? 0;
@@ -246,10 +263,20 @@ export class InMemoryDurableBackend implements DurableWorkflowBackend {
     return checkpoint !== undefined && "output" in checkpoint ? checkpoint.output : undefined;
   }
 
-  getStageSession(workflowId: string, replayKey: string): { sessionId?: string; sessionFile?: string } | undefined {
+  getStageSession(workflowId: string, replayKey: string): {
+    sessionId?: string;
+    sessionFile?: string;
+    startedAt?: number;
+    durationMs?: number;
+  } | undefined {
     const checkpoint = this.workflows.get(workflowId)?.stageSessionByReplayKey.get(replayKey);
     if (checkpoint?.sessionId === undefined && checkpoint?.sessionFile === undefined) return undefined;
-    return { ...(checkpoint.sessionId !== undefined ? { sessionId: checkpoint.sessionId } : {}), ...(checkpoint.sessionFile !== undefined ? { sessionFile: checkpoint.sessionFile } : {}) };
+    return {
+      ...(checkpoint.sessionId !== undefined ? { sessionId: checkpoint.sessionId } : {}),
+      ...(checkpoint.sessionFile !== undefined ? { sessionFile: checkpoint.sessionFile } : {}),
+      ...(checkpoint.startedAt !== undefined ? { startedAt: checkpoint.startedAt } : {}),
+      ...(checkpoint.durationMs !== undefined ? { durationMs: checkpoint.durationMs } : {}),
+    };
   }
 
   listCheckpoints(workflowId: string): readonly DurableCheckpoint[] {
@@ -270,7 +297,13 @@ export class InMemoryDurableBackend implements DurableWorkflowBackend {
 
   listResumableWorkflows(): readonly ResumableWorkflowEntry[] {
     return [...this.workflows.values()]
-      .filter((rec) => isRootWorkflow(rec.handle) && isResumableHandle(rec.handle))
+      .filter((rec) => isDurableWorkflowResumable(rec.handle))
+      .map((rec) => toResumableEntry(rec.handle));
+  }
+
+  listCompletedWorkflows(): readonly ResumableWorkflowEntry[] {
+    return [...this.workflows.values()]
+      .filter((rec) => isRootWorkflow(rec.handle) && isCompletedHandle(rec.handle))
       .map((rec) => toResumableEntry(rec.handle));
   }
 
@@ -279,6 +312,7 @@ export class InMemoryDurableBackend implements DurableWorkflowBackend {
     if (!rec) return undefined;
     const h = rec.handle;
     return {
+      formatVersion: DURABLE_FORMAT_VERSION,
       type: "workflow.durable.checkpoint",
       workflowId: h.workflowId,
       name: h.name,
@@ -297,8 +331,18 @@ export class InMemoryDurableBackend implements DurableWorkflowBackend {
     };
   }
 
+  async deleteWorkflow(workflowId: string): Promise<void> {
+    this.workflows.delete(workflowId);
+    this.deletedWorkflowIds.add(workflowId);
+  }
+
+  isWorkflowLoadable(workflowId: string): boolean {
+    return !this.deletedWorkflowIds.has(workflowId);
+  }
+
   reset(): void {
     this.workflows.clear();
+    this.deletedWorkflowIds.clear();
   }
 
   /** Export all records (for FileDurableBackend serialization or debugging). */
@@ -323,14 +367,8 @@ function hasResumeProgress(handle: DurableWorkflowHandle): boolean {
   return handle.completedCheckpoints > 0 || handle.pendingPrompts > 0;
 }
 
