@deksden-com/dd-flow-cli 0.9.0-beta.11 → 0.9.0-beta.111

package/dist/schemas/agent-profile.schema.json

@@ -7,7 +7,7 @@
   "properties": {
     "schema_id": {"const": "dd-flow/agent-profile@1"},
     "id": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$"},
-    "harness": {"enum": ["codex", "zcode", "agy", "opencode", "grok"]},
+    "harness": {"enum": ["codex", "zcode", "agy", "opencode", "grok", "droid"]},
     "provider": {"type": "string", "minLength": 1},
     "model": {"type": "string", "minLength": 1},
     "reasoning": {"type": "string", "minLength": 1},

package/dist/schemas/code-review-result.schema.json

@@ -8,7 +8,7 @@
     "schema_id": {"const": "dd-flow/code-review-result@1"},
     "verdict": {"enum": ["pass", "findings", "blocked"]},
     "summary": {"type": "string", "minLength": 1},
-    "aspects": {"type": "array", "items": {"type": "object", "additionalProperties": false, "required": ["aspect_id", "verdict", "summary", "evidence_refs"], "properties": {"aspect_id": {"type": "string", "minLength": 1}, "verdict": {"enum": ["pass", "findings", "blocked"]}, "summary": {"type": "string", "minLength": 1}, "evidence_refs": {"type": "array", "items": {"type": "string"}}}}},
+    "aspects": {"type": "array", "items": {"type": "object", "additionalProperties": false, "required": ["aspect_id", "verdict", "summary", "evidence_refs"], "properties": {"aspect_id": {"type": "string", "minLength": 1}, "verdict": {"enum": ["pass", "findings", "blocked"]}, "summary": {"type": "string", "minLength": 1}, "evidence_refs": {"type": "array", "minItems": 1, "items": {"type": "string", "minLength": 1}}}}},
     "findings": {"type": "array", "items": {"type": "object", "additionalProperties": false, "required": ["finding_id", "aspect_id", "priority", "problem", "impact", "required_outcome", "evidence_refs", "obligation_refs"], "properties": {"finding_id": {"type": "string", "pattern": "^FIND-[0-9]{3}$"}, "aspect_id": {"type": "string", "minLength": 1}, "priority": {"enum": ["p0", "p1", "p2", "p3"]}, "problem": {"type": "string", "minLength": 1}, "impact": {"type": "string", "minLength": 1}, "required_outcome": {"type": "string", "minLength": 1}, "evidence_refs": {"type": "array", "minItems": 1, "items": {"type": "string", "minLength": 1}}, "obligation_refs": {"type": "array", "minItems": 1, "items": {"type": "string", "minLength": 1}}}}}
   }
 }

