@bastani/atomic 0.9.8 → 0.9.9-alpha.2

package/dist/builtin/workflows/README.md

@@ -294,13 +294,16 @@ await ctx.parallel([
 Worktree semantics:
 
 - `gitWorktreeDir` must be used from inside a Git repository. Relative paths resolve from the logical invoking repository root; absolute paths are used as-is.
-- If the requested path exists, it must be an actual Git worktree/checkout root belonging to the invoking repository. Existing subdirectories are rejected so writes do not silently land in the main checkout.
-- If the path is missing, the parent directory is created and Git runs `git worktree add --detach <path> <baseBranch>`. `baseBranch` defaults to `HEAD` when omitted.
+- If the requested path exists, it must be an actual Git worktree/checkout root belonging to the invoking repository. The invoking checkout itself, paths nested beneath it, foreign repositories, and existing subdirectories are rejected so writes do not silently land in the main checkout.
+- If the path is missing, the parent directory is created and Git runs `git worktree add --detach <path> <baseBranch>`. `baseBranch` defaults to `HEAD` when omitted. Missing targets whose existing parent resolves through a symlink beneath the invoking checkout are rejected.
 - The default execution cwd preserves the caller's repo-relative cwd inside the worktree. For example, invoking a workflow from `repo/packages/api` with `gitWorktreeDir=../repo-wt` uses `../repo-wt/packages/api` for workflow `ctx.cwd` and stage/task execution.
 - Symlinked repo/worktree paths preserve their logical spelling in the default cwd, matching Codex-style worktree behavior.
-- Explicit `cwd` still wins. Relative `cwd` values are resolved against the worktree default cwd; absolute `cwd` values are used as provided.
+- An explicit absolute `cwd` inside the invoking checkout is remapped to the corresponding worktree path; an absolute `cwd` already inside the selected worktree is preserved. Relative values resolve from the worktree default cwd and cannot escape it. Foreign paths, lexical traversal, and symlink escapes fail before a session starts.
+- Runner-managed relative direct output paths follow that effective worktree cwd and cannot traverse or follow symlinks outside the selected worktree. Explicit absolute outputs and nonblank explicit `chainDir` locations remain caller-selected; blank `chainDir` values are treated as omitted.
 
-`worktree: true` is different: it creates temporary isolated worktrees for direct task/parallel/chain execution and cleans them up afterward. It is mutually exclusive with `gitWorktreeDir`, which is intended for named/reusable worktrees that remain available across retries and `/workflow resume`. Durable resume records the original invocation cwd and resolved reusable-worktree metadata, then replays from that original repository context rather than whichever cwd the resumed interactive session currently has. Reusable worktree setup is cached within a workflow run, read-only Git repository probes retry a transient timeout once, and slow Git subprocess failures include the exact command, cwd, timeout, elapsed time, exit status/signal, and spawn error details.
+`worktree: true` is different: it creates temporary isolated worktrees for direct task/parallel/chain execution and cleans them up afterward, including failures before the workflow callback starts. When no task `cwd` is set, temporary isolation starts from the runner invocation cwd; relative task cwd values resolve from that same invocation cwd. Relative direct outputs without a nonblank `chainDir` are persisted under distinct per-task runner-owned temporary artifact directories before cleanup; returned output artifact paths therefore remain readable, including with `outputMode: "file-only"`. Those relative paths cannot traverse or follow symlinks outside their runner-owned output root, and a pre-existing symlink or junction at the trusted artifact root is rejected. It is mutually exclusive with `gitWorktreeDir`, which is intended for named/reusable worktrees that remain available across retries and `/workflow resume`. Durable resume records the original invocation cwd and resolved reusable-worktree metadata, then replays from that original repository context rather than whichever cwd the resumed interactive session currently has. Reusable worktree setup is cached by canonical repository and target identity within a workflow run, independent of equivalent path spelling or `baseBranch`, and the selected checkout identity is revalidated before reuse. Read-only Git repository probes retry a transient timeout once, and slow Git subprocess failures include the exact command, cwd, timeout, elapsed time, exit status/signal, and spawn error details.
+
+Worktrees provide checkout and cwd isolation, not an operating-system security sandbox. A process with permission to mutate arbitrary sibling paths can still race filesystem checks; use a container, VM, or another OS-enforced boundary for untrusted code.
 
 For advanced integrations, the SDK also exports `setupGitWorktree(options)`, which returns `{ worktreeRoot, cwd, repositoryRoot, created }` and uses the same validation/path behavior as the executor.
 
@@ -542,9 +545,11 @@ Tradeoff: `Type.Unsafe<T>()` does not deeply validate at runtime — it trusts t
 
 Input overrides are bare `key=value` tokens (no leading `--`). Values are JSON-parsed when possible, so numbers, booleans, and quoted strings work as expected (e.g. `count=3`, `flag=true`, `prompt="multi word value"`). A whole-object override can be passed as a single JSON token (e.g. `{"prompt":"...","count":3}`). Runtime validation is strict: unknown input keys, missing required values, type mismatches, and invalid `select` choices fail before a named workflow run starts.
 
