@deksden-com/dd-flow-cli 0.9.0-beta.123 → 0.9.0-beta.127

package/dist/services/engines.js

@@ -82,7 +82,7 @@ export function installCurrentEngine(context, input = {}) {
             packageVersion: build.version,
             integrityChecksum: stagedChecksum
         }) : null;
-        if (duplicate) {
+        if (duplicate && manifestDiagnostics(duplicate, { checkEntrypoint: false }).length === 0) {
             fs.rmSync(tmp, { recursive: true, force: true });
             return {
                 ok: true,
@@ -141,7 +141,7 @@ export function doctorEngines(context, input = {}) {
     const installed = readInstalledManifests(root);
     const checks = installed.map(manifest => {
         const diagnostics = manifestDiagnostics(manifest);
-        return { engine: manifestSummary(manifest, diagnostics), status: diagnostics.length ? "corrupt" : "ok", diagnostics };
+        return { engine: manifestSummary(manifest, diagnostics), status: diagnostics.includes("entrypoint_probe_unavailable") ? "unverified" : diagnostics.length ? "corrupt" : "ok", diagnostics };
     });
     const classification = input.classification ?? classifyCliOperation(["engine", "doctor"], input.env ?? context.env);
     const selection = selectEngine(context, input, {}, classification);
@@ -223,6 +223,8 @@ export function bindRunEngine(context, input, prepared = prepareRunEngineBind(co
         encoding: "utf8",
         timeout: 30_000
     });
+    if (probe.error || probe.signal)
+        throw new AppError("run_engine_probe_unavailable", "Selected engine observation could not complete; compatibility is unknown", 1, { run_id: located.run_id, cause: probe.error?.message, signal: probe.signal });
     if (probe.status !== 0) {
         throw new AppError("run_engine_probe_failed", "Selected engine cannot read the RUN authority", 1, {
             run_id: located.run_id,
@@ -291,6 +293,8 @@ export function upgradeForkedRunEngine(context, input) {
         env: { ...process.env, ...context.env, DD_FLOW_HOME: context.ddFlowHome, DD_FLOW_ENGINE_MODE: "1", DD_FLOW_ENGINE_HOME: manifest.snapshot_root },
         encoding: "utf8", timeout: 30_000
     });
+    if (probe.error || probe.signal)
+        throw new AppError("fork_engine_probe_unavailable", "Selected engine observation could not complete; compatibility is unknown", 1, { run_id: located.run_id, cause: probe.error?.message, signal: probe.signal });
     if (probe.status !== 0)
         throw new AppError("fork_engine_probe_failed", "Selected engine cannot read the forked RUN", 1, { run_id: located.run_id, engine: manifestSummary(manifest), stderr: probe.stderr.slice(0, 2000) });
     const binding = { schema_id: runEngineBindingSchemaId, run_id: located.run_id, project_root: projectRoot, bound_at: context.now(), source: "fork_upgrade", reason: requiredText(input.reason, "reason"), engine: requested, probe: { status: "passed", command: `dd-flow ${probeArgs.join(" ")}` } };
@@ -429,7 +433,11 @@ export function selectEngine(context, input, options = {}, classification = inpu
     const requiredRange = stringValue(compatibility?.engine?.version_range) ?? (classification.mode === "mb_upgrade" ? null : `>=${build.version} <9999.0.0`);
     const recommended = stringValue(compatibility?.engine?.recommended_version) ?? build.version;
     const installHintTemplate = stringValue(compatibility?.engine?.old_engine_install_hint) ?? `npx ${packageName}@<version> engine install`;
-    const manifests = readInstalledManifests(engineStoreRoot(context.ddFlowHome))
+    // An engine-mode caller already executes this module's build. Another
+    // installed engine cannot establish compatibility for its current writes.
+    // Keep full snapshot validation in routing/binding, not lease maintenance.
+    const executingCurrent = options.allowCurrentInProcess && isEngineMode(input.env ?? process.env);
+    const manifests = executingCurrent ? [] : readInstalledManifests(engineStoreRoot(context.ddFlowHome))
         .filter((manifest) => manifest.package_name === packageName)
         .filter((manifest) => requiredRange !== null && satisfiesRange(manifest.package_version, requiredRange))
         .filter((manifest) => manifestHealthy(manifest))
@@ -447,7 +455,7 @@ export function selectEngine(context, input, options = {}, classification = inpu
         requiredRange !== null &&
         packageName === build.package_name &&
         satisfiesRange(build.version, requiredRange)
-        ? currentBuildManifest(context, build)
+        ? currentBuildManifest(context, build, options.verifyCurrentContent !== false)
         : null);
     const diagnostics = [
         ...targetBlockers,
@@ -465,9 +473,38 @@ export function selectEngine(context, input, options = {}, classification = inpu
         diagnostics
     };
 }
-function currentBuildManifest(context, build) {
+function currentBuildManifest(context, build, verifyContent) {
     const packageRoot = findPackageRoot(path.dirname(sourceFile)) ?? process.cwd();
-    return buildManifest(context, build.package_name, build.version, packageRoot, packageRoot, packageRoot);
+    const manifestFile = path.join(packageRoot, "engine.json");
+    const installedLayout = path.basename(path.dirname(path.dirname(packageRoot))) === "engines"
+        && path.basename(path.dirname(packageRoot)) === path.basename(path.dirname(engineVersionRoot(context.ddFlowHome, build.package_name, build.version)));
+    if (fs.existsSync(manifestFile) || installedLayout) {
+        const installed = readManifest(manifestFile);
+        // Use the executing module's physical root, never an environment alias.
+        // A damaged installed manifest must not become a development fallback.
