@deksden-com/dd-flow-cli 0.9.0-beta.123 → 0.9.0-beta.127

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.127
+
+### Patch Changes
+
+- Scope boundary consistency to productive RUN authority and retain accepted Work results across snapshot relocation without requiring unchanged provider service files.
+- Reject conflicting retained native operation inputs before transport dispatch, preserving the same conflict classification across all harness observers.
+- Distinguish recoverable pre-shutdown refusal from durable unclean shutdown in full-cycle fixtures. Verify clean settlement or retained blocker custody before teardown, with native operation-inspection and cancel-tree parameter parity.
+
+## 0.9.0-beta.126
+
+### Patch Changes
+
+- Separate existing controller renewal from productive launch admission, allowing terminal RUNs to finish sealed boundary capture and native settlement.
+- Make terminal stop retain durable cleanup without changing subject outcomes or reopening productive recovery; expose scoped read-only finalization diagnostics.
+- Verify final snapshot identity and physical retirement before full-cycle fixture teardown.
+
+## 0.9.0-beta.124
+
+### Patch Changes
+
+- Stop only two confirmed continuation overload refusals within the inclusive two-minute window, preserving native refusal times and exact owner admission across recovery.
+
+  Retain final PLAN check obligations, completion markers and native output bytes in verification evidence; require canonical fixes for duplicated CODE P0/P1 findings.
+
+  Join native daemon cleanup before durable stop acknowledgement and reconcile already-closed provider bridges without replay.
+
 ## 0.9.0-beta.123
 
 ### Patch Changes

package/README.md

@@ -3,6 +3,29 @@
 See [dd-zcode integration](src/harness-runtime/DD-ZCODE.md) for native transport,
 adapter ownership and the versioned bridge contract.
 
+## Native daemon shutdown
+
+`daemon.stop` fences productive dispatch before awaiting settlement. A successful
+durable stop receipt follows native tree settlement, physical provider exit,
+journal drain and required resource/auth finalization. The endpoint then retires
+before ACK; clients also verify the retained daemon PID has exited. A missing
+socket alone is not physical shutdown proof.
+
+Partial cleanup preserves the same incarnation's completed phases in
+`daemon.json` (`dd-flow/daemon-shutdown@1`). A fresh control operation can finish
+remaining cleanup without replaying agent work or inspecting a closed pipe.
+Failed operation IDs remain immutable. Unknown ownership and persistent EPERM
+remain failures; never remove sockets or repair runtime databases manually to
+make an outcome look clean.
+
+Shutdown proof records `required_phases`; every recorded phase must be complete,
+including native tree and daemon resource settlement. A `clean` label without
+this proof cannot authorize retained restart. `stopping`, `cleanup_failed` and
+`unclean` cannot start a replacement native bridge. Forced AGY termination
+without a current native terminal receipt is unclean, even after a previous
+successful Turn. Mandatory stream-journal failures remain failures after
+physical cleanup. Listener retirement must not unlink a replacement endpoint.
+
 ## Managed temporary HTTP services
 
 For an interactive scenario, `runtime process start --run <RUN-ID>
@@ -448,12 +471,21 @@ remain invalid and receive a standalone retry.
 Local verification for this repository:
 
 ```bash
-pnpm test
 pnpm typecheck
 pnpm lint
 pnpm build
+pnpm test
 ```
 
+Build once before testing: release contracts and native fixtures verify the
+copied `dist` bytes. `pnpm test` remains release → integration → runtime-sensitive.
+For development use `pnpm test:fast`, `pnpm test:core` or `pnpm test:flow` plus
+the affected native contracts; these subsets are not full acceptance.
+New files default to serial core execution. A forced serial fallback is
+`pnpm test:integration --no-file-parallelism --maxWorkers=1`.
+The [test-suite verification runbook](https://github.com/deksden-com/dd-eval/blob/docs/066-test-suite-optimization/runbooks/flow-test-suite-verification.md)
+owns group qualification, complete reports and cross-repository commands.
+
 Manual smoke checks should use a temporary `DD_FLOW_HOME` when they do not intentionally inspect the operator's real local state.
 
