@deksden-com/dd-flow-cli 0.9.0-beta.127 → 0.9.0-beta.133

package/dist/harness-runtime/lib/managed-daemon.mjs

@@ -75,9 +75,15 @@ export async function assertDaemonOwnership(stateDir, dispatch = {}, assertCurre
   const record = state.resource_process;
   if (owner.state_dir !== stateDir || !record?.id || !record.lease_token) throw Object.assign(new Error("owned daemon has no confirmed resource binding"), { code: "process_ownership_unknown" });
   scheduleDaemonProcessHeartbeat(state.config, record);
-  const admissionRenewal = createRenewalState();
+  const admissionRenewal = createRenewalState({ leaseExpiresAt: record.lease_expires_at });
   for (;;) {
     await gate();
+    // daemon.json is a snapshot, not the current authority. gate() verified
+    // the exact retained owner and its latest committed renewal above.
+    const retained = leases.get(leaseKey(state.config, record));
+    if (!retained || record.registration_sha256 && record.registration_sha256 !== retained.record.registration_sha256) throw Object.assign(new Error("Admission registration differs from confirmed owner"), { code: "process_maintenance_receipt_invalid" });
+    retainReceipt(record, retained.record);
+    if (!renewalConfirmed(admissionRenewal, performance.now(), record.lease_expires_at)) requireTimelyMaintenance(admissionRenewal, "admission", retained.record, record);
     admissionRenewal.uncertainSince ??= performance.now();
     let result;
     try { result = await runtimeProcess(state.config, "admission", { id: record.id, "lease-token": record.lease_token, owner: owner.owner_id, "state-dir": stateDir, "daemon-id": state.daemon_id ?? state.config?.daemonId, ...dispatch }, { timeoutMs: renewalRemaining(admissionRenewal) }); }
@@ -213,8 +219,16 @@ export async function runtimeProcess(config, action, options = {}, { timeoutMs =
     return await executeRuntimeProcess(config, action, options, { timeoutMs: remaining, signal });
   } catch (error) {
     const lease = leases.get(key);
+    // A settled transport may have lost its ACK after COMMIT. Observe the exact
+    // owner, never replay the writer. Productive admission still checks RUN.
+    const registration = lease?.record.registration_sha256 ?? options["registration-sha256"];
+    if (action === "heartbeat" && error.details?.effect === "unknown" && error.details?.cleanup_unconfirmed !== true && /^[a-f0-9]{64}$/.test(registration ?? "")) {
+      const readback = await executeRuntimeProcess(config, "status", { id: options.id, "lease-token": options["lease-token"], "registration-sha256": registration }, { timeoutMs: RENEWAL_POLICY.budgetMs, signal });
+      if (readback?.ok === true && readback.process_id === options.id && readback.registration_sha256 === registration) return readback;
+      throw Object.assign(new Error("Managed heartbeat readback did not establish the exact effect"), { code: "process_maintenance_receipt_invalid" });
+    }
     const text = value => typeof value === "string" ? value.slice(0, 128) : undefined;
-    const request = { phase: started ? "request" : "queue", action, process_id: text(options.id), operation_id: text(options["operation-id"] ?? config.runtime_owner?.operation_id), role: text(lease?.record.kind ?? config.runtime_owner?.role), attempt_kind: prior ? "join" : "fresh", attempt: (lease?.renewal.attempt ?? 0) + 1, remaining_ms: Math.max(0, Math.round(deadline - performance.now())), native_dispatch_started: false, maintenance_effect: started ? "unknown" : "no_effect" };
+    const request = { phase: started ? "request" : "queue", action, process_id: text(options.id), operation_id: text(options["operation-id"] ?? options.operation ?? config.runtime_owner?.operation_id), role: text(lease?.record.kind ?? options.role ?? config.runtime_owner?.role), attempt_kind: prior ? "join" : "fresh", attempt: (lease?.renewal.attempt ?? 0) + 1, remaining_ms: Math.max(0, Math.round(deadline - performance.now())), native_dispatch_started: false, maintenance_effect: started ? "unknown" : "no_effect" };
     // Parent queue/import failures precede any child trace. Keep only bounded,
     // credential-free context and the existing child phase allowlist.
     const childPhases = Array.isArray(error.details?.hook_diagnostics) ? error.details.hook_diagnostics : [];
@@ -231,6 +245,16 @@ export async function runtimeProcess(config, action, options = {}, { timeoutMs =
   }
 }
 