-function isResumableHandle(handle: DurableWorkflowHandle): boolean {
-  if (handle.status === "failed" || handle.status === "blocked") return handle.resumable !== false;
-  // `running`/`paused` are both resumable at the backend level: a `running`
-  // durable handle may belong to a crashed process (no live executor), which
-  // is exactly the cross-session crash-recovery case. Same-session
-  // double-resume is prevented by the command layer, which hides durable
-  // entries that match an active live run.
-  return (handle.status === "running" || handle.status === "paused") && hasResumeProgress(handle);
+function isCompletedHandle(handle: DurableWorkflowHandle): boolean {
+  return handle.status === "completed" && hasResumeProgress(handle);
 }
 
 function toResumableEntry(handle: DurableWorkflowHandle): ResumableWorkflowEntry {

package/dist/builtin/workflows/src/durable/completed-catalog.ts

@@ -0,0 +1,245 @@
+import { readFileSync, statSync } from "node:fs";
+import type { RunSnapshot, StageSnapshot } from "../shared/store-types.js";
+import type { WorkflowInputValues } from "../shared/types.js";
+import type { DurableWorkflowBackend } from "./backend.js";
+import type {
+  DurableCheckpoint,
+  DurableStageCheckpoint,
+  ResumableWorkflowEntry,
+} from "./types.js";
+import { resolveDurableEntry } from "./resume-runtime.js";
+
+export type CompletedWorkflowResolution =
+  | { readonly kind: "found"; readonly entry: ResumableWorkflowEntry; readonly snapshot: RunSnapshot }
+  | { readonly kind: "ambiguous"; readonly matches: readonly ResumableWorkflowEntry[] }
+  | { readonly kind: "not_found" }
+  | { readonly kind: "stale"; readonly entry: ResumableWorkflowEntry };
+
+interface SessionTranscriptEntry {
+  readonly type?: string;
+  readonly id?: string;
+  readonly timestamp?: string;
+  readonly message?: {
+    readonly role?: string;
+    readonly content?: string | object;
+  };
+}
+
+interface StageDraft {
+  readonly replayKey: string;
+  readonly name: string;
+  readonly firstCompletedAt: number;
+  readonly output?: DurableStageCheckpoint["output"];
+  readonly result?: string;
+  readonly sessionId?: string;
+  readonly sessionFile?: string;
+  readonly startedAt?: number;
+  readonly endedAt?: number;
+  readonly durationMs?: number;
+  readonly model?: string;
+  readonly fastMode?: boolean;
+  readonly attemptedModels?: readonly string[];
+  readonly modelAttempts?: DurableStageCheckpoint["modelAttempts"];
+}
+
+/** Authoritative completed rows. This path is deliberately separate from resumability. */
+export function listCompletedFromBackend(
+  backend: DurableWorkflowBackend,
+): readonly ResumableWorkflowEntry[] {
+  return backend.listCompletedWorkflows();
+}
+
+/** Completed rows whose authoritative checkpoints and referenced transcripts still exist. */
+export function listOpenableCompletedWorkflows(
+  backend: DurableWorkflowBackend,
+): readonly ResumableWorkflowEntry[] {
+  return listCompletedFromBackend(backend)
+    .filter((entry) => completedWorkflowSnapshot(backend, entry) !== undefined)
+    .sort((a, b) => b.updatedAt - a.updatedAt);
+}
+
+export function resolveCompletedWorkflow(
+  workflowIdOrPrefix: string,
+  backend: DurableWorkflowBackend,
+  openableCatalog: readonly ResumableWorkflowEntry[] = listOpenableCompletedWorkflows(backend),
+): CompletedWorkflowResolution {
+  const resolved = resolveDurableEntry(workflowIdOrPrefix, openableCatalog);
+  if (resolved !== undefined) {
+    if ("kind" in resolved) return { kind: "ambiguous", matches: resolved.matches };
+    const snapshot = completedWorkflowSnapshot(backend, resolved);
+    return snapshot === undefined
