@deksden-com/dd-flow-cli 0.9.0-beta.122 → 0.9.0-beta.124

package/dist/harness-runtime/lib/dd-zcode.mjs

@@ -7,7 +7,8 @@ import { createHash } from "node:crypto";
 import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 import readline from "node:readline";
-import { stopProcessGroup } from "./managed-daemon.mjs";
+import { closeBridgeProcess } from "./managed-daemon.mjs";
+import { errorRecord } from "./operation-errors.mjs";
 import { checkObservedProfile, observeModel, observedFields } from "./model-observations.mjs";
 
 import { readZcodeUsage } from "./zcode-usage.mjs";
@@ -164,13 +165,15 @@ export class AcpBridge {
     const identity = this.modelSessions.get(adapterId); if (!identity) return;
     this.modelProfiles.set(identity.sessionId, observed);
     await observeModel({ journal: this.options.journal, harness: this.options.clientInfo?.name === "dd-grok" ? "grok-acp" : "zcode-acp",
-      sessionId: identity.sessionId, parentSessionId: identity.parentSessionId, requested: identity.requested, observed, source });
+      sessionId: identity.sessionId, parentSessionId: identity.parentSessionId, requested: identity.requested, observed, source: typeof source === "string" ? { channel: source, scope: "configured", raw_model: observed.raw_model ?? observed.model, raw_provider: observed.provider } : source });
   }
   async observeModelUpdate(message) {
     const update = message.params?.update;
     if (update?.sessionUpdate !== "config_option_update" || !Array.isArray(update.configOptions)) return;
     const value = category => update.configOptions.find(option => option.type === "select" && (option.category === category || option.id === category))?.currentValue ?? null;
-    const observed = { model: value("model"), reasoning: value("thought_level"), mode: value("mode") };
+    const raw = value("model");
+    const model = this.options.clientInfo?.name === "dd-grok" ? { model: raw } : zcodeModelSelector(raw);
+    const observed = { ...model, reasoning: value("thought_level"), mode: value("mode") };
     const identity = this.modelSessions.get(message.params.sessionId); if (!identity?.armed) return;
     checkObservedProfile(identity.requested, observed);
     await this.recordModel(message.params.sessionId, observed, "acp.config_option_update");
@@ -421,13 +424,10 @@ export class AcpBridge {
   async close() {
     // Productive notification failures belong to flush()/the original Turn.
     // Draining them must not relabel a successful physical shutdown as failed.
-    await Promise.allSettled([...this.lifecycleNotifications, this.notifications]);
-    if (this.child) {
-      this.child.stdin.end();
-      await Promise.race([new Promise((resolve) => this.child.once("exit", resolve)), new Promise((resolve) => setTimeout(resolve, 2000))]);
-      await stopProcessGroup(this.child, 2_000);
-    }
-    await this.journal.flush();
+    return await closeBridgeProcess(this, async () => {
+      await Promise.allSettled([...this.lifecycleNotifications, this.notifications]);
+      await this.journal.flush();
+    });
   }
 }
 
@@ -443,11 +443,20 @@ function isProductiveSessionNotification(message) {
   return true;
 }
 
+// The qualified bridge encodes exactly providerId\\modelId; no other suffix or
+// slash normalization is authorized. Bare IDs do not prove account routing.
+export function zcodeModelSelector(raw, provider = null) {
+  if (typeof raw !== "string") return { model: null, provider, raw_model: raw };
+  const parts = raw.split("\\");
+  if (parts.length === 1) return { model: raw || null, provider, raw_model: raw };
+  if (parts.length !== 2 || !parts.every(Boolean) || provider && provider !== parts[0]) return { model: null, provider, raw_model: raw };
+  return { model: parts[1], provider: parts[0], raw_model: raw };
+}
+
 export function observedProfile(read) {
   const model = read?.settings?.model?.current ?? {};
   return {
-    provider: typeof model.providerId === "string" ? model.providerId : null,
-    model: typeof model.modelId === "string" ? model.modelId : null,
+    ...zcodeModelSelector(model.modelId, typeof model.providerId === "string" ? model.providerId : null),
     reasoning: read?.settings?.thoughtLevel?.current ?? null,
     mode: read?.settings?.mode?.current ?? read?.projection?.mode ?? null,
   };
@@ -710,9 +719,10 @@ function requireJournal(options) { absolute(options.journal, "--journal"); }
 function receipt(options, value) { return options.daemonId ? { daemon_id: options.daemonId, ...value } : value; }
 
 async function withBridge(options, operation) {
-  const bridge = new AcpBridge(options);
+  const bridge = new AcpBridge(options); let primary;
   try { const initialized = await bridge.start(); const result = await operation(bridge, initialized); await bridge.flush(); return result; }
-  finally { await bridge.close(); }
+  catch (error) { primary = error; throw error; }
+  finally { try { await bridge.close(); } catch (error) { if (!primary) throw error; primary.cleanup_error = errorRecord(error); primary.details = { ...primary.details, cleanup_error: primary.cleanup_error }; } }
 }
 
 function flowForwarder(options, rootProviderSessionId, bridge) {

package/dist/harness-runtime/lib/driver-recovery.mjs

@@ -7,11 +7,21 @@ import { reportedError } from "./operation-errors.mjs";
 import { ObservationClock } from "./observation-clock.mjs";
 import { runtimeProcess } from "./managed-daemon.mjs";
 