+/** Only after the original maintenance transport physically settled. This
+ * endpoint reads exact current authority and cannot renew or reserve a turn. */
+export async function readbackDaemonProcess(config, record, { signal } = {}) {
+  if (!record?.id || !record.lease_token || !/^[a-f0-9]{64}$/.test(record.registration_sha256 ?? "")) throw Object.assign(new Error("Readback has no exact registration"), { code: "process_maintenance_receipt_invalid" });
+  const result = await runtimeProcess(config, "status", { id: record.id, "lease-token": record.lease_token, "registration-sha256": record.registration_sha256 }, { timeoutMs: RENEWAL_POLICY.budgetMs, signal });
+  if (result?.ok !== true || result.process_id !== record.id || result.registration_sha256 !== record.registration_sha256) throw Object.assign(new Error("Readback returned foreign authority"), { code: "process_maintenance_receipt_invalid" });
+  retainReceipt(record, result);
+  return result;
+}
+
 async function executeRuntimeProcess(config, action, options = {}, { timeoutMs, signal }) {
   const owner = config.runtime_owner;
   const resourceHome = owner?.resource_home ?? config.resourceHome;
@@ -251,7 +275,7 @@ async function executeRuntimeProcess(config, action, options = {}, { timeoutMs,
     try { output = await runBoundedCommand({ bin: ddFlowBin, args: [...args, "--json"], cwd: config.cwd,
       env: { ...(config.env ?? {}), DD_FLOW_HOME: ddFlowHome, DD_FLOW_RESOURCE_HOME: resourceHome }, timeoutMs,
       timeoutCode: action === "heartbeat" ? "process_heartbeat_timeout" : "process_maintenance_timeout", inheritDeadline: false, cleanupWithinBudget: true,
-      maintenanceProgress: { action, processId: options.id ?? null, inactivityMs: RENEWAL_POLICY.attemptMs }, signal }); }
+      maintenanceProgress: { action, processId: options.id ?? null, startupMs: Math.min(timeoutMs, RENEWAL_POLICY.startupMs), inactivityMs: RENEWAL_POLICY.attemptMs }, signal }); }
     catch (error) {
       if (action !== "status" && options.id && error.details?.cleanup_unconfirmed) maintenancePoison.set(poisonKey(options["lease-token"]), error);
       throw error;
@@ -279,7 +303,8 @@ export async function registerDaemonProcess(config, input) {
   for (;;) {
     try { result = await runtimeProcess(config, "register", options, { timeoutMs: renewalRemaining(renewal) }); break; }
     catch (error) {
-      if (!maintenanceRetryable(error) || !renewalFailure(renewal)) throw error;
+      const unknownSettled = error.details?.effect === "unknown" && error.details?.cleanup_unconfirmed !== true;
+      if ((!maintenanceRetryable(error) && !unknownSettled) || !renewalFailure(renewal)) throw error;
       // The child has exited before a timeout is retryable. Reconcile the exact
       // startup identity, not an arbitrary PID or another operation's owner.
       let status;
@@ -327,14 +352,19 @@ export async function startManagedBridge({ config, state, bridge, kind, publish
   const provider = config.runtime_owner ? await registerDaemonProcess(config, { kind, owner: config.runtime_owner.owner_id, operation: kind }) : null;
   try {
     state.provider_process = provider;
+    state.startup_phase = "owner_registered";
     await publish(state);
     bridge.options.onSpawn = async child => {
       await confirmDaemonProcess(config, provider, child);
       state.provider_pid = child.pid;
+      state.startup_phase = "provider_spawned";
       await publish(state);
       scheduleDaemonProcessHeartbeat(config, provider);
     };
-    return await bridge.start();
+    const initialized = await bridge.start();
+    state.startup_phase = "native_initialized";
+    await publish(state);
+    return initialized;
   }
   catch (error) { await cleanupFailedStart(config, provider, bridge.child, error); throw error; }
 }
@@ -348,10 +378,10 @@ export function scheduleDaemonProcessHeartbeat(config, record) {
   if (!record?.id || !record.lease_token) return;
   const key = leaseKey(config, record);
   if (leases.has(key)) return;
-  const lease = { pending: null, error: null, timer: null, lost: false, closing: false, expiresAt: Date.parse(record.lease_expires_at ?? ""), renewal: createRenewalState(), stateDir: path.resolve(config.runtime_owner?.state_dir ?? config.stateDir ?? config.cwd), config, record };
+  const lease = { pending: null, error: null, timer: null, lost: false, closing: false, expiresAt: Date.parse(record.lease_expires_at ?? ""), renewal: createRenewalState({ leaseExpiresAt: record.lease_expires_at }), stateDir: path.resolve(config.runtime_owner?.state_dir ?? config.stateDir ?? config.cwd), config, record };
   leases.set(key, lease);
-  // Retry inside the same uncertainty episode while native work is active.
-  // Waiting for the next 60s tick would exhaust the 30s budget after one BUSY.
+  // Retry no-effect contention inside the same authority episode while native
+  // work is active; scheduling ticks are not ownership evidence.
   lease.timer = setInterval(() => reconfirmLease(lease, () => {}).catch(() => {}), 60_000);
   lease.timer.unref();
 }
@@ -375,8 +405,9 @@ export async function heartbeatDaemonProcess(config, record) {
       }
       if (result?.ok !== true || result.process_id !== record.id) throw Object.assign(new Error("Managed renewal response belongs to another process"), { code: "process_maintenance_receipt_invalid", details: { process_id: record.id } });
       if (!lease.closing) {
-        if (!renewalConfirmed(lease.renewal)) requireTimelyMaintenance(lease.renewal, "heartbeat", result, record);
-        retainReceipt(record, result); lease.error = null; lease.expiresAt = Date.parse(record.lease_expires_at);
+        retainReceipt(record, result);
+        if (!renewalConfirmed(lease.renewal, performance.now(), record.lease_expires_at)) requireTimelyMaintenance(lease.renewal, "heartbeat", result, record);
+        lease.error = null; lease.expiresAt = Date.parse(record.lease_expires_at);
       }
     } catch (cause) {
       if (!lease.closing) renewalFailure(lease.renewal);
@@ -389,9 +420,11 @@ export async function heartbeatDaemonProcess(config, record) {
 