package/dist/schemas/code-work-batch.schema.json

@@ -16,10 +16,10 @@
     "spine": {"type": "object", "additionalProperties": false, "required": ["user_outcome", "component_responsibility", "must_preserve", "non_goals", "acceptance_contribution"], "properties": {"user_outcome": {"type": "string", "minLength": 1}, "component_responsibility": {"type": "string", "minLength": 1}, "must_preserve": {"$ref": "#/$defs/strings"}, "non_goals": {"$ref": "#/$defs/stringList"}, "acceptance_contribution": {"type": "string", "minLength": 1}}},
     "obligation": {"type": "object", "additionalProperties": false, "required": ["id", "statement"], "properties": {"id": {"type": "string", "minLength": 1}, "statement": {"type": "string", "minLength": 1}}},
     "acceptance": {"type": "object", "additionalProperties": false, "required": ["criterion_id", "path", "environment", "fixtures", "cleanup", "check_refs", "expected_evidence", "proof_limits", "gate"], "properties": {"criterion_id": {"type": "string", "pattern": "^AC-[0-9]+$"}, "path": {"type": "string", "minLength": 1}, "environment": {"type": "string", "minLength": 1}, "fixtures": {"$ref": "#/$defs/stringList"}, "cleanup": {"type": "string", "minLength": 1}, "check_refs": {"type": "array", "uniqueItems": true, "items": {"type": "string", "minLength": 1}}, "expected_evidence": {"$ref": "#/$defs/strings"}, "proof_limits": {"$ref": "#/$defs/strings"}, "gate": {"type": "string", "minLength": 1}}},
-    "check": {"type": "object", "additionalProperties": false, "required": ["id", "command", "purpose", "run_at", "availability"], "properties": {"id": {"type": "string", "pattern": "^CHK-[A-Za-z0-9-]+$"}, "command": {"type": "string", "minLength": 1}, "purpose": {"type": "string", "minLength": 1}, "run_at": {"enum": ["work", "code", "readiness", "merge", "release", "external"]}, "availability": {"enum": ["available", "planned"]}, "provided_by": {"type": "string", "minLength": 1}, "definition": {"type": "string", "minLength": 1}, "required_artifacts": {"type": "array", "uniqueItems": true, "items": {"type": "string", "minLength": 1}}, "ports": {"type": "array", "uniqueItems": true, "items": {"type": "string", "pattern": "^[A-Za-z][A-Za-z0-9_]*$"}}}, "allOf": [{"if": {"properties": {"availability": {"const": "planned"}}, "required": ["availability"]}, "then": {"required": ["provided_by", "definition"], "properties": {"command": {"pattern": "^@check/"}}}}]},
+    "check": {"type": "object", "additionalProperties": false, "required": ["id", "command", "purpose", "run_at", "availability"], "properties": {"id": {"type": "string", "pattern": "^CHK-[A-Za-z0-9-]+$"}, "command": {"type": "string", "minLength": 1}, "purpose": {"type": "string", "minLength": 1}, "run_at": {"enum": ["work", "code", "readiness", "merge", "release"]}, "availability": {"enum": ["available", "planned"]}, "provided_by": {"type": "string", "minLength": 1}, "definition": {"type": "string", "minLength": 1}, "required_artifacts": {"type": "array", "uniqueItems": true, "items": {"type": "string", "minLength": 1}}, "ports": {"type": "array", "uniqueItems": true, "items": {"type": "string", "pattern": "^[A-Za-z][A-Za-z0-9_]*$"}}, "inputs": {"type": "array", "uniqueItems": true, "items": {"type": "string", "minLength": 1}}, "reuse": {"const": "deterministic"}}, "allOf": [{"if": {"properties": {"availability": {"const": "planned"}}, "required": ["availability"]}, "then": {"required": ["provided_by", "definition"], "properties": {"command": {"pattern": "^@check/"}}}}]},
     "documentUpdate": {"type": "object", "additionalProperties": false, "required": ["path", "action", "owner", "reason", "baseline_sha256"], "properties": {"path": {"type": "string", "minLength": 1}, "action": {"enum": ["create", "update"]}, "owner": {"type": "string", "minLength": 1}, "reason": {"type": "string", "minLength": 1}, "baseline_sha256": {"type": ["string", "null"], "pattern": "^[a-f0-9]{64}$"}}},
     "reviewFinding": {"type": "object", "additionalProperties": false, "required": ["finding_ref", "priority", "problem", "impact", "required_outcome", "evidence_refs", "obligation_refs", "decision_reason", "check_refs"], "properties": {"finding_ref": {"type": "string", "minLength": 1}, "priority": {"enum": ["p0", "p1", "p2", "p3"]}, "problem": {"type": "string", "minLength": 1}, "impact": {"type": "string", "minLength": 1}, "required_outcome": {"type": "string", "minLength": 1}, "evidence_refs": {"$ref": "#/$defs/strings"}, "obligation_refs": {"$ref": "#/$defs/strings"}, "decision_reason": {"type": "string", "minLength": 1}, "check_refs": {"$ref": "#/$defs/strings"}}},
-    "repair": {"type": "object", "additionalProperties": false, "required": ["origin_work_ids"], "anyOf": [{"required": ["check_receipt_id", "failure_receipt_path"]}, {"required": ["review_findings"]}, {"required": ["semantic_unresolved", "verification_path"]}], "properties": {"origin_work_ids": {"$ref": "#/$defs/strings"}, "check_receipt_id": {"type": "string", "minLength": 1}, "failure_receipt_path": {"type": "string", "minLength": 1}, "review_findings": {"type": "array", "minItems": 1, "items": {"$ref": "#/$defs/reviewFinding"}}, "semantic_unresolved": {"$ref": "#/$defs/strings"}, "verification_path": {"type": "string", "minLength": 1}}},
-    "work": {"type": "object", "additionalProperties": false, "required": ["schema_id", "key", "launch_policy", "source", "task", "semantic_spine", "requirements", "acceptance", "document_updates", "required_read", "discovery_boundary", "planned_write_areas", "checks", "provides_checks", "stop_conditions", "depends_on", "result_schema"], "properties": {"schema_id": {"const": "dd-flow/code-work-packet@5"}, "key": {"type": "string", "minLength": 1}, "launch_policy": {"const": "fresh_agent_required"}, "source": {"$ref": "#/$defs/source"}, "repair": {"$ref": "#/$defs/repair"}, "task": {"type": "string", "minLength": 1}, "semantic_spine": {"$ref": "#/$defs/spine"}, "requirements": {"type": "array", "minItems": 1, "items": {"$ref": "#/$defs/obligation"}}, "acceptance": {"type": "array", "items": {"$ref": "#/$defs/acceptance"}}, "document_updates": {"type": "array", "items": {"$ref": "#/$defs/documentUpdate"}}, "required_read": {"$ref": "#/$defs/strings", "description": "Mandatory starting sources, not a read allowlist."}, "discovery_boundary": {"$ref": "#/$defs/strings", "description": "Likely discovery areas; additional project-local reads are allowed."}, "planned_write_areas": {"type": "array", "items": {"type": "string", "minLength": 1}, "description": "Soft coordination hints only. A worker may change any necessary project file inside the RUN workspace."}, "checks": {"type": "array", "items": {"$ref": "#/$defs/check"}}, "provides_checks": {"type": "array", "items": {"$ref": "#/$defs/check"}}, "stop_conditions": {"$ref": "#/$defs/strings", "description": "Hard semantic or external stop conditions; path prediction drift is not a stop condition."}, "depends_on": {"type": "array", "uniqueItems": true, "items": {"type": "string", "minLength": 1}}, "result_schema": {"const": "dd-flow/code-work-result@2"}}}
+    "repair": {"type": "object", "additionalProperties": false, "required": ["origin_work_ids", "verification_check_refs"], "anyOf": [{"required": ["check_receipt_id", "failure_receipt_path"]}, {"required": ["review_findings"]}, {"required": ["semantic_unresolved", "verification_path"]}], "properties": {"origin_work_ids": {"$ref": "#/$defs/strings"}, "check_receipt_id": {"type": "string", "minLength": 1}, "failure_receipt_path": {"type": "string", "minLength": 1}, "review_findings": {"type": "array", "minItems": 1, "items": {"$ref": "#/$defs/reviewFinding"}}, "semantic_unresolved": {"$ref": "#/$defs/strings"}, "verification_path": {"type": "string", "minLength": 1}, "verification_check_refs": {"type": "array", "minItems": 1, "items": {"$ref": "#/$defs/check"}}}},
+    "work": {"type": "object", "additionalProperties": false, "required": ["schema_id", "key", "launch_policy", "source", "task", "semantic_spine", "requirements", "acceptance", "document_updates", "required_read", "discovery_boundary", "planned_write_areas", "checks", "provides_checks", "stop_conditions", "depends_on", "result_schema"], "properties": {"schema_id": {"const": "dd-flow/code-work-packet@5"}, "key": {"type": "string", "minLength": 1}, "launch_policy": {"const": "fresh_agent_required"}, "source": {"$ref": "#/$defs/source"}, "repair": {"$ref": "#/$defs/repair"}, "task": {"type": "string", "minLength": 1}, "semantic_spine": {"$ref": "#/$defs/spine"}, "requirements": {"type": "array", "minItems": 1, "items": {"$ref": "#/$defs/obligation"}}, "acceptance": {"type": "array", "items": {"$ref": "#/$defs/acceptance"}}, "document_updates": {"type": "array", "items": {"$ref": "#/$defs/documentUpdate"}}, "required_read": {"$ref": "#/$defs/strings", "description": "Mandatory starting sources, not a read allowlist."}, "discovery_boundary": {"$ref": "#/$defs/strings", "description": "Likely discovery areas; additional project-local reads are allowed."}, "planned_write_areas": {"type": "array", "items": {"type": "string", "minLength": 1}, "description": "Soft coordination hints only. A worker may change any necessary project file inside the RUN workspace."}, "checks": {"type": "array", "items": {"$ref": "#/$defs/check"}}, "provides_checks": {"type": "array", "items": {"$ref": "#/$defs/check"}}, "stop_conditions": {"$ref": "#/$defs/strings", "description": "Hard semantic or external stop conditions; path prediction drift is not a stop condition."}, "depends_on": {"type": "array", "uniqueItems": true, "items": {"type": "string", "minLength": 1}}, "result_schema": {"const": "dd-flow/code-work-result@3"}}}
   }
 }