+      ? { kind: "stale", entry: resolved }
+      : { kind: "found", entry: resolved, snapshot };
+  }
+
+  const authoritative = resolveDurableEntry(workflowIdOrPrefix, listCompletedFromBackend(backend));
+  if (authoritative === undefined) return { kind: "not_found" };
+  if ("kind" in authoritative) return { kind: "ambiguous", matches: authoritative.matches };
+  return { kind: "stale", entry: authoritative };
+}
+
+export function completedWorkflowSnapshot(
+  backend: DurableWorkflowBackend,
+  entry: ResumableWorkflowEntry,
+): RunSnapshot | undefined {
+  const handle = backend.getWorkflow(entry.workflowId);
+  if (handle === undefined || handle.status !== "completed") return undefined;
+  const checkpoints = backend.listCheckpoints(entry.workflowId);
+  if (checkpoints.length === 0) return undefined;
+  const stages = stageSnapshotsFromCheckpoints(checkpoints, handle.updatedAt).map(validatedStageTranscript);
+  if (!stages.some((stage) => stage.sessionFile !== undefined)) return undefined;
+
+  return {
+    id: handle.workflowId,
+    name: handle.name,
+    inputs: { ...handle.inputs } as WorkflowInputValues,
+    status: "completed",
+    stages,
+    startedAt: handle.createdAt,
+    endedAt: handle.updatedAt,
+    durationMs: Math.max(0, handle.updatedAt - handle.createdAt),
+    resumable: false,
+  };
+}
+
+function validatedStageTranscript(stage: StageSnapshot): StageSnapshot {
+  if (stage.sessionFile === undefined || isReopenableSessionTranscript(stage.sessionFile)) return stage;
+  const { sessionFile, ...withoutSessionFile } = stage;
+  void sessionFile;
+  return withoutSessionFile;
+}
+
+function isReopenableSessionTranscript(path: string): boolean {
+  try {
+    const stats = statSync(path);
+    if (!stats.isFile() || stats.size === 0) return false;
+    const lines = readFileSync(path, "utf8").split("\n").filter((line) => line.trim().length > 0);
+    if (lines.length < 2) return false;
+    const entries: SessionTranscriptEntry[] = [];
+    for (const line of lines) {
+      const parsed = JSON.parse(line) as object;
+      if (typeof parsed !== "object" || parsed === null) return false;
+      entries.push(parsed as SessionTranscriptEntry);
+    }
+    const header = entries[0];
+    return header?.type === "session" && typeof header.id === "string" && entries.some(isUsableContextMessage);
+  } catch {
+    return false;
+  }
+}
+
+function isUsableContextMessage(entry: SessionTranscriptEntry): boolean {
+  return entry.type === "message"
+    && typeof entry.id === "string"
+    && typeof entry.timestamp === "string"
+    && typeof entry.message?.role === "string"
+    && hasUsableMessageContent(entry.message.content);
+}
+
+function hasUsableMessageContent(content: string | object | undefined): boolean {
+  if (typeof content === "string") return content.trim().length > 0;
+  return Array.isArray(content) && content.some(hasUsableContentBlock);
+}
+
+function hasUsableContentBlock(block: object): boolean {
+  if (typeof block !== "object" || block === null) return false;
+  const contentBlock = block as {
+    readonly text?: string;
+    readonly thinking?: string;
+    readonly data?: string;
+    readonly name?: string;
+  };
+  return [contentBlock.text, contentBlock.thinking, contentBlock.data, contentBlock.name]
+    .some((value) => typeof value === "string" && value.trim().length > 0);
+}
+
+function stageSnapshotsFromCheckpoints(
+  checkpoints: readonly DurableCheckpoint[],
+  fallbackCompletedAt: number,
+): StageSnapshot[] {
+  const drafts = new Map<string, StageDraft>();
+  for (const checkpoint of checkpoints) {
+    if (checkpoint.kind !== "stage") continue;
