@deksden-com/dd-flow-cli 0.9.0-beta.127 → 0.9.0-beta.133

package/dist/services/code-checks.js

@@ -1,4 +1,6 @@
 import crypto from "node:crypto";
+import { readRunnerEvidence, readRunnerProgress, runnerContractsValid, runnerEvidencePass, runnerObservationDurations } from "./check-runner-evidence.js";
+export { assertSourceRepairEligible, checkRepairDisposition } from "./check-runner-evidence.js";
 import { isGitlessWorkspace, ownedWorkspaceHookPath, projectServicePathFilter, workspaceGitFiles } from "./workspace-files.js";
 import { spawn, spawnSync } from "node:child_process";
 import { ObservationClock, validateObservationDuration } from "../harness-runtime/lib/observation-clock.mjs";
@@ -63,6 +65,8 @@ export function codeExecutionEnvironment(workspaceRoot) {
     // provider can otherwise run x64 checks against arm64-installed modules.
     const environment = { ...process.env, PATH: `${path.dirname(process.execPath)}${path.delimiter}${process.env.PATH ?? ""}`, DD_FLOW_LOCAL_DATABASE_SUFFIX: suffix };
     delete environment.NODE_PATH;
+    for (const key of ["DD_FLOW_CHECK_RUNNER_EVIDENCE_PATH", "DD_FLOW_CHECK_RUNNER_PROGRESS_PATH", "DD_FLOW_CHECK_INVOCATION_ID", "DD_FLOW_CHECK_ID", "DD_FLOW_CHECK_INPUT_HASH", "DD_FLOW_CHECK_VERIFICATION_EPOCH", "DD_FLOW_CHECK_COMMAND"])
+        delete environment[key];
     return environment;
 }
 export function workspaceOperationId(workspaceRoot) { return `workspace:${crypto.createHash("sha256").update(path.resolve(workspaceRoot)).digest("hex")}`; }
@@ -72,8 +76,13 @@ export function readCodeCheckProfile(workspaceRoot) {
         return { profile: null, hash: null, file };
     const bytes = fs.readFileSync(file);
     const value = JSON.parse(bytes.toString("utf8"));
-    if (value.schema_id !== "dd-flow/code-check-profile@6")
-        throw new AppError("invalid_code_check_profile", "CODE check profile has an unsupported schema", 2, { file, schema_id: value.schema_id ?? null, required: "dd-flow/code-check-profile@6" });
+    if (!["dd-flow/code-check-profile@6", "dd-flow/code-check-profile@7"].includes(value.schema_id ?? ""))
+        throw new AppError("invalid_code_check_profile", "CODE check profile has an unsupported schema", 2, { file, schema_id: value.schema_id ?? null, supported: ["dd-flow/code-check-profile@6", "dd-flow/code-check-profile@7"] });
+    if (!runnerContractsValid(value.runner_evidence_by_alias) || value.schema_id === "dd-flow/code-check-profile@6" && value.runner_evidence_by_alias !== undefined)
+        throw new AppError("invalid_code_check_profile", "Runner evidence requires valid profile@7 relative artifact contracts", 2, { file });
+    for (const alias of Object.keys(value.runner_evidence_by_alias ?? {}))
+        if (!value.aliases?.[alias])
+            throw new AppError("invalid_code_check_profile", "Runner evidence references an unknown alias", 2, { file, alias });
     if (!isStringRecord(value.aliases) || !isStringRecord(value.require_alias_for) || !isGateRecord(value.mandatory_by_gate) || !isPortAliasRecord(value.ports_by_alias) || !isInputAliasRecord(workspaceRoot, value.inputs_by_alias))
         throw new AppError("invalid_code_check_profile", "CODE check profile aliases, require_alias_for, mandatory_by_gate, ports_by_alias or inputs_by_alias are invalid", 2, { file });
     for (const [gate, aliases] of Object.entries(value.mandatory_by_gate))
@@ -100,15 +109,19 @@ export function codeCheckProfileHash(workspaceRoot, checks = []) {
     if (!profile)
         return null;
