@deksden-com/dd-flow-cli 0.9.0-beta.123 → 0.9.0-beta.124

package/dist/services/run-controller.js

@@ -35,7 +35,7 @@ import { resumeControllerSession, failControllerRecovery } from "./run-controlle
 import { captureControllerBoundary } from "./run-controller-capture.js";
 import { requestRunControl } from "./run-control-worker.js";
 import { storageSessionId } from "./session-identity.js";
-import { terminalCodexOverload } from "../harness-runtime/lib/dd-codex.mjs";
+import { CAPACITY_POLICY, nativeItemsSettled, overloadBurst, refusalObservation, terminalCodexOverload } from "../harness-runtime/lib/codex-capacity-policy.mjs";
 export { resumeRunController } from "./run-controller-recovery.js";
 export function prepareRunControllerLaunch(context, input) {
     if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(input.requestId) || !/^[a-f0-9]{64}$/.test(input.contextSha256))
@@ -561,8 +561,15 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 const inspect = (args, id) => runHarnessAdapter({ executable: manifest.adapters["codex-desktop"].executable,
                     args, env: controllerEnvironment(context, manifest, session), runtimeOwner: session.owner, operationId: id, timeoutMs: 30_000, signal: cancellation.signal });
                 const resumed = await continueCodexCapacity({ error, sessionId: session.id, operationId: firstOperationId, signal: cancellation.signal, allowSettledDescendants: true,
-                    retainedIntents: () => context.db.all("SELECT receipt_json FROM run_controller_operations WHERE controller_id = ? AND generation = ? AND operation_id IN (?, ?)", [row.controller_id, row.generation, firstOperationId, `${firstOperationId}:capacity:1:session.prompt`])
-                        .flatMap(item => { const retained = JSON.parse(item.receipt_json || "null"); return retained?.capacity_intent ? [retained.capacity_intent] : []; }).sort((a, b) => a.ordinal - b.ordinal),
+                    retainedIntents: () => context.db.all("SELECT receipt_json FROM run_controller_operations WHERE controller_id = ? AND generation = ?", [row.controller_id, row.generation])
+                        .flatMap(item => { const retained = JSON.parse(item.receipt_json || "null"); return retained?.capacity_intent?.root_operation_id === firstOperationId ? [retained.capacity_intent] : []; }).sort((a, b) => a.ordinal - b.ordinal),
+                    retainedFailures: () => context.db.all("SELECT receipt_json FROM run_controller_operations WHERE controller_id = ? AND generation = ?", [row.controller_id, row.generation])
+                        .flatMap(item => { const retained = JSON.parse(item.receipt_json || "null"); return retained?.capacity_root === firstOperationId && retained.capacity_failure ? [retained.capacity_failure] : []; }),
+                    retainFailure: (id, refusal) => {
+                        const changed = context.db.run("UPDATE run_controller_operations SET receipt_json = ?, updated_at = ? WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'outcome_unknown'", [JSON.stringify({ capacity_root: firstOperationId, capacity_failure: refusal }), context.now(), id, row.controller_id, row.generation]);
+                        if (changed.changes !== 1)
+                            throw new AppError("capacity_continuation_blocked", "Failed Turn owner changed before its refusal was retained", 1);
+                    },
                     inspectOperation: id => inspect(["daemon", "operation", "--state-dir", session.state_dir, "--operation-id", id, "--json"], `${id}:capacity-observe`),
                     inspectSession: turnId => inspect(["session", "inspect", "--session-id", session.id, ...(turnId ? ["--turn-id", turnId] : []), ...sessionArguments(context, manifest, session)], `${firstOperationId}:capacity-inspect`),
                     assertCurrent: () => {
@@ -601,7 +608,7 @@ async function executeController(context, row, manifest, state, assertOwnership,
                         return next.kind === "wait" ? "reconciliation_blocked" : "continue";
                     },
                     retainIntent: intent => context.db.writeTransaction(() => {
-                        const changed = context.db.run("UPDATE run_controller_operations SET status = 'failed', receipt_json = ?, updated_at = ? WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'outcome_unknown'", [JSON.stringify({ capacity_intent: intent }), context.now(), intent.predecessor, row.controller_id, row.generation]);
+                        const changed = context.db.run("UPDATE run_controller_operations SET status = 'failed', receipt_json = ?, updated_at = ? WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'outcome_unknown'", [JSON.stringify({ capacity_root: firstOperationId, capacity_failure: intent.refusal, capacity_intent: intent }), context.now(), intent.predecessor, row.controller_id, row.generation]);
                         if (changed.changes !== 1)
                             throw new AppError("capacity_continuation_blocked", "Failed native operation changed before continuation", 1);
                         appendEvent(context, row.controller_id, "capacity_continuation", intent);
@@ -768,6 +775,7 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 }
                 state.native_baseline = controllerNativeChildren(state.last_receipt ?? {}, session.id).map(child => child.session_id);
                 state.stage = next.stage;
+                state.child_capacity = {};
                 saveState(context, row, state);
                 setStatus("running");
                 if (next.stage === "code" || next.stage === "code-review") {
@@ -794,29 +802,49 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 saveState(context, row, state);
                 children = controllerNativeChildren(inspected, session.id).filter(child => !baseline.has(child.session_id));
                 const failed = children.filter(child => child.status === "failed");
-                const child = failed.length === 1 && children.every(item => item === failed[0] || item.status === "completed") ? failed[0] : undefined;
+                // Continue one existing child at a time; another failed child does not
+                // create a second fanout wave or share this child's refusal counter.