+        if (!installed || installed.package_name !== build.package_name || installed.package_version !== build.version
+            || installed.engine_version !== build.version || installed.engine_id !== "dd-flow-engine"
+            || typeof installed.snapshot_root !== "string" || !fs.existsSync(installed.snapshot_root)
+            || fs.realpathSync(installed.snapshot_root) !== fs.realpathSync(packageRoot)
+            || typeof installed.entrypoint !== "string" || installed.integrity?.source !== "package_snapshot"
+            || typeof installed.integrity?.checksum !== "string" || !/^[a-f0-9]{64}$/.test(installed.integrity.checksum)
+            || (installed.schema_registry && (!Array.isArray(installed.schema_registry.entries)
+                || installed.schema_registry.entries.some(entry => !entry || typeof entry.path !== "string"
+                    || typeof entry.id !== "string" || typeof entry.name !== "string" || !/^[a-f0-9]{64}$/.test(entry.checksum ?? ""))))) {
+            throw new AppError("unhealthy_engine", "Executing engine snapshot manifest does not match its build", 1, { manifest: manifestFile });
+        }
+        const diagnostics = manifestDiagnostics(installed, { checkEntrypoint: false, verifyContent });
+        if (diagnostics.length)
+            throw new AppError("unhealthy_engine", "Executing engine snapshot is unhealthy", 1, { manifest: manifestFile, diagnostics });
+        return installed;
+    }
+    // Only an unmaterialized package has no snapshot proof. Canon and
+    // package-manager aliases are expected in development checkouts.
+    const manifest = buildManifest(context, build.package_name, build.version, packageRoot, packageRoot, packageRoot, null);
+    // An ephemeral routing choice has no snapshot proof. Hash bytes only when
+    // materializing/validating an installed snapshot, never on every CLI call.
+    manifest.integrity.mode = "degraded_local_development";
+    return manifest;
 }
 export function compatibilityContexts(context, input = {}) {
     const env = input.env ?? process.env;
@@ -614,7 +651,7 @@ function option(parsed, key) {
 function positional(parsed, index) {
     return parsed.positional[index] ?? null;
 }
-function buildManifest(context, packageName, version, packageRoot, snapshotRoot, checksumRoot) {
+function buildManifest(context, packageName, version, packageRoot, snapshotRoot, checksumRoot, checksum = engineSnapshotChecksum(checksumRoot)) {
     return {
         schema_id: engineManifestSchemaId,
         package_name: packageName,
@@ -635,7 +672,7 @@ function buildManifest(context, packageName, version, packageRoot, snapshotRoot,
         schema_registry: buildSchemaRegistry(checksumRoot),
         integrity: {
             source: "package_snapshot",
-            checksum: engineSnapshotChecksum(checksumRoot),
+            checksum,
             mode: "full_content"
         }
     };
@@ -703,19 +740,23 @@ export function prepareForkEngine(engineVersion, integrityChecksum) {
         throw new AppError("harness_runtime_unbuilt", "Build the CLI before preparing a fork", 1);
     const files = packageSnapshotFiles(packageRoot);
     if (integrityChecksum !== undefined) {
-        const checksum = crypto.createHash("sha256");
-        for (const [relative, source] of [...files].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
-            if (path.basename(relative) === "engine.json")
-                continue;
-            checksum.update(relative);
-            checksum.update("\0");
-            checksum.update(fs.readFileSync(source));
-            checksum.update("\0");
-        }
-        if (checksum.digest("hex") !== integrityChecksum)
+        const checksum = snapshotFilesChecksum(files);
+        if (checksum !== integrityChecksum)
             throw new AppError("fork_engine_unavailable", "Requested engine checksum differs from the invoking CLI artifact", 2, { requested: integrityChecksum });
     }
 }
+function snapshotFilesChecksum(files) {
+    const checksum = crypto.createHash("sha256");
+    for (const [relative, source] of [...files].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
+        if (path.basename(relative) === "engine.json")
+            continue;
+        checksum.update(relative);
+        checksum.update("\0");
+        checksum.update(fs.readFileSync(source));
+        checksum.update("\0");
+    }
+    return checksum.digest("hex");
+}
 function readProductionDependencies(packageRoot) {
     try {
         const manifest = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8"));
@@ -795,6 +836,9 @@ function readInstalledManifests(root) {
         if (!fs.statSync(packageRoot).isDirectory())
             continue;
         for (const versionDir of fs.readdirSync(packageRoot)) {
+            // Failed staging, activation backups and locks are not installations.