+    const existing = drafts.get(checkpoint.replayKey);
+    drafts.set(checkpoint.replayKey, mergeStageDraft(existing, checkpoint));
+  }
+  const ordered = [...drafts.values()].sort((a, b) => a.firstCompletedAt - b.firstCompletedAt);
+  if (ordered.length === 0) return [syntheticCheckpointStage(checkpoints.length, fallbackCompletedAt)];
+  return ordered.map(stageSnapshotFromDraft);
+}
+
+function mergeStageDraft(
+  existing: StageDraft | undefined,
+  checkpoint: DurableStageCheckpoint,
+): StageDraft {
+  return {
+    replayKey: checkpoint.replayKey,
+    name: existing?.name ?? checkpoint.name,
+    firstCompletedAt: Math.min(existing?.firstCompletedAt ?? checkpoint.completedAt, checkpoint.completedAt),
+    ...valueOrExisting("output", checkpoint, existing),
+    ...valueOrExisting("result", checkpoint, existing),
+    ...valueOrExisting("sessionId", checkpoint, existing),
+    ...valueOrExisting("sessionFile", checkpoint, existing),
+    ...valueOrExisting("startedAt", checkpoint, existing),
+    ...valueOrExisting("endedAt", checkpoint, existing),
+    ...valueOrExisting("durationMs", checkpoint, existing),
+    ...valueOrExisting("model", checkpoint, existing),
+    ...valueOrExisting("fastMode", checkpoint, existing),
+    ...valueOrExisting("attemptedModels", checkpoint, existing),
+    ...valueOrExisting("modelAttempts", checkpoint, existing),
+  };
+}
+
+function valueOrExisting<
+  K extends keyof Omit<StageDraft, "replayKey" | "name" | "firstCompletedAt">
+>(key: K, checkpoint: DurableStageCheckpoint, existing: StageDraft | undefined): Pick<StageDraft, K> | object {
+  const checkpointValue = checkpoint[key];
+  if (checkpointValue !== undefined) return { [key]: checkpointValue } as Pick<StageDraft, K>;
+  const existingValue = existing?.[key];
+  return existingValue === undefined ? {} : { [key]: existingValue } as Pick<StageDraft, K>;
+}
+
+function stageSnapshotFromDraft(draft: StageDraft, index: number): StageSnapshot {
+  const startedAt = draft.startedAt ?? draft.firstCompletedAt;
+  const endedAt = draft.endedAt ?? draft.firstCompletedAt;
+  return {
+    id: `completed-stage-${index + 1}`,
+    name: draft.name,
+    status: "completed",
+    parentIds: [],
+    startedAt,
+    endedAt,
+    durationMs: draft.durationMs ?? Math.max(0, endedAt - startedAt),
+    ...(stageResult(draft) !== undefined ? { result: stageResult(draft) } : {}),
+    replayKey: draft.replayKey,
+    toolEvents: [],
+    attachable: false,
+    ...(draft.sessionId !== undefined ? { sessionId: draft.sessionId } : {}),
+    ...(draft.sessionFile !== undefined ? { sessionFile: draft.sessionFile } : {}),
+    ...(draft.model !== undefined ? { model: draft.model } : {}),
+    ...(draft.fastMode !== undefined ? { fastMode: draft.fastMode } : {}),
+    ...(draft.attemptedModels !== undefined ? { attemptedModels: draft.attemptedModels } : {}),
+    ...(draft.modelAttempts !== undefined ? { modelAttempts: draft.modelAttempts } : {}),
+  };
+}
+
+function stageResult(draft: StageDraft): string | undefined {
+  if (draft.result !== undefined) return draft.result;
+  if (draft.output === undefined) return undefined;
+  return typeof draft.output === "string" ? draft.output : JSON.stringify(draft.output);
+}
+
+function syntheticCheckpointStage(checkpointCount: number, completedAt: number): StageSnapshot {
+  return {
+    id: "completed-checkpoints",
+    name: "durable checkpoints",
+    status: "completed",
+    parentIds: [],
+    startedAt: completedAt,
+    endedAt: completedAt,
+    durationMs: 0,
+    result: `${checkpointCount} durable checkpoint${checkpointCount === 1 ? "" : "s"}`,
+    toolEvents: [],
+    attachable: false,
+  };
+}