     const planned = new Set(checks.filter(check => check.availability === "planned" && check.command.startsWith("@check/")).map(check => check.command));
+    const serialize = (value) => profile.schema_id === "dd-flow/code-check-profile@7"
+        ? JSON.stringify(value, (_key, item) => item && typeof item === "object" && !Array.isArray(item) ? Object.fromEntries(Object.entries(item).sort(([left], [right]) => left.localeCompare(right))) : item)
+        : JSON.stringify(value);
     if (!planned.size)
-        return crypto.createHash("sha256").update(JSON.stringify(profile)).digest("hex");
+        return crypto.createHash("sha256").update(serialize(profile)).digest("hex");
     const canonical = {
         ...profile,
         aliases: Object.fromEntries(Object.entries(profile.aliases).filter(([alias]) => !planned.has(alias))),
         ports_by_alias: Object.fromEntries(Object.entries(profile.ports_by_alias ?? {}).filter(([alias]) => !planned.has(alias))),
-        inputs_by_alias: Object.fromEntries(Object.entries(profile.inputs_by_alias ?? {}).filter(([alias]) => !planned.has(alias)))
+        inputs_by_alias: Object.fromEntries(Object.entries(profile.inputs_by_alias ?? {}).filter(([alias]) => !planned.has(alias))),
+        ...(profile.schema_id === "dd-flow/code-check-profile@7" ? { runner_evidence_by_alias: Object.fromEntries(Object.entries(profile.runner_evidence_by_alias ?? {}).filter(([alias]) => !planned.has(alias))) } : {})
     };
-    return crypto.createHash("sha256").update(JSON.stringify(canonical)).digest("hex");
+    return crypto.createHash("sha256").update(serialize(canonical)).digest("hex");
 }
 /** The integration target starts at its baseline profile; the reviewed source
  * may add aliases, but must not change existing check policy or bindings. */
@@ -120,7 +133,7 @@ export function mergeCheckProfileHash(sourceWorkspace, targetWorkspace, checks)
     if (!source || !target)
         throw new AppError("check_profile_drift", "Source and integration check profiles differ", 1);
     const retained = structuredClone(source);
-    for (const field of ["aliases", "ports_by_alias", "inputs_by_alias"]) {
+    for (const field of ["aliases", "ports_by_alias", "inputs_by_alias", "runner_evidence_by_alias"]) {
         const old = target[field];
         if (!old) {
             delete retained[field];
@@ -130,7 +143,7 @@ export function mergeCheckProfileHash(sourceWorkspace, targetWorkspace, checks)
         retained[field] = Object.fromEntries(Object.keys(old).filter(key => key in current).map(key => [key, current[key]]));
     }
     const existingAliases = new Set(Object.keys(target.aliases));
-    const changedExistingMetadata = ["ports_by_alias", "inputs_by_alias"].some(field => Object.keys(source[field] ?? {}).some(alias => existingAliases.has(alias) && !(alias in (target[field] ?? {}))));
+    const changedExistingMetadata = ["ports_by_alias", "inputs_by_alias", "runner_evidence_by_alias"].some(field => Object.keys(source[field] ?? {}).some(alias => existingAliases.has(alias) && !(alias in (target[field] ?? {}))));
     if (changedExistingMetadata || !isDeepStrictEqual(retained, target)) {
         throw new AppError("check_profile_drift", "Source check profile changes existing integration policy", 1, { source_profile_hash: codeCheckProfileHash(sourceWorkspace, checks), target_profile_hash: codeCheckProfileHash(targetWorkspace, checks) });
     }
@@ -171,6 +184,8 @@ export function validateCheckPlacement(workspaceRoot, checks) { const { profile
 export function validateCheckDeclaration(workspaceRoot, check) {