+            if (versionDir.startsWith(".") || /\.previous-\d+-\d+$/.test(versionDir) || versionDir.endsWith(".lock"))
+                continue;
             const manifest = readManifest(path.join(packageRoot, versionDir, "engine.json"));
             if (manifest)
                 manifests.push(manifest);
@@ -847,7 +891,7 @@ function manifestDiagnostics(manifest, options = {}) {
     if (!manifest.integrity || manifest.integrity.mode !== "full_content" || !manifest.integrity.checksum) {
         diagnostics.push("content_checksum_missing");
     }
-    else if (fs.existsSync(snapshotRoot)) {
+    else if (options.verifyContent !== false && fs.existsSync(snapshotRoot)) {
         try {
             if (engineSnapshotChecksum(snapshotRoot) !== manifest.integrity.checksum)
                 diagnostics.push("content_checksum_mismatch");
@@ -861,6 +905,8 @@ function manifestDiagnostics(manifest, options = {}) {
             const schemaPath = safeResolveSnapshotPath(manifest, entry.path);
             if (!schemaPath || !fs.existsSync(schemaPath))
                 diagnostics.push(`schema_registry_missing:${entry.name}`);
+            else if (options.verifyContent === false)
+                continue;
             else if (fileChecksum(schemaPath) !== entry.checksum)
                 diagnostics.push(`schema_registry_checksum_mismatch:${entry.name}`);
             else {
@@ -887,7 +933,9 @@ function manifestDiagnostics(manifest, options = {}) {
             stdio: ["ignore", "pipe", "pipe"],
             timeout: 15_000
         });
-        if (health.status !== 0)
+        if (health.error || health.signal)
+            diagnostics.push("entrypoint_probe_unavailable");
+        else if (health.status !== 0)
             diagnostics.push("entrypoint_dependency_load_failed");
     }
     return diagnostics;
@@ -1072,6 +1120,8 @@ function collectFiles(root, current, files) {
         if (entry.name === "engine.json")
             continue;
         const full = path.join(current, entry.name);
+        if (entry.isSymbolicLink())
+            throw new AppError("engine_integrity_symlink", "Pinned engine snapshot contains an unhashed symbolic link", 1, { path: path.relative(root, full) });
         if (entry.isDirectory())
             collectFiles(root, full, files);
         else if (entry.isFile())

package/dist/services/eval-snapshots.js

@@ -8,10 +8,11 @@ import { beginSnapshotImport, completeSnapshotImport } from "../storage/import-g
 import { foreignKeyTransaction } from "../storage/foreign-key-transaction.js";
 import { createContext } from "../runtime/context.js";
 import { AppError } from "../shared/errors.js";
-import { resolveProjectRoot, runtimeProtocolDir, runtimeRunDir } from "../storage/paths.js";
+import { canonicalPath, resolveProjectRoot, runtimeProtocolDir, runtimeRunDir } from "../storage/paths.js";
 import { registerProject, requireProjectByRoot } from "./projects.js";
 import { freezeRunExecutionRouting, getFlowRunStatus, importFlowRunExecutionProfile, startFlowRun } from "./runs.js";
 import { loadExecutionRoutingInput, resolveExecutionPolicy } from "./execution-policy.js";
+import { validateRunOperationalDecision } from "./vnext-execution-profile.js";
 import { readVnextFlowDefinition } from "./vnext-specify.js";
 import { captureRecoveryDatabase, readRecoveryResourceEvidence } from "./recovery-snapshot-database.js";
 import { resourceHome } from "./managed-processes.js";
@@ -19,6 +20,7 @@ import { codexHomeSharedEntries } from "./hooks.js";
 import { prepareOutputFile } from "../cli/input-preparation.js";
 import { localEnvironmentAllowed, projectServicePathFilter } from "./workspace-files.js";
 import { cleanupScopeWriters } from "./scope-writer-cleanup.js";
+import { isObservationOperation, nativeInventoryVersion, retainedDaemonOperations } from "./run-control.js";
 /** Capture the only flow boundary which exists before `stage start --bootstrap` creates a RUN. */
 export function prepareEvalBootstrapSnapshot(context, input) {
     const projectRoot = resolveProjectRoot(input.projectRoot);
@@ -75,7 +77,7 @@ function bootstrapSourceVersion(projectRoot) {
         treeHash(projectRoot, true),
         treeModesHash(projectRoot, true),
         git(projectRoot, ["symbolic-ref", "--quiet", "HEAD"]),
-        gitBytes(projectRoot, ["show-ref", "--head"]).toString("base64"),
+        git(projectRoot, ["rev-parse", "HEAD"]),
         indexEntries(projectRoot).toString("base64")
     ]);
 }
@@ -108,7 +110,7 @@ export function createEvalRunSnapshot(context, input) {
     try {
         input.boundary?.verify();
         sourceVersion = input.boundary ? snapshotSourceVersion(context, input) : null;
-        const result = captureEvalRunSnapshot(context, { ...input, output: temporary });
+        const result = captureEvalRunSnapshot(context, { ...input, ...(sourceVersion ? { journalCuts: sourceVersion.journals, observationCuts: sourceVersion.observations } : {}), output: temporary });
         if (input.boundary && sourceVersion) {
             Object.assign(result, { consistency: "controller_boundary_writer_barrier@1", boundary_capture: { controller_id: input.boundary.controllerId, operation_id: input.boundary.operationId, boundary_key: input.boundary.boundaryKey, source_sha256: sourceVersion.sha256, observation: input.boundary.observation } });
             writeJson(path.join(temporary, "snapshot.json"), Object.fromEntries(Object.entries(result).filter(([key]) => key !== "ok" && key !== "snapshot")));
@@ -126,7 +128,7 @@ export function createEvalRunSnapshot(context, input) {
             if (sourceVersion) {
                 let after;
                 try {
-                    after = snapshotSourceVersion(context, input, sourceVersion.databases);
+                    after = snapshotSourceVersion(context, input, sourceVersion.databases, sourceVersion.journals);
                 }
                 catch (error) {
                     if (error.code !== "ENOENT")
@@ -145,6 +147,13 @@ export function createEvalRunSnapshot(context, input) {
     }
     catch (error) {
         fs.rmSync(temporary, { recursive: true, force: true });
+        // Native journal publication creates its directory before requested.json.
+        // Retry a gap during any capture phase, without classifying an incomplete
+        // request as read-only. Persistent missing inputs still exhaust the budget.