 export async function finishDaemonProcess(config, process, state = "stopped", reason = "daemon_stopped") {
   if (process?.id && process.lease_token) {
-    const settlement = createRenewalState(); settlement.uncertainSince = performance.now();
     const key = leaseKey(config, process), lease = leases.get(key);
     if (lease) { lease.closing = true; clearInterval(lease.timer); await lease.pending?.catch(() => {}); if (lease.error?.cause?.details?.cleanup_unconfirmed) throw lease.error; }
+    // A predecessor owns its transport fence; finish gets an independent
+    // settlement window only after that flight physically settled.
+    const settlement = createRenewalState(); settlement.uncertainSince = performance.now();
     const result = await retryBookkeeping(timeoutMs => runtimeProcess(config, "finish", { id: process.id, "lease-token": process.lease_token, state, reason }, { timeoutMs }), settlement);
     if (result?.ok !== true) throw Object.assign(new Error("managed process finish was not accepted"), { code: "process_lease_lost", details: { process_id: process.id } });
     leases.delete(key);
@@ -401,7 +434,7 @@ export async function finishDaemonProcess(config, process, state = "stopped", re
 function leaseKey(config, record) { return JSON.stringify([path.resolve(config.runtime_owner?.resource_home ?? config.resourceHome), record.id, record.lease_token]); }
 function retainReceipt(record, receipt) {
   const expiresAt = Date.parse(receipt.lease_expires_at ?? "");
-  if (!Number.isFinite(expiresAt) || !/^[a-f0-9]{64}$/.test(receipt.registration_sha256 ?? "") || record.registration_sha256 && record.registration_sha256 !== receipt.registration_sha256) throw Object.assign(new Error("Managed lease receipt has no authoritative expiry/binding"), { code: "process_maintenance_receipt_invalid", details: { process_id: record.id } });
+  if (!Number.isFinite(expiresAt) || expiresAt <= Date.now() + RENEWAL_POLICY.safetyMs || !/^[a-f0-9]{64}$/.test(receipt.registration_sha256 ?? "") || record.registration_sha256 && record.registration_sha256 !== receipt.registration_sha256) throw Object.assign(new Error("Managed lease receipt has no authoritative expiry/binding"), { code: "process_maintenance_receipt_invalid", details: { process_id: record.id } });
   record.lease_expires_at = receipt.lease_expires_at;
   record.registration_sha256 = receipt.registration_sha256;
 }
@@ -428,10 +461,12 @@ async function retryBookkeeping(action, renewal = createRenewalState()) {
   }
 }
 
-// A committed ACK is evidence, but cannot revive an expired authority episode.
-// Cleanup-only finish/release receipts remain facts, not productive grants.
+// A current exact committed ACK establishes authority, not an arbitrary
+// elapsed-time cutoff. Cleanup finish/release remains a non-productive fact.
 function requireTimelyMaintenance(renewal, action, receipt, record) {
-  if (renewalRemaining(renewal)) return;
+  const expiry = receipt?.process?.lease_expires_at ?? receipt?.lease_expires_at;
+  if (expiry && renewalConfirmed(renewal, performance.now(), expiry)) return;
+  if (!expiry && renewalRemaining(renewal)) return;
   const safeText = value => typeof value === "string" ? value.slice(0, 128) : undefined;
   const hash = receipt?.process?.registration_sha256 ?? receipt?.registration_sha256 ?? record?.registration_sha256;
   throw Object.assign(new Error("Managed ownership confirmation arrived after its uncertainty budget"), {

package/dist/harness-runtime/lib/native-hook-command.d.mts

@@ -4,4 +4,4 @@ export function readNativeHookInput(stream: NodeJS.ReadStream, budget: { remaini
 export function acceptNativeHookRequest(stateDir: string, binding: Record<string, unknown>, current?: { requests: Map<string, { binding: Record<string, unknown> }>; accepting?: Map<string, Promise<Record<string, unknown>>> } | null): Promise<Record<string, unknown>>;
 export function writeNativeHookFailure(stateDir: string, binding: Record<string, unknown> | undefined, error: unknown, budget: ReturnType<typeof hookBudget>): Promise<void>;
 export function readNativeHookFailures(stateDir: string, requests: Map<string, { current: unknown; binding: Record<string, unknown> }>, current: unknown, reject: (error: Error & { code?: string; details?: Record<string, unknown> }) => void): Promise<void>;
-export function runBoundedCommand(input: { bin: string; args: string[]; input?: string | null; cwd?: string; env?: NodeJS.ProcessEnv; timeoutMs?: number; timeoutCode?: string; inheritDeadline?: boolean; cleanupWithinBudget?: boolean; maintenanceProgress?: { action: string; processId: string | null; inactivityMs: number } | null; signal?: AbortSignal }): Promise<string>;
+export function runBoundedCommand(input: { bin: string; args: string[]; input?: string | null; cwd?: string; env?: NodeJS.ProcessEnv; timeoutMs?: number; timeoutCode?: string; inheritDeadline?: boolean; cleanupWithinBudget?: boolean; maintenanceProgress?: { action: string; processId: string | null; startupMs?: number; inactivityMs: number } | null; signal?: AbortSignal }): Promise<string>;