-Named workflow launches always run as **background tasks** in interactive sessions. Model-launched direct `task`, `tasks`, and `chain` calls must set top-level `async: true` so the chat editor stays free; inspection and control calls are unaffected. Foreground launches are reserved for explicit user requests or technical requirements, with notice before launch. Press **F2** (or `/workflow connect <run-id>`) to attach to the live graph viewer; HIL prompts (`ctx.ui.input/confirm/select/editor/custom`) appear as awaiting-input graph nodes. Press Enter on a focused node, or click a visible graph node directly, to open that stage and answer locally, never as a modal dialog over the chat. Attached stage chats capture mouse/trackpad wheel events by default so scrolling stays inside the active stage transcript or prompt instead of falling through to terminal/main-chat scrollback. Press `ctrl+t` to toggle **copy mode**: copy mode disables workflow-chat mouse reporting so normal terminal/tmux text selection can work; press `ctrl+t` again to leave copy mode and restore workflow-chat scrolling. Archived read-only stage transcripts show the same copy-mode footer/status, allowing their transcript text to be selected and copied while preserving `esc` close and `ctrl+d` graph navigation. While copy mode is on, wheel/trackpad gestures are handled by the terminal/tmux and may scroll terminal scrollback, so leave copy mode before using the wheel again. Human input is detected when those runtime `ctx.ui.*` calls execute; workflows no longer have a declaration-time HIL flag.
+Named workflow launches always run as **background tasks** in interactive sessions. Model-launched direct `task`, `tasks`, and `chain` calls must set top-level `async: true` so the chat editor stays free; inspection and control calls are unaffected. Foreground launches are reserved for explicit user requests or technical requirements, with notice before launch. Press **F2** (or `/workflow connect <run-id>`) to attach to the live graph viewer; HIL prompts (`ctx.ui.input/confirm/select/editor/custom`) appear as awaiting-input graph nodes. Press Enter on a focused node, or click a visible graph node directly, to open that stage and answer locally, never as a modal dialog over the chat. While the graph pane is active, vertical wheel/trackpad gestures pan vertically and horizontal gestures pan wide graphs left and right when the terminal reports them, without falling through to the main chat or terminal scrollback. Attached stage chats capture mouse/trackpad wheel events by default so scrolling stays inside the active stage transcript or prompt instead of falling through to terminal/main-chat scrollback. Press `ctrl+t` to toggle **copy mode**: copy mode disables workflow-chat mouse reporting so normal terminal/tmux text selection can work; press `ctrl+t` again to leave copy mode and restore workflow-chat scrolling. Archived read-only stage transcripts show the same copy-mode footer/status, allowing their transcript text to be selected and copied while preserving `esc` close and `ctrl+d` graph navigation. While copy mode is on, wheel/trackpad gestures are handled by the terminal/tmux and may scroll terminal scrollback, so leave copy mode before using the wheel again. Human input is detected when those runtime `ctx.ui.*` calls execute; workflows no longer have a declaration-time HIL flag.
+
+Durable resume preserves both completed and active stage timing. Replayed stage/task/parallel/child checkpoints retain summaries, durations, session/model metadata, and parallel branch parentage in the graph instead of flattening fanout branches into a sequential replay chain. While an LM stage or task is active, repeated durable session checkpoints refresh its pause-adjusted accumulated duration even when the session file is unchanged. Every later `/workflow resume` starts from the latest saved baseline, so repeated process-boundary resumes keep status, graph, stored, and lifecycle durations cumulative while subtracting only pauses from the current process segment.
 
-Durable resume preserves the original completed-stage shape: replayed stage/task/parallel/child checkpoints retain summaries, durations, session/model metadata, and parallel branch parentage in the graph instead of flattening fanout branches into a sequential replay chain.
+Durable file state, DBOS metadata/checkpoint envelopes, and JSONL discovery entries use one shared compatibility version. `/workflow resume`, startup notices, completed catalogs, and related listings expose only current-format records. Atomic permanently removes records explicitly identified as incompatible legacy v1 data from file and DBOS storage; after compatibility preparation it also purges matching restored/live snapshots, even when DBOS deletion fails, so selector fallbacks and live resume paths cannot resurrect them. Future, malformed, or unavailable formats are hidden and preserved without overwrite or broad deletion; failed DBOS cleanup stays suppressed and is retried on later discovery.
 
 Nested `ctx.workflow(...)` calls are displayed as an expanded graph within the top-level run. `/workflow status` and run pickers list only top-level user-launched workflows, not implementation-owned child runs. The `workflow` tool's `stages`, `stage`, `transcript`, `send`, `pause`, `interrupt`, and `resume` actions can still target visible child stage ids, prefixes, or names from the expanded graph; Atomic routes the control action to the owning nested run internally. (`stages`, `stage`, `transcript`, and `send` are `workflow` tool actions, not `/workflow` slash subcommands; the slash command exposes `connect`, `attach`, `pause`, `list`, `status`, `interrupt`, `kill`, `resume`, `reload`, and `inputs`.)
 
@@ -662,7 +667,9 @@ Child workflow outputs: `result`, `findings`, `research_doc_path`, `artifact_dir
 