+        if (input.boundary && error.code === "ENOENT") {
+            const missing = error.path;
+            throw new AppError("snapshot_source_changed", "Snapshot source was not fully published during boundary capture", 1, { components: [missing && path.isAbsolute(missing) && isInside(context.ddFlowHome, missing) ? `runtime/${path.relative(context.ddFlowHome, missing)}` : "source_path_disappeared"] });
+        }
         throw error;
     }
     finally {
@@ -204,17 +213,22 @@ function captureEvalRunSnapshot(context, input) {
     fs.mkdirSync(output, { recursive: true, mode: 0o700 });
     const resourceDatabase = path.join(context.ddFlowHome, "runtime.sqlite");
     const databaseFiles = [context.db.path, resourceDatabase].flatMap(file => [file, `${file}-wal`, `${file}-shm`]);
-    const codexExclusions = codexHomeSnapshotExclusions(context, project.id, input.runId);
+    const codexExclusions = [...codexHomeSnapshotExclusions(context, project.id, input.runId), ...input.journalCuts?.keys() ?? [], ...input.observationCuts?.keys() ?? []];
     if (recovery) {
         if (typeof status.run.run_root !== "string" || !isInside(physicalPath(context.ddFlowHome), physicalPath(status.run.run_root)) || samePath(physicalPath(context.ddFlowHome), physicalPath(status.run.run_root)))
             throw new AppError("snapshot_run_scope_invalid", "Recovery requires a RUN artifact root within its runtime", 1);
         for (const source of new Set([status.run.run_root, runtimeRunDir(context.ddFlowHome, project.id, input.runId)])) {
             if (fs.existsSync(source))
-                copyRuntimeTree(source, path.join(output, "runtime", path.relative(context.ddFlowHome, source)), true, codexExclusions);
+                copyRuntimeTree(source, path.join(output, "runtime", path.relative(context.ddFlowHome, source)), true, codexExclusions, [], input.observationCuts);
         }
     }
     else
-        copyRuntimeTree(context.ddFlowHome, path.join(output, "runtime"), false, [...databaseFiles, ...codexExclusions], grokProviderHomes(context.ddFlowHome));
+        copyRuntimeTree(context.ddFlowHome, path.join(output, "runtime"), false, [...databaseFiles, ...codexExclusions], grokProviderHomes(context.ddFlowHome), input.observationCuts);
+    for (const [file, cut] of input.journalCuts ?? []) {
+        const target = path.join(output, "runtime", path.relative(context.ddFlowHome, file));
+        fs.mkdirSync(path.dirname(target), { recursive: true });
+        fs.writeFileSync(target, cut.payload, { mode: cut.mode });
+    }
     // VACUUM INTO is a consistent SQLite read snapshot, including committed WAL
     // pages. Copying the live database and its WAL separately is not atomic.
     const databaseCopy = path.join(output, "runtime", path.relative(context.ddFlowHome, context.db.path));
@@ -275,6 +289,8 @@ function captureEvalRunSnapshot(context, input) {
         project_sha256: treeHash(path.join(output, "project")),
         project_payload_policy: "service-files@1",
         ...(!recovery ? { runtime_payload_policy: "flow-evidence@1" } : {}),
+        ...(input.journalCuts ? { journal_cuts: [...input.journalCuts].map(([file, cut]) => ({ path: path.relative(context.ddFlowHome, file), bytes: cut.payload.length, sha256: cut.sha256 })) } : {}),
+        ...(input.observationCuts ? { observation_cuts: [...input.observationCuts].map(([file, receipt]) => ({ path: path.relative(context.ddFlowHome, file), receipt })) } : {}),
         project_git: projectGit,
         workspace,
         payload_modes: { project: treeModesHash(path.join(output, "project")), runtime: treeModesHash(path.join(output, "runtime")), ...(workspace.kind === "git_worktree" ? { workspace: treeModesHash(path.join(output, "workspace")) } : {}) },
@@ -325,6 +341,8 @@ export function prepareEvalRunRestore(context, input, preparedManifest) {
     const recovery = manifest.purpose === "recovery";
     if (recovery && input.executionRoutingFile !== undefined)
         throw new AppError("snapshot_recovery_policy_frozen", "Recovery must retain its frozen execution policy", 2);
+    if (recovery && input.operationalDecisionFile !== undefined)
+        throw new AppError("snapshot_recovery_policy_frozen", "Recovery cannot replace its accepted operational decision", 2);
     if (recovery && input.recoveryId !== manifest.recovery_id)
         throw new AppError("snapshot_recovery_requires_explicit_restore", "Recovery snapshots require their explicit --recovery-id", 1, { snapshot });
     if (!recovery && input.recoveryId)
@@ -340,7 +358,9 @@ export function prepareEvalRunRestore(context, input, preparedManifest) {
     const sourceRuntime = path.join(snapshot, "runtime");
     const sourceProject = path.join(snapshot, "project");
     const routingInput = input.executionRoutingFile !== undefined ? loadExecutionRoutingInput(input.executionRoutingFile) : undefined;
-    let selectedProfile;
+    const acceptedOperational = recovery ? undefined : prepareSnapshotOperationalDecision({ snapshot, runId: manifest.run_id, projectRoot, now: context.now(), ...(input.operationalDecisionFile ? { file: input.operationalDecisionFile } : {}) });
+    const operationalDecisionBytes = acceptedOperational?.bytes;
+    let selectedProfile = acceptedOperational?.profile;
     if (routingInput) {
         // Resolve selected profiles before replacing the caller's fresh runtime.