+function cleanShutdownConfirmed(state) {
+  const proof = state.shutdown;
+  return state.shutdown_state === "clean" && state.active_tree === false
+    && proof?.schema_id === "dd-flow/daemon-shutdown@1" && proof.daemon_id === state.daemon_id
+    && proof.result?.clean === true && Array.isArray(proof.required_phases)
+    && proof.required_phases.length >= 3 && proof.required_phases.includes("tree")
+    && proof.required_phases.includes("daemon_resource")
+    && proof.required_phases.every(phase => typeof phase === "string" && proof.phases?.[phase] === true);
+}
+
 /** Explicit same-Session restart retains native stores and the old daemon
  * receipt; it does not turn a terminal directory into a new execution. */
 export async function authorizeRetainedDaemonResume(root, previous, sessionId, config) {
   const sessions = [...(previous.sessions ?? []), ...(previous.root_session_id ? [previous.root_session_id] : [])];
-  if (previous.shutdown_state !== "clean" || previous.active_tree === true || typeof sessionId !== "string" || !sessions.some(session => (typeof session === "string" ? session : session.provider_session_id) === sessionId)) throw Object.assign(new Error("terminal daemon restart requires a retained, settled Session identity"), { code: "daemon_state_terminal" });
+  if (!cleanShutdownConfirmed(previous) || typeof sessionId !== "string" || !sessions.some(session => (typeof session === "string" ? session : session.provider_session_id) === sessionId)) throw Object.assign(new Error("terminal daemon restart requires a retained, settled Session identity and complete shutdown proof"), { code: "daemon_state_terminal" });
   for (const key of ["cwd", "projectRoot", "ddFlowHome", "ddFlowBin", "provider", "model", "reasoning", "mode", "variant", "agent", "bin", "noFlow"]) {
     if ((previous.config?.[key] ?? null) !== (config[key] ?? null)) throw Object.assign(new Error(`retained daemon configuration changed: ${key}`), { code: "daemon_config_mismatch" });
   }
@@ -43,7 +53,7 @@ export async function recoverySettlement(driversRoot) {
       }
       else if (entry.name === "daemon.json") {
         const state = JSON.parse(await readFile(file, "utf8"));
-        if (state.shutdown_state !== "clean" || state.active_tree === true) throw Object.assign(new Error("provider tree has no clean shutdown receipt"), { code: "recovery_settlement_unconfirmed" });
+        if (!cleanShutdownConfirmed(state)) throw Object.assign(new Error("provider tree has no complete clean shutdown receipt"), { code: "recovery_settlement_unconfirmed" });
         await assertDaemonReplaceable(directory);
         await reconcileDriverReplies(directory);
         if (state.config?.resourceHome && state.resource_process?.id) {

package/dist/harness-runtime/lib/managed-daemon.d.mts

@@ -0,0 +1,2 @@
+import type { ChildProcess } from "node:child_process";
+export function stopProcessGroup(child: ChildProcess | null | undefined, graceMs?: number, options?: { detached?: boolean }): Promise<void>;

package/dist/harness-runtime/lib/managed-daemon.mjs

@@ -286,42 +286,111 @@ export async function cleanupFailedDaemonStart(config, daemonRecord, daemonChild
   }
 }
 