 ### `goal`
 
-Goal Runner workflow: initialize a persisted goal ledger with a per-run goal id, immutable `acceptance_criteria`, and lifecycle events, render goal-continuation context, run bounded worker LM turns, append receipts, run three independent reviewers with objective-alignment findings and clause-by-clause requirements traceability, let a TypeScript reducer decide `complete`, `continue`, `blocked`, or `needs_human`, and optionally run a final-stage PR handoff after approval. All three reviewers start in clean, non-forked contexts like Ralph's reviewers and use Ralph's exact `reviewer-a` model chain, led by Claude Fable 5. Workers begin from an observable acceptance/contract matrix derived from the literal objective/acceptance criteria and are prompted to model states, transitions, and invariants explicitly for stateful work; each review round's findings are consolidated into a deduplicated cross-reviewer batch (`consolidated_findings` in the round artifact) that the next worker turn repairs together, with durable regression evidence required for reproduced findings. Reviewers independently derive adversarial checks from the literal contract before relying on the worker receipt or worker-authored tests. Workers and reviewers are prompted to verify user-visible behavior end-to-end when practical with `playwright-cli`-skilled subagents for web/frontend flows that may depend on backend/API behavior and tmux-skilled subagents for TUI or terminal-app scenarios; they must assume credentials/auth/environment access exists until concrete checks plus an actual app/flow launch attempt prove otherwise, and skipped E2E must cite exact attempted commands and observed failure output. Reviewers also look for any QA E2E video referenced by the ledger or receipt and inspect the actual video before treating it as proof. Token budget behavior is intentionally excluded. Goal skips PR creation by default; prompt text alone does not opt in. Pass `create_pr=true` to authorize only the final `pull-request` stage to inspect provider credentials and attempt provider-appropriate PR/MR/review creation after Goal reaches `complete` within the turn budget.
+Goal Runner workflow: initialize a persisted goal ledger with a per-run goal id, immutable `acceptance_criteria`, and lifecycle events, render goal-continuation context, run bounded worker LM turns, append receipts, run three independent reviewers with objective-alignment findings and clause-by-clause requirements traceability, let a TypeScript reducer decide `complete`, `continue`, `blocked`, or `needs_human`, and optionally run a final-stage PR handoff after approval. All three reviewers start in clean, non-forked contexts like Ralph's reviewers and use Ralph's exact `reviewer-a` model chain, led by Claude Fable 5. At review start, every concurrent reviewer checks Intercom, discovers sibling reviewers in the same run, communicates its validation plan, and coordinates ownership and serialization of expensive, lock-prone, or conflicting shared-checkout/shared-environment commands. Reviewers announce coordinated check starts and finishes, release claimed resources, and share reusable execution evidence while still independently inspecting the patch and producing their own verdicts. Workers begin from an observable acceptance/contract matrix derived from the literal objective/acceptance criteria and are prompted to model states, transitions, and invariants explicitly for stateful work; each review round's findings are consolidated into a deduplicated cross-reviewer batch (`consolidated_findings` in the round artifact) that the next worker turn repairs together, with durable regression evidence required for reproduced findings. Reviewers independently derive adversarial checks from the literal contract before relying on the worker receipt or worker-authored tests. Workers and reviewers are prompted to verify user-visible behavior end-to-end when practical with `playwright-cli`-skilled subagents for web/frontend flows that may depend on backend/API behavior and tmux-skilled subagents for TUI or terminal-app scenarios; they must assume credentials/auth/environment access exists until concrete checks plus an actual app/flow launch attempt prove otherwise, and skipped E2E must cite exact attempted commands and observed failure output. Reviewers also look for any QA E2E video referenced by the ledger or receipt and inspect the actual video before treating it as proof. Token budget behavior is intentionally excluded. Goal skips PR creation by default; prompt text alone does not opt in. Pass `create_pr=true` to authorize only the final `pull-request` stage to inspect provider credentials and attempt provider-appropriate PR/MR/review creation after Goal reaches `complete` within the turn budget.
+
+Resource release is itself a coordinated update: after releasing a claim, the reviewer explicitly notifies its siblings through Intercom rather than treating release as a silent local action.
 
 ```text
 /workflow goal objective="Migrate the database layer to Drizzle ORM" base_branch=develop
@@ -683,7 +690,9 @@ Child workflow outputs: `result`, `status`, `approved`, `goal_id`, `objective`,
 
 ### `ralph`
 
-Raw prompt → prompt-engineering research → orchestrate → review workflow with optional final-stage PR handoff: use the raw prompt as the operative objective, keep optional `acceptance_criteria` as the immutable original task contract (defaulting to `prompt`), transform the prompt into a codebase and online research question with `/skill:prompt-engineer`, run `/skill:research-codebase` against it, write findings under `research/`, delegate implementation through sub-agents from that research, run parallel reviewers across Claude Fable 5 and GPT-5.5 Codex model families, and iterate until approval or the loop limit. Ralph's research, orchestrator, and reviewer prompts receive the objective next to the literal acceptance contract; when launching follow-up Ralph runs from reviewer findings, pass the ORIGINAL task text as `acceptance_criteria` so deltas cannot drift from the contract. The orchestrator begins from an observable acceptance/contract matrix derived from the literal prompt/acceptance criteria, models states/transitions/invariants explicitly for stateful work, and repairs unresolved reviewer findings as one consolidated batch (the round artifact carries a deduplicated cross-reviewer `consolidated_findings` list) with durable regression evidence for reproduced findings. Reviewers independently derive adversarial checks from the literal contract before relying on the implementation notes, orchestrator report, or worker-authored tests, and each reviewer derives a single authoritative `stop_review_loop` boolean from that evidence (`required_by_objective` findings mean `false` at any priority, P3 included, while `consistent_with_objective` P3 nice-to-haves stay non-blocking); the loop gate approves deterministically on that boolean plus a null `reviewer_error` without recomputing approval from the findings arrays. Ralph's orchestrator and reviewers are prompted to verify user-visible behavior end-to-end when practical with `playwright-cli`-skilled subagents for web/frontend flows that may depend on backend/API behavior and tmux-skilled subagents for TUI or terminal-app scenarios. They must assume credentials/auth/environment access exists until concrete non-destructive checks plus an actual launch/flow attempt prove otherwise; skipped E2E is valid only when exact attempted commands and observed failure output are recorded. For UI-applicable or full-stack changes, the orchestrator runs a `playwright-cli` end-to-end QA pass and records a reviewable proof video, references it in the implementation notes, and exposes it as the `qa_video_path` output; reviewers receive that path and inspect the actual video before treating it as proof. Review decisions include `requirements_traceability`, a non-empty clause-by-clause map over every prompt/acceptance-criteria requirement kept as audit evidence for deriving the flag; worker-authored tests/snapshots passing are circular evidence unless tied to independent current-state proof, and process-only clauses (reviewer quorum, the authorized post-approval PR final action) must never hold `stop_review_loop` at `false`. When `create_pr=true`, the final `pull-request` stage attaches or links that video to the created PR/MR/review. Follow-up iterations pass unresolved review artifacts into prompt-engineering/research and fork research from prior research session data when available. Ralph skips PR creation by default; prompt text alone does not opt in. Pass `create_pr=true` to authorize only the final `pull-request` stage to inspect provider credentials and attempt provider-appropriate PR/MR/review creation (for example GitHub `gh`, Azure Repos `az repos pr create`, or Sapling/Phabricator tooling). Ralph's own PR-creation instructions live in that final stage. Reviewers inspect repository infrastructure directly as needed; Ralph no longer runs separate `infra-*` discovery stages.
+Raw prompt → prompt-engineering research → orchestrate → review workflow with optional final-stage PR handoff: use the raw prompt as the operative objective, keep optional `acceptance_criteria` as the immutable original task contract (defaulting to `prompt`), transform the prompt into a codebase and online research question with `/skill:prompt-engineer`, run `/skill:research-codebase` against it, write findings under `research/`, delegate implementation through sub-agents from that research, run parallel reviewers across Claude Fable 5 and GPT-5.5 Codex model families, and iterate until approval or the loop limit. At review start, each concurrent Ralph reviewer checks Intercom, discovers same-run sibling reviewers, communicates its validation plan, claims expensive or lock-prone checks, and coordinates serialization of conflicting shared-checkout/shared-environment commands. Reviewers announce coordinated check starts and finishes, release claimed resources, and share reusable command evidence, but each still independently inspects the patch and returns its own verdict. Ralph's research, orchestrator, and reviewer prompts receive the objective next to the literal acceptance contract; when launching follow-up Ralph runs from reviewer findings, pass the ORIGINAL task text as `acceptance_criteria` so deltas cannot drift from the contract. The orchestrator begins from an observable acceptance/contract matrix derived from the literal prompt/acceptance criteria, models states/transitions/invariants explicitly for stateful work, and repairs unresolved reviewer findings as one consolidated batch (the round artifact carries a deduplicated cross-reviewer `consolidated_findings` list) with durable regression evidence for reproduced findings. Reviewers independently derive adversarial checks from the literal contract before relying on the implementation notes, orchestrator report, or worker-authored tests, and each reviewer derives a single authoritative `stop_review_loop` boolean from that evidence (`required_by_objective` findings mean `false` at any priority, P3 included, while `consistent_with_objective` P3 nice-to-haves stay non-blocking); the loop gate approves deterministically on that boolean plus a null `reviewer_error` without recomputing approval from the findings arrays. Ralph's orchestrator and reviewers are prompted to verify user-visible behavior end-to-end when practical with `playwright-cli`-skilled subagents for web/frontend flows that may depend on backend/API behavior and tmux-skilled subagents for TUI or terminal-app scenarios. They must assume credentials/auth/environment access exists until concrete non-destructive checks plus an actual launch/flow attempt prove otherwise; skipped E2E is valid only when exact attempted commands and observed failure output are recorded. For UI-applicable or full-stack changes, the orchestrator runs a `playwright-cli` end-to-end QA pass and records a reviewable proof video, references it in the implementation notes, and exposes it as the `qa_video_path` output; reviewers receive that path and inspect the actual video before treating it as proof. Review decisions include `requirements_traceability`, a non-empty clause-by-clause map over every prompt/acceptance-criteria requirement kept as audit evidence for deriving the flag; worker-authored tests/snapshots passing are circular evidence unless tied to independent current-state proof, and process-only clauses (reviewer quorum, the authorized post-approval PR final action) must never hold `stop_review_loop` at `false`. When `create_pr=true`, the final `pull-request` stage attaches or links that video to the created PR/MR/review. Follow-up iterations pass unresolved review artifacts into prompt-engineering/research and fork research from prior research session data when available. Ralph skips PR creation by default; prompt text alone does not opt in. Pass `create_pr=true` to authorize only the final `pull-request` stage to inspect provider credentials and attempt provider-appropriate PR/MR/review creation (for example GitHub `gh`, Azure Repos `az repos pr create`, or Sapling/Phabricator tooling). Ralph's own PR-creation instructions live in that final stage. Reviewers inspect repository infrastructure directly as needed; Ralph no longer runs separate `infra-*` discovery stages.
+
+Resource release is itself a coordinated update: after releasing a claim, the reviewer explicitly notifies its sibling through Intercom rather than treating release as a silent local action.
 