         const sourceDb = new DatabaseSync(path.join(sourceRuntime, "db.sqlite"), { readOnly: true });
@@ -350,7 +370,7 @@ export function prepareEvalRunRestore(context, input, preparedManifest) {
             if (!index?.execution_profile || !["vnext_specify", "vnext_protocolize"].includes(index.flow_kind))
                 throw new AppError("execution_profile_not_frozen", "Stage-entry routing requires a vNext execution snapshot", 1);
             assertStageEntry(index.stage_runs, manifest.stage_entry);
-            selectedProfile = freezeRunExecutionRouting(context.ddFlowHome, index.execution_profile, routingInput);
+            selectedProfile = freezeRunExecutionRouting(context.ddFlowHome, selectedProfile ?? index.execution_profile, routingInput);
             for (const row of sourceDb.prepare("SELECT payload_json FROM works WHERE run_id = ? AND status = 'created'").all(manifest.run_id)) {
                 const payload = row.payload_json ? JSON.parse(row.payload_json) : null;
                 if (payload?.execution_override !== undefined)
@@ -368,7 +388,34 @@ export function prepareEvalRunRestore(context, input, preparedManifest) {
             sourceDb.close();
         }
     }
-    return { snapshot, manifest, recovery, projectRoot, sourceRuntime, sourceProject, routingInput, selectedProfile };
+    return { snapshot, manifest, recovery, projectRoot, sourceRuntime, sourceProject, routingInput, selectedProfile, operationalDecisionBytes };
+}
+/** Shared no-effect scope preparation for direct restore and run fork. */
+export function prepareSnapshotOperationalDecision(input) {
+    const sourceDb = new DatabaseSync(path.join(input.snapshot, "runtime", "db.sqlite"), { readOnly: true });
+    try {
+        const row = sourceDb.prepare("SELECT index_json FROM runs WHERE id = ?").get(input.runId);
+        const profile = row ? JSON.parse(row.index_json).execution_profile : undefined;
+        if (profile?.operational_decision && !input.file)
+            throw new AppError("snapshot_operational_acceptance_required", "A new stage-entry execution needs its own accepted operational decision", 2);
+        if (!input.file)
+            return undefined;
+        if (!profile)
+            throw new AppError("execution_profile_not_frozen", "Operational stage-entry decision needs a frozen vNext profile", 2);
+        const bytes = fs.readFileSync(input.file);
+        const decision = validateRunOperationalDecision(JSON.parse(bytes.toString("utf8")), profile.settings);
+        if (canonicalPath(decision.scope.project_root, false) !== canonicalPath(input.projectRoot, false))
+            throw new AppError("operational_decision_scope_mismatch", "Imported decision must name the new project root", 2);
+        const sourceProject = path.join(input.snapshot, "project"), policyFile = path.resolve(sourceProject, decision.policy.path);
+        if (!isInside(sourceProject, policyFile) || !fs.existsSync(policyFile) || !isInside(fs.realpathSync(sourceProject), fs.realpathSync(policyFile)) || fileHash(policyFile) !== decision.policy.sha256)
+            throw new AppError("operational_decision_policy_changed", "Imported decision policy must match the owned frozen project source", 2);
+        if (decision.exception?.expires_at && Date.parse(decision.exception.expires_at) <= Date.parse(input.now))
+            throw new AppError("operational_decision_expired", "Imported operational decision has explicitly expired", 2);
+        return { profile: { ...profile, operational_decision: decision }, bytes };
+    }
+    finally {
+        sourceDb.close();
+    }
 }
 function assertRunRestoreTargets(context, input, snapshot, projectRoot, manifest) {
     assertRestoreTargetSeparation(snapshot, [projectRoot, context.ddFlowHome]);
@@ -392,6 +439,8 @@ function assertRunRestoreTargets(context, input, snapshot, projectRoot, manifest
 }
 export function restoreEvalRunSnapshot(context, input, prepared = prepareEvalRunRestore(context, input), prearmedImportId) {
     const { snapshot, manifest, recovery, projectRoot, sourceRuntime, sourceProject, routingInput, selectedProfile } = prepared;
+    if (input.operationalDecisionFile && (!prepared.operationalDecisionBytes || !fs.readFileSync(input.operationalDecisionFile).equals(prepared.operationalDecisionBytes)))
+        throw new AppError("operational_decision_changed", "Accepted operational decision changed after import preparation", 2);
     assertRunRestoreTargets(context, input, snapshot, projectRoot, manifest);
     const sourceManifestSha256 = fileHash(path.join(snapshot, "snapshot.json"));
     const importId = prearmedImportId ?? beginSnapshotImport({ home: context.ddFlowHome, projectRoot,
@@ -414,18 +463,36 @@ export function restoreEvalRunSnapshot(context, input, prepared = prepareEvalRun
         const publicationRun = restored.db.get("SELECT project_id, run_root FROM runs WHERE id = ?", [manifest.run_id]);
         if (!originalRunRoot || !publicationRun?.run_root || !isInside(manifest.dd_flow_home, originalRunRoot) || !isInside(context.ddFlowHome, publicationRun.run_root))
             throw new AppError("snapshot_invalid", "Restored publication roots are not bound to their runtime", 1);
-        restored.db.run("INSERT INTO audit_events (project_id, event_type, forced, payload_json, created_at) VALUES (?, 'flow_run.publication_relocation', 0, ?, ?)", [publicationRun.project_id, JSON.stringify({ run_id: manifest.run_id, from: originalRunRoot, to: publicationRun.run_root, source_manifest_sha256: sourceManifestSha256, import_id: importId }), restored.now()]);