-export async function stopProcessGroup(child, graceMs = 1_000) {
+const processStops = new WeakMap();
+export async function closeBridgeProcess(bridge, drain) {
+  if (bridge.closePending) return await bridge.closePending;
+  const pending = (async () => {
+    let primary;
+    try {
+      if (!bridge.physicallyClosed && bridge.child) {
+        const child = bridge.child;
+        if (!bridge.stdinEnded && !child.stdin?.destroyed) { bridge.stdinEnded = true; child.stdin?.end(); }
+        if (child.exitCode == null && child.signalCode == null) {
+          await new Promise(resolve => {
+            const done = () => { clearTimeout(timer); child.removeListener("exit", done); resolve(); };
+            const timer = setTimeout(done, 2_000); child.once("exit", done);
+          });
+        }
+        await stopProcessGroup(child, 2_000);
+        bridge.physicallyClosed = true;
+      }
+    } catch (error) { primary = error; }
+    let drainTimer;
+    try { await Promise.race([drain(), new Promise((_, reject) => { drainTimer = setTimeout(() => reject(Object.assign(new Error("bridge drain did not finish"), { code: "bridge_drain_timeout" })), 10_000); })]); }
+    catch (error) { if (primary) { primary.cleanup_error = errorRecord(error); primary.details = { ...primary.details, cleanup_error: primary.cleanup_error }; } else primary = error; }
+    finally { clearTimeout(drainTimer); }
+    if (primary) throw primary;
+  })();
+  bridge.closePending = pending;
+  try { return await pending; }
+  finally { bridge.closePending = null; }
+}
+
+export async function stopProcessGroup(child, graceMs = 1_000, { detached = true } = {}) {
   if (!child?.pid) return;
-  // Harness bridges are detached on Unix, so their own process group is the
-  // smallest reliable unit of cleanup. Windows has no equivalent negative-PID
-  // signal operation; there the direct child is the safe best effort.
-  const target = process.platform === "win32" ? child.pid : -child.pid;
+  if (processStops.has(child)) return await processStops.get(child);
+  const pending = stopOwnedChild(child, graceMs, detached);
+  processStops.set(child, pending);
+  try { return await pending; } finally { processStops.delete(child); }
+}
+async function stopOwnedChild(child, graceMs, detached) {
+  const target = process.platform === "win32" || !detached ? child.pid : -child.pid;
+  const details = signal => ({ pid: child.pid, pgid: target < 0 ? child.pid : null, signal, platform: process.platform, exit_code: child.exitCode ?? null, signal_code: child.signalCode ?? null, observed_at: new Date().toISOString() });
   const alive = () => { try { process.kill(target, 0); return true; } catch (error) { if (error.code === "ESRCH") return false; if (error.code === "EPERM") return true; throw error; } };
+  const gone = async ms => {
+    const deadline = performance.now() + ms;
+    while (alive() && performance.now() < deadline) await new Promise(resolve => setTimeout(resolve, 25));
+    return !alive();
+  };
+  const signal = async name => {
+    try { process.kill(target, name); return true; }
+    catch (error) {
+      if (error.code === "ESRCH") return false;
+      error.details = { ...error.details, ...details(name), syscall: error.syscall ?? "kill" };
+      // Permission denial is not permission to escalate. Observe only the retained target.
+      let absent = false;
+      try { absent = await gone(Math.min(250, Math.max(25, graceMs))); }
+      catch (observation) { error.details.observation_error = errorRecord(observation); }
+      if (absent) {
+        process.stderr.write(`${JSON.stringify({ cleanup_reobserved: errorRecord(error), physical_exit: "ESRCH" })}\n`);
+        return false;
+      }
+      throw error;
+    }
+  };
   if (!alive()) return;
-  if ((child.exitCode !== undefined && child.exitCode !== null) || (child.signalCode !== undefined && child.signalCode !== null)) {
-    // The leader can exit a few ticks before its helpers. Observe their normal
-    // shutdown before failing ownership; never signal a leaderless group.
-    const deadline = Date.now() + Math.max(1_000, graceMs);
-    while (alive() && Date.now() < deadline) await new Promise(resolve => setTimeout(resolve, 25));
-    if (!alive()) return;
-    throw Object.assign(new Error("process group remains after its leader exited; ownership cannot be proven from this child handle"), { code: "process_group_ownership_unknown", details: { pid: child.pid } });
-  }
-  process.kill(target, "SIGTERM");
-  await new Promise((resolve) => setTimeout(resolve, graceMs));
-  if (!alive()) return;
-  if (child.exitCode != null || child.signalCode != null) return stopProcessGroup(child, graceMs);
-  process.kill(target, "SIGKILL");
-  // Grace controls escalation, not the OS acknowledgement budget. A caller
-  // testing immediate escalation must still allow the kernel to reap children.
-  const deadline = Date.now() + Math.max(1_000, graceMs);
-  while (alive() && Date.now() < deadline) await new Promise((resolve) => setTimeout(resolve, 25));
-  if (alive()) throw Object.assign(new Error(`process group ${child.pid} did not stop`), { code: "process_group_stop_incomplete" });
+  const leaderExited = () => child.exitCode != null || child.signalCode != null;
+  const observeLeaderless = async () => {
+    if (await gone(Math.max(1_000, graceMs))) return;
+    throw Object.assign(new Error("process group remains after its leader exited; ownership cannot be proven from this child handle"), { code: "process_group_ownership_unknown", details: details(null) });
+  };
+  if (leaderExited()) return await observeLeaderless();
+  if (!await signal("SIGTERM")) return;
+  if (await gone(graceMs)) return;
+  if (leaderExited()) return await observeLeaderless();
+  if (!await signal("SIGKILL")) return;
+  if (!await gone(Math.max(1_000, graceMs))) throw Object.assign(new Error(`process group ${child.pid} did not stop`), { code: "process_group_stop_incomplete", details: details("SIGKILL") });
 }
 
 /** A daemon acknowledgement is not a completed stop until its endpoint closes. */
-export async function confirmDaemonStopped(request, socket, timeoutMs = 30_000) {
-  const result = await request();
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    try { await lstat(socket); }
-    catch (error) { if (error.code === "ENOENT") return result; throw error; }
-    await new Promise((resolve) => setTimeout(resolve, 25));
+export async function confirmDaemonStopped(request, socket, timeoutMs = 30_000, { readState } = {}) {
+  const deadline = performance.now() + timeoutMs;
+  const expected = await readState?.();
+  const identity = state => state?.daemon_id ?? state?.config?.daemonId;
+  if (readState && (!identity(expected) || !Number.isSafeInteger(expected?.pid) || expected.pid < 1)) throw Object.assign(new Error('daemon stop has no retained incarnation/PID proof'), { code: 'daemon_cleanup_identity_mismatch' });
+  const failure = async observer => {
+    const state = await readState?.();
+    if (expected && identity(state) !== identity(expected)) throw Object.assign(new Error("daemon incarnation changed during stop"), { code: "daemon_identity_mismatch" });
+    const primary = state?.shutdown_state === "cleanup_failed" ? state.cleanup_error : null;
+    if (primary) throw Object.assign(new Error(primary.message), primary, { details: { ...primary.details, socket, phase: "confirm_daemon_stop", observer_error: errorRecord(observer) } });
+    throw observer;
+  };
+  let result;
+  try { result = await request(); }
+  catch (error) { return await failure(error); }
+  if (result?.stopped !== true) return await failure(Object.assign(new Error("stop acknowledgement does not prove shutdown"), { code: "daemon_stop_incomplete" }));
+  for (;;) {
+    const state = await readState?.();
+    if (expected && identity(state) !== identity(expected)) return await failure(Object.assign(new Error("daemon incarnation changed"), { code: "daemon_identity_mismatch" }));
+    let endpointPresent = true;
+    try { await lstat(socket); } catch (error) { if (error.code === "ENOENT") endpointPresent = false; else throw error; }
+    let daemonPresent = false;
+    if (expected?.pid) { try { process.kill(expected.pid, 0); daemonPresent = true; } catch (error) { if (error.code !== "ESRCH") daemonPresent = true; } }
+    if (!endpointPresent && !daemonPresent) {
+      if (readState && result.clean === true && (state?.shutdown_state !== 'clean' || state.active_tree !== false)) return await failure(Object.assign(new Error('daemon clean ACK conflicts with its retained state'), { code: 'daemon_stop_incomplete' }));
+      return result;
+    }
+    if (performance.now() >= deadline) return await failure(Object.assign(new Error("daemon stop could not confirm endpoint retirement and owned PID exit"), { code: "daemon_stop_incomplete", details: { socket, daemon_pid: expected?.pid ?? null, endpoint_present: endpointPresent, daemon_present: daemonPresent } }));
+    await new Promise(resolve => setTimeout(resolve, 25));
   }
-  throw Object.assign(new Error("daemon acknowledged stop but its socket remained live"), { code: "daemon_stop_incomplete", details: { socket } });
 }