package/dist/schemas/code-work-result.schema.json

@@ -1,14 +1,14 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "dd-flow/code-work-result@2",
+  "$id": "dd-flow/code-work-result@3",
   "type": "object",
   "additionalProperties": false,
   "required": ["schema_id", "summary", "changed_paths", "evidence", "deviations", "blockers"],
   "properties": {
-    "schema_id": {"const": "dd-flow/code-work-result@2"},
+    "schema_id": {"const": "dd-flow/code-work-result@3"},
     "summary": {"type": "string", "minLength": 1},
     "changed_paths": {"type": "array", "uniqueItems": true, "items": {"type": "string", "minLength": 1}},
-    "evidence": {"type": "array", "items": {"type": "object", "additionalProperties": false, "required": ["criterion_id", "refs"], "properties": {"criterion_id": {"type": "string", "minLength": 1}, "refs": {"type": "array", "uniqueItems": true, "items": {"type": "string", "minLength": 1}}}}},
+    "evidence": {"type": "array", "items": {"type": "object", "additionalProperties": false, "required": ["obligation_ref", "refs"], "properties": {"obligation_ref": {"type": "string", "minLength": 1}, "refs": {"type": "array", "uniqueItems": true, "items": {"type": "string", "minLength": 1}}}}},
     "deviations": {"type": "array", "items": {"type": "string", "minLength": 1}},
     "blockers": {"type": "array", "items": {"type": "string", "minLength": 1}},
     "resolutions": {"type": "array", "uniqueItems": true, "items": {"type": "object", "additionalProperties": false, "required": ["finding_ref", "summary", "evidence_refs"], "properties": {"finding_ref": {"type": "string", "minLength": 1}, "summary": {"type": "string", "minLength": 1}, "evidence_refs": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"type": "string", "minLength": 1}}}}}

package/dist/schemas/plan-review-result.schema.json

@@ -20,7 +20,7 @@
           "aspect_id": {"type": "string", "minLength": 1},
           "verdict": {"enum": ["pass", "watch", "needs_changes", "blocked"]},
           "summary": {"type": "string", "minLength": 1},
-          "evidence_refs": {"type": "array", "items": {"type": "string", "minLength": 1}},
+          "evidence_refs": {"type": "array", "minItems": 1, "items": {"type": "string", "minLength": 1}},
           "findings": {
             "type": "array",
             "items": {
@@ -31,7 +31,7 @@
                 "finding_id": {"type": "string", "pattern": "^FIND-[0-9]{3}$"},
                 "severity": {"enum": ["blocker", "high", "medium", "low", "info"]},
                 "summary": {"type": "string", "minLength": 1},
-                "evidence_refs": {"type": "array", "items": {"type": "string", "minLength": 1}}
+                "evidence_refs": {"type": "array", "minItems": 1, "items": {"type": "string", "minLength": 1}}
               }
             }
           }