 ### RUN status during recovery

package/dist/build-info.json

@@ -1,15 +1,15 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.123",
-  "cli_commit": "0d75e9e7e18868fbe9eee8d51e4c4d06ab03a8cd",
-  "built_at": "2026-09-30T12:08:03.924Z",
+  "cli_version": "0.9.0-beta.127",
+  "cli_commit": "8c98b4fa9e0f69be85ef616d7c7c3dac884fc0f5",
+  "built_at": "2026-10-11T11:57:17.805Z",
   "built_with_canon": {
     "version": "4.1.2",
-    "commit": "bbb3845083d7c1984bb61d813dd6700fe695180a",
+    "commit": "2ba0b9ceedf8e4544ad9566c240ef37ea5e8d099",
     "flow_contract": "dd-flow-canonical-2026-08",
-    "repo_root": "/home/runner/work/dd-flow-cli/dd-flow-cli/dd-memorybank",
-    "memorybank_root": "/home/runner/work/dd-flow-cli/dd-flow-cli/dd-memorybank/.memory-bank",
-    "flow_root": "/home/runner/work/dd-flow-cli/dd-flow-cli/dd-memorybank/.memory-bank/dd-flow",
+    "repo_root": "/Users/deksden/.dd-eval/qualification/cp-214-release-canon",
+    "memorybank_root": "/Users/deksden/.dd-eval/qualification/cp-214-release-canon/.memory-bank",
+    "flow_root": "/Users/deksden/.dd-eval/qualification/cp-214-release-canon/.memory-bank/dd-flow",
     "layout": "dot_memory_bank"
   }
 }

package/dist/cli/argument-values.js

@@ -0,0 +1,38 @@
+import { AppError } from "../shared/errors.js";
+const flagValue = "__dd_flow_flag__";
+export function optionalOption(parsed, key) {
+    const values = parsed.options.get(key);
+    const value = values?.[values.length - 1];
+    if (value === flagValue)
+        throw new AppError("usage", `--${key} requires a value`, 2);
+    if (value !== undefined && !value.trim())
+        throw new AppError("usage", `--${key} requires a non-empty value`, 2);
+    return value;
+}
+export function requiredOption(parsed, key) {
+    const value = optionalOption(parsed, key);
+    if (!value) {
+        throw new AppError("usage", `Missing required option: --${key}`, 2);
+    }
+    return value;
+}
+export function optionalNumber(parsed, key) {
+    const value = optionalOption(parsed, key);
+    if (typeof value === "undefined") {
+        return undefined;
+    }
+    const parsedNumber = Number(value);
+    if (!Number.isFinite(parsedNumber)) {
+        throw new AppError("validation", `--${key} must be a number`, 2);
+    }
+    return parsedNumber;
+}
+export function optionalPositiveNumber(parsed, key, integer = false) {
+    const value = optionalNumber(parsed, key);
+    if (typeof value === "undefined")
+        return undefined;
+    if (value <= 0 || (integer && !Number.isInteger(value))) {
+        throw new AppError("validation", `--${key} must be a positive${integer ? " integer" : ""} number`, 2);
+    }
+    return value;
+}