package/dist/harness-runtime/lib/model-observations.mjs

@@ -5,6 +5,7 @@ import { withRunnerLock } from "./runner-lock.mjs";
 
 const text = value => typeof value === "string" && value.trim() ? value.trim() : null;
 const fields = ["provider", "model", "reasoning", "mode", "permission_mode"];
+const observationScope = source => JSON.stringify([source?.channel ?? null, source?.scope ?? null, source?.attempt_id ?? null, source?.turn_id ?? null, source?.non_asserting === true]);
 export const observedFields = value => Object.fromEntries(fields.map(key => [key, text(value?.[key])]));
 export const modelObservationFile = journal => path.join(path.dirname(journal), "model-observations.jsonl");
 
@@ -31,20 +32,23 @@ export async function readModelObservations(journal) {
 export async function observeModel({ journal, harness, sessionId, parentSessionId = null, requested = {}, observed = {}, source, evidence = "configured", reason = null, nativeTimestamp = null, previousModel = null }) {
   if (!journal || !sessionId) return null;
   if (!source || !["configured", "request", "response", "unavailable"].includes(evidence)) throw new Error("model observation requires a native source and evidence level");
+  if (typeof source === "string") source = { channel: source, ...(["configured", "response"].includes(evidence) ? { scope: evidence } : {}) };
   const file = modelObservationFile(journal), profile = observedFields(observed);
   await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
   return withRunnerLock(file, async () => {
     const events = await readModelObservations(journal);
-    const replay = source?.event_sha256 ? events.find(item => item.harness === harness && item.session_id === sessionId && item.source?.event_sha256 === source.event_sha256) : null;
+    const replay = source?.event_sha256 ? events.find(item => item.harness === harness && item.session_id === sessionId && observationScope(item.source) === observationScope(source) && item.source?.event_sha256 === source.event_sha256) : null;
     if (replay) return replay;
-    const channel = source?.channel ?? evidence;
-    const previous = events.findLast(item => item.harness === harness && item.session_id === sessionId && (item.source?.channel ?? item.evidence) === channel
-      && (item.source?.attempt_id ?? null) === (source?.attempt_id ?? null));
+    const previous = events.findLast(item => item.harness === harness && item.session_id === sessionId && observationScope(item.source) === observationScope(source));
     const normalizedReason = text(reason)?.slice(0, 200) ?? null;
-    if (previous && JSON.stringify(previous.observed) === JSON.stringify(profile) && previous.reason === normalizedReason && previous.evidence === evidence) return previous;
-    const previousKnown = events.findLast(item => item.harness === harness && item.session_id === sessionId && item.evidence === evidence && item.observed?.model);
+    if (previous && JSON.stringify(previous.observed) === JSON.stringify(profile) && previous.reason === normalizedReason && previous.evidence === evidence
+      && previous.source?.raw_model === source?.raw_model && previous.source?.raw_provider === source?.raw_provider) return previous;
+    const previousKnown = events.findLast(item => item.harness === harness && item.session_id === sessionId && item.evidence === evidence && item.observed?.model
+      && (item.source?.scope ?? "session") === (source?.scope ?? "session") && (item.source?.attempt_id ?? null) === (source?.attempt_id ?? null));
     const fromModel = text(previousModel) ?? previousKnown?.observed.model ?? null;
-    const changed = Boolean(profile.model && fromModel && profile.model !== fromModel);
+    const previousRouting = events.findLast(item => item.harness === harness && item.session_id === sessionId && item.evidence === evidence && item.observed?.provider
+      && (item.source?.scope ?? "session") === (source?.scope ?? "session") && (item.source?.attempt_id ?? null) === (source?.attempt_id ?? null));
+    const changed = Boolean(profile.model && fromModel && (profile.model !== fromModel || profile.provider && previousRouting && profile.provider !== previousRouting.observed.provider));
     const value = { schema_id: "dd-flow/model-observation@1", sequence: events.length + 1,
       harness, session_id: sessionId, parent_session_id: parentSessionId,
       kind: changed ? "model_changed" : !profile.model ? "model_observation_unavailable" : "model_observed",
@@ -76,19 +80,22 @@ export function modelAttribution(events, expectedSessions = []) {
   const missingSessions = expectedSessions.filter(session => typeof session === "string" ? !observedIds.has(session)
     : !sessions.has(`${session.harness}:${session.session_id}`));
   const models = [...new Set(events.map(event => event.observed?.model).filter(Boolean))];
+  const providers = [...new Set(events.map(event => event.observed?.provider).filter(Boolean))];
   const incomplete = !events.length || missingSessions.length > 0 || [...sessions.values()].some(session => {
     const known = session.observations.filter(event => event.observed?.model);
     if (!known.length) return true;
     const knownScopes = new Set(known.map(event => `${event.evidence}:${event.source?.scope ?? "session"}:${event.source?.attempt_id ?? ""}:${event.source?.turn_id ?? ""}`));
     return session.observations.some(event => {
-      if (event.evidence !== "unavailable") return false;
       if (event.source?.non_asserting) return false;
+      if (["configured", "response"].includes(event.evidence) && !event.observed?.model) return true;
+      if (event.evidence !== "unavailable") return false;
       const scope = event.source?.scope;
       return !scope || !knownScopes.has(`configured:${scope}:${event.source?.attempt_id ?? ""}:${event.source?.turn_id ?? ""}`)
         && !knownScopes.has(`response:${scope}:${event.source?.attempt_id ?? ""}:${event.source?.turn_id ?? ""}`);
     });
   });
-  return { models, mixed: models.length > 1 || events.some(event => event.observed?.model && event.requested?.model && event.observed.model !== event.requested.model),
+  return { models, providers, mixed: models.length > 1 || providers.length > 1 || events.some(event => event.observed?.model && event.requested?.model && event.observed.model !== event.requested.model
+    || event.observed?.provider && event.requested?.provider && event.observed.provider !== event.requested.provider),
     observation_completeness: incomplete ? "incomplete" : "available_native_sources", transitions: events.filter(event => event.kind === "model_changed"),
     sessions: [...sessions.values()], missing_sessions: missingSessions, usage_attribution: "session_totals_unattributed_to_model", note: "Native settings/events do not prove undisclosed server routing or per-model token costs." };
 }