package/dist/schemas/run-control-receipt.schema.json

@@ -0,0 +1,99 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "dd-flow/run-control-receipt@1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_id", "ok", "request_id", "control_id", "scope", "generation", "requested_mode", "applied_mode", "state", "settled", "nodes", "unsettled_reasons", "resumability"],
+  "properties": {
+    "schema_id": { "const": "dd-flow/run-control-receipt@1" },
+    "ok": { "const": true },
+    "request_id": { "type": ["string", "null"], "minLength": 1, "maxLength": 128 },
+    "control_id": { "type": ["string", "null"], "pattern": "^CTL-[A-Za-z0-9][A-Za-z0-9._-]*$" },
+    "scope": {
+      "type": "object", "additionalProperties": false,
+      "required": ["project_id", "run_id"],
+      "properties": {
+        "project_id": { "type": "string", "minLength": 1 },
+        "run_id": { "type": "string", "pattern": "^RUN-[A-Za-z0-9][A-Za-z0-9._-]*$" }
+      }
+    },
+    "generation": { "type": "integer", "minimum": 0 },
+    "requested_mode": { "enum": [null, "pause", "stop", "resume"] },
+    "applied_mode": { "enum": [null, "pause", "stop", "resume"] },
+    "state": { "enum": ["not_requested", "pause_requested", "paused", "stop_requested", "stopped", "resuming", "running", "terminal_noop", "superseded", "recovery_required"] },
+    "settled": { "type": "boolean" },
+    "nodes": {
+      "type": "array",
+      "items": {
+        "type": "object", "additionalProperties": false,
+        "required": ["id", "role", "status", "acknowledged", "settled", "reason"],
+        "properties": {
+          "id": { "type": "string", "minLength": 1 },
+          "role": { "enum": ["subject", "worker", "merge", "judge", "probe", "check", "process", "unknown"] },
+          "status": { "enum": ["pending", "unknown", "idle", "stopped", "completed"] },
+          "acknowledged": { "type": "boolean" },
+          "settled": { "type": "boolean" },
+          "reason": { "type": ["string", "null"] },
+          "receipt_path": { "type": "string", "minLength": 1 },
+          "details": { "type": "object" }
+        },
+        "allOf": [{
+          "if": { "properties": { "settled": { "const": true } } },
+          "then": { "properties": { "status": { "enum": ["idle", "stopped", "completed"] } } }
+        }]
+      }
+    },
+    "unsettled_reasons": { "type": "array", "uniqueItems": true, "items": { "type": "string", "minLength": 1 } },
+    "resumability": { "enum": ["pending", "same_session", "replacement_allowed", "recovery_required", "not_applicable"] },
+    "recovery_id": { "type": ["string", "null"] },
+    "reused": { "type": "boolean" },
+    "next_cursor": { "type": "integer", "minimum": 0 },
+    "run_status": { "type": "string" },
+    "control": { "type": ["object", "null"] },
+    "operations": { "type": "array", "items": { "type": "object" } },
+    "worker": { "type": ["object", "null"] },
+    "resume_operation": { "type": ["object", "null"] },
+    "controller": { "type": "object" },
+    "operation_id": { "type": "string", "minLength": 1 },
+    "status": { "type": "string" },
+    "action": { "enum": ["pause", "stop", "resume"] },
+    "progress": {
+      "type": "array",
+      "items": { "type": "object", "additionalProperties": false, "required": ["phase", "message", "at"], "properties": { "phase": { "enum": ["start", "running", "done", "failed"] }, "message": { "type": "string" }, "at": { "type": "string" }, "detail": { "type": "object" } } }
+    },
+    "warnings": { "type": "array", "items": { "type": "object" } },
+    "response_file": { "type": "string", "minLength": 1 },
+    "response_file_error": { "type": "string" }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "state": { "not": { "enum": ["not_requested", "terminal_noop"] } } } },
+      "then": { "properties": { "control_id": { "type": "string" }, "request_id": { "type": "string" }, "requested_mode": { "type": "string" } } }
+    },
+    {
+      "if": { "properties": { "state": { "enum": ["paused", "stopped"] } } },
+      "then": { "properties": { "settled": { "const": true } } }
+    },
+    {
+      "if": { "properties": { "state": { "const": "paused" } } },
+      "then": { "properties": { "applied_mode": { "const": "pause" } } }
+    },
+    {
+      "if": { "properties": { "state": { "const": "stopped" } } },
+      "then": { "properties": { "applied_mode": { "const": "stop" } } }
+    },
+    {
+      "if": { "properties": { "settled": { "const": true } } },
+      "then": {
+        "properties": {
+          "nodes": { "items": { "properties": { "settled": { "const": true } } } },
+          "unsettled_reasons": { "maxItems": 0 }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "settled": { "const": false } } },
+      "then": { "properties": { "unsettled_reasons": { "minItems": 1 }, "resumability": { "enum": ["pending", "recovery_required", "not_applicable"] } } }
+    }
+  ]
+}

package/dist/schemas/run-control-request.schema.json

@@ -0,0 +1,36 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "dd-flow/run-control-request@1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_id", "request_id", "project_root", "run_id", "action"],
+  "properties": {
+    "schema_id": { "const": "dd-flow/run-control-request@1" },
+    "request_id": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]*$" },
+    "project_root": { "type": "string", "minLength": 1, "pattern": "^(?:/|[A-Za-z]:[\\\\/]|\\\\\\\\)" },
+    "run_id": { "type": "string", "pattern": "^RUN-[A-Za-z0-9][A-Za-z0-9._-]*$" },
+    "action": { "enum": ["pause", "stop", "resume"] },
+    "wait_ms": { "type": "integer", "minimum": 0, "maximum": 60000, "default": 0 },
+    "grace_ms": { "type": "integer", "minimum": 0, "maximum": 3600000, "default": 30000 },
+    "escalate": { "const": "interrupt" },
+    "force": { "type": "boolean" },
+    "from": { "type": "string", "pattern": "^CTL-[A-Za-z0-9][A-Za-z0-9._-]*$" }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "action": { "const": "pause" } } },
+      "then": { "not": { "anyOf": [{ "required": ["force"] }, { "required": ["from"] }] } }
+    },
+    {
+      "if": { "properties": { "action": { "const": "stop" } } },
+      "then": { "not": { "anyOf": [{ "required": ["grace_ms"] }, { "required": ["escalate"] }, { "required": ["from"] }] } }
+    },
+    {
+      "if": { "properties": { "action": { "const": "resume" } } },
+      "then": {
+        "required": ["from"],
+        "not": { "anyOf": [{ "required": ["grace_ms"] }, { "required": ["escalate"] }, { "required": ["force"] }] }
+      }
+    }
+  ]
+}