+                const child = children.every(item => item.status === "failed" || item.status === "completed") ? failed.find(item => item.parent_session_id === session.id && item.terminal_turn_id && nativeItemsSettled(item.native_turn_items) && terminalCodexOverload({ code: "turn_interrupted", details: { provider_session_id: item.session_id, turn_id: item.terminal_turn_id, native_turn_id: item.terminal_turn_id, terminal_status: "failed", provider_error: item.provider_error } }, item.session_id)) : undefined;
                 const turnId = child?.terminal_turn_id;
                 const native = child && turnId ? { code: "turn_interrupted", details: { provider_session_id: child.session_id, turn_id: turnId, native_turn_id: turnId,
-                        terminal_status: "failed", provider_error: child.provider_error } } : null;
+                        terminal_status: "failed", provider_error: child.provider_error, observed_at: child.terminal_observed_at } } : null;
                 const prior = child && state.child_capacity?.[child.session_id];
                 const links = child ? context.db.all("SELECT w.status FROM work_sessions ws JOIN works w ON w.work_id = ws.work_id WHERE w.project_id = ? AND w.run_id = ? AND ws.session_id = ?", [row.project_id, row.run_id, storageSessionId({ harness_id: "codex-desktop", session_id: child.session_id })]) : [];
                 if (child && turnId && native && terminalCodexOverload(native, child.session_id, turnId)
-                    && child.native_turn_items?.observed === true && (child.native_turn_items.possible_effects === false || child.native_turn_items.pending === false)
+                    && nativeItemsSettled(child.native_turn_items)
                     && inspected.settled === true && child.parent_session_id === session.id && links.length <= 1
-                    && (!links.length || links[0].status === "running") && ((prior?.attempts ?? 0) < 2 || prior?.turn_id === turnId && prior.dispatched === false)) {
+                    && (!links.length || links[0].status === "running")) {
                     const prepared = prior?.turn_id === turnId && prior.dispatched === false && prior.operation_id && prior.not_before ? prior : null;
                     if (prior?.turn_id === turnId && !prepared)
                         throw new AppError("capacity_child_followup_unconfirmed", "Parent continuation did not start a new native child Turn", 1, { child_session_id: child.session_id, turn_id: turnId });
                     const attempt = prepared ? prepared.attempts : (prior?.attempts ?? 0) + 1;
+                    if (!Number.isSafeInteger(attempt) || prior && prior.policy !== CAPACITY_POLICY)
+                        throw new AppError("capacity_continuation_conflict", "Native child continuation policy or ordinal is incompatible", 1);
+                    const refusals = [...(prior?.refusals ?? [])];
+                    if (!refusals.some(item => item.turn_id === turnId)) {
+                        const refusal = refusalObservation(native, attempt - 1, child.terminal_observed_at ?? context.now());
+                        refusals.push(refusal);
+                        state.child_capacity ??= {};
+                        state.child_capacity[child.session_id] = { ...prior, turn_id: prior?.turn_id ?? turnId, attempts: prior?.attempts ?? 0, policy: CAPACITY_POLICY, refusals };
+                        saveState(context, row, state);
+                    }
+                    const burst = overloadBurst(refusals);
+                    if (burst)
+                        throw new AppError("provider_overload_burst", "Native child had two continuation refusals within two minutes", 1, { ...burst, child_session_id: child.session_id, primary_error: native });
                     const wait = prepared ? Math.max(0, Date.parse(prepared.not_before) - Date.now()) : capacityDelay(native, attempt);
-                    if (!Number.isFinite(wait) || wait > 30_000)
-                        throw new AppError("capacity_child_retry_delay_exceeded", "Native child retry delay exceeds the bounded continuation window", 1, { child_session_id: child.session_id, delay_ms: wait });
-                    const operationId = prepared?.operation_id ?? `${row.controller_id}:child:${digest([child.session_id, turnId]).slice(0, 16)}:followup:${attempt}`;
+                    if (!Number.isFinite(wait) || Date.now() + wait > 8.64e15)
+                        throw new AppError("capacity_retry_metadata_invalid", "Native child retry time is invalid", 1, { child_session_id: child.session_id, delay_ms: wait });
+                    const rootOperationId = prior?.root_operation_id ?? `${row.controller_id}:child:${digest([child.session_id, turnId]).slice(0, 16)}`;
+                    const operationId = prepared?.operation_id ?? `${rootOperationId}:followup:${attempt}`;
                     state.child_capacity ??= {};
-                    state.child_capacity[child.session_id] = { turn_id: turnId, attempts: attempt, operation_id: operationId, not_before: prepared?.not_before ?? new Date(Date.now() + wait).toISOString(), dispatched: false };
+                    state.child_capacity[child.session_id] = { turn_id: turnId, attempts: attempt, operation_id: operationId, root_operation_id: rootOperationId, policy: CAPACITY_POLICY, refusals, not_before: prepared?.not_before ?? new Date(Date.now() + wait).toISOString(), dispatched: false };
                     saveState(context, row, state);
                     appendEvent(context, row.controller_id, "capacity_child_followup", { child_session_id: child.session_id, turn_id: turnId, attempt, operation_id: operationId });
-                    await delay(wait, undefined, { signal: cancellation.signal });
+                    const until = performance.now() + wait;
+                    while (performance.now() < until) {
+                        await delay(Math.min(250, Math.max(0, until - performance.now())), undefined, { signal: cancellation.signal });
+                        assertOwner();
+                    }
                     assertOwner();
                     const current = getFlowRunStatus(executionContext, { projectRoot: manifest.request.project_root, runId: row.run_id });