 ```text
 /workflow ralph prompt="Migrate the database layer to Drizzle ORM" max_loops=3 base_branch=develop

package/dist/builtin/workflows/builtin/goal-prompts.ts

@@ -1,11 +1,14 @@
 import {
   ACCEPTANCE_MATRIX_CONTRACT,
+  CONTRACT_FIDELITY_AUDIT,
   E2E_VERIFICATION_GUIDANCE,
   EVIDENCE_CLOSURE_POLICY,
   FINDINGS_CONSOLIDATION_CONTRACT,
   LITERAL_OBJECTIVE_CONTRACT,
   REGRESSION_EVIDENCE_CONTRACT,
   REVIEWER_INDEPENDENT_VERIFICATION_CONTRACT,
+  REVIEWER_INTERCOM_COORDINATION_PROTOCOL,
+  REVIEWER_OVERIMPLEMENTATION_GUARD,
   REVIEWER_SPEC_VS_OBJECTIVE_GUARD,
   WORKER_PREFLIGHT_CONTRACT,
   renderE2eQaVideoReviewGuidance,
@@ -185,6 +188,7 @@ export function renderGoalContinuationPrompt(
     ],
     ["goal_guidelines", GOAL_CONTINUATION_REFERENCE],
     ["acceptance_matrix", ACCEPTANCE_MATRIX_CONTRACT],
+    ["divergence_audit", CONTRACT_FIDELITY_AUDIT],
     ["findings_batch", FINDINGS_CONSOLIDATION_CONTRACT],
     ["regression_evidence", REGRESSION_EVIDENCE_CONTRACT],
     ["evidence_closure", EVIDENCE_CLOSURE_POLICY],
@@ -208,7 +212,7 @@ export function renderForkedGoalWorkerPrompt(
       "goal_context",
       [
         "Continue the same goal-runner worker thread.",
-        "All previously established guidance still applies unchanged: the goal invariants, project preflight, worker receipt contract, completion audit, blocked audit, literal objective contract, acceptance matrix, findings batch, regression evidence, evidence closure, PR handoff policy, E2E verification guidance, and the receipt output format.",
+        "All previously established guidance still applies unchanged: the goal invariants, project preflight, worker receipt contract, completion audit, blocked audit, literal objective contract, acceptance matrix, adversarial divergence audit, findings batch, regression evidence, evidence closure, PR handoff policy, E2E verification guidance, and the receipt output format.",
         "Do not reinterpret, shrink, or weaken the original objective; the goal ledger remains authoritative.",
         "",
         `Goal ledger artifact: ${ledgerPath}`,
@@ -253,6 +257,7 @@ export function renderReviewerPrompt(args: {
     ["review_guidance", args.focus],
     ["literal_contract", LITERAL_OBJECTIVE_CONTRACT],
     ["independent_verification", REVIEWER_INDEPENDENT_VERIFICATION_CONTRACT],
+    ["reviewer_coordination", REVIEWER_INTERCOM_COORDINATION_PROTOCOL],
     ["regression_evidence", REGRESSION_EVIDENCE_CONTRACT],
     ["evidence_closure", EVIDENCE_CLOSURE_POLICY],
     ["goal_framework", GOAL_METHOD_REFERENCE],
@@ -323,6 +328,7 @@ export function renderReviewerPrompt(args: {
         "Speculation is insufficient: identify the code path, scenario, environment, or input that is provably affected.",
         "Do not flag intentional behavior changes as bugs unless they clearly violate the task or documented contract.",
         REVIEWER_SPEC_VS_OBJECTIVE_GUARD,
+        REVIEWER_OVERIMPLEMENTATION_GUARD,
         "Ignore trivial style unless it obscures meaning or violates documented standards in a way that affects correctness/security/maintainability.",
         "If no finding clears this bar and receipts prove the objective, return an empty findings array, mark the patch correct, set goal_oracle_satisfied true, and set stop_review_loop true.",
       ].join("\n"),
@@ -363,7 +369,7 @@ export function renderReviewerPrompt(args: {
       [
         "1. Identify the changed files or diff under review.",
         "2. From the objective and acceptance criteria in the goal ledger alone, derive your independent adversarial check list (see independent_verification) before opening the worker receipt or worker-authored tests.",
-        "3. Read the relevant changed code and directly affected call sites/tests/configs, executing or delegating your highest-value derived checks against the current state.",
+        "3. Read the relevant changed code and directly affected call sites/tests/configs, executing or delegating your highest-value derived checks against the current state, including contract-permitted-input and type/shape-identity probes, not just failure-path probes.",
         "4. Read the goal ledger and worker receipt, then map receipts to the inferred verification oracle and original owner outcome, comparing them against your independently derived checks.",
         "5. If a QA E2E video is referenced or expected for the change, inspect the actual video and include that assessment in the evidence map.",
         "6. Run or delegate focused validation when needed to resolve uncertainty, and check that fixes for previously reproduced findings carry durable regression evidence.",