package/dist/harness-runtime/lib/native-hook-command.mjs

@@ -127,6 +127,7 @@ export async function runBoundedCommand({ bin, args, input = null, cwd, env = {}
   }
   if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) throw Object.assign(new Error("Native hook budget exhausted before subprocess launch"), { code: timeoutCode, details: { phase: "subprocess", effect: "no_effect" } });
   if (maintenanceProgress && (!Number.isFinite(maintenanceProgress.inactivityMs) || maintenanceProgress.inactivityMs <= 0
+    || maintenanceProgress.startupMs !== undefined && (!Number.isFinite(maintenanceProgress.startupMs) || maintenanceProgress.startupMs <= 0)
     || typeof maintenanceProgress.action !== "string" || !(maintenanceProgress.processId === null || typeof maintenanceProgress.processId === "string")))
     throw Object.assign(new Error("Invalid maintenance progress budget"), { code: "process_maintenance_timeout", details: { effect: "no_effect", native_dispatch_started: false } });
   const started = performance.now();
@@ -142,6 +143,8 @@ export async function runBoundedCommand({ bin, args, input = null, cwd, env = {}
     let stdout = "", stderr = "", failure, cleanupTimer, settled = false, termination;
     let timer, phaseBuffer = "", lastProgress = started;
     const progressPhases = new Set();
+    let importsReady = maintenanceProgress?.startupMs === undefined;
+    const silenceMs = () => importsReady ? maintenanceProgress?.inactivityMs : maintenanceProgress.startupMs;
     const commandDeadline = started + commandMs;
     const finish = (error, value) => {
       if (settled) return;
@@ -156,7 +159,7 @@ export async function runBoundedCommand({ bin, args, input = null, cwd, env = {}
       if (termination || settled) return;
       failure ??= error;
       clearTimeout(timer);
-      failure.details = { ...failure.details, elapsed_ms: Math.round(performance.now() - started), effect: "unknown", subprocess_pid: child.pid ?? null };
+      failure.details = { ...failure.details, failure_at: new Date().toISOString(), elapsed_ms: Math.round(performance.now() - started), effect: "unknown", subprocess_pid: child.pid ?? null };
       termination = terminateCommandTree(child).catch(cleanup => {
         if (cleanup.code === "ESRCH") return;
         failure.details.cleanup_error = { code: cleanup.code, message: cleanup.message };
@@ -175,8 +178,10 @@ export async function runBoundedCommand({ bin, args, input = null, cwd, env = {}
     const arm = () => {
       clearTimeout(timer);
       const now = performance.now();
-      const remaining = Math.min(commandDeadline - now, maintenanceProgress ? lastProgress + maintenanceProgress.inactivityMs - now : Infinity);
-      if (remaining <= 0) { stop(Object.assign(new Error("Bounded CLI request timed out"), { code: timeoutCode })); return; }
+      const remaining = Math.min(commandDeadline - now, maintenanceProgress ? lastProgress + silenceMs() - now : Infinity);
+      if (remaining <= 0) { stop(Object.assign(new Error("Bounded CLI request timed out"), { code: timeoutCode,
+        details: maintenanceProgress ? { phase: importsReady ? "storage" : "startup", inactivity_ms: silenceMs(),
+          ownership_horizon_ms: commandMs } : {} })); return; }
       timer = setTimeout(arm, Math.ceil(remaining));
     };
     arm();
@@ -196,13 +201,16 @@ export async function runBoundedCommand({ bin, args, input = null, cwd, env = {}
         let phase; try { phase = JSON.parse(line); } catch { continue; }
         if (phase?.kind !== "process_maintenance_phase" || phase.action !== maintenanceProgress.action
           || (phase.process_id ?? null) !== maintenanceProgress.processId || phase.native_dispatch_started !== false
-          || !["request", "store_open", "store_validation", "lookup", "writer_reservation", "writer_reserved", "write", "commit", "committed", "ack"].includes(phase.phase)
+          || !["request", "imports_ready", "store_open", "store_validation", "lookup", "writer_reservation", "writer_reserved", "write", "commit", "committed", "ack"].includes(phase.phase)
           || phase.store_kind !== undefined && !["run", "resource"].includes(phase.store_kind)) continue;
         const key = `${phase.store_kind ?? ""}:${phase.phase}`;
         if (progressPhases.has(key)) continue;
         // Delayed observation cannot revive an already-expired silence window.
         const now = performance.now();
-        if (now >= commandDeadline || now - lastProgress >= maintenanceProgress.inactivityMs) { arm(); return; }
+        if (now >= commandDeadline || now - lastProgress >= silenceMs()) { arm(); return; }
+        // Cold imports are not a stalled storage operation. Readiness is an
+        // actual boundary, never a timer heartbeat; the ownership horizon stays fixed.
+        if (["imports_ready", "store_open"].includes(phase.phase)) importsReady = true;
         progressPhases.add(key); lastProgress = now; arm();
       }
     });

package/dist/harness-runtime/lib/process-json.d.mts

@@ -0,0 +1,5 @@
+type Options = { cwd?: string; env?: NodeJS.ProcessEnv; input?: string | null; onProgress?: (value: unknown) => void; progress?: () => number; startupMs?: number | null; timeoutMs?: number | null; phase?: string; signal?: AbortSignal; onDiagnostic?: (data: string, stream: string) => void };
+export function reportedFailure(stdout: string, stderr: string, fallback: string, fallbackCode?: string, retainedError?: Record<string, unknown> | null): Error & import('./operation-errors.mjs').ErrorRecord;
+export function commandJson(bin: string, args: string[], options?: Options): Promise<Record<string, unknown>>;
+export function commandText(bin: string, args: string[], options?: Options): Promise<string>;
+export function commandResult(bin: string, args: string[], options?: Options): Promise<{exit_code: number | null; signal: string | null; stdout: string; stderr: string}>;

package/dist/harness-runtime/lib/process-json.mjs

@@ -2,10 +2,13 @@ import { spawn } from "node:child_process";
 import { errorRecord, reportedError } from "./operation-errors.mjs";
 import { ObservationClock, validateObservationDuration } from "./observation-clock.mjs";
 import { terminateCommandTree } from "./native-hook-command.mjs";
+import { SETUP_STARTUP_MS, publishSetup, setupObserver, observationDetails, isSetupPhase } from './setup-progress.mjs';
+let probeSequence = 0;
 