                     if (current.continuation.stage !== state.stage || ["terminal", "paused", "blocked", "wait"].includes(current.continuation.kind))
@@ -830,7 +858,7 @@ async function executeController(context, row, manifest, state, assertOwnership,
                         continue;
                     }
                     if (fresh.settled !== true || !still || still.parent_session_id !== session.id || still.status !== "failed" || still.terminal_turn_id !== turnId
-                        || still.native_turn_items?.observed !== true || still.native_turn_items.possible_effects !== false && still.native_turn_items.pending !== false || currentLinks.length > 1
+                        || !nativeItemsSettled(still.native_turn_items) || currentLinks.length > 1
                         || currentLinks.some(link => link.status !== "running"))
                         throw new AppError("capacity_child_followup_blocked", "Native child or Work changed during capacity wait", 1, { child_session_id: child.session_id, turn_id: turnId });
                     assertOwner();

package/dist/services/run-recovery-runtime.js

@@ -8,6 +8,7 @@ import { managedProcessBinding, processIsAlive, resourceHome } from "./managed-p
 import { getResourceDatabase } from "../storage/database.js";
 import { requireManagedDaemonBinding } from "./managed-daemon-binding.js";
 import { lifecycleRetryInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
+import { CAPACITY_POLICY, overloadBurst } from "../harness-runtime/lib/codex-capacity-policy.mjs";
 /** Pin retained Session loading and its first acknowledgement Turn, never a general fence bypass. */
 export function prepareRunRecoveryDispatch(context, input) {
     if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/.test(input.operationId) || !path.isAbsolute(input.stateDir))
@@ -59,7 +60,9 @@ export function prepareRunRecoveryDispatch(context, input) {
 /** Publish only an exact successor to a failed, effect-free recovery ACK Turn. */
 export function retainRecoveryCapacityIntent(context, input) {
     const { intent } = input;
-    if (![1, 2].includes(intent.ordinal) || !intent.turn_id || !intent.not_before)
+    if (!Number.isSafeInteger(intent.ordinal) || intent.ordinal < 1 || !intent.turn_id || !Number.isFinite(Date.parse(intent.not_before)) || intent.policy !== CAPACITY_POLICY
+        || !intent.refusal || intent.refusal.policy !== CAPACITY_POLICY || intent.refusal.ordinal !== intent.ordinal - 1 || intent.refusal.turn_id !== intent.turn_id
+        || !Number.isFinite(Date.parse(intent.refusal.first_observed_at)) || intent.deadline !== null)
         throw new AppError("recovery_capacity_intent_invalid", "Recovery capacity successor is invalid", 1);
     context.db.writeTransaction(() => {
         const guard = recoveryGuard(context, input.projectId, input.runId);
@@ -71,12 +74,26 @@ export function retainRecoveryCapacityIntent(context, input) {
         if (controller?.generation !== input.generation || ["completed", "cancelled", "superseded"].includes(controller.status) || control?.status !== "resuming")
             throw new AppError("recovery_capacity_owner_changed", "Recovery controller or control changed before successor publication", 1);
         const dispatch = JSON.parse(binding.runtime_dispatch_json);
+        if (intent.root_operation_id !== dispatch.operation_id || intent.session_id !== binding.provider_session_id || intent.refusal.session_id !== binding.provider_session_id)
+            throw new AppError("recovery_capacity_intent_conflict", "Recovery capacity intent belongs to another root or Session", 1);
         const currentProcess = getResourceDatabase(resourceHome(context)).get("SELECT * FROM managed_processes WHERE id = ?", [dispatch.process_id]);
         if (!currentProcess || currentProcess.state !== "running" || currentProcess.lease_expires_at <= context.now() || currentProcess.owner_id !== dispatch.owner_id
             || currentProcess.project_id !== input.projectId || currentProcess.run_id !== input.runId)
             throw new AppError("recovery_capacity_owner_changed", "Replacement daemon lease changed before successor publication", 1);
         const prior = dispatch.capacity_intents ?? [];
-        const predecessor = intent.ordinal === 1 ? dispatch.operation_id : prior[0]?.operation_id;
+        for (let index = 0; index < prior.length; index++) {
+            const retained = prior[index];
+            if (retained.policy !== CAPACITY_POLICY || retained.ordinal !== index + 1 || retained.root_operation_id !== dispatch.operation_id || retained.session_id !== binding.provider_session_id
+                || retained.predecessor !== (index === 0 ? dispatch.operation_id : prior[index - 1].operation_id)
+                || retained.operation_id !== `${dispatch.operation_id}:capacity:${index + 1}:session.prompt` || retained.refusal?.ordinal !== index
+                || retained.refusal.turn_id !== retained.turn_id || retained.refusal.session_id !== binding.provider_session_id)
+                throw new AppError("recovery_capacity_intent_conflict", "Retained recovery capacity chain is invalid", 1);
+        }
+        const refusals = dispatch.capacity_failures ?? [];
+        const observed = refusals.find(item => item.ordinal === intent.refusal.ordinal);
+        if (!observed || JSON.stringify(observed) !== JSON.stringify(intent.refusal) || overloadBurst(refusals))
+            throw new AppError("recovery_capacity_intent_conflict", "Recovery successor lacks an immutable non-burst refusal binding", 1);
+        const predecessor = intent.ordinal === 1 ? dispatch.operation_id : prior[intent.ordinal - 2]?.operation_id;
         if (prior.length !== intent.ordinal - 1 || predecessor !== intent.predecessor || intent.operation_id !== `${dispatch.operation_id}:capacity:${intent.ordinal}:session.prompt`)
             throw new AppError("recovery_capacity_intent_conflict", "Recovery capacity successor does not extend the pinned ACK", 1);
         const failed = context.db.get("SELECT status FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ?", [intent.predecessor, input.controllerId, input.generation]);
@@ -87,7 +104,7 @@ export function retainRecoveryCapacityIntent(context, input) {