package/dist/harness-runtime/lib/tool-observations.d.mts

@@ -10,6 +10,7 @@ export class ToolObservations {
   calls: Map<string, ToolEvent>;
   turns: Map<string, { session: { harness_id: string; session_id: string }; turn_id: string; started: boolean; completed: boolean }>;
   gaps: Set<string>;
+  sources: Map<string, ToolEvent>;
   add(event: ToolEvent | null): void;
   observeTurn(event: { session: { harness_id: string; session_id: string }; turn_id: string; started?: boolean; completed?: boolean }): void;
   summary(sessionId?: string, cursor?: Set<string>): { total: number; failures: number; pending: number; by_tool: Record<string, number>; completeness: string; outcome_completeness: string; sessions: Array<{ session: { harness_id: string; session_id: string }; total: number; failures: number; pending: number; by_tool: Record<string, number> }>; reasons: string[] };

package/dist/harness-runtime/lib/tool-observations.mjs

@@ -3,7 +3,7 @@ import fs from "node:fs";
 /** Canonical physical-session tool accounting. Native decoding lives below;
  * consumers never have to inspect provider envelopes or aggregate tokens. */
 export class ToolObservations {
-  constructor() { this.calls = new Map(); this.turns = new Map(); this.gaps = new Set(); }
+  constructor() { this.calls = new Map(); this.turns = new Map(); this.gaps = new Set(); this.transcriptSessions = new Set(); this.sources = new Map(); }
   observeTurn(event) {
     if (!event?.session?.harness_id || !event.session.session_id || !event.turn_id) { this.gaps.add("turn_identity_missing"); return; }
     const key = JSON.stringify([event.session, event.turn_id]);
@@ -13,10 +13,19 @@ export class ToolObservations {
   }
   add(event) {
     if (!event) return;
-    if (event.reason) { this.gaps.add(event.reason); return; }
+    if (event.reason) this.gaps.add(event.reason);
+    if (event.source_observed && event.session?.harness_id && event.session?.session_id) { this.sources.set(JSON.stringify(event.session), event); return; }
+    if (event.reason && !event.call_id) return;
     const { harness_id, session_id } = event.session ?? {};
     if (!harness_id || !session_id || !event.call_id) { this.gaps.add("tool_identity_missing"); return; }
     const key = JSON.stringify([harness_id, session_id, event.epoch ?? "", event.call_id]);
+    const physical = JSON.stringify([harness_id, session_id]);
+    if (event.source?.channel === "agy.native_transcript") {
+      this.transcriptSessions.add(physical);
+      for (const [oldKey, call] of this.calls) if (JSON.stringify([call.session.harness_id, call.session.session_id]) === physical && call.source?.channel !== "agy.native_transcript") {
+        this.calls.delete(oldKey); this.gaps.add("agy_live_transcript_correlation_unproven");
+      }
+    } else if (this.transcriptSessions.has(physical)) { this.gaps.add("agy_live_transcript_correlation_unproven"); return; }
     const old = this.calls.get(key);
     // Replay and late starts cannot undo a terminal outcome. Conflicting
     // terminal facts remain visible rather than silently choosing success.
@@ -28,12 +37,12 @@ export class ToolObservations {
         : old?.status === "unknown" || event.status === "unknown" ? "unknown" : "running" });
   }
   summary(sessionId, cursor) {
-    const by_tool = {}, sessions = new Map(), reasons = new Set(this.gaps); let total = 0, failures = 0, pending = 0;
+    const by_tool = Object.create(null), sessions = new Map(), reasons = new Set(this.gaps); let total = 0, failures = 0, pending = 0;
     for (const [key, value] of this.calls) {
       if (sessionId !== undefined && value.session.session_id !== sessionId || cursor?.has(key)) continue;
       const id = JSON.stringify(value.session);
       if (value.name === "unknown") reasons.add("tool_start_missing");
-      const session = sessions.get(id) ?? { session: value.session, parent_session: value.parent_session ?? null, total: 0, failures: 0, pending: 0, by_tool: {} };
+      const session = sessions.get(id) ?? { session: value.session, parent_session: value.parent_session ?? null, total: 0, failures: 0, pending: 0, by_tool: Object.create(null) };
       total++; session.total++; by_tool[value.name] = (by_tool[value.name] ?? 0) + 1; session.by_tool[value.name] = (session.by_tool[value.name] ?? 0) + 1;
       if (value.status === "failed") { failures++; session.failures++; }
       if (!["completed", "failed"].includes(value.status)) { pending++; session.pending++; }
@@ -45,6 +54,10 @@ export class ToolObservations {
       sessions.set(id, sessions.get(id) ?? { session: turn.session, parent_session: null, total: 0, failures: 0, pending: 0, by_tool: {} });
       if (!turn.started || !turn.completed) reasons.add("turn_lifecycle_incomplete");
     }
+    if (!cursor) for (const [id, event] of this.sources) {
+      if (sessionId !== undefined && event.session.session_id !== sessionId) continue;
+      sessions.set(id, sessions.get(id) ?? { session: event.session, parent_session: event.parent_session ?? null, total: 0, failures: 0, pending: 0, by_tool: {} });
+    }
     return { schema_id: "dd-flow/tool-summary@1", scope: "physical_sessions", measurement: "observed_invocations", origin: "native_tool_events", aggregation: cursor ? "delta" : "cumulative", total, failures, pending, by_tool,
       sessions: [...sessions.values()], completeness: reasons.size ? "partial" : "complete", outcome_completeness: pending ? "partial" : "complete", reasons: [...reasons] };
   }
@@ -56,7 +69,7 @@ export class ToolObservations {
 export function journalToolObservations(file, events, previous) {
   const batch = new ToolObservations();
   for (const event of events) batch.add(event);
-  const records = [...batch.calls.values(), ...[...batch.gaps].map(reason => ({ reason }))];
+  const records = [...batch.calls.values(), ...batch.sources.values(), ...[...batch.gaps].map(reason => ({ reason }))];
   for (const event of records) {
     const key = JSON.stringify([event.session, event.epoch, event.call_id, event.reason]);
     const encoded = JSON.stringify(event);
@@ -67,7 +80,9 @@ export function journalToolObservations(file, events, previous) {
 }
 