 function failure(message, code) {
   return Object.assign(new Error(message), { code });
 }
+const phaseDiagnostic = value => isSetupPhase(value) || ["native_hook_phase", "process_maintenance_phase"].includes(value?.kind);
 
 export function reportedFailure(stdout, stderr, fallback, fallbackCode = "flow_reconciliation_failed", retainedError = null) {
   for (const text of [stdout, stderr]) {
@@ -13,13 +16,13 @@ export function reportedFailure(stdout, stderr, fallback, fallbackCode = "flow_r
     // pretty-printed error envelope. Remove only our diagnostics, not arbitrary
     // text or a substring that might masquerade as an authoritative receipt.
     const envelope = text.split(/\n/).filter(line => {
-      try { return !["native_hook_phase", "process_maintenance_phase"].includes(JSON.parse(line)?.kind); }
+      try { return !phaseDiagnostic(JSON.parse(line)); }
       catch { return true; }
     }).join("\n").trim();
     for (const line of [text.trim(), envelope, ...text.trim().split(/\n/).reverse()]) {
       try {
         const value = JSON.parse(line);
-        if (["native_hook_phase", "process_maintenance_phase"].includes(value?.kind)) continue;
+        if (phaseDiagnostic(value)) continue;
         const error = value?.error;
         if (typeof error?.code === "string" && error.code) return reportedError(error, fallback);
         if (typeof value?.code === "string" && value.code) return reportedError({ ...value, message: typeof error === "string" ? error : value.message }, fallback);
@@ -36,10 +39,14 @@ function processTarget(executable, args) {
 
 // These are utility/transport children, never a second productive-work owner.
 async function command(bin, args, json, { cwd, env = {}, input = null, onProgress = null,
-  timeoutMs = 30_000, phase = "utility", signal = null, onDiagnostic = null } = {}) {
+  timeoutMs = 30_000, startupMs = null, phase = "utility", signal = null, onDiagnostic = null, result = false, progress = null } = {}) {
+  if (startupMs !== null) validateObservationDuration(startupMs);
   if (timeoutMs !== null) validateObservationDuration(timeoutMs);
   if (timeoutMs === null && phase !== "native-work") throw new RangeError("only native-work may omit the utility quiet timeout");
   if (signal?.aborted) throw signal.reason ?? failure("command aborted", "command_aborted");
+  const setupProbe = ['native-version', 'native-doctor'].includes(phase);
+  const step = setupProbe ? `version-${++probeSequence}` : null;
+  if (setupProbe) publishSetup('probe_started', step);
   const executable = bin === "dd-flow" && typeof env.DD_FLOW_BIN === "string" ? env.DD_FLOW_BIN : bin;
   const target = processTarget(executable, json ? [...args, "--json"] : args);
   return await new Promise((resolve, reject) => {
@@ -49,11 +56,13 @@ async function command(bin, args, json, { cwd, env = {}, input = null, onProgres
     let stdout = "", stderr = "", pendingStderr = "", settled = false, primary = null, cursor = 0, droppingStructured = false;
     let outputBytes = 0, cleanupTimer = null, inputError = null, termination = null, retainedError = null, prettyError = "";
     const phases = new Set();
-    const clock = timeoutMs === null ? null : new ObservationClock({ timeoutMs });
+    const clock = timeoutMs === null ? null : new ObservationClock({ timeoutMs: startupMs ?? timeoutMs });
+    const observeSetup = setupObserver(env.DD_EVAL_OPERATION_ID ?? process.env.DD_EVAL_OPERATION_ID);
     const productive = () => { cursor++; clock?.sample(cursor, Date.now()); };
     const finish = (error, value) => {
       if (settled) return; settled = true;
       clearInterval(timer); clearTimeout(cleanupTimer); signal?.removeEventListener("abort", abort);
+      if (!error && setupProbe) publishSetup('probe_completed', step);
       error ? reject(error) : resolve(value);
     };
     const stop = error => {
@@ -80,6 +89,15 @@ async function command(bin, args, json, { cwd, env = {}, input = null, onProgres
         prettyError = candidate.length > maxTail ? null : candidate; return;
       }
       const kind = value?.kind;
+      if (kind === 'setup_phase') {
+        if (observeSetup(value)) {
+          if (clock) clock.setupProgress = { phase: value.phase, sequence: value.sequence, step: value.step, operation_id: value.operation_id };
+          if (clock) clock.timeoutMs = ['ingress_entered', 'probe_started'].includes(value.phase) ? startupMs ?? timeoutMs : timeoutMs;
+          productive();
+          if (setupProbe || phase === 'engine-probe') publishSetup(value.phase, `${step ?? 'engine'}:${value.sequence}:${value.step ?? ''}`);
+        }
+        return;
+      }
       const passive = ["heartbeat", "poll", "status", "elapsed", "wait", "waiting"].some(marker => [kind, value?.phase, value?.action].includes(marker));
       if (!["native_hook_phase", "process_maintenance_phase"].includes(kind)) {
         const error = typeof value?.error?.code === "string" && value.error.code ? value.error
@@ -110,9 +128,17 @@ async function command(bin, args, json, { cwd, env = {}, input = null, onProgres
         }
       } catch (error) { stop(error); }
     };
+    let observedProgress = 0;
     const timer = clock ? setInterval(() => {
+      if (progress) {
+        try {
+          const next = progress();
+          if (!Number.isSafeInteger(next) || next < 0) throw new RangeError('progress must be a non-negative integer');
+          if (next > observedProgress) { observedProgress = next; productive(); }
+        } catch (error) { stop(error); return; }
+      }
       if (clock.sample(cursor)) stop(Object.assign(failure("command observation became quiet", "command_observation_lost"),
-        { details: { phase, timeout_ms: timeoutMs, observation_lost: clock.observationLost } }));
+        { details: observationDetails(clock, phase, child.pid) }));
     }, Math.max(1, Math.min(1_000, timeoutMs / 4))) : null;
     clock?.sample(cursor);
     signal?.addEventListener("abort", abort, { once: true });
@@ -148,10 +174,15 @@ async function command(bin, args, json, { cwd, env = {}, input = null, onProgres
       child.stdin.on("error", error => { inputError = error; if (error.code !== "EPIPE") stop(error); });
       child.stdin.end(input);
     }
-    child.once("close", status => {
+    child.once("close", (status, signal) => {
       if (pendingStderr) deliverProgress(pendingStderr);
       if (primary) { void (termination ?? Promise.resolve()).then(() => finish(primary)); return; }
-      if (status !== 0) return finish(reportedFailure(stdout, stderr, `${executable} exited ${status}`, json ? "flow_reconciliation_failed" : "command_failed", retainedError));
+      if (result) return finish(inputError, { exit_code: status, signal, stdout: stdout.trim(), stderr });
+      if (status !== 0) {
+        const error = reportedFailure(stdout, stderr, `${executable} exited ${status}`, json ? "flow_reconciliation_failed" : "command_failed", retainedError);
+        error.details = { reason: 'child_exit', exit_code: status, signal, phase, pid: child.pid, ...error.details };
+        return finish(error);
+      }
       if (!json) return finish(inputError, stdout.trim());
       try {
         const value = JSON.parse(stdout.trim());
@@ -165,5 +196,6 @@ async function command(bin, args, json, { cwd, env = {}, input = null, onProgres
     });
   });
 }
-export async function commandJson(bin, args, options = {}) { return await command(bin, args, true, options); }
-export async function commandText(bin, args, options = {}) { return await command(bin, args, false, options); }
+export async function commandJson(bin, args, options = {}) { return await command(bin, args, true, { startupMs: options.timeoutMs ?? SETUP_STARTUP_MS, ...options }); }
+export async function commandText(bin, args, options = {}) { return await command(bin, args, false, { startupMs: options.timeoutMs ?? SETUP_STARTUP_MS, ...options }); }
+export async function commandResult(bin, args, options = {}) { return await command(bin, args, false, { startupMs: options.timeoutMs ?? SETUP_STARTUP_MS, ...options, result: true }); }