         const changed = context.db.run("UPDATE run_recovery_bindings SET runtime_dispatch_json = ? WHERE recovery_id = ? AND daemon_id = ? AND status = 'prepared' AND runtime_dispatch_json = ?", [JSON.stringify(updated), input.recoveryId, input.daemonId, binding.runtime_dispatch_json]);
         if (changed.changes !== 1)
             throw new AppError("recovery_capacity_intent_conflict", "Recovery dispatch changed before successor publication", 1);
-        const marked = context.db.run("UPDATE run_controller_operations SET status = 'failed', receipt_json = ?, updated_at = ? WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'outcome_unknown'", [JSON.stringify({ capacity_intent: next }), context.now(), intent.predecessor, input.controllerId, input.generation]);
+        const marked = context.db.run("UPDATE run_controller_operations SET status = 'failed', receipt_json = ?, updated_at = ? WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'outcome_unknown'", [JSON.stringify({ capacity_failure: next.refusal, capacity_intent: next }), context.now(), intent.predecessor, input.controllerId, input.generation]);
         if (marked.changes !== 1)
             throw new AppError("recovery_capacity_intent_conflict", "Recovery predecessor changed before successor publication", 1);
     });
@@ -113,6 +130,35 @@ export function recoveryRuntimeAdmission(context, record, input) {
     if (guard.status === "resuming" && binding.status === "prepared" && input.operation === "session.resume")
         return typeof dispatch.resume_operation_id === "string" && input.operationId === dispatch.resume_operation_id && input.nativeSessionId === binding.provider_session_id;
     const active = dispatch.capacity_intents?.at(-1);
+    if (active) {
+        const ordinal = dispatch.capacity_intents.length;
+        const predecessor = ordinal === 1 ? dispatch.operation_id : dispatch.capacity_intents[ordinal - 2].operation_id;
+        if (active.policy !== CAPACITY_POLICY || active.ordinal !== ordinal || active.root_operation_id !== dispatch.operation_id || active.session_id !== binding.provider_session_id
+            || active.predecessor !== predecessor || active.operation_id !== `${dispatch.operation_id}:capacity:${ordinal}:session.prompt`
+            || active.refusal?.policy !== CAPACITY_POLICY || active.refusal.ordinal !== ordinal - 1 || active.refusal.turn_id !== active.turn_id
+            || active.refusal.session_id !== binding.provider_session_id || active.deadline !== null || !Number.isFinite(Date.parse(active.not_before)))
+            return false;
+        const failure = dispatch.capacity_failures?.find(item => item.ordinal === ordinal - 1);
+        if (!failure || JSON.stringify(failure) !== JSON.stringify(active.refusal))
+            return false;
+        try {
+            if (overloadBurst(dispatch.capacity_failures))
+                return false;
+        }
+        catch {
+            return false;
+        }
+        const predecessorRow = context.db.get("SELECT status,receipt_json FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ?", [predecessor, record.owner_id, guard.generation]);
+        if (predecessorRow?.status !== "failed")
+            return false;
+        try {
+            if (JSON.stringify(JSON.parse(predecessorRow.receipt_json).capacity_intent) !== JSON.stringify(active))
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
     if (active && active.not_before > context.now())
         return false;
     return guard.status === "resuming" && binding.status === "prepared" && input.operation === "session.prompt"

package/dist/services/runs.js

@@ -85,7 +85,7 @@ export function startFlowRun(context, input, prepared = prepareFlowRunStart(cont
         run_id: runId,
         short_id: shortId,
         flow_kind: flowKind,
-        ...(["vnext_specify", "vnext_protocolize"].includes(flowKind) ? { verification_matrix_contract: "dd-flow/verification-matrix@1" } : {}),
+        ...(["vnext_specify", "vnext_protocolize"].includes(flowKind) ? { verification_matrix_contract: "dd-flow/verification-matrix@1", final_check_coverage_contract: "dd-flow/final-check-coverage@1" } : {}),
         subject: {
             id: subjectId,
             title: subjectId

package/dist/services/verification-matrix.js

@@ -7,6 +7,7 @@ import { checkReceiptEvidenceValid, checkReceipts, effectiveCheckDeclarations }
 import { acceptStagePacket, prepareStagePacket, publishStagePacket, resolveStagePublicationPath } from "./stage-report-renderer.js";
 import { assertRunMutationAllowed } from "./run-recovery.js";
 export const verificationMatrixContract = "dd-flow/verification-matrix@1";
+export const finalCheckCoverageContract = "dd-flow/final-check-coverage@1";
 /** A view of already validated facts: never a gate or a receipt selector. */
 export function buildVerificationMatrix(input) {
     const sourceCatalog = new Map();
@@ -178,6 +179,10 @@ export function prepareRunVerificationMatrix(context, input) {
     let finalBindings;
     if (input.stage === "merge") {
         const gate = readSource("merge_gate", "run", "07-merge/merge-gate.json");
+        if (index.final_check_coverage_contract === finalCheckCoverageContract) {
+            for (const role of final ? ["baseline", "source", "target"] : ["baseline", "source"])
+                readSource(`check_profile_${role}`, "run", `07-merge/check-profile-${role}.json`);
+        }
         const semanticRefs = new Set(plans.flatMap(plan => plan.acceptance.flatMap(entry => entry.check_refs.map(id => `${plan.protocol_id}/${id}`))));
         policyChecks = gate.checks.filter(check => !semanticRefs.has(check.canonical_ref ?? check.id));
         if (final) {
@@ -224,6 +229,20 @@ export function prepareRunVerificationMatrix(context, input) {
             return { id: check.id, canonical_ref: ref, declaration: check, result: portable, disposition: "unavailable", reason: "receipt_file_missing" };
         const bytes = fs.readFileSync(receiptFile);
         sources.push({ role: `receipt:${ref}`, root: "run", path: portable.receipt_path, sha256: digest(bytes) });
+        const retainedReceipt = JSON.parse(bytes.toString("utf8"));
+        for (const artifact of retainedReceipt.artifacts ?? []) {
+            if (path.isAbsolute(artifact.path) || artifact.path.includes("\0") || artifact.path.split(/[\\/]/).includes(".."))