+        const pathMapping = [{ from: manifest.dd_flow_home, to: context.ddFlowHome }, { from: sourceWorkspaceRoot(manifest), to: workspaceRoot }, { from: manifest.project_root, to: projectRoot }];
+        restored.db.run("INSERT INTO audit_events (project_id, event_type, forced, payload_json, created_at) VALUES (?, 'flow_run.publication_relocation', 0, ?, ?)", [publicationRun.project_id, JSON.stringify({ run_id: manifest.run_id, from: originalRunRoot, to: publicationRun.run_root, source_manifest_sha256: sourceManifestSha256, import_id: importId, path_mapping: pathMapping }), restored.now()]);
         registerProject(restored, { root: projectRoot });
         requireProjectByRoot(restored, projectRoot);
-        if (selectedProfile && routingInput && runtimeLineage) {
+        if (selectedProfile && runtimeLineage) {
             const run = restored.db.get("SELECT run_root FROM runs WHERE id = ?", [manifest.run_id]);
-            const artifact = path.join(run.run_root, selectedProfile.routing_input.artifact);
-            if (fs.existsSync(artifact)) {
-                if (!fs.readFileSync(artifact).equals(routingInput.bytes))
-                    throw new AppError("snapshot_checksum_mismatch", "Existing routing input does not match its checksum", 1);
+            if (routingInput) {
+                const artifact = path.join(run.run_root, selectedProfile.routing_input.artifact);
+                if (fs.existsSync(artifact)) {
+                    if (!fs.readFileSync(artifact).equals(routingInput.bytes))
+                        throw new AppError("snapshot_checksum_mismatch", "Existing routing input does not match its checksum", 1);
+                }
+                else
+                    fs.writeFileSync(artifact, routingInput.bytes, { flag: "wx", mode: 0o600 });
+            }
+            if (input.operationalDecisionFile) {
+                if (!prepared.operationalDecisionBytes || !fs.readFileSync(input.operationalDecisionFile).equals(prepared.operationalDecisionBytes))
+                    throw new AppError("operational_decision_changed", "Accepted operational decision changed before import publication", 2);
+                const binding = { project_id: publicationRun.project_id, run_id: manifest.run_id, ...selectedProfile.operational_decision.scope };
+                const policyBytes = fs.readFileSync(path.resolve(projectRoot, selectedProfile.operational_decision.policy.path));
+                const policySource = { path: `operational-policy.${selectedProfile.operational_decision.policy.sha256}.source.md`, sha256: crypto.createHash("sha256").update(policyBytes).digest("hex") };
+                if (policySource.sha256 !== selectedProfile.operational_decision.policy.sha256)
+                    throw new AppError("operational_decision_policy_changed", "Imported policy changed before binding", 2);
+                if (!fs.existsSync(path.join(run.run_root, policySource.path)))
+                    fs.writeFileSync(path.join(run.run_root, policySource.path), policyBytes, { flag: "wx" });
+                const bytes = `${JSON.stringify({ schema_id: "dd-flow/run-operational-contract@1", binding, settings: { merge_delivery: selectedProfile.settings.merge_delivery, merge_cleanup: selectedProfile.settings.merge_cleanup }, decision: selectedProfile.operational_decision, policy_source: policySource }, null, 2)}\n`;
+                const artifact = `operational-contract.${crypto.createHash("sha256").update(bytes).digest("hex")}.json`;
+                fs.writeFileSync(path.join(run.run_root, artifact), bytes, { flag: "wx" });
+                selectedProfile.operational_contract = { path: artifact, sha256: crypto.createHash("sha256").update(bytes).digest("hex"), policy_source: policySource, binding };
             }
-            else
-                fs.writeFileSync(artifact, routingInput.bytes, { flag: "wx", mode: 0o600 });
             importFlowRunExecutionProfile(restored, { projectRoot, runId: manifest.run_id, stage: manifest.stage_entry, lineageFile: runtimeLineage, profile: selectedProfile });
         }
         const relocation = recovery ? {
@@ -637,13 +704,29 @@ function rewriteOperationalRouteReceipts(root, oldRoot, newRoot, oldWorkspace, n
     };
     visit(root);
 }
-function rewriteDatabaseColumn(context, table, column, oldRoot, newRoot, oldWorkspace, newWorkspace, oldHome, newHome) { for (const row of context.db.all(`SELECT rowid AS rid, ${column} AS value FROM ${table} WHERE ${column} IS NOT NULL`)) {
-    if (!row.value)
-        continue;
-    const value = column.endsWith("_json") || column === "index_json" ? JSON.stringify(rebaseStructuredValue(JSON.parse(row.value), oldRoot, newRoot, oldWorkspace, newWorkspace, oldHome, newHome)) : rebasePathString(row.value, oldRoot, newRoot, oldWorkspace, newWorkspace, oldHome, newHome);
-    if (value !== row.value)
-        context.db.run(`UPDATE ${table} SET ${column} = ? WHERE rowid = ?`, [value, row.rid]);
-} }
+function rewriteDatabaseColumn(context, table, column, oldRoot, newRoot, oldWorkspace, newWorkspace, oldHome, newHome) {
+    for (const row of context.db.all(`SELECT rowid AS rid, ${column} AS value FROM ${table} WHERE ${column} IS NOT NULL`)) {
+        if (!row.value)
+            continue;
+        let value;
+        if (column.endsWith("_json") || column === "index_json") {
+            const original = JSON.parse(row.value);
+            const mapped = rebaseStructuredValue(original, oldRoot, newRoot, oldWorkspace, newWorkspace, oldHome, newHome);
+            if (table === "runs" && column === "index_json" && original.execution_profile) {
+                // Accepted source/binding are logical provenance, not mutable physical locators.