package/dist/cli/command-inputs.js

@@ -15,6 +15,7 @@ const control = "project-root run";
 /** Path-shaped arguments default to physical paths unless the route explicitly
  * opts into contextualPaths. This inventory does not expand arbitrary strings. */
 export const physicalPathOptions = new Set(words("root project-root workspace-root workspace-path path dir file schema-dir output result-file semantic-file data decision-file verification-file reason-file task-file intake-file context-file observations-file observation-file summary-file question-file answer-file payload-file json-file task-profile-file execution-routing-file protocol-override-file manifest-file routing-file config-file input-file report-file snapshot-file output-dir state-dir capture-root capture-path destination source archive snapshot plan-file backup-path database backup source-home target-home stdout stderr adapter-executable memory-bank flow stage-report dashboard report"));
+physicalPathOptions.add("operational-decision-file");
 export const commandInputs = {
     "version": route(0),
     "status": route(0, "", "root project-root", "check-registry"),
@@ -102,8 +103,8 @@ export const commandInputs = {
     "run snapshot bootstrap create": route(0, `${project} output`),
     "run snapshot bootstrap restore": route(0, `${project} snapshot`),
     "run snapshot create": route(1, `${project} output`, "recovery-id stage-entry", "candidate incomplete"),
-    "run snapshot restore": route(0, `${project} snapshot`, "execution-routing-file recovery-id"),
-    "run fork": route(0, "from output engine-version request-id", "integrity-checksum"),
+    "run snapshot restore": route(0, `${project} snapshot`, "execution-routing-file operational-decision-file recovery-id"),
+    "run fork": route(0, "from output engine-version request-id", "integrity-checksum operational-decision-file"),
     "run drive status": route(0, control, "after"),
     "run drive launch": route(0, `${control} request-id context-file context-sha256`, "stop-after capture-root"),
     "run drive serve": route(0, `${control} controller-id`),
@@ -125,7 +126,7 @@ export const commandInputs = {
     "runtime process check-admission": route(0, "id lease-token"),
     "runtime process start": route(0, `${control} command ports ready-port`, "ready-path ready-timeout-ms"),
     "runtime process stop": route(0, "id lease-token", "grace-ms"),
-    "runtime process register": route(0, "kind owner", "lease-ms budget-json project-id run pid process-group-id owner-pid work check operation stdout stderr harness dispatch-barrier role state-dir adapter-executable"),
+    "runtime process register": route(0, "kind owner", "id lease-ms budget-json project-id run pid process-group-id owner-pid work check operation stdout stderr harness dispatch-barrier role state-dir adapter-executable"),
     "runtime process confirm": route(0, "id lease-token pid", "owner-pid lease-ms process-group-id"),
     "runtime process heartbeat": route(0, "id lease-token", "lease-ms"),
     "runtime process admission": route(0, "id lease-token owner state-dir", "daemon-id operation-id operation native-session-id prompt-sha256"),

package/dist/cli/help.js

@@ -213,6 +213,7 @@ RUN-* is the execution envelope for one concrete flow launch. Semantic truth rem
 
 run start and prepare-vnext-specify accept --execution-routing-file for vNext RUNs: dd-flow/execution-routing@1 with an execution object selects the complete routing policy from existing agent-profiles. RUN creation freezes the input and selected profiles without changing project settings.
 run snapshot restore also accepts --execution-routing-file for a new stage-entry experiment. Its fresh DD_FLOW_HOME may contain only agent-profiles and the empty database; selected profiles are read before import, previous RUN policy is archived, and existing Work overrides must resolve against the selected frozen profiles. Recovery imports reject this option.
+run snapshot restore and run fork accept --operational-decision-file for an explicitly accepted decision bound to the new stage-entry experiment. Store the input outside fork output; its bytes are bound to the idempotent request. A snapshot with a scoped decision cannot grant it to another execution implicitly. Recovery retains the original decision and rejects replacement.
 run fork restores one sealed stage-entry snapshot to an isolated project and DD_FLOW_HOME, archives source authority, then binds an exact engine only in that copy. It is idempotent by request ID and output receipt; it never resumes a provider session or changes its source RUN.
 run prepare-vnext-specify allocates an otherwise unstarted vNext RUN for the canonical SPECIFY entry checkpoint. run recovery makes an interrupted RUN read-only, requires an explicit settled-tree receipt, captures immutable recovery evidence, then explicitly returns delegated Work to the ready graph. run snapshot is the eval-only checkpoint boundary: it snapshots one quiescent RUN, its dedicated DD_FLOW_HOME, and the exact project tree including its Git repository, then restores them into a fresh dedicated runtime. It is not a general runtime backup command and fails closed for a shared runtime.
 

package/dist/cli/hook-ingress.js

@@ -26,7 +26,7 @@ export async function runHookIngress(args) {
         const payload = parseJsonObject(stdin || "{}", "native hook stdin");
         const command = lifecycleCommandFromPayload(payload);
         const analysis = command ? parseLifecycleCommand(command) : { kind: "none", unresolved: false };
-        if (event !== "PreToolUse" || !command || (analysis.kind === "none" && !analysis.unresolved && !continuationCommand(command))) {
+        if (event !== "PreToolUse" || !command || (analysis.kind === "none" && (!("participation" in analysis) || !["lifecycle", "auxiliary"].includes(analysis.participation)) && !continuationCommand(command))) {
             process.stdout.write("{}\n");
             return 0;
         }