+                throw new AppError("verification_matrix_path_invalid", "Native artifact must remain inside its evidence directory", 1, { path: artifact.path });
+            const artifactPath = slash(path.join(path.dirname(portable.receipt_path), "artifacts", artifact.path));
+            const artifactFile = safePath(home, artifactPath);
+            if (fs.existsSync(artifactFile))
+                sources.push({ role: `artifact:${ref}:${artifact.path}`, root: "run", path: artifactPath, sha256: digest(fs.readFileSync(artifactFile)) });
+        }
+        if (receipt.status !== "aborted" && fs.existsSync(receipt.completion_path)) {
+            const completionPath = portable.completion_path;
+            const completionFile = safePath(home, completionPath);
+            sources.push({ role: `completion:${ref}`, root: "run", path: completionPath, sha256: digest(fs.readFileSync(completionFile)) });
+        }
         return { id: check.id, canonical_ref: ref, declaration: check, result: portable, disposition: valid ? "retained" : "unavailable", ...(!valid ? { reason: "receipt_evidence_invalid" } : {}) };
     });
     const works = context.db.all("SELECT work_id, payload_json FROM works WHERE project_id = ? AND run_id = ?", [input.projectId, input.runId]).flatMap(work => {
@@ -238,6 +257,8 @@ export function prepareRunVerificationMatrix(context, input) {
     const markdown = prepareStagePacket(safePath(home, `${root}/verification-matrix.md`), Buffer.from(renderVerificationMatrix(matrix)));
     packets.push(json, markdown);
     const metadata = { contract: verificationMatrixContract, role: header.role, completeness: header.completeness, source_fingerprint: matrix.header.source_fingerprint, json: { path: slash(path.relative(home, json.file)), sha256: json.sha256 }, markdown: { path: slash(path.relative(home, markdown.file)), sha256: markdown.sha256 } };
+    if (index.final_check_coverage_contract === finalCheckCoverageContract)
+        metadata.coverage_contract = finalCheckCoverageContract;
     const predecessors = (index.stage_runs ?? []).filter(item => item.stage !== input.stage && item.status === "done").map(item => ({ stage: item.stage, ...(item.attempt ? { attempt: item.attempt } : {}), ...(item.data_sha256 ? { data_sha256: item.data_sha256 } : {}) }));
     return { projectId: input.projectId, runId: input.runId, stage: input.stage, home, attempt, generation, packets, matrix, metadata, predecessors };
 }
@@ -297,6 +318,8 @@ export function latestRunVerificationMatrix(context, projectId, runId, stage, ro
         const md = { file: mdFile, bytes: mdBytes, sha256: paired.sha256 };
         const json = { file: packet.file, bytes, sha256: packet.sha256 };
         const metadata = { contract: verificationMatrixContract, role: matrix.header.role, completeness: matrix.header.completeness, source_fingerprint: matrix.header.source_fingerprint, json: { path: slash(path.relative(run.run_root, packet.file)), sha256: packet.sha256 }, markdown: { path: slash(path.relative(run.run_root, mdFile)), sha256: md.sha256 } };
+        if (index.final_check_coverage_contract === finalCheckCoverageContract)
+            metadata.coverage_contract = finalCheckCoverageContract;
         const sourcePackets = matrix.sources.filter(source => (source.role.startsWith("plan:") || source.role === "code_work_batch") && source.root === "run").map(source => {
             const file = safePath(run.run_root, source.path, false);
             const retained = rows.map(row => JSON.parse(row.payload_json)).find(item => item.run_id === runId && item.stage === stage && item.attempt === attempt && resolveStagePublicationPath(context, projectId, runId, item.file) === file && item.sha256 === source.sha256);
@@ -314,7 +337,13 @@ export function latestRunVerificationMatrix(context, projectId, runId, stage, ro
 }
 function portableReceipt(receipt, home) {
     const relative = (file) => slash(path.relative(home, safePath(home, path.relative(home, file))));
-    return { ...receipt, receipt_path: relative(receipt.receipt_path), completion_path: relative(receipt.completion_path), stdout_path: relative(receipt.stdout_path), stderr_path: relative(receipt.stderr_path), artifacts: receipt.artifacts.map(item => ({ ...item, path: relative(item.path) })) };
+    return { ...receipt, receipt_path: relative(receipt.receipt_path), completion_path: relative(receipt.completion_path), stdout_path: relative(receipt.stdout_path), stderr_path: relative(receipt.stderr_path), artifacts: receipt.artifacts.map(item => {
+            const artifactPath = path.isAbsolute(item.path) ? path.relative(path.join(path.dirname(receipt.receipt_path), "artifacts"), item.path) : item.path;
+            if (path.isAbsolute(artifactPath) || artifactPath.includes("\0") || artifactPath.split(/[\\/]/).includes(".."))
+                throw new AppError("verification_matrix_path_invalid", "Native artifact must remain inside its evidence directory", 1, { path: item.path });
+            safePath(home, path.join(path.dirname(relative(receipt.receipt_path)), "artifacts", artifactPath));
+            return { ...item, path: slash(artifactPath) };
+        }) };
 }
 function safePath(root, relative, inspectFilesystem = true) {
     if (path.isAbsolute(relative) || relative.split(/[\\/]/).includes(".."))

package/dist/services/vnext-code-review.js

@@ -26,6 +26,7 @@ import { validateVnextCodeHandoff } from "./vnext-plan.js";
 import { assertRunMutationAllowed } from "./run-recovery.js";
 import { prepareJsonFile, prepareOutputFile } from "../cli/input-preparation.js";
 import { reviewerSourceInputs, reviewerSourceInstruction } from "./review-copy.js";
+import { reviewDefEvidence } from "./review-deferral.js";
 const stage = "code-review";
 const stageDir = vnextStageDirectory(stage);
 const baselineAspects = ["goal_traceability", "coding_standards_design_review", "verification_evidence_review"];
@@ -196,6 +197,7 @@ export async function finishVnextCodeReview(context, input) {
     validateSchema({ schemaName: "code-review-decision", file: decisionFile, data: decision, projectRoot: run.workspace_root, ddFlowHome: context.ddFlowHome, runId: run.id, runRoot: home });
     const cycle = reviewContext.cycle ?? "initial";
     const reviewers = reviewerWorks(context, project.id, run.id, cycle);
+    const defEvidence = decision.findings.filter(item => item.disposition === "defer").map(item => reviewDefEvidence(run.workspace_root, item.def_id));
     if (mode !== "off") {
         assertCodeReviewCoverage(reviewGroups(home), reviewers);
         const incomplete = reviewers.filter((work) => work.status !== "completed");
@@ -204,6 +206,8 @@ export async function finishVnextCodeReview(context, input) {
         for (const work of reviewers)
             validateReviewerResult(context, work, run);
         const canonical = reviewDecisionForRepair(decision, reviewers);
+        if (reviewContext.accepted_decision && JSON.stringify(reviewContext.def_evidence ?? []) !== JSON.stringify(defEvidence))
+            throw new AppError("deferral_invalid", "Accepted DEF evidence changed during review repair", 2);
         const checkRefsByFinding = validateRepairChecks(context, { projectId: project.id, runId: run.id, decision: canonical.decision });
         let repairs = reviewRepairWorks(context, project.id, run.id, root, cycle);
         const frozenShaFile = path.join(root, ".decision-sha256");
@@ -215,7 +219,7 @@ export async function finishVnextCodeReview(context, input) {
             // Accept the value once. Repairs consume this decision, not a mutable
             // operator file. Reuse the existing context artifact and review cycle.