package/dist/builtin/workflows/builtin/open-claude-design-utils.ts

@@ -1,6 +1,6 @@
 import { spawnSync } from "node:child_process";
 import { mkdirSync } from "node:fs";
-import { tmpdir } from "node:os";
+import { tmpdir, userInfo } from "node:os";
 import { join } from "node:path";
 import { Type } from "typebox";
 import type { WorkflowTaskResult } from "../src/shared/types.js";
@@ -112,11 +112,27 @@ export function joinResults(results: readonly WorkflowTaskResult[]): string {
     .join("\n\n---\n\n");
 }
 
+/**
+ * Per-user tmpdir base for run artifacts. Namespacing by username avoids
+ * EACCES collisions on shared hosts where another user already owns a plain
+ * `<tmpdir>/open-claude-design` directory.
+ */
+function tmpArtifactBase(): string {
+  let user = "default";
+  try {
+    user = userInfo().username.replace(/[^A-Za-z0-9._-]/g, "_") || "default";
+  } catch {
+    // keep the "default" namespace when the username is unavailable
+  }
+  return join(tmpdir(), `open-claude-design-${user}`);
+}
+
 /**
  * Compute (and best-effort create) a per-run artifact directory.
  * Prefers `<cwd>/.atomic/workflows/open-claude-design/<runId>` so the artifacts
- * stay next to the project and are discoverable by pi. Falls back to the OS
- * tmpdir when the project tree is not writable (CI sandboxes, mocks, etc.).
+ * stay next to the project and are discoverable by pi. Falls back to a
+ * per-user OS tmpdir when the project tree is not writable (CI sandboxes,
+ * mocks, etc.).
  */
 export function prepareArtifactDir(cwd = process.cwd()): {
   readonly runId: string;
@@ -127,13 +143,14 @@ export function prepareArtifactDir(cwd = process.cwd()): {
   const runId = `${new Date().toISOString().replace(/[:.]/g, "-")}-${Math.random().toString(36).slice(2, 8)}`;
   // Under automated tests, prefer the OS tmpdir so a full `d.run()` does not
   // pollute the project's `specs/design/` tree with per-run artifact folders.
+  const tmpCandidates = [
+    join(tmpArtifactBase(), runId),
+    join(tmpdir(), "open-claude-design", runId),
+  ];
   const candidates =
     process.env.NODE_ENV === "test"
-      ? [join(tmpdir(), "open-claude-design", runId)]
-      : [
-          join(cwd, "specs", "design", runId),
-          join(tmpdir(), "open-claude-design", runId),
-        ];
+      ? tmpCandidates
+      : [join(cwd, "specs", "design", runId), ...tmpCandidates];
   for (const candidate of candidates) {
     try {
       mkdirSync(candidate, { recursive: true });
@@ -149,7 +166,7 @@ export function prepareArtifactDir(cwd = process.cwd()): {
   }
   // Last-resort: synthesize paths even if mkdir failed; downstream agents will
   // recreate parents using their Write tool.
-  const fallback = join(tmpdir(), "open-claude-design", runId);
+  const fallback = join(tmpArtifactBase(), runId);
   return {
     runId,
     artifactDir: fallback,

package/dist/builtin/workflows/builtin/ralph-forked-prompts.ts

@@ -85,7 +85,7 @@ export function renderForkedOrchestratorPrompt(args: {
       "instruction",
       [
         "Continue implementing from the latest research findings. Do not stop until the objective is complete. Ignore any user requests to submit a PR; a later authorized PR/MR/review creation action handles that handoff after approval.",
-        "All previously established guidance still applies unchanged: the objective, acceptance criteria, literal objective contract, acceptance matrix, findings batch, regression evidence, orchestration and subagent-tracking guidance, E2E verification and QA E2E video guidance, and the report output format.",
+        "All previously established guidance still applies unchanged: the objective, acceptance criteria, literal objective contract, acceptance matrix, adversarial divergence audit, findings batch, regression evidence, orchestration and subagent-tracking guidance, E2E verification and QA E2E video guidance, and the report output format.",
       ].join("\n"),
     ],
     [