     if (!["work", "code", "readiness", "merge", "release"].includes(check.run_at))
         throw new AppError("unsupported_check_gate", "Check requires an autonomous executable gate; replan the incompatible declaration", 2, { check_id: check.id, run_at: check.run_at });
+    if (check.runner_evidence !== undefined && !runnerContractsValid({ "@check/declaration": check.runner_evidence }))
+        throw new AppError("invalid_code_check_profile", "Check runner evidence contract is invalid", 2, { check_id: check.id });
     const { profile } = readCodeCheckProfile(workspaceRoot);
     const resolvedCommand = profile?.aliases[check.command] ?? check.command;
     validateTerminatingCheckCommand(resolvedCommand, check.id);
@@ -274,7 +289,13 @@ async function runCodeChecksOwned(context, input, workspaceGateId, generation) {
     const profileHash = codeCheckProfileHash(input.workspaceRoot, input.checks);
     if (input.expectedProfileHash !== undefined && input.expectedProfileHash !== profileHash)
         throw new AppError("check_profile_drift", "The frozen check profile differs from the workspace profile", 1, { expected_profile_hash: input.expectedProfileHash, actual_profile_hash: profileHash });
-    const checks = input.checks.map((check) => { const ports = profile?.ports_by_alias?.[check.command]; const inputs = profile?.inputs_by_alias?.[check.command]; return { ...check, ...(check.ports || !ports ? {} : { ports }), ...(check.inputs || !inputs ? {} : { inputs }) }; });
+    const checks = input.checks.map(check => {
+        const ports = profile?.ports_by_alias?.[check.command], inputs = profile?.inputs_by_alias?.[check.command];
+        const runner = profile?.runner_evidence_by_alias?.[check.command] ?? check.runner_evidence;
+        if (runner && !runnerContractsValid({ "@check/declaration": runner }))
+            throw new AppError("invalid_code_check_profile", "Check runner evidence contract is invalid", 2, { check_id: check.id });
+        return { ...check, ...(check.ports || !ports ? {} : { ports }), ...(check.inputs || !inputs ? {} : { inputs }), ...(runner ? { runner_evidence: runner, required_artifacts: [...new Set([...(check.required_artifacts ?? []), runner.path])] } : {}) };
+    });
     const resolved = resolveCodeCheckCommands(input.workspaceRoot, input.runId, checks.map((check) => check.command));
     assertConsistentDeclarations(checks, resolved);
     const groups = deduplicate(checks, resolved), receipts = [];
@@ -313,8 +334,16 @@ async function runCodeChecksOwned(context, input, workspaceGateId, generation) {
         let result = { exitCode: null, error: "check did not start", aborted: true };
         try {
             fs.mkdirSync(evidenceDir, { recursive: true });
-            writeReceipt(receiptPath, receiptFor({ ...reserved, resources, result, status: "running", after: before, mutationPaths: [], artifacts: [] }));
+            const startingReceipt = receiptFor({ ...reserved, resources, result, status: "running", after: before, mutationPaths: [], artifacts: [] });
+            if (group.runnerEvidence)
+                startingReceipt.runner_evidence_required = group.runnerEvidence;
+            writeReceipt(receiptPath, startingReceipt);
             const budget = runtimeBudgetForRun(context, input.projectId, input.runId);
+            if (group.runnerEvidence) {
+                // Reject configuration before acquiring a check lease/ports, so there
+                // is no unconfirmed managed child to strand on a validation error.