+                if (original.execution_profile.operational_decision)
+                    mapped.execution_profile.operational_decision = original.execution_profile.operational_decision;
+                if (original.execution_profile.operational_contract)
+                    mapped.execution_profile.operational_contract = original.execution_profile.operational_contract;
+            }
+            value = JSON.stringify(mapped);
+        }
+        else
+            value = rebasePathString(row.value, oldRoot, newRoot, oldWorkspace, newWorkspace, oldHome, newHome);
+        if (value !== row.value)
+            context.db.run(`UPDATE ${table} SET ${column} = ? WHERE rowid = ?`, [value, row.rid]);
+    }
+}
 function rebaseStructuredValue(value, oldRoot, newRoot, oldWorkspace, newWorkspace, oldHome, newHome) { if (typeof value === "string")
     return rebasePathString(value, oldRoot, newRoot, oldWorkspace, newWorkspace, oldHome, newHome); if (Array.isArray(value))
     return value.map((item) => rebaseStructuredValue(item, oldRoot, newRoot, oldWorkspace, newWorkspace, oldHome, newHome)); if (value && typeof value === "object")
@@ -720,7 +803,7 @@ function prepareSnapshotProjectGit(projectRoot) {
 function snapshotProjectGit(projectRoot, output) {
     const { branch, head } = prepareSnapshotProjectGit(projectRoot);
     const bundle = path.join(output, "project.bundle");
-    runGit(projectRoot, ["bundle", "create", bundle, "--all"]);
+    runGit(projectRoot, ["bundle", "create", bundle, `refs/heads/${branch}`]);
     return { branch, head, bundle_sha256: fileHash(bundle), ...snapshotIndex(projectRoot, output, "project") };
 }
 function restoreProjectGit(snapshot, source, projectRoot) {
@@ -910,6 +993,17 @@ function grokProviderHomes(runtimeRoot) {
     visit(runtimeRoot);
     return homes;
 }
+function nativeDaemonFile(file) {
+    if (!fs.lstatSync(file, { throwIfNoEntry: false })?.isFile())
+        return false;
+    try {
+        const state = JSON.parse(fs.readFileSync(file, "utf8"));
+        return typeof state.daemon_id === "string" && /^dd-(codex|zcode|grok|agy|opencode|droid)\/daemon-state@1$/.test(String(state.schema_id));
+    }
+    catch {
+        return false;
+    } // Unrecognized files retain full-byte protection.
+}
 function sqliteFile(file) {
     if (!fs.existsSync(file) || !fs.statSync(file).isFile())
         return false;
@@ -943,7 +1037,7 @@ function sqliteValue(value) {
  * This intentionally applies to the small set of managed SQLite files, not
  * to arbitrary provider databases.
  */
-function sqliteSemanticFingerprint(db, resourceRegistry = false) {
+function sqliteSemanticFingerprint(db) {
     db.exec("PRAGMA busy_timeout = 4000");
     db.exec("BEGIN");
     try {
@@ -953,9 +1047,8 @@ function sqliteSemanticFingerprint(db, resourceRegistry = false) {
                 .sort((left, right) => Number(left.cid ?? 0) - Number(right.cid ?? 0))
                 .map(column => ({ name: String(column.name ?? ""), type: String(column.type ?? ""), notnull: Number(column.notnull ?? 0), default: sqliteValue(column.dflt_value ?? null), pk: Number(column.pk ?? 0) }));
             const names = columns.map(column => column.name);
-            const stableNames = resourceRegistry && row.name === "managed_processes" ? names.filter(name => name !== "lease_expires_at" && name !== "updated_at") : names;
             const rows = db.prepare(`SELECT * FROM ${sqliteIdentifier(row.name)}`).all()
-                .map(record => stableNames.map(name => [name, sqliteValue(record[name])]))
+                .map(record => names.map(name => [name, sqliteValue(record[name])]))
                 .sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));
             return { name: row.name, columns, rows };
         });
@@ -983,8 +1076,9 @@ function runtimeSnapshotKind(file, excluded, providerHomes = []) {
 /** Productive writers are fenced separately. Compare exactly the copied
  * source set; SQLite serialization includes committed WAL pages without
  * mistaking a physical checkpoint for new logical content. */
-function snapshotSourceVersion(context, input, retainedDatabases) {
+function snapshotSourceVersion(context, input, retainedDatabases, retainedJournals) {
     const databases = retainedDatabases ?? new Map();
+    const journals = retainedJournals ?? new Map();
     const projectRoot = resolveProjectRoot(input.projectRoot);
     const project = requireProjectByRoot(context, projectRoot);
     const run = context.db.get("SELECT workspace_root FROM runs WHERE project_id = ? AND id = ?", [project.id, input.runId]);
@@ -993,34 +1087,62 @@ function snapshotSourceVersion(context, input, retainedDatabases) {
     const entries = new Map();
     const excluded = codexHomeSnapshotExclusions(context, project.id, input.runId);
     const providerHomes = input.recoveryId === undefined ? grokProviderHomes(context.ddFlowHome) : [];
+    const observations = new Map();
+    const operationRoots = new Set();
     const visit = (directory) => {
+        const daemon = path.join(directory, "daemon.json");
+        const native = nativeDaemonFile(daemon);
+        if (native) {
+            operationRoots.add(path.join(directory, "operations"));
+            for (const operation of retainedDaemonOperations(directory))
+                if (isObservationOperation(operation.operation))
+                    observations.set(path.join(directory, "operations", crypto.createHash("sha256").update(String(operation.operation_id)).digest("hex")), operation);
+        }
         for (const entry of fs.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
             const file = path.join(directory, entry.name);
+            // These diagnostic cuts are retained, but their creation cannot
+            // invalidate a productive boundary. Unknown operations remain protected.