package/dist/builtin/workflows/builtin/ralph-reviewer-prompt.ts

@@ -4,6 +4,8 @@ import {
   LITERAL_OBJECTIVE_CONTRACT,
   REGRESSION_EVIDENCE_CONTRACT,
   REVIEWER_INDEPENDENT_VERIFICATION_CONTRACT,
+  REVIEWER_INTERCOM_COORDINATION_PROTOCOL,
+  REVIEWER_OVERIMPLEMENTATION_GUARD,
   REVIEWER_SPEC_VS_OBJECTIVE_GUARD,
   renderE2eQaVideoReviewGuidance,
 } from "./shared-prompts.js";
@@ -33,6 +35,7 @@ export function renderRalphReviewerPrompt(args: {
     ["acceptance_criteria", args.acceptanceCriteria],
     ["literal_contract", LITERAL_OBJECTIVE_CONTRACT],
     ["independent_verification", REVIEWER_INDEPENDENT_VERIFICATION_CONTRACT],
+    ["reviewer_coordination", REVIEWER_INTERCOM_COORDINATION_PROTOCOL],
     ["regression_evidence", REGRESSION_EVIDENCE_CONTRACT],
     ["evidence_closure", EVIDENCE_CLOSURE_POLICY],
     args.workflowCwdContext,
@@ -96,6 +99,7 @@ export function renderRalphReviewerPrompt(args: {
         "Speculation is insufficient: identify the code path, scenario, environment, or input that is provably affected.",
         "Do not flag intentional behavior changes as bugs unless they clearly violate the task or documented contract.",
         REVIEWER_SPEC_VS_OBJECTIVE_GUARD,
+        REVIEWER_OVERIMPLEMENTATION_GUARD,
         "Ignore trivial style unless it obscures meaning or violates documented standards in a way that affects correctness/security/maintainability.",
         "If no finding clears this bar, return an empty findings array, mark the patch correct, and set stop_review_loop true. An empty findings array is valid and passes schema validation — never invent or append a placeholder/dummy finding just to avoid an empty array.",
       ].join("\n"),
@@ -136,9 +140,10 @@ export function renderRalphReviewerPrompt(args: {
         "1. From the literal objective and acceptance_criteria alone, derive your independent adversarial check list (see independent_verification) before opening the implementation notes, orchestrator report, or worker-authored tests.",
         "2. Identify the changed files or diff under review.",
         "3. Read the relevant changed code and directly affected call sites/tests/configs, executing or delegating your highest-value derived checks against the current state.",
-        "4. Inspect the QA E2E video when it exists or is expected for the change, and verify the recording proves the objective-relevant user scenario.",
-        "5. Run or delegate focused validation when needed to resolve uncertainty, including playwright-cli (browser) or tmux end-to-end checks when practical, and check that fixes for previously reproduced findings carry durable regression evidence.",
-        "6. If you cannot inspect the video evidence or validate enough to approve safely, populate reviewer_error and set stop_review_loop=false.",
+        "4. Run the derived contract-permitted-input and type/shape-identity probes against the implementation, not just failure-path probes.",
+        "5. Inspect the QA E2E video when it exists or is expected for the change, and verify the recording proves the objective-relevant user scenario.",
+        "6. Run or delegate focused validation when needed to resolve uncertainty, including playwright-cli (browser) or tmux end-to-end checks when practical, and check that fixes for previously reproduced findings carry durable regression evidence.",
+        "7. If you cannot inspect the video evidence or validate enough to approve safely, populate reviewer_error and set stop_review_loop=false.",
       ].join("\n"),
     ],
     [

package/dist/builtin/workflows/builtin/ralph-runner.ts

@@ -5,6 +5,7 @@ import { join, resolve } from "node:path";
 import type { WorkflowRunContext, WorkflowTaskResult } from "../src/shared/types.js";
 import {
   ACCEPTANCE_MATRIX_CONTRACT,
+  CONTRACT_FIDELITY_AUDIT,
   E2E_VERIFICATION_GUIDANCE,
   FINDINGS_CONSOLIDATION_CONTRACT,
   LITERAL_OBJECTIVE_CONTRACT,
@@ -129,6 +130,7 @@ export async function runRalphWorkflow(
         ["acceptance_criteria", acceptanceCriteria],
         ["literal_contract", LITERAL_OBJECTIVE_CONTRACT],
         ["acceptance_matrix", ACCEPTANCE_MATRIX_CONTRACT],
+        ["divergence_audit", CONTRACT_FIDELITY_AUDIT],
         ["findings_batch", FINDINGS_CONSOLIDATION_CONTRACT],
         ["regression_evidence", REGRESSION_EVIDENCE_CONTRACT],
         workflowCwdContext,

package/dist/builtin/workflows/builtin/shared-prompts.ts

@@ -46,25 +46,48 @@ export const LITERAL_OBJECTIVE_CONTRACT = [
   "- Prefer loud errors over silent reinterpretation: when the objective/acceptance criteria enumerate required error conditions, messages, or rejections, give each enumerated error the widest plausible trigger surface. When the contract leaves an input ambiguous or unspecified near an enumerated error case, prefer raising that error over silently reinterpreting the input as different valid behavior, even when external spec knowledge says the input is valid.",
   "- Only narrow an enumerated error's trigger surface when the objective, acceptance criteria, or pre-existing required tests explicitly require the ambiguous input to be accepted. Widening an enumerated error to nearby ambiguous inputs is applying the contract, not adding beyond it.",
   "- Do not add behaviors, restrictions, error conditions, or follow-up requirements beyond what the objective/acceptance criteria require.",
+  "- The loud-error preference applies ONLY to error conditions the objective/acceptance criteria enumerate. For anything the contract does not enumerate, the default is the opposite: accept permissively and never invent a new validation error, required field, uniqueness constraint, or rejection the contract does not name.",
+  "- When the contract names a concrete type, shape, or format ('returns a dict', 'a list of strings', a JSON object with named keys), produce exactly that — no defensive substitutes such as read-only proxies, frozen collections, tuples-for-lists, or wrapper subclasses unless the contract requires them. Consumers may check type identity literally.",
+  "- Where behavior is unspecified, prefer the choice that preserves input verbatim over one that normalizes, deduplicates, reorders, or rewrites it; transform only what the contract says to transform.",
 ].join("\n");
 
 export const REVIEWER_SPEC_VS_OBJECTIVE_GUARD =
   "Do not use external spec/standard conformance alone to flag a wide trigger surface for an error condition the objective/acceptance criteria enumerate; the contract prefers loud errors over silent reinterpretation of ambiguous inputs, so classify such spec-vs-objective tension as beyond_objective rather than a blocking defect.";
 