             const contextFile = path.join(root, "review-context.json"), temporary = `${contextFile}.tmp-${crypto.randomUUID()}`;
-            fs.writeFileSync(temporary, `${JSON.stringify({ ...reviewContext, accepted_decision: decision }, null, 2)}\n`);
+            fs.writeFileSync(temporary, `${JSON.stringify({ ...reviewContext, accepted_decision: decision, def_evidence: defEvidence }, null, 2)}\n`);
             fs.renameSync(temporary, contextFile);
             const repair = addVnextCodeReviewRepair(context, { projectRoot, runId: run.id, findingIds: fixIds, checkRefsByFinding, decisionReasonsByFinding: Object.fromEntries(canonical.decision.findings.map((item) => [item.finding_ref, item.reason])), objective: `Resolve accepted CODE-REVIEW findings: ${fixIds.join(", ")}` });
             const retained = latestRunVerificationMatrix(context, project.id, run.id, stage, "input");
@@ -263,6 +267,9 @@ export async function finishVnextCodeReview(context, input) {
     const prepareMerge = nextAction === "start_merge" ? prepareVnextMergeRequest(context, { projectRoot, runId: run.id, acceptedPaths }) : null;
     if (matrix)
         Object.assign(report.semantic, { verification_matrix: matrix.metadata });
+    if (JSON.stringify(defEvidence) !== JSON.stringify(decision.findings.filter(item => item.disposition === "defer").map(item => reviewDefEvidence(run.workspace_root, item.def_id))))
+        throw new AppError("deferral_invalid", "DEF evidence changed while final checks ran", 2);
+    Object.assign(report.semantic, { def_evidence: defEvidence });
     const preparedReport = prepareStageReport(report);
     const completionInput = { projectRoot, runId: run.id, stage, status: "done", data: "stage-report.json", dataSchemaId: "dd-flow/stage-report@1", report: "stage-report.md", stageReport: "stage-report.html", dataSha256: preparedReport.sha256, git: report.mechanical.git };
     withStageSettlement(context, () => {
@@ -356,7 +363,10 @@ export function assertCodeReviewCoverage(groups, reviewers) {
 export function reviewerTask(home, group) { return `Read-only independent CODE review for ${group.key}. Assess every assigned aspect exactly once: ${group.aspect_ids.join(", ")}. Read the accepted PLAN, ${path.join(home, "05-code", "stage-report.json")}, and any files needed under the bounded CODE evidence root ${path.join(home, "05-code")}. Verify that universal and exclusive constraints (only, any, all, never, whole) and stated exceptions were not narrowed. For every changed mutation guarded by membership, ownership, authorization or parent lifecycle state, trace the decision to the write boundary: the predicate must remain in the write statement or the guard and write must share one explicit transaction with the needed lock. A separate earlier read is not proof of current authority or lifecycle state; report a material finding when this invariant is broken. Evidence closes a claim only when it exercises the named failure mechanism; a sequential negative test does not prove a concurrency race, and proof limits cannot waive an accepted obligation. Report only material, evidenced defects: a violated obligation or rule, direct evidence, impact, and minimum required outcome. Do not report taste, cosmetics, or untargeted refactoring. Use local finding ids FIND-001, FIND-002, and so on; dd-flow adds the Work-qualified canonical reference. Return dd-flow/code-review-result@1.`; }
 function orchestratorPrompt(context, input) { const { template, checks } = input; const decision = path.join(input.root, "decision.json"); return ["<stage_identity>", `- RUN: ${input.run.id}`, `- root Work: ${input.rootWork.work_id}`, `- stage: ${stage}`, `- mode: ${input.mode}`, "</stage_identity>", "", "<trusted_runtime_context>", `- project root: ${input.projectRoot}`, `- immutable write workspace: ${input.run.workspace_root}`, `- stage workspace: ${input.root}`, `- bounded CODE evidence root: ${path.join(input.run.run_root, "05-code")}`, "CODE passed its declared checks; each check proves only its named contour and proof limits, not complete semantic acceptance. Conduct independent quality review and do not manually rerun every declared check.", "</trusted_runtime_context>", "", "<review_groups>", ...input.groups.map((group) => `- ${group.key}: ${group.aspect_ids.join(", ")}`), "</review_groups>", "", "<execution_commands>", "Do not choose a provider delegation tool from this stage prompt. At the Work-graph boundary, return immediately; the shared controller supplies the selected adapter's native tool, exact parameters, child task, and wait contract. Each reviewer Work must run in one fresh child session. The coordinator must never invoke a Work start_command itself: a child runs its exact start_command after native delegation. Reviewers are read-only and must not create subagents. Do not interrupt a quiet worker.", "Ready reviewer Works: " + runtimeCommand(context, ["work", "ls", "--run", input.run.id, "--ready", "--project-root", input.projectRoot, "--json"]), `Write the decision to this exact absolute path, not a relative look-alike: ${decision}`, `Finish only after every reviewer Work settles and that exact file exists: ${finishCommand(context, input.run.id, input.projectRoot, decision)}`, "Reviewer results use local FIND-NNN ids. Classify them by the canonical WRK-.../FIND-NNN finding_ref returned by dd-flow. Fix P0/P1. Fix bounded safe P2 by default; defer only a legitimate P2 with a named DEF. P3 is an observation or a reasoned rejection, not automatic repair/DEF. For every