 const identity = (harness_id, session_id) => ({ harness_id, session_id });
-const status = value => ["error", "failed", "ERROR"].includes(value) ? "failed" : ["completed", "success", "DONE"].includes(value) ? "completed" : "running";
+const status = value => ["error", "failed", "ERROR"].includes(value) ? "failed" : ["completed", "success", "DONE"].includes(value) ? "completed"
+  : value === undefined || value === null || ["running", "pending", "in_progress", "inProgress", "RUNNING", "PENDING", "IN_PROGRESS"].includes(value) ? "running" : "unknown";
+const nativeStatus = value => ({ status: status(value), ...(status(value) === "unknown" ? { reason: "tool_status_unsupported" } : {}) });
 export function zcodePhysicalSession(update, rootSessionId) {
   const native = update?._meta?.zcodeRuntime ?? {};
   if (native.source === "subagent" && !native.childSessionId) return null;
@@ -84,7 +99,7 @@ export function acpToolObservation(message, { harness = "zcode-acp", rootSession
   const session = harness === "zcode-acp" ? zcodePhysicalSession(update, root) : harness === "grok-acp" ? transport : root;
   if (!session || !update.toolCallId) return { reason: "tool_identity_missing" };
   return { session: identity(harness, session), parent_session: session !== root ? identity(harness, root) : null,
-    transport_session_id: transport, call_id: update.toolCallId, name: update._meta?.["x.ai/tool"]?.name ?? update._meta?.claudeCode?.toolName ?? update.title?.split(":", 1)[0], status: status(update.status) };
+    transport_session_id: transport, call_id: update.toolCallId, name: update._meta?.["x.ai/tool"]?.name ?? update._meta?.claudeCode?.toolName ?? update.title?.split(":", 1)[0], ...nativeStatus(update.status) };
 }
 
 export function droidToolObservations(record, sessionId) {
@@ -130,15 +145,41 @@ export function codexAppServerObservation(message) {
 export function openCodeToolObservation(part, sessionId, messageId) {
   if (part.type !== "tool") return null;
   return { session: identity("opencode-server", part.sessionID ?? sessionId), call_id: part.callID ?? part.id,
-    epoch: messageId, name: part.tool, status: status(part.state?.status) };
+    epoch: messageId, name: part.tool, ...nativeStatus(part.state?.status) };
 }
 