package/dist/harness-runtime/lib/setup-progress.d.mts

@@ -0,0 +1,9 @@
+export const SETUP_STARTUP_MS: number;
+export const SETUP_QUIET_MS: number;
+export const setupPhases: Set<string>;
+export function setupReporter(operationId?: string): (phase: string, step?: string | number | null) => void;
+export const publishSetup: ReturnType<typeof setupReporter>;
+export function isSetupPhase(value: unknown): boolean;
+export function startupObserver(stateDir: string, daemonId: string): () => Promise<number>;
+export function setupObserver(operationId: string): (value: unknown) => boolean;
+export function observationDetails(clock: import('./observation-clock.mjs').ObservationClock, phase: string | null, pid: number | undefined): Record<string, unknown>;

package/dist/harness-runtime/lib/setup-progress.mjs

@@ -0,0 +1,51 @@
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+export const SETUP_STARTUP_MS = 120_000;
+export const SETUP_QUIET_MS = 30_000;
+export const setupPhases = new Set(['ingress_entered', 'imports_ready', 'probe_started', 'probe_completed', 'dependency_check_completed', 'transfer_progress', 'identity_digest_progress', 'identity_digest_completed', 'native_initialized', 'ready']);
+export function setupReporter(operationId = process.env.DD_EVAL_OPERATION_ID) {
+  if (!operationId) return () => {};
+  let sequence = 0;
+  return (phase, step = null) => {
+    if (!setupPhases.has(phase)) throw new Error('Invalid setup phase');
+    process.stderr.write(JSON.stringify({ kind: 'setup_phase', operation_id: operationId, phase, step, sequence: ++sequence, observed_at: new Date().toISOString() }) + '\n');
+  };
+}
+export const publishSetup = setupReporter();
+export function isSetupPhase(value) {
+  return value?.kind === 'setup_phase' && typeof value.operation_id === 'string' && value.operation_id.length > 0 && setupPhases.has(value.phase)
+    && Number.isSafeInteger(value.sequence) && value.sequence > 0 && value.sequence <= 1_000_000
+    && (value.step === null || typeof value.step === 'string' && value.step.length <= 4096 || Number.isSafeInteger(value.step) && value.step >= 0)
+    && typeof value.observed_at === 'string' && Number.isFinite(Date.parse(value.observed_at))
+    && !Object.hasOwn(value, 'error') && !Object.hasOwn(value, 'code');
+}
+export function startupObserver(stateDir, daemonId) {
+  const seen = new Set(); let sequence = 0, binding;
+  return async () => {
+    let state;
+    try { state = JSON.parse(await readFile(path.join(stateDir, 'daemon.json'), 'utf8')); }
+    catch (error) { if (error.code === 'ENOENT') return sequence; throw error; }
+    if (state.daemon_id !== daemonId) throw Object.assign(new Error('Startup daemon identity changed'), { code: 'operation_binding_conflict' });
+    const owner = state.config?.runtime_owner;
+    const identity = JSON.stringify([state.started_at ?? null, owner?.owner_id ?? null, owner?.operation_id ?? null, state.generation ?? null]);
+    binding ??= identity;
+    if (identity !== binding) throw Object.assign(new Error('Startup ownership binding changed'), { code: 'operation_binding_conflict' });
+    const marker = JSON.stringify([state.pid ?? null, state.provider_pid ?? null, state.shutdown_state ?? null, state.startup_phase ?? null]);
+    if (!seen.has(marker)) { seen.add(marker); sequence++; publishSetup(state.shutdown_state === 'running' ? 'native_initialized' : 'probe_started', `${daemonId}:${sequence}`); }
+    return sequence;
+  };
+}
+export function setupObserver(operationId) {
+  const startedAt = Date.now(); let sequence = 0; const markers = new Set();
+  return value => {
+    if (typeof operationId !== 'string' || markers.size >= 4096 || !isSetupPhase(value) || value.operation_id !== operationId
+      || value.sequence <= sequence || Date.parse(value.observed_at) < startedAt || Date.parse(value.observed_at) > Date.now()) return false;
+    const marker = JSON.stringify([value.phase, value.step]);
+    if (markers.has(marker)) return false;
+    markers.add(marker); sequence = value.sequence; return true;
+  };
+}
+export function observationDetails(clock, phase, pid) {
+  return { reason: clock.observationLost ? 'observation_gap' : 'inactivity', phase, pid,
+    timeout_ms: clock.timeoutMs, observation_lost: clock.observationLost, observation_clock: clock.state(), ...(clock.setupProgress ? { last_setup: clock.setupProgress } : {}), effect: 'unknown' };
+}