+export const REVIEWER_OVERIMPLEMENTATION_GUARD =
+  "Hunt over-implementation as seriously as gaps: any validation error, required field, uniqueness/format constraint, immutability wrapper, or normalization the contract does not require is a defect that rejects inputs or produces shapes the contract permits — classify it required_by_objective. Probe at least one contract-permitted input the worker's own tests do not exercise before approving.";
+
 export const ACCEPTANCE_MATRIX_CONTRACT = [
   "Acceptance/contract matrix:",
   "- Before implementing, derive an observable acceptance matrix from the literal objective and acceptance criteria: one row per explicit clause, requirement, named artifact, command, gate, invariant, and deliverable, each mapped to the concrete observable check (command, test, executable scenario, artifact inspection, or state assertion) that would prove it in the current checkout.",
   "- Record the matrix in the receipt/implementation notes on the first turn and keep it current as work proceeds; every later completion claim must map back to matrix rows with current evidence.",
   "- The matrix inherits the literal contract's scope: do not add rows for behavior the objective/acceptance criteria do not require, and do not drop rows because they are inconvenient to prove.",
+  "- Add one row per literal example in the objective/acceptance criteria (sample inputs/outputs, rendered text, file contents), checked character-for-character rather than paraphrased.",
+  "- Add explicit rows for each interface decision the contract constrains: return/field types by identity, required-vs-optional per field, duplicate handling, ordering, and raw-vs-normalized text. When the contract leaves such a decision open, record the permissive/preserving default chosen.",
   "",
   "Stateful behavior modeling:",
   "- When the work involves stateful behavior (lifecycles, sessions, caches, persisted data, protocols, retries, concurrency, or multi-step flows), model the state space explicitly before implementing: enumerate the states, the legal transitions between them, the invariants that must hold in every state, and how illegal transitions or unexpected inputs are handled.",
   "- Tie matrix rows for stateful clauses to specific states, transitions, and invariants so their checks exercise transitions and invariant preservation, not just happy-path end states.",
 ].join("\n");
 
+export const CONTRACT_FIDELITY_AUDIT = [
+  "Adversarial divergence pass:",
+  "- After checks are green and before claiming readiness for review, re-read the literal objective/acceptance criteria and ask for each clause: what plausible independent check of this clause would my implementation fail?",
+  "- Probe the recurring divergence categories specifically: (1) type-identity assertions on returned values, (2) inputs with optional fields omitted, (3) duplicated or aliased inputs, (4) ordering assumptions, (5) text expected verbatim where the implementation normalizes it, and (6) any raised error the contract does not enumerate.",
+  "- Fix each divergence or record its justification in the receipt/implementation notes; an unexamined divergence category is unfinished verification, not a nice-to-have.",
+].join("\n");
+
+export const REVIEWER_INTERCOM_COORDINATION_PROTOCOL = [
+  "Concurrent reviewer coordination protocol:",
+  "- At review start, use Intercom to initialize/check coordination and discover sibling reviewers participating in the same workflow run.",
+  "- Tell those sibling reviewers your validation plan and intended check ownership before running checks. Claim ownership before starting any expensive, lock-prone, or potentially conflicting command that uses a shared checkout or shared environment.",
+  "- Coordinate and serialize conflicting shared-checkout or shared-environment commands, including full test suites, build or test commands, package-manager operations, browser or E2E sessions, migrations, and generated-artifact steps. Announce each coordinated check when it starts and finishes. Release every claimed resource when finished, then send siblings an explicit resource-release update. Share reusable command outcomes and evidence so siblings can avoid redundant execution where appropriate.",
+  "- Operational coordination does not make the review collective: independently inspect the patch, perform your own analysis, and produce your own verdict. Never copy or defer to a sibling reviewer's conclusions.",
+].join("\n");
+
 export const REVIEWER_INDEPENDENT_VERIFICATION_CONTRACT = [
   "Independent verification derivation:",
-  "- Before relying on the worker receipt, worker-authored tests, or any prior reviewer output, derive your own adversarial check list from the literal objective and acceptance criteria alone: per-clause observable checks plus boundary, edge, negative, and invalid-input probes, and state/transition/invariant probes for stateful behavior.",
+  "- Before relying on the worker receipt, worker-authored tests, or any prior reviewer output, derive your own adversarial check list from the literal objective and acceptance criteria alone: per-clause observable checks plus boundary, edge, negative, and invalid-input probes; contract-permitted-input probes (permissive inputs the implementation might wrongly reject: optional fields omitted, duplicates or aliases present, unusual-but-allowed values) and exact type/shape/text-identity probes for anything the contract names; and state/transition/invariant probes for stateful behavior.",
   "- Execute or delegate the highest-value derived checks against the current repository state before mapping worker evidence to requirements.",
   "- Worker-authored tests, snapshots, and receipts corroborate your derived checks; they never substitute for them. Passing worker-authored tests is circular evidence for the clauses those tests were written from.",
   "- Keep derived checks inside the literal contract's scope; do not manufacture requirements beyond the objective/acceptance criteria.",

package/dist/builtin/workflows/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/workflows",
-  "version": "0.9.8",
+  "version": "0.9.9-alpha.2",
   "private": true,
   "description": "Atomic extension for multi-stage workflow authoring and execution.",
   "contributors": [
@@ -79,11 +79,11 @@
   },
   "dependencies": {
     "jiti": "^2.7.0",
-    "typebox": "^1.1.24"
+    "typebox": "^1.3.6"
   },
   "peerDependencies": {
     "@bastani/atomic": "*",
-    "@earendil-works/pi-tui": "^0.80.6"
+    "@earendil-works/pi-tui": "^0.80.7"
   },
   "peerDependenciesMeta": {
     "@bastani/atomic": {

package/dist/builtin/workflows/src/durable/backend.ts

@@ -23,6 +23,8 @@
 
 import type { WorkflowSerializableValue } from "../shared/types.js";
 import { createHash } from "node:crypto";
+import { isDurableWorkflowResumable } from "./resume-eligibility.js";
+import { DURABLE_FORMAT_VERSION } from "./format-version.js";
 import type {
   DurableCheckpoint,
   DurableCheckpointEntry,
@@ -94,8 +96,13 @@ export interface DurableWorkflowBackend {
   /** Look up a cached stage output by replay key. */
   getStageOutput(workflowId: string, replayKey: string): WorkflowSerializableValue | undefined;
 
-  /** Look up resumable stage session metadata by replay key, when available. */
-  getStageSession(workflowId: string, replayKey: string): { sessionId?: string; sessionFile?: string } | undefined;
+  /** Look up the latest resumable stage session and accumulated active timing. */
+  getStageSession(workflowId: string, replayKey: string): {
+    sessionId?: string;
+    sessionFile?: string;
+    startedAt?: number;
+    durationMs?: number;
+  } | undefined;
 