 export function agyToolObservation(step, rootSessionId) {
-  if (step.step_type !== "tool") return null;
+  if (step.step_type !== "tool" && !(step.step_type === "subagent" && step.tool_name === "invoke_subagent")) return null;
   const sessionId = step.conversation_id ?? rootSessionId;
   return { session: identity("antigravity-cli", sessionId), parent_session: sessionId !== rootSessionId ? identity("antigravity-cli", rootSessionId) : null,
     call_id: step.step_id ?? step.stepId ?? step.id ?? step.tool_call_id ?? step.toolCallId ?? (Number.isInteger(step.step_index) ? String(step.step_index) : null),
-    name: step.tool_name ?? step.tool_info?.name, status: step.tool_info?.error ? "failed" : status(step.state) };
+    name: step.tool_name ?? step.tool_info?.name, ...(step.tool_info?.error ? { status: "failed" } : nativeStatus(step.state)) };
+}
+
+/** Native AGY JSONL records have planner tool invocations, not matching live
+ * step IDs. GENERIC result text is deliberately not guessed into success. */
+export function agyTranscriptObservations(text, sessionId, parentSessionId, source = {}) {
+  const events = [], lines = text.split("\n"); let recognized = false;
+  const session = identity("antigravity-cli", sessionId);
+  for (const [line, bytes] of lines.entries()) {
+    if (!bytes.trim()) continue;
+    let record; try { record = JSON.parse(bytes); } catch { events.push({ session, reason: line === lines.length - 1 ? "agy_transcript_partial_tail" : "agy_transcript_invalid_record" }); continue; }
+    if (!record || typeof record !== "object" || Array.isArray(record)) { events.push({ session, reason: "agy_transcript_shape_unsupported" }); continue; }
+    if (record.conversation_id && record.conversation_id !== sessionId) { events.push({ session, reason: "agy_transcript_session_mismatch" }); continue; }
+    if (!["SYSTEM_MESSAGE", "USER_INPUT", "PLANNER_RESPONSE", "GENERIC", "TOOL_RESPONSE", "CHECKPOINT"].includes(record.type)) { events.push({ session, reason: "agy_transcript_shape_unsupported" }); continue; }
+    recognized = true;
+    if (record.tool_calls !== undefined && !Array.isArray(record.tool_calls)) events.push({ session, reason: "agy_transcript_shape_unsupported" });
+    if (record.truncated || record.truncation || typeof record.content === "string" && /\[.*truncat|<.*truncat/i.test(record.content)) events.push({ session, reason: "agy_transcript_truncated" });
+    for (const [index, call] of (Array.isArray(record.tool_calls) ? record.tool_calls : []).entries()) {
+      if (!Number.isInteger(record.step_index) || !call || typeof call.name !== "string" || !call.name) { events.push({ session, reason: "agy_transcript_tool_identity_missing" }); continue; }
+      const id = call.id ?? call.tool_call_id;
+      events.push({ session, parent_session: identity("antigravity-cli", parentSessionId), epoch: "native_transcript", call_id: id ?? `${record.step_index}:${index}`, name: call.name,
+        status: "unknown", reason: "agy_transcript_tool_outcome_unproven", source: { ...source, channel: "agy.native_transcript", line: line + 1, step_index: record.step_index } });
+    }
+  }
+  if (!recognized) events.push({ session, reason: "agy_transcript_shape_unsupported" });
+  else events.push({ session, parent_session: identity("antigravity-cli", parentSessionId), source_observed: true, source: { ...source, channel: "agy.native_transcript" } });
+  return events;
 }
 
 /** Read-only replay, shared by accounting and offline diagnosis. A journal
@@ -150,7 +191,7 @@ export function replayToolJournal(file, options, reducer = new ToolObservations(
   for (const [index, line] of lines.entries()) {
     if (!line.trim()) continue;
     let e; try { e = JSON.parse(line); } catch { reducer.gaps.add(index === lines.length - 1 ? "journal_partial_tail" : "journal_invalid_record"); continue; }
-    const add = event => { if (event) reducer.add({ ...event, source: { journal: file, line: index + 1 }, observed_at: e.observed_at ?? e.timestamp ?? e.at ?? e.ts ?? null }); };
+    const add = event => { if (event) reducer.add({ ...event, source: { ...event.source, journal: file, journal_line: index + 1 }, observed_at: e.observed_at ?? e.timestamp ?? e.at ?? e.ts ?? null }); };
     if (e.kind === "tool_observation" && e.schema_id === "dd-flow/tool-observation@1") { add(e.event); continue; }
     if (e.kind === "notification_failure") reducer.gaps.add("notification_failure");
     const m = e.payload ?? e;

package/dist/schemas/flow-run.schema.json

@@ -13,6 +13,7 @@
     "subject": {"$ref": "#/definitions/identity"},
     "flow_kind": {"type": "string", "minLength": 1},
     "verification_matrix_contract": {"const": "dd-flow/verification-matrix@1"},
+    "final_check_coverage_contract": {"const": "dd-flow/final-check-coverage@1"},
     "status": {"enum": ["created", "running", "paused", "waiting_for_user", "done", "failed", "blocked", "cancelled", "discarded"]},
     "verdict": {"type": ["string", "null"]},
     "started_at": {"type": "string", "format": "date-time"},