+                runnerObservationDurations(process.env);
+            }
             const managed = registerManagedProcess(context, { kind: "check", ownerPid: process.pid, ownerId: `check:${id}`, operationId: workspaceOperationId(input.workspaceRoot), projectId: input.projectId, runId: input.runId, workId: input.workId ?? null, checkId: id, stdoutPath, stderrPath, metadata: { command: group.command, role: "check", workspace_root: input.workspaceRoot, workspace_gate_id: workspaceGateId, budget } });
             const allocation = await reservePorts(context, { ownerId: managed.owner_id, processId: managed.id, names: group.ports });
             resources = allocation.ports;
@@ -329,13 +358,17 @@ async function runCodeChecksOwned(context, input, workspaceGateId, generation) {
             }
             const stdout = fs.openSync(stdoutPath, "a");
             const stderr = fs.openSync(stderrPath, "a");
+            let confirmedExpiry = null;
             try {
-                result = await runCheck(group.command, input.workspaceRoot, { ...codeExecutionEnvironment(input.workspaceRoot), DD_FLOW_EVIDENCE_DIR: evidenceDir, DD_FLOW_CHECK_COMPLETION_FILE: completionPath, ...portEnvironment(resources) }, stdout, stderr, (elapsed) => input.progress?.(`check ${index + 1}/${groups.length} still running (${elapsed}s): ${group.command}`), (pid) => {
-                    confirmManagedProcess(context, { id: managed.id, leaseToken: managed.lease_token, pid, processGroupId: process.platform === "win32" ? null : pid });
+                const runnerEnvironment = group.runnerEvidence ? { DD_FLOW_CHECK_RUNNER_EVIDENCE_PATH: path.join(evidenceDir, group.runnerEvidence.path), DD_FLOW_CHECK_RUNNER_PROGRESS_PATH: path.join(evidenceDir, "runner-progress.jsonl"), DD_FLOW_CHECK_INVOCATION_ID: id, DD_FLOW_CHECK_ID: id, DD_FLOW_CHECK_INPUT_HASH: inputHash, DD_FLOW_CHECK_VERIFICATION_EPOCH: epoch } : {};
+                if (group.runnerEvidence)
+                    fs.mkdirSync(path.dirname(path.join(evidenceDir, group.runnerEvidence.path)), { recursive: true });
+                result = await runCheck(group.command, input.workspaceRoot, { ...codeExecutionEnvironment(input.workspaceRoot), DD_FLOW_EVIDENCE_DIR: evidenceDir, DD_FLOW_CHECK_COMPLETION_FILE: completionPath, ...runnerEnvironment, ...portEnvironment(resources) }, stdout, stderr, (elapsed) => input.progress?.(`check ${index + 1}/${groups.length} still running (${elapsed}s): ${group.command}`), (pid) => {
+                    confirmedExpiry = confirmManagedProcess(context, { id: managed.id, leaseToken: managed.lease_token, pid, processGroupId: process.platform === "win32" ? null : pid }).lease_expires_at;
                     assertRunMutationAllowed(context, input.projectId, input.runId, generation);
                     if (budget)
                         admitRuntimeCheck(context, managed.id, managed.lease_token);
-                }, attemptMs => renewManagedProcess({ ...context, resourceDatabaseMode: "prepared_existing", databaseDeadlineAt: Date.now() + attemptMs }, { id: managed.id, leaseToken: managed.lease_token }));
+                }, attemptMs => renewManagedProcess({ ...context, resourceDatabaseMode: "prepared_existing", databaseDeadlineAt: Date.now() + attemptMs }, { id: managed.id, leaseToken: managed.lease_token }), { leaseExpiresAt: () => confirmedExpiry });
             }
             finally {
                 fs.closeSync(stdout);
@@ -364,8 +397,13 @@ async function runCodeChecksOwned(context, input, workspaceGateId, generation) {
             if (mutationPaths.length)
                 fs.appendFileSync(stderrPath, `\ncheck mutated project workspace: ${mutationPaths.join(", ")}\n`);
         }
-        const status = result.aborted ? "aborted" : result.exitCode === 0 && !result.error && artifacts.complete && mutationPaths.length === 0 ? "passed" : "failed";