package/dist/schemas/vnext-protocol-plan.schema.json

@@ -29,9 +29,9 @@
     "documentUpdate": {"type": "object", "additionalProperties": false, "required": ["path", "action", "owner", "reason"], "properties": {"path": {"type": "string", "minLength": 1}, "action": {"enum": ["create", "update"]}, "owner": {"type": "string", "minLength": 1}, "reason": {"type": "string", "minLength": 1}}},
     "spine": {"type": "object", "additionalProperties": false, "required": ["user_outcome", "component_responsibility", "must_preserve", "non_goals", "acceptance_contribution"], "properties": {"user_outcome": {"type": "string", "minLength": 1}, "component_responsibility": {"type": "string", "minLength": 1}, "must_preserve": {"$ref": "#/$defs/strings"}, "non_goals": {"type": "array", "items": {"type": "string", "minLength": 1}}, "acceptance_contribution": {"type": "string", "minLength": 1}}},
     "execution": {"type": "object", "additionalProperties": false, "required": ["required_read", "discovery_boundary", "planned_write_areas", "stop_conditions"], "properties": {"required_read": {"$ref": "#/$defs/strings", "description": "Mandatory starting sources. This is not a read allowlist."}, "discovery_boundary": {"$ref": "#/$defs/strings", "description": "Likely discovery areas. A worker may inspect other project-local sources when necessary."}, "planned_write_areas": {"type": "array", "items": {"type": "string", "minLength": 1}, "description": "Optional file or directory hints used only to coordinate concurrent Works. They never grant or deny write permission."}, "stop_conditions": {"$ref": "#/$defs/strings", "description": "Semantic contradictions or external blockers that require the worker to stop."}}},
-    "check": {"type": "object", "additionalProperties": false, "required": ["id", "command", "purpose", "run_at", "availability"], "properties": {"id": {"type": "string", "pattern": "^CHK-[A-Za-z0-9-]+$"}, "command": {"type": "string", "minLength": 1}, "purpose": {"type": "string", "minLength": 1}, "run_at": {"enum": ["work", "code", "readiness", "merge", "release", "external"]}, "availability": {"enum": ["available", "planned"]}, "provided_by": {"type": "string", "pattern": "^P[0-9]+$"}, "definition": {"type": "string", "minLength": 1}, "required_artifacts": {"type": "array", "uniqueItems": true, "items": {"type": "string", "minLength": 1}}, "ports": {"type": "array", "uniqueItems": true, "items": {"type": "string", "pattern": "^[A-Za-z][A-Za-z0-9_]*$"}}}, "allOf": [{"if": {"properties": {"availability": {"const": "planned"}}, "required": ["availability"]}, "then": {"required": ["provided_by", "definition"], "properties": {"command": {"pattern": "^@check/"}}}}, {"if": {"properties": {"command": {"pattern": "^@check/"}}}, "then": {"required": ["definition"]}}]},
+    "check": {"type": "object", "additionalProperties": false, "required": ["id", "command", "purpose", "run_at", "availability"], "properties": {"id": {"type": "string", "pattern": "^CHK-[A-Za-z0-9-]+$"}, "command": {"type": "string", "minLength": 1}, "purpose": {"type": "string", "minLength": 1}, "run_at": {"enum": ["work", "code", "readiness", "merge", "release"]}, "availability": {"enum": ["available", "planned"]}, "provided_by": {"type": "string", "pattern": "^P[0-9]+$"}, "definition": {"type": "string", "minLength": 1}, "required_artifacts": {"type": "array", "uniqueItems": true, "items": {"type": "string", "minLength": 1}}, "ports": {"type": "array", "uniqueItems": true, "items": {"type": "string", "pattern": "^[A-Za-z][A-Za-z0-9_]*$"}}, "inputs": {"type": "array", "uniqueItems": true, "items": {"type": "string", "minLength": 1}}, "reuse": {"const": "deterministic"}}, "allOf": [{"if": {"properties": {"availability": {"const": "planned"}}, "required": ["availability"]}, "then": {"required": ["provided_by", "definition"], "properties": {"command": {"pattern": "^@check/"}}}}, {"if": {"properties": {"command": {"pattern": "^@check/"}}}, "then": {"required": ["definition"]}}]},
     "verification": {"type": "object", "additionalProperties": false, "required": ["check_refs"], "properties": {"check_refs": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"type": "string", "pattern": "^CHK-[A-Za-z0-9-]+$"}}}},
     "item": {"type": "object", "additionalProperties": false, "required": ["id", "title", "summary", "details", "depends_on", "requirement_refs", "semantic_spine", "execution_context", "verification"], "properties": {"id": {"type": "string", "pattern": "^P[0-9]+$"}, "title": {"type": "string", "minLength": 1}, "summary": {"type": "string", "minLength": 1}, "details": {"type": "string", "minLength": 1}, "depends_on": {"type": "array", "uniqueItems": true, "items": {"type": "string", "pattern": "^P[0-9]+$"}}, "requirement_refs": {"$ref": "#/$defs/strings"}, "semantic_spine": {"$ref": "#/$defs/spine"}, "execution_context": {"$ref": "#/$defs/execution"}, "verification": {"$ref": "#/$defs/verification"}}},
-    "acceptance": {"type": "object", "additionalProperties": false, "required": ["criterion_id", "plan_item_ids", "changed_surfaces", "path", "environment", "fixtures", "cleanup", "check_refs", "expected_evidence", "proof_limits", "gate"], "properties": {"criterion_id": {"type": "string", "pattern": "^AC-[0-9]+$"}, "plan_item_ids": {"type": "array", "minItems": 1, "items": {"type": "string", "pattern": "^P[0-9]+$"}}, "changed_surfaces": {"$ref": "#/$defs/strings"}, "path": {"type": "string", "minLength": 1}, "environment": {"type": "string", "minLength": 1}, "fixtures": {"type": "array", "items": {"type": "string", "minLength": 1}}, "cleanup": {"type": "string", "minLength": 1}, "check_refs": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"type": "string", "pattern": "^CHK-[A-Za-z0-9-]+$"}}, "expected_evidence": {"$ref": "#/$defs/strings"}, "proof_limits": {"$ref": "#/$defs/strings"}, "gate": {"enum": ["work", "code", "readiness", "merge", "release", "external"]}}}
+    "acceptance": {"type": "object", "additionalProperties": false, "required": ["criterion_id", "plan_item_ids", "changed_surfaces", "path", "environment", "fixtures", "cleanup", "check_refs", "expected_evidence", "proof_limits", "gate"], "properties": {"criterion_id": {"type": "string", "pattern": "^AC-[0-9]+$"}, "plan_item_ids": {"type": "array", "minItems": 1, "items": {"type": "string", "pattern": "^P[0-9]+$"}}, "changed_surfaces": {"$ref": "#/$defs/strings"}, "path": {"type": "string", "minLength": 1}, "environment": {"type": "string", "minLength": 1}, "fixtures": {"type": "array", "items": {"type": "string", "minLength": 1}}, "cleanup": {"type": "string", "minLength": 1}, "check_refs": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"type": "string", "pattern": "^CHK-[A-Za-z0-9-]+$"}}, "expected_evidence": {"$ref": "#/$defs/strings"}, "proof_limits": {"$ref": "#/$defs/strings"}, "gate": {"enum": ["work", "code", "readiness", "merge", "release"]}}}
   }
 }