disposition fix, check_refs is mandatory: choose the one or more causal checks from the accepted list below that the repair must rerun. Do not guess a CHK id or copy every check. The first successful Finish freezes this decision and creates one repair Work when needed. Do not invoke that Work's start_command from the coordinator Session: end this Turn so the controller can launch a fresh child, then call the returned next.finish_command after it completes. Internal invocation IDs are runtime-owned and must not be copied or reused. Review is not repeated.", "If the aggregate gate fails with repair_required, its repair Work is already registered with all causal checks. End this Turn so the controller launches a fresh child. Do not copy receipt IDs, create another repair, invoke its start_command in the coordinator, or edit invisibly in the root orchestrator.", `Accepted repair checks: ${JSON.stringify(checks)}`, "```json", JSON.stringify({ schema_id: "dd-flow/code-review-decision@3", summary: "Evidence-backed conclusion.", findings: [{ finding_ref: "WRK-001-review/FIND-001", disposition: "fix | defer | reject | duplicate", reason: "Why this classification is correct.", check_refs: ["CHK-CAUSAL-CHECK only when disposition is fix"], def_id: "DEF-0001 only for an allowed P2 deferral", duplicate_of: "canonical finding_ref only for duplicate" }] }, null, 2), "```", "</execution_commands>", "", "<stage_instructions>", template, "</stage_instructions>", ""].join("\n"); }
 function canonicalReviewEvidence(decision, reviewers) {
-    const known = new Set(canonicalCodeFindings(reviewers).map((item) => item.finding_ref));
+    const known = new Map(canonicalCodeFindings(reviewers).map((item) => [item.finding_ref, item.finding]));
+    const refs = decision.findings.map(item => item.finding_ref);
+    if (new Set(refs).size !== refs.length || refs.some(ref => !known.has(ref)))
+        throw new AppError("review_evidence_invalid", "CODE decisions must use unique known canonical finding references", 2, { finding_refs: refs });
     const items = new Map(decision.findings.map((item) => [item.finding_ref, item]));
     const duplicates = new Set();
     for (const item of decision.findings.filter((entry) => entry.disposition === "duplicate")) {
@@ -372,6 +382,9 @@ function canonicalReviewEvidence(decision, reviewers) {
         }
         if (!cursor)
             throw new AppError("review_evidence_invalid", "Duplicate finding chain must end at a decided canonical finding", 2, { finding_ref: item.finding_ref });
+        if (["p0", "p1"].includes(known.get(item.finding_ref).priority) && cursor.disposition !== "fix") {
+            throw new AppError("review_material_disposition_invalid", "P0/P1 duplicate findings must resolve to a fixed canonical finding", 2, { finding_ref: item.finding_ref, canonical_finding_ref: cursor.finding_ref, disposition: cursor.disposition });
+        }
         duplicates.add(item.finding_ref);
     }
     return {
@@ -422,8 +435,7 @@ function validateDecision(context, input) {
         if (item.disposition === "fix" && !repaired.some((work) => requiredChecks.every((ref) => reviewCheckRefs(work).includes(ref))))
             throw new AppError("review_repair_check_missing", "A fixed CODE-REVIEW finding needs a repair Work that retains every selected causal check", 2, { finding_ref: findingRef, check_refs: requiredChecks });
         if (finding.priority === "p2" && item.disposition === "defer") {
-            if (!item.def_id || !fs.existsSync(path.join(input.workspaceRoot, ".memory-bank", "defs", `${item.def_id}.md`)))
-                throw new AppError("deferral_invalid", "A deferred P2 requires a named durable DEF", 2, { finding_ref: findingRef, def_id: item.def_id ?? null });
+            reviewDefEvidence(input.workspaceRoot, item.def_id);
         }
         if (finding.priority === "p3" && item.disposition === "defer")
             throw new AppError("deferral_invalid", "P3 observations are not deferred as DEF", 2, { finding_ref: findingRef });

package/dist/services/vnext-merge.js

@@ -17,7 +17,7 @@ import { runtimeCommand, checkRetryArgs, recoveryEvidenceInput } from "./runtime
 import { acceptStageReport, prepareStageReport, publishStageReport } from "./stage-report-renderer.js";
 import { bindStageCoordinatorWork, createChildWork, failWork, finishFanInWork, finishWork, refreshRunWorkProjection, startStageCoordinatorWork } from "./work-registry.js";
 import { addVnextCodeRepair } from "./vnext-code.js";
-import { checkReceiptEvidenceValid, checkReceipts, effectiveCheckDeclarations, mergeCheckProfileHash, runCodeChecks, validateFailedCheckRetry, workspaceChangedPaths, workspaceFingerprint } from "./code-checks.js";
+import { checkReceiptEvidenceValid, checkReceipts, effectiveCheckDeclarations, mergeCheckProfileHash, readCodeCheckProfile, runCodeChecks, validateCheckDeclaration, validateFailedCheckRetry, workspaceChangedPaths, workspaceFingerprint } from "./code-checks.js";
 import { applyExternalStageContext, prepareExternalStageContext } from "./stage-context.js";
 import { ensureLaneWorkspace, prepareLaneWorkspace, heartbeatLaneLock, releaseLaneLock, waitAcquireLaneLock } from "./lanes.js";
 import { assertRunMutationAllowed } from "./run-recovery.js";
@@ -64,6 +64,8 @@ export function prepareVnextMergeRequest(context, input) {
     validateMergeAcceptance(run.workspace_root, protocols, semantic);
     const acceptanceRefs = mergeAcceptanceRefs(run.workspace_root, protocols);