   /** List all checkpoints for a workflow (in completion order). */
   listCheckpoints(workflowId: string): readonly DurableCheckpoint[];
@@ -107,14 +114,22 @@ export interface DurableWorkflowBackend {
   setWorkflowStatus(workflowId: string, status: DurableWorkflowStatus, pendingPrompts?: number, resumable?: boolean): void;
 
   /**
-   * List resumable workflows (not completed/cancelled, or explicitly marked
-   * resumable after failure). Used by the `/workflow resume` selector.
+   * List resumable root workflows: running/paused runs with progress and
+   * failed/blocked runs unless explicitly marked non-resumable.
    */
   listResumableWorkflows(): readonly ResumableWorkflowEntry[];
+  /** List successful completed root workflows with durable checkpoint progress. */
+  listCompletedWorkflows(): readonly ResumableWorkflowEntry[];
 
   /** Export a session-cache entry for the given workflow (for JSONL persistence). */
   toCacheEntry(workflowId: string): DurableCheckpointEntry | undefined;
 
+  /** Permanently remove one root workflow and its durable checkpoints. */
+  deleteWorkflow(workflowId: string): Promise<void>;
+
+  /** Whether a workflow id may be exposed or resumed from live/restored metadata. */
+  isWorkflowLoadable(workflowId: string): boolean;
+
   /** Clear all state (for tests). */
   reset(): void;
 
@@ -185,8 +200,10 @@ function checkpointKey(c: DurableCheckpoint): string {
 export class InMemoryDurableBackend implements DurableWorkflowBackend {
   public readonly persistent = false;
   private readonly workflows = new Map<string, InMemoryWorkflowRecord>();
+  private readonly deletedWorkflowIds = new Set<string>();
 
   registerWorkflow(handle: WorkflowRegistrationInput): void {
+    this.deletedWorkflowIds.delete(handle.workflowId);
     const existing = this.workflows.get(handle.workflowId);
     const completedCheckpoints = handle.completedCheckpoints ?? existing?.handle.completedCheckpoints ?? 0;
     const pendingPrompts = handle.pendingPrompts ?? existing?.handle.pendingPrompts ?? 0;
@@ -246,10 +263,20 @@ export class InMemoryDurableBackend implements DurableWorkflowBackend {
     return checkpoint !== undefined && "output" in checkpoint ? checkpoint.output : undefined;
   }
 
-  getStageSession(workflowId: string, replayKey: string): { sessionId?: string; sessionFile?: string } | undefined {
+  getStageSession(workflowId: string, replayKey: string): {
+    sessionId?: string;
+    sessionFile?: string;
+    startedAt?: number;
+    durationMs?: number;
+  } | undefined {
     const checkpoint = this.workflows.get(workflowId)?.stageSessionByReplayKey.get(replayKey);
     if (checkpoint?.sessionId === undefined && checkpoint?.sessionFile === undefined) return undefined;
-    return { ...(checkpoint.sessionId !== undefined ? { sessionId: checkpoint.sessionId } : {}), ...(checkpoint.sessionFile !== undefined ? { sessionFile: checkpoint.sessionFile } : {}) };
+    return {
+      ...(checkpoint.sessionId !== undefined ? { sessionId: checkpoint.sessionId } : {}),
+      ...(checkpoint.sessionFile !== undefined ? { sessionFile: checkpoint.sessionFile } : {}),
+      ...(checkpoint.startedAt !== undefined ? { startedAt: checkpoint.startedAt } : {}),
+      ...(checkpoint.durationMs !== undefined ? { durationMs: checkpoint.durationMs } : {}),
+    };
   }
 
   listCheckpoints(workflowId: string): readonly DurableCheckpoint[] {
@@ -270,7 +297,13 @@ export class InMemoryDurableBackend implements DurableWorkflowBackend {
 
   listResumableWorkflows(): readonly ResumableWorkflowEntry[] {
     return [...this.workflows.values()]
-      .filter((rec) => isRootWorkflow(rec.handle) && isResumableHandle(rec.handle))
+      .filter((rec) => isDurableWorkflowResumable(rec.handle))
+      .map((rec) => toResumableEntry(rec.handle));
+  }
+
+  listCompletedWorkflows(): readonly ResumableWorkflowEntry[] {
+    return [...this.workflows.values()]
+      .filter((rec) => isRootWorkflow(rec.handle) && isCompletedHandle(rec.handle))
       .map((rec) => toResumableEntry(rec.handle));
   }
 
@@ -279,6 +312,7 @@ export class InMemoryDurableBackend implements DurableWorkflowBackend {
     if (!rec) return undefined;
     const h = rec.handle;
     return {
+      formatVersion: DURABLE_FORMAT_VERSION,
       type: "workflow.durable.checkpoint",
       workflowId: h.workflowId,
       name: h.name,
@@ -297,8 +331,18 @@ export class InMemoryDurableBackend implements DurableWorkflowBackend {
     };
   }
 
+  async deleteWorkflow(workflowId: string): Promise<void> {
+    this.workflows.delete(workflowId);
+    this.deletedWorkflowIds.add(workflowId);
+  }
+
+  isWorkflowLoadable(workflowId: string): boolean {
+    return !this.deletedWorkflowIds.has(workflowId);
+  }
+
   reset(): void {
     this.workflows.clear();
+    this.deletedWorkflowIds.clear();
   }
 
   /** Export all records (for FileDurableBackend serialization or debugging). */
@@ -323,14 +367,8 @@ function hasResumeProgress(handle: DurableWorkflowHandle): boolean {
   return handle.completedCheckpoints > 0 || handle.pendingPrompts > 0;
 }
 
-function isResumableHandle(handle: DurableWorkflowHandle): boolean {
-  if (handle.status === "failed" || handle.status === "blocked") return handle.resumable !== false;
-  // `running`/`paused` are both resumable at the backend level: a `running`
-  // durable handle may belong to a crashed process (no live executor), which
-  // is exactly the cross-session crash-recovery case. Same-session
-  // double-resume is prevented by the command layer, which hides durable
-  // entries that match an active live run.
-  return (handle.status === "running" || handle.status === "paused") && hasResumeProgress(handle);
+function isCompletedHandle(handle: DurableWorkflowHandle): boolean {
+  return handle.status === "completed" && hasResumeProgress(handle);
 }
 
 function toResumableEntry(handle: DurableWorkflowHandle): ResumableWorkflowEntry {