package/dist/services/canon.js

@@ -1,27 +1,30 @@
 import fs from "node:fs";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
+import { AppError } from "../shared/errors.js";
+import { prepareError } from "../cli/input-preparation.js";
 const canonRootKey = "canon.root";
-export function registerCanonRoot(context, input) {
+export function prepareCanonRegistration(context, input) {
+    if (typeof input.root !== "string" || !input.root.trim())
+        return prepareError(new AppError("validation", "Canon root must be a non-empty path", 2));
     const resolution = resolveCanonRoot(context, { explicitRoot: input.root, allowRegistered: false });
     if (!resolution.ok || !resolution.canon) {
-        return {
-            ...resolution,
-            action: "register",
-            exit_code: 1
-        };
+        return prepareError(new AppError("validation", "Canon root cannot be registered", 2, { root: input.root, blockers: resolution.blockers, candidates: resolution.candidates, bootstrap: resolution.bootstrap }));
     }
+    return resolution.canon;
+}
+export function registerCanonRoot(context, input, canon = prepareCanonRegistration(context, input)) {
     const now = context.now();
     context.db.run(`INSERT INTO runtime_config (key, value_json, created_at, updated_at)
      VALUES (?, ?, ?, ?)
      ON CONFLICT(key) DO UPDATE SET
        value_json = excluded.value_json,
-       updated_at = excluded.updated_at`, [canonRootKey, JSON.stringify({ root: resolution.canon.root }), now, now]);
+       updated_at = excluded.updated_at`, [canonRootKey, JSON.stringify({ root: canon.root }), now, now]);
     return {
         ok: true,
         action: "register",
         canon: {
-            ...resolution.canon,
+            ...canon,
             source: "registered"
         },
         db_path: context.db.path