     const effective = effectiveCheckDeclarations(targetWorkspace, semantic, ["work", "code", "readiness", "merge"]);
+    for (const check of effective)
+        validateCheckDeclaration(run.workspace_root, check);
     if (run.workspace_root !== targetWorkspace && effective.length === 0)
         throw new AppError("merge_gate_missing", "A real source/target integration requires at least one semantic or policy merge check", 2, { run_id: run.id, protocol_ids: protocols });
     const ignored = ignoredGitPaths(context, project.id);
@@ -73,6 +75,8 @@ export function prepareVnextMergeRequest(context, input) {
     const gateFile = path.join(freezeRoot, "merge-gate.json");
     fs.mkdirSync(freezeRoot, { recursive: true });
     const profileHash = mergeCheckProfileHash(run.workspace_root, targetWorkspace, effective);
+    retainMergeProfile(freezeRoot, "baseline", targetWorkspace);
+    retainMergeProfile(freezeRoot, "source", run.workspace_root);
     freezeMergeGate(gateFile, { runId: run.id, protocols, checks: effective, acceptanceRefs, profileHash, now: context.now() });
     let sourceCommit;
     let sourcePaths;
@@ -294,6 +298,9 @@ export async function finishVnextMerge(context, input, prepared = prepareVnextMe
     const gate = prepared.gate, checks = gate.checks;
     if (input.retryCheckId)
         appendFlowRunTimelineEvent(context, project.id, run.id, { type: "check_retry_requested", check_receipt_id: input.retryCheckId, stage, reason: input.retryReason ?? "operator retry" });
+    for (const check of checks)
+        validateCheckDeclaration(request.target_workspace, check);
+    retainMergeProfile(path.join(requireHome(run), stageDir), "target", request.target_workspace);
     const acceptancePath = path.join(requireHome(run), stageDir, "merge-gate-acceptance.json");
     const recovered = readMergeGateAcceptance(context, acceptancePath, request, gate);
     const resumingGate = ["checks_passed", "integration_committed", "delivered"].includes(request.checkpoint);
@@ -501,7 +508,7 @@ function mergeReport(context, run, request, semantic, receipts) {
 }
 function effectiveMergeChecks(run, request) { return readFrozenMergeGate(path.join(requireHome(run), stageDir, "merge-gate.json"), request.merge_request_id).checks; }
 function planChecks(workspace, protocols) { return protocols.flatMap((protocol) => { const file = path.join(workspace, ".memory-bank", "protocol", protocol, "plan.json"); if (!fs.existsSync(file))
-    return []; const plan = JSON.parse(fs.readFileSync(file, "utf8")); return (plan.checks ?? []).filter((check) => check.availability === "available").map((check) => ({ ...check, canonical_ref: `${protocol}/${check.id}` })); }); }
+    throw new AppError("merge_plan_missing", "MERGE requires every accepted PLAN", 2, { protocol_id: protocol }); const plan = JSON.parse(fs.readFileSync(file, "utf8")); return (plan.checks ?? []).map((check) => ({ ...check, canonical_ref: `${protocol}/${check.id}` })); }); }
 function validateMergeAcceptance(workspace, protocols, checks) { const known = new Set(checks.map((check) => check.canonical_ref)); const missing = mergeAcceptanceRefs(workspace, protocols).filter((ref) => !known.has(ref)); if (missing.length)
     throw new AppError("merge_acceptance_invalid", "A merge acceptance criterion references a missing check", 2, { check_refs: missing }); }
 function freezeMergeGate(file, input) { const canonical = JSON.stringify({ checks: input.checks, acceptance_refs: [...input.acceptanceRefs].sort() }); const hash = cryptoHash(canonical); if (fs.existsSync(file)) {
@@ -519,6 +526,17 @@ function readFrozenMergeGate(file, requestId) { try {
 catch (cause) {
     throw new AppError("merge_gate_missing", "MERGE gate is missing or invalid", 1, { merge_request_id: requestId, file, cause: String(cause) });
 } }
+function retainMergeProfile(root, role, workspace) {
+    const { profile, hash, file: profileFile } = readCodeCheckProfile(workspace);
+    const file = path.join(root, `check-profile-${role}.json`);
+    const bytes = `${JSON.stringify({ schema_id: "dd-flow/retained-check-profile@1", profile, profile_sha256: hash, profile_bytes: profile ? fs.readFileSync(profileFile, "utf8") : null }, null, 2)}\n`;
+    if (fs.existsSync(file)) {
+        if (fs.readFileSync(file, "utf8") !== bytes)
+            throw new AppError("check_profile_drift", "Retained MERGE profile changed", 2, { role, file });
+    }
+    else
+        fs.writeFileSync(file, bytes, { flag: "wx" });
+}
 function frozenGateRefs(gate) { return [...new Set([...gate.checks.map(check => check.canonical_ref ?? check.id), ...gate.acceptanceRefs])].sort(); }
 function writeMergeGateAcceptance(context, file, request, gate, acceptedTree, receipts) { const persisted = new Map(checkReceipts(context, { projectId: request.project_id, runId: request.run_id }).map(receipt => [receipt.id, receipt])); const value = { schema_id: "dd-flow/merge-gate-acceptance@2", merge_request_id: request.merge_request_id, run_id: request.run_id, work_id: request.executor_work_id, gate_hash: gate.gateHash, profile_hash: gate.profileHash, accepted_tree: acceptedTree, receipts: receipts.map(receipt => ({ id: receipt.id, execution_refs: [...(persisted.get(receipt.id)?.check_refs ?? receipt.check_refs)].sort(), binding_refs: [...receipt.check_refs].sort(), input_hash: receipt.input_hash })) }; const temporary = `${file}.tmp-${process.pid}-${crypto.randomUUID()}`; fs.writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`); fs.renameSync(temporary, file); }
 function readMergeGateAcceptance(context, file, request, gate) { try {