package/dist/services/branch-context.js

@@ -166,11 +166,11 @@ function gitFacts(workspacePath) {
     if (!fs.existsSync(workspacePath)) {
         return { status: "missing_workspace", actual_branch: null, dirty: null, path: workspacePath };
     }
-    const branch = spawnSync("git", ["-C", workspacePath, "rev-parse", "--abbrev-ref", "HEAD"], { encoding: "utf8" });
+    const branch = spawnSync("git", ["-C", workspacePath, "rev-parse", "--abbrev-ref", "HEAD"], { encoding: "utf8", timeout: 5000 });
     if (branch.status !== 0) {
-        return { status: "not_git_checkout", actual_branch: null, dirty: null, path: workspacePath };
+        return { status: branch.error || branch.signal ? "observation_unavailable" : "not_git_checkout", actual_branch: null, dirty: null, path: workspacePath };
     }
-    const status = spawnSync("git", ["-C", workspacePath, "status", "--porcelain"], { encoding: "utf8" });
+    const status = spawnSync("git", ["-C", workspacePath, "status", "--porcelain"], { encoding: "utf8", timeout: 5000 });
     return {
         status: "ok",
         actual_branch: branch.stdout.trim() || null,

package/dist/services/check-runner-evidence.js

@@ -0,0 +1,121 @@
+import fs from "node:fs";
+import path from "node:path";
+import { parse } from "shell-quote";
+import { AppError } from "../shared/errors.js";
+import { validateObservationDuration } from "../harness-runtime/lib/observation-clock.mjs";
+export function runnerObservationDurations(environment) {
+    // Both observers leave the launcher its bounded physical cleanup tail.
+    return { startupMs: validateObservationDuration(validateObservationDuration(Number(environment.DD_FLOW_TEST_STARTUP_SILENCE_MS ?? 120_000)) + 10_000),
+        executionMs: validateObservationDuration(validateObservationDuration(Number(environment.DD_FLOW_TEST_EXECUTION_SILENCE_MS ?? 600_000)) + 10_000) };
+}
+/** Baseline uses argv rather than a shell alias. Recognize only a literal,
+ * unique execution contract; never guess shell expansion or compound syntax. */
+export function runnerContractForArgv(profile, command, args) {
+    if (profile.schema_id !== "dd-flow/code-check-profile@7" || !profile.runner_evidence_by_alias)
+        return null;
+    if (!runnerContractsValid(profile.runner_evidence_by_alias))
+        throw new AppError("invalid_code_check_profile", "Invalid baseline runner evidence contract", 2);
+    const matches = [];
+    for (const [alias, contract] of Object.entries(profile.runner_evidence_by_alias)) {
+        const source = profile.aliases?.[alias];
+        if (typeof source !== "string")
+            throw new AppError("invalid_code_check_profile", "Baseline runner evidence references an unknown alias", 2, { alias });
+        let expansion = false;
+        const tokens = parse(source, () => { expansion = true; return ""; });
+        if (!expansion && tokens.every(token => typeof token === "string") && JSON.stringify(tokens) === JSON.stringify([command, ...args]))
+            matches.push({ alias, command: source, contract });
+    }
+    if (matches.some(match => JSON.stringify(match.contract) !== JSON.stringify(matches[0].contract)))
+        throw new AppError("runner_evidence_ambiguous", "Baseline argv matches conflicting runner evidence contracts", 2, { aliases: matches.map(match => match.alias) });
+    return matches[0] ?? null;
+}
+/** Shared by CODE and EVAL baseline. Logs, repeated cursors and foreign records
+ * are diagnostic bytes, not runner progress. Partial final lines await append. */
+export function readRunnerProgress(file, invocationId, lastSequence = 0, now = Date.now()) {
+    try {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.size > 1024 * 1024)
+            return [];
+        const accepted = [];
+        for (const line of fs.readFileSync(file, "utf8").split("\n").slice(0, -1)) {
+            let value;
+            try {
+                value = JSON.parse(line);
+            }
+            catch {
+                continue;
+            }
+            if (!value || typeof value !== "object" || Array.isArray(value) || value.schema_id !== "dd-flow/check-runner-progress@1" || value.invocation_id !== invocationId
+                || !Number.isSafeInteger(value.sequence) || value.sequence <= lastSequence || typeof value.at !== "string" || !Number.isFinite(Date.parse(value.at)) || Date.parse(value.at) > now
+                || !["startup", "execution"].includes(value.phase)
+                || !["setup_step_completed", "run_started", "module_collected", "test_started", "test_completed", "step_completed", "run_completed"].includes(value.event))
+                continue;
+            accepted.push(value);
+            lastSequence = value.sequence;