package/dist/services/cleanup.js

@@ -2,13 +2,13 @@ import fs from "node:fs";
 import { spawnSync } from "node:child_process";
 import path from "node:path";
 import { AppError } from "../shared/errors.js";
-import { parseJsonObject } from "../shared/json.js";
-import { ensureReadableFile } from "../storage/database.js";
-import { projectCheckoutRoot, resolveProjectRoot } from "../storage/paths.js";
+import { prepareJsonFile } from "../cli/input-preparation.js";
+import { projectCheckoutRoot, resolveProjectRoot, runtimeStateJsonPath } from "../storage/paths.js";
 import { appendAudit } from "./audit.js";
 import { requireProjectByRoot } from "./projects.js";
-import { protocolRunDiagnostics, readProtocolRuntimeState, requireProtocol } from "./protocols.js";
+import { persistProtocolState, prepareProtocolRuntimeRepair, protocolRunDiagnostics, readProtocolRuntimeState, requireProtocol } from "./protocols.js";
 import { publicSessionIdentity } from "./session-identity.js";
+import { publishRunProjections } from "./runs.js";
 const actionKinds = new Set([
     "repair_protocol_state",
     "cancel_queue_job",
@@ -25,7 +25,8 @@ export function cleanupScan(context, input) {
     const protocols = context.db.all("SELECT id, status, stage, state_path FROM protocols WHERE project_id = ? ORDER BY id ASC", [project.id]);
     for (const protocol of protocols) {
         const terminal = ["closed", "cancelled"].includes(protocol.status) || ["closed", "cancelled"].includes(protocol.stage);
-        if (!fs.existsSync(protocol.state_path)) {
+        const requiresMigration = protocol.state_path !== runtimeStateJsonPath(context.ddFlowHome, project.id, protocol.id);
+        if (!fs.existsSync(protocol.state_path) || requiresMigration) {
             pushFinding(findings, actions, "missing_protocol_runtime_state", "warning", {
                 protocol_id: protocol.id,
                 path: protocol.state_path,
@@ -43,6 +44,8 @@ export function cleanupScan(context, input) {
             }
         }
         const fullProtocol = requireProtocol(context, protocol.id, project.id);
+        if (requiresMigration)
+            continue;
         const state = readProtocolRuntimeState(context, fullProtocol).state;
         const diagnostics = protocolRunDiagnostics(context, fullProtocol, state).diagnostics;
         for (const diagnostic of diagnostics.filter((entry) => entry.code === "protocol_run_stage_mismatch")) {
@@ -170,36 +173,55 @@ export function cleanupScan(context, input) {
         plan: { project_root: project.root, project_id: project.id, actions }
     };
 }
-export function cleanupApply(context, input) {
-    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+export function prepareCleanupApply(context, input) {
     const reason = input.reason.trim();
     if (!reason) {
         throw new AppError("validation", "cleanup apply requires --reason", 2);
     }
-    ensureReadableFile(input.planFile);
-    const plan = validateCleanupPlan(parseJsonObject(fs.readFileSync(input.planFile, "utf8"), input.planFile), project);
+    const value = prepareJsonFile(input.planFile, "cleanup plan").value;
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new AppError("validation", "cleanup plan must be an object", 2);
+    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    const plan = validateCleanupPlan(value, project);
     validateNoDestructiveSurprises(context, plan, input.force);
+    return { project, reason, plan };
+}
+export function cleanupApply(context, input) {
+    const { project, reason, plan } = input.prepared ?? prepareCleanupApply(context, input);
+    // A supplied plan can outlive its initial inspection. Refresh external
+    // workspace evidence before reserving the writer, then recheck SQL below.
+    if (input.prepared)
+        validateNoDestructiveSurprises(context, plan, input.force);
+    const prepared = prepareCleanupEffects(context, plan);
     const now = context.now();
     const results = [];
-    context.db.exec("BEGIN IMMEDIATE");
+    let executing = false, committed = false;
     try {
-        for (const action of plan.actions) {
-            results.push(applyAction(context, action, reason, input.force, now));
-        }
-        const changed = results.filter((result) => result.changed).length;
-        if (changed > 0) {
-            appendAudit(context, {
-                projectId: project.id,
-                eventType: "cleanup.applied",
-                reason,
-                forced: input.force,
-                payload: { project_id: project.id, action_count: plan.actions.length, changed, results }
-            });
-        }
-        context.db.exec("COMMIT");
+        context.db.writeTransaction(() => {
+            context.db.afterCommit(() => { committed = true; });
+            validateNoDestructiveSurprises(context, plan, input.force, false);
+            prepared.assertUnchanged();
+            for (const action of plan.actions) {
+                executing = true;
+                results.push(applyAction(context, action, reason, input.force, now, prepared));
+            }
+            const changed = results.filter((result) => result.changed).length;
+            if (changed > 0) {
+                appendAudit(context, {
+                    projectId: project.id,
+                    eventType: "cleanup.applied",
+                    reason,
+                    forced: input.force,
+                    payload: { project_id: project.id, action_count: plan.actions.length, changed, results }
+                });
+            }
+        });
     }
     catch (error) {
-        context.db.exec("ROLLBACK");
+        if (committed || error instanceof AppError && error.details.effect === "committed")
+            throw new AppError(error instanceof AppError ? error.code : "cleanup_publication_failed", error instanceof Error ? error.message : "Committed cleanup publication failed", error instanceof AppError ? error.exitCode : 1, { ...(error instanceof AppError ? error.details : {}), effect: "committed", publication_pending: true, attempted_results: results, cause: String(error) });
+        if (executing)
+            throw new AppError("cleanup_apply_failed", "Cleanup failed after execution began; inspect retained artifacts before retrying", 1, { effect: "unknown", database_rolled_back: true, attempted_results: results, cause: error instanceof Error ? error.message : String(error), ...(error instanceof AppError ? { cause_code: error.code } : {}) });
         throw error;
     }
     return {
@@ -248,18 +270,36 @@ function validateCleanupPlan(value, project) {
                 throw new AppError("validation", "close_flow_session requires a native session identity", 2);
             }
         }
+        const requiredField = action.kind === "discard_stale_run" ? "run_id"
+            : ["repair_protocol_state", "cancel_queue_job", "close_worktree_record"].includes(String(action.kind)) ? "protocol_id" : undefined;
+        if (requiredField && (typeof action[requiredField] !== "string" || !action[requiredField].trim()))
+            throw new AppError("validation", `cleanup ${String(action.kind)} requires ${requiredField}`, 2);
+        const numericField = action.kind === "expire_lane_lock" ? "lock_id" : action.kind === "expire_lane_waiter" ? "waiter_id" : undefined;
+        if (numericField && (!Number.isSafeInteger(action[numericField]) || action[numericField] < 1))
+            throw new AppError("validation", `cleanup ${String(action.kind)} requires a positive integer ${numericField}`, 2);
+        if (action.worktree_path !== undefined && (typeof action.worktree_path !== "string" || !path.isAbsolute(action.worktree_path)))
+            throw new AppError("validation", "cleanup worktree_path must be an absolute path", 2);
         return action;
     });
     return { project_root: project.root, project_id: project.id, actions };
 }
-function validateNoDestructiveSurprises(context, plan, force) {
-    const destructive = plan.actions.find((action) => action.kind === "close_worktree_record" && action.worktree_path && dirtyGit(action.worktree_path));
+function validateNoDestructiveSurprises(context, plan, force, inspectFiles = true) {
+    for (const action of plan.actions) {
+        if (action.kind === "repair_protocol_state")
+            requireProtocol(context, action.protocol_id, action.project_id);
+        if (action.kind === "discard_stale_run") {
+            const run = context.db.get("SELECT index_json, status FROM runs WHERE project_id = ? AND id = ?", [action.project_id, action.run_id]);
+            if (run && ["running", "discarded"].includes(run.status))
+                cleanupRunIndex(run.index_json);
+        }
+    }
+    const destructive = inspectFiles && plan.actions.find((action) => action.kind === "close_worktree_record" && action.worktree_path && dirtyGit(action.worktree_path));
     if (destructive && !force) {
         throw new AppError("worktree_dirty", "cleanup apply refuses dirty worktree actions without --force --reason", 1, {
             path: destructive.worktree_path