+            if (observations.has(file))
+                continue;
             const kind = runtimeSnapshotKind(file, excluded, providerHomes);
             if (kind === "excluded" || kind === "sidecar")
                 continue;
             const key = `runtime/${path.relative(context.ddFlowHome, file)}`;
             const stat = fs.lstatSync(file);
             if (stat.isDirectory()) {
-                entries.set(key, "directory");
+                if (!operationRoots.has(file))
+                    entries.set(key, "directory");
                 visit(file);
             }
             else if (stat.isSymbolicLink())
                 entries.set(key, `link:${fs.readlinkSync(file)}`);
+            else if (native && file === daemon)
+                entries.set(key, `daemon:${nativeInventoryVersion(directory)}:${stat.mode & 0o111}`);
             else if (kind === "sqlite") {
+                // Their productive identities are checked by boundary.verify(). A
+                // consistent backup is evidence, not a demand for global DB silence.
+                if (file === context.db.path || file === path.join(resourceHome(context), "runtime.sqlite")) {
+                    entries.set(key, `managed-sqlite:${stat.mode & 0o111}`);
+                    continue;
+                }
                 let db = databases.get(file);
                 if (!db) {
                     db = new DatabaseSync(file, { readOnly: true });
                     databases.set(file, db);
                 }
-                // Resource heartbeats are copied consistently but are not productive
-                // RUN writers; owner identity is fenced by boundary.verify().
-                if (file === path.join(resourceHome(context), "runtime.sqlite")) {
-                    entries.set(key, `resource-sqlite:${sqliteSemanticFingerprint(db, true)}:${stat.mode & 0o111}`);
-                    continue;
-                }
                 entries.set(key, `sqlite:${sqliteSemanticFingerprint(db)}:${stat.mode & 0o111}`);
             }
+            else if (stat.isFile() && ["adapter.events.jsonl", "events.jsonl", "model-observations.jsonl", "timeline.jsonl", "daemon.log", "controller.log"].includes(path.basename(file))) {
+                const bytes = fs.readFileSync(file);
+                let cut = journals.get(file);
+                if (!cut && !retainedJournals) {
+                    const payload = bytes.subarray(0, bytes.lastIndexOf(10) + 1);
+                    cut = { payload, dev: stat.dev, ino: stat.ino, mode: stat.mode, sha256: crypto.createHash("sha256").update(payload).digest("hex") };
+                    journals.set(file, cut);
+                }
+                const valid = cut && cut.dev === stat.dev && cut.ino === stat.ino && bytes.length >= cut.payload.length && bytes.subarray(0, cut.payload.length).equals(cut.payload);
+                entries.set(key, valid && cut ? `journal:${cut.sha256}:${cut.payload.length}:${stat.mode & 0o111}` : "journal:changed");
+            }
             else if (stat.isFile())
                 entries.set(key, `file:${crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex")}:${stat.mode & 0o111}`);
         }
@@ -1029,9 +1151,9 @@ function snapshotSourceVersion(context, input, retainedDatabases) {
         visit(context.ddFlowHome);
         for (const root of new Set([projectRoot, run.workspace_root]))
             entries.set(`source/${root}`, JSON.stringify([
-                treeHash(root, true), treeModesHash(root, true), git(root, ["symbolic-ref", "--quiet", "HEAD"]), gitBytes(root, ["show-ref", "--head"]).toString("base64"), indexEntries(root).toString("base64")
+                treeHash(root, true), treeModesHash(root, true), git(root, ["symbolic-ref", "--quiet", "HEAD"]), git(root, ["rev-parse", "HEAD"]), indexEntries(root).toString("base64")
             ]));
-        return { entries, databases, sha256: crypto.createHash("sha256").update(JSON.stringify([...entries].sort(([a], [b]) => a.localeCompare(b)))).digest("hex") };
+        return { entries, databases, journals, observations, sha256: crypto.createHash("sha256").update(JSON.stringify([...entries].sort(([a], [b]) => a.localeCompare(b)))).digest("hex") };
     }
     catch (error) {
         if (!retainedDatabases)
@@ -1083,7 +1205,7 @@ function codexHomeSnapshotExclusions(context, projectId, runId) {
     return excluded;
 }
 /** Copy a dedicated home or scoped recovery tree, preserving SQLite WAL commits. */
-function copyRuntimeTree(source, destination, scoped = true, excluded = [], providerHomes = []) {
+function copyRuntimeTree(source, destination, scoped = true, excluded = [], providerHomes = [], observationCuts) {
     if (fs.lstatSync(source).isSymbolicLink())
         throw new AppError("snapshot_runtime_symlink_outside_scope", "Recovery artifact roots must not be symbolic links", 1, { path: source });
     const root = physicalPath(source);
@@ -1094,6 +1216,23 @@ function copyRuntimeTree(source, destination, scoped = true, excluded = [], prov
     fs.cpSync(source, destination, {
         recursive: true, verbatimSymlinks: true,
         filter: file => {
+            if (observationCuts && path.basename(path.dirname(file)) === "operations" && fs.lstatSync(file).isDirectory() && nativeDaemonFile(path.join(path.dirname(path.dirname(file)), "daemon.json"))) {
+                let operations;
+                try {
+                    operations = retainedDaemonOperations(path.dirname(path.dirname(file)));
+                }
+                catch (error) {
+                    if (error.code !== "ENOENT")
+                        throw error;
+                    throw new AppError("snapshot_source_changed", "Native operation was not fully published during capture", 1, { components: ["native_operation_publication"] });
+                }
+                const operation = operations.find(row => crypto.createHash("sha256").update(String(row.operation_id)).digest("hex") === path.basename(file));
+                if (operation && isObservationOperation(operation.operation)) {
+                    if (!observationCuts.has(file))
+                        observationCuts.set(file, operation);
+                    return false;
+                }
+            }
             const kind = runtimeSnapshotKind(file, excluded, providerHomes);
             if (kind === "excluded" || kind === "sidecar")
                 return false;