+        }
+        return accepted;
+    }
+    catch {
+        return [];
+    }
+}
+export function runnerContractsValid(value) {
+    if (value === undefined)
+        return true;
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    return Object.entries(value).every(([alias, raw]) => {
+        if (!raw || typeof raw !== "object" || Array.isArray(raw))
+            return false;
+        const contract = raw;
+        return alias.startsWith("@check/") && contract.schema_id === "dd-flow/check-runner-evidence@1" && typeof contract.path === "string" && contract.path.length > 0 && !contract.path.includes("\\") && !path.isAbsolute(contract.path) && !contract.path.split("/").some(part => part === ".." || part === "" || part === ".");
+    });
+}
+export function readRunnerEvidence(root, contract, binding) {
+    try {
+        let current = root;
+        if (!fs.lstatSync(current).isDirectory())
+            return null;
+        for (const part of contract.path.split(/[\\/]/)) {
+            current = path.join(current, part);
+            if (fs.lstatSync(current).isSymbolicLink())
+                return null;
+        }
+        const stat = fs.statSync(current);
+        if (!stat.isFile() || stat.size > 1024 * 1024)
+            return null;
+        const evidence = JSON.parse(fs.readFileSync(current, "utf8"));
+        if (evidence.schema_id !== contract.schema_id || !evidence.binding || Object.entries(binding).some(([key, value]) => evidence.binding[key] !== value)
+            || typeof evidence.runner?.name !== "string" || !evidence.runner.name || typeof evidence.runner.version !== "string" || !evidence.runner.version || typeof evidence.completed !== "boolean" || !evidence.counts
+            || ![evidence.counts.passed, evidence.counts.failed, evidence.counts.skipped].every(n => Number.isSafeInteger(n) && n >= 0)
+            || !Array.isArray(evidence.failures) || evidence.failures.some(f => !f || !["assertion", "tooling", "unclassified"].includes(f.category))
+            || evidence.counts.failed > evidence.failures.length || evidence.observation_unknown !== undefined && typeof evidence.observation_unknown !== "boolean")
+            return null;
+        return evidence;
+    }
+    catch {
+        return null;
+    }
+}
+export function runnerEvidencePass(evidence) { return Boolean(evidence?.completed && !evidence.observation_unknown && evidence.counts.failed === 0 && evidence.failures.length === 0); }
+export function checkRepairDisposition(receipt) {
+    if (receipt.status === "running" || receipt.status === "aborted" || receipt.runner_evidence?.observation_unknown)
+        return "settlement_required";
+    if (receipt.status === "passed")
+        return "passed";
+    const evidence = receipt.runner_evidence;
+    if (!evidence || !Array.isArray(evidence.failures) || !evidence.failures.length || receipt.exit_code === 0 || evidence.failures.some(f => !f || !["assertion", "tooling", "unclassified"].includes(f.category)))
+        return "unclassified";
+    if (evidence.failures.some(f => f.category === "tooling"))
+        return "tooling_blocker";
+    if (!evidence.completed)
+        return "unclassified";
+    if (evidence.failures.some(f => f.category === "unclassified"))
+        return "unclassified";
+    return "source_repair";
+}
+export function assertSourceRepairEligible(receipts) {
+    const blockers = receipts.filter(receipt => checkRepairDisposition(receipt) !== "source_repair");
+    if (!receipts.length || blockers.length)
+        throw new AppError("check_gate_blocked", "Checks require tooling diagnosis or settlement before product repair; retained nonzero is not an assertion verdict", 2, { failures: receipts, dispositions: receipts.map(receipt => ({ check_receipt_id: receipt.id, disposition: checkRepairDisposition(receipt) })), outcome: "blocked", recoverable: false, instruction: "Inspect retained runner evidence. Do not change product code to repair tooling, unknown observation or unclassified failure. Retry only after establishing and correcting the cause." });
+}

package/dist/services/cleanup.js

@@ -512,7 +512,7 @@ function dirtyGit(worktreePath) {
     if (!fs.existsSync(worktreePath)) {
         return false;
     }
-    const result = spawnSync("git", ["-C", worktreePath, "status", "--porcelain"], { encoding: "utf8" });
+    const result = spawnSync("git", ["-C", worktreePath, "status", "--porcelain"], { encoding: "utf8", timeout: 5000 });
     if (result.error || result.status !== 0)
         throw new AppError("workspace_status_failed", "Cannot establish worktree status before cleanup", 1, { path: worktreePath, cause: result.error?.message ?? result.stderr });
     return result.stdout.trim().length > 0;