         });
     }
-    const unsafeWorktree = plan.actions.find((action) => action.kind === "close_worktree_record" && action.worktree_path && !safeCleanupWorktreePath(context, action.project_id, action.worktree_path));
+    const unsafeWorktree = inspectFiles && plan.actions.find((action) => action.kind === "close_worktree_record" && action.worktree_path && !safeCleanupWorktreePath(context, action.project_id, action.worktree_path));
     if (unsafeWorktree) {
         throw new AppError("worktree_cleanup_unsafe", "cleanup apply refuses unsafe worktree path", 1, {
             path: unsafeWorktree.worktree_path
@@ -278,12 +318,53 @@ function validateNoDestructiveSurprises(context, plan, force) {
         });
     }
 }
-function applyAction(context, action, reason, force, now) {
+function prepareCleanupEffects(context, plan) {
+    const checks = [], files = new Map();
+    const repairs = new Map();
+    const read = (sql, params) => {
+        const value = context.db.get(sql, params), encoded = JSON.stringify(value);
+        checks.push(() => { if (JSON.stringify(context.db.get(sql, params)) !== encoded)
+            throw new AppError("cleanup_plan_changed", "Cleanup target changed during preparation", 1, { effect: "no_effect" }); });
+        return value;
+    };
+    const remember = (file) => { if (file !== undefined)
+        files.set(file, fs.existsSync(file)); };
+    for (const action of plan.actions) {
+        if (action.kind === "repair_protocol_state") {
+            read("SELECT * FROM protocols WHERE project_id = ? AND id = ?", [action.project_id, action.protocol_id]);
+            const protocol = requireProtocol(context, action.protocol_id, action.project_id);
+            remember(protocol.state_path);
+            repairs.set(action, prepareProtocolRuntimeRepair(context, protocol));
+        }
+        if (action.kind === "discard_stale_run") {
+            const run = read("SELECT * FROM runs WHERE project_id = ? AND id = ?", [action.project_id, action.run_id]);
+            if (run) {
+                remember(run.runtime_path);
+                remember(run.run_dir);
+                remember(run.workspace_root);
+            }
+        }
+        if (action.kind === "close_worktree_record") {
+            const record = read("SELECT * FROM worktree_records WHERE project_id = ? AND protocol_id = ?", [action.project_id, action.protocol_id]);
+            remember(action.worktree_path ?? record?.worktree_path);
+        }
+    }
+    return { repairs, assertUnchanged: () => { for (const check of checks)
+            check(); }, exists: (file) => {
+            if (!files.has(file))
+                throw new AppError("cleanup_plan_changed", "Cleanup target has no prepared filesystem observation", 1, { path: file, effect: "no_effect" });
+            return files.get(file);
+        } };
+}
+function applyAction(context, action, reason, force, now, prepared) {
     if (action.kind === "repair_protocol_state" && action.protocol_id) {
         const protocol = requireProtocol(context, action.protocol_id, action.project_id);
         const beforePath = protocol.state_path;
-        const existed = fs.existsSync(beforePath);
-        readProtocolRuntimeState(context, protocol);
+        const existed = prepared.exists(beforePath), repair = prepared.repairs.get(action);
+        context.db.run("UPDATE protocols SET state_path = ?, plan_path = ? WHERE project_id = ? AND id = ?", [repair.statePath, repair.planPath, action.project_id, action.protocol_id]);
+        persistProtocolState(context, { ...protocol, state_path: repair.statePath, plan_path: repair.planPath }, repair.state);
+        protocol.state_path = repair.statePath;
+        appendAudit(context, { protocolId: protocol.id, projectId: protocol.project_id, eventType: "protocol.runtime_state_repaired", payload: { protocol_id: protocol.id, path: repair.statePath, repaired_from: repair.previousStatePath, source: "sqlite" } });
         return {
             kind: action.kind,
             changed: !existed || beforePath !== protocol.state_path,
@@ -338,21 +419,19 @@ function applyAction(context, action, reason, force, now) {
         if (run.status === "discarded") {
             const index = discardedRunIndex(run.index_json, reason, now);
             context.db.run("UPDATE runs SET verdict = 'discarded', next_action = ?, index_json = ?, updated_at = ?, completed_at = COALESCE(completed_at, ?) WHERE project_id = ? AND id = ?", [reason, JSON.stringify(index), now, now, action.project_id, action.run_id]);
-            if (fs.existsSync(run.runtime_path))
-                fs.writeFileSync(run.runtime_path, `${JSON.stringify(index, null, 2)}\n`);
+            context.db.afterCommit(() => publishRunProjections(context, action.project_id, action.run_id));
             return { kind: action.kind, changed: true, run_id: action.run_id };
         }
         if (run.status !== "running") {
             return { kind: action.kind, changed: false, skipped: true, reason: `already_${run.status}`, run_id: action.run_id };
         }
-        if (fs.existsSync(run.runtime_path) || fs.existsSync(run.run_dir) || fs.existsSync(run.workspace_root)) {
+        if (prepared.exists(run.runtime_path) || prepared.exists(run.run_dir) || prepared.exists(run.workspace_root)) {
             return { kind: action.kind, changed: false, skipped: true, reason: "runtime_or_workspace_reappeared", run_id: action.run_id };
         }
         const index = discardedRunIndex(run.index_json, reason, now);
         context.db.run(`UPDATE runs SET status = 'discarded', verdict = 'discarded', next_action = ?, index_json = ?, updated_at = ?, completed_at = ?
        WHERE project_id = ? AND id = ? AND status = 'running'`, [reason, JSON.stringify(index), now, now, action.project_id, action.run_id]);
-        fs.mkdirSync(run.run_dir, { recursive: true });
-        fs.writeFileSync(run.runtime_path, `${JSON.stringify(index, null, 2)}\n`);
+        context.db.afterCommit(() => publishRunProjections(context, action.project_id, action.run_id));
         context.db.run(`UPDATE sessions SET status = 'stopped', stop_reason = ?, updated_at = ?, stopped_at = ?
        WHERE project_id = ? AND run_id = ? AND status IN ('pending', 'active', 'waiting_user', 'blocked', 'stopping')`, [reason, now, now, action.project_id, action.run_id]);
         context.db.run("UPDATE flow_session_segments SET ended_at = ? WHERE project_id = ? AND run_id = ? AND ended_at IS NULL", [now, action.project_id, action.run_id]);
@@ -394,7 +473,7 @@ function applyAction(context, action, reason, force, now) {
     }
     if (action.kind === "close_worktree_record" && action.protocol_id) {
         const worktreePath = action.worktree_path ?? context.db.get("SELECT worktree_path FROM worktree_records WHERE project_id = ? AND protocol_id = ?", [action.project_id, action.protocol_id])?.worktree_path;
-        const status = worktreePath && fs.existsSync(worktreePath) ? "kept" : "removed";
+        const status = worktreePath && prepared.exists(worktreePath) ? "kept" : "removed";
         const result = context.db.run(`UPDATE worktree_records SET status = ?, updated_at = ?, closed_at = ?
        WHERE project_id = ? AND protocol_id = ? AND status = 'active'`, [status, now, now, action.project_id, action.protocol_id]);
         return {
@@ -407,22 +486,36 @@ function applyAction(context, action, reason, force, now) {
     return { kind: action.kind, changed: false, skipped: true, reason: "invalid_action" };
 }
 function discardedRunIndex(indexJson, reason, now) {
-    const index = JSON.parse(indexJson);
+    const index = cleanupRunIndex(indexJson);
     index.schema_id = "dd-flow/flow-run@3";
     index.status = "discarded";
     index.verdict = "discarded";
     index.next_action = reason;
     index.updated_at = now;
+    index.runtime_revision = (typeof index.runtime_revision === "number" ? index.runtime_revision : 0) + 1;
     index.completed_at ??= now;
     index.finished_at ??= now;
     return index;
 }
+function cleanupRunIndex(indexJson) {
+    try {
+        const index = JSON.parse(indexJson);
+        if (!index || typeof index !== "object" || Array.isArray(index))
+            throw new Error("RUN index must be an object");
+        return index;
+    }
+    catch (error) {
+        throw new AppError("runtime_state_invalid", "Cleanup cannot read retained RUN state", 1, { cause: String(error) });
+    }
+}
 function dirtyGit(worktreePath) {
     if (!fs.existsSync(worktreePath)) {
         return false;
     }
     const result = spawnSync("git", ["-C", worktreePath, "status", "--porcelain"], { encoding: "utf8" });
-    return result.status === 0 && result.stdout.trim().length > 0;
+    if (result.error || result.status !== 0)
+        throw new AppError("workspace_status_failed", "Cannot establish worktree status before cleanup", 1, { path: worktreePath, cause: result.error?.message ?? result.stderr });
+    return result.stdout.trim().length > 0;
 }
 function safeCleanupWorktreePath(context, projectId, worktreePath) {
     if (!fs.existsSync(worktreePath)) {