package/dist/schemas/plan-review-decision.schema.json

@@ -1,14 +1,14 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "dd-flow/plan-review-decision@3",
+  "$id": "dd-flow/plan-review-decision@4",
   "type": "object",
   "additionalProperties": false,
   "required": ["schema_id", "outcome", "summary", "finding_decisions", "correction"],
   "properties": {
-    "schema_id": {"const": "dd-flow/plan-review-decision@3"},
+    "schema_id": {"const": "dd-flow/plan-review-decision@4"},
     "outcome": {"enum": ["accepted", "failed", "cancelled"]},
     "summary": {"type": "string", "minLength": 1},
-    "finding_decisions": {"type": "array", "items": {"type": "object", "additionalProperties": false, "required": ["finding_ref", "decision", "reason"], "properties": {"finding_ref": {"type": "string", "pattern": "^WRK-[^/]+/FIND-[0-9]{3}$"}, "decision": {"enum": ["accepted_fix", "rejected", "deferred_as_DEF", "requires_user", "duplicate"]}, "reason": {"type": "string", "minLength": 1}}}},
+    "finding_decisions": {"type": "array", "items": {"type": "object", "additionalProperties": false, "required": ["finding_ref", "decision", "reason"], "properties": {"finding_ref": {"type": "string", "pattern": "^WRK-[^/]+/FIND-[0-9]{3}$"}, "decision": {"enum": ["accepted_fix", "rejected", "deferred_as_DEF", "requires_user", "duplicate"]}, "reason": {"type": "string", "minLength": 1}, "duplicate_of": {"type": "string", "pattern": "^WRK-[^/]+/FIND-[0-9]{3}$"}, "def_id": {"type": "string", "pattern": "^DEF-[A-Za-z0-9][A-Za-z0-9_-]*$"}}}},
     "correction": {"type": "object", "additionalProperties": false, "required": ["status", "previous_plan_revision", "changed_paths", "summary"], "properties": {"status": {"enum": ["applied", "not_required"]}, "previous_plan_revision": {"type": "integer", "minimum": 1}, "changed_paths": {"type": "array", "items": {"type": "string", "minLength": 1}}, "summary": {"type": "string", "minLength": 1}}}
   }
 }

package/dist/services/code-checks.js

@@ -6,7 +6,8 @@ import path from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { parse } from "shell-quote";
 import { assertRunMutationAllowed } from "./run-recovery.js";
-import { AppError } from "../shared/errors.js";
+import { AppError, errorRecord } from "../shared/errors.js";
+import { stopProcessGroup } from "../harness-runtime/lib/managed-daemon.mjs";
 import { confirmManagedProcess, finishManagedProcess, heartbeatManagedProcess, managedProcessStatus, managedProcessRuntimeHome, managedOwnerIsAlive, processTreeIsAlive, registerManagedProcess, reservePorts } from "./managed-processes.js";
 import { admitRuntimeCheck, runtimeBudgetForRun } from "./runtime-budget.js";
 import { getResourceDatabase } from "../storage/database.js";
@@ -340,7 +341,8 @@ async function runCodeChecksOwned(context, input, workspaceGateId, generation) {
             if (processTreeIsAlive(current))
                 throw new AppError("check_in_progress", "The check shell exited but its process tree is still live; retain this receipt and its resources until settlement", 2, { process_id: managed.id, check_receipt_id: id });
             allocation.release();
-            finishManagedProcess(context, { id: managed.id, leaseToken: managed.lease_token, state: result.aborted || result.exitCode !== 0 || Boolean(result.error) ? "failed" : "stopped", reason: result.error });
+            if (!result.cleanupUnconfirmed)
+                finishManagedProcess(context, { id: managed.id, leaseToken: managed.lease_token, state: result.aborted || result.exitCode !== 0 || Boolean(result.error) ? "failed" : "stopped", reason: result.error });
         }
         catch (error) {
             if (error instanceof AppError && error.code === "check_in_progress")
@@ -825,7 +827,8 @@ export function runCheck(command, cwd, environment, stdout, stderr, heartbeat, o
         let error = null;
         let stopping = false;
         let progress;
-        let escalation;
+        let cleanup;
+        let cleanupUnconfirmed = false;
         const stop = (cause) => {
             if (stopping)
                 return;
@@ -835,23 +838,21 @@ export function runCheck(command, cwd, environment, stdout, stderr, heartbeat, o
                 clearInterval(progress);
                 progress = undefined;
             }
-            if (child.pid) {
-                terminateProcessGroup(child.pid, "SIGTERM");
-                escalation = setTimeout(() => terminateProcessGroup(child.pid, "SIGKILL"), 5_000);
-            }
+            cleanup = stopProcessGroup(child, 5_000).catch(cause => {
+                cleanupUnconfirmed = true;
+                error = `${error}; cleanup: ${JSON.stringify(errorRecord(cause))}`;
+                resolve({ exitCode: null, error, aborted: true, cleanupUnconfirmed });
+            });
         };
         // Register handlers before checking pid or calling persistence callbacks.
         // Failure is not completion until the spawned process has actually closed.
         child.once("error", (value) => { error = value.message; });
         child.stdin.on("error", stop);
-        child.once("close", (exitCode, signal) => {
+        child.once("close", async (exitCode, signal) => {
             if (progress)
                 clearInterval(progress);
-            if (escalation)
-                clearTimeout(escalation);
-            if (stopping)
-                terminateProcessGroup(child.pid, "SIGKILL");
-            resolve({ exitCode, error: error ?? (signal ? `terminated by ${signal}` : null), aborted: stopping || Boolean(signal) || Boolean(error) });
+            await cleanup;
+            resolve({ exitCode, error: error ?? (signal ? `terminated by ${signal}` : null), aborted: stopping || Boolean(signal) || Boolean(error), ...(cleanupUnconfirmed ? { cleanupUnconfirmed } : {}) });
         });
         if (!child.pid) {
             error = "check process did not provide a PID";
@@ -890,8 +891,3 @@ function checkShellScript() {
         'exit "$code"'
     ].join("\n");
 }
-function terminateProcessGroup(pid, signal) { if (!pid)
-    return; try {
-    process.kill(process.platform === "win32" ? pid : -pid, signal);
-}
-catch { /* already exited */ } }