+        const runnerEvidence = group.runnerEvidence ? readRunnerEvidence(evidenceDir, group.runnerEvidence, { invocation_id: id, check_id: id, command: group.command, input_hash: inputHash, verification_epoch: epoch }) : undefined;
+        const status = result.aborted ? "aborted" : result.exitCode === 0 && !result.error && artifacts.complete && mutationPaths.length === 0 && (!group.runnerEvidence || runnerEvidencePass(runnerEvidence)) ? "passed" : "failed";
         const receipt = receiptFor({ ...reserved, resources, result, status, after, mutationPaths, artifacts: artifacts.items });
+        if (group.runnerEvidence) {
+            receipt.runner_evidence_required = group.runnerEvidence;
+            receipt.runner_evidence = runnerEvidence ?? null;
+        }
         context.db.run("UPDATE check_receipts SET status = ?, exit_code = ?, after_fingerprint = ?, mutation_paths_json = ?, artifacts_json = ?, finished_at = ? WHERE id = ? AND project_id = ? AND status = 'running'", [receipt.status, receipt.exit_code, receipt.after_fingerprint, JSON.stringify(receipt.mutation_paths), JSON.stringify(receipt.artifacts), receipt.finished_at, id, input.projectId]);
         writeReceipt(receiptPath, receipt);
         receipts.push(receipt);
@@ -420,14 +458,15 @@ export function reconcileUnfinishedChecks(context, input) {
         const after = workspaceState(input.workspaceRoot, input.runHome ? [input.runHome] : []);
         const artifacts = receipt ? collectCheckArtifacts(path.join(path.dirname(receipt.completion_path || pendingReceipt.receipt_path), "artifacts"), receipt.required_artifacts ?? []) : { complete: false, missing: [], items: [] };
         const workspaceUnchanged = receipt?.before_fingerprint === after.fingerprint;
-        const status = completion === null ? "aborted" : completion.exit_code === 0 && workspaceUnchanged && artifacts.complete ? "passed" : "failed";
+        const runnerEvidence = receipt?.runner_evidence_required ? readRunnerEvidence(path.join(path.dirname(pendingReceipt.receipt_path), "artifacts"), receipt.runner_evidence_required, { invocation_id: receipt.id, check_id: receipt.id, command: receipt.command, input_hash: receipt.input_hash, verification_epoch: receipt.verification_epoch }) : undefined;
+        const status = completion === null ? "aborted" : completion.exit_code === 0 && workspaceUnchanged && artifacts.complete && (!receipt?.runner_evidence_required || runnerEvidencePass(runnerEvidence)) ? "passed" : "failed";
         const exitCode = completion?.exit_code ?? null;
         const finishedAt = completion?.finished_at ?? context.now();
         context.db.run("UPDATE check_receipts SET status = ?, exit_code = ?, after_fingerprint = ?, mutation_paths_json = ?, artifacts_json = ?, finished_at = ? WHERE id = ? AND project_id = ? AND status = 'running'", [status, exitCode, after.fingerprint, JSON.stringify(workspaceUnchanged ? [] : ["<workspace changed while detached check ran>"]), JSON.stringify(artifacts.items), finishedAt, pendingReceipt.id, input.projectId]);
         if (process)
             finishManagedProcess(context, { id: process.id, leaseToken: process.lease_token, state: status === "passed" ? "stopped" : "failed", reason: status === "passed" ? "reconciled_completion" : completion === null ? "completion_marker_missing" : "reconciled_check_failed" });
         if (receipt) {
-            const repaired = { ...receipt, completion_path: receipt.completion_path || path.join(path.dirname(pendingReceipt.receipt_path), "completion.json"), required_artifacts: receipt.required_artifacts ?? [], ...(status === "aborted" ? { abort_reason: "completion_marker_missing" } : {}), status, exit_code: exitCode, after_fingerprint: after.fingerprint, mutation_paths: workspaceUnchanged ? [] : ["<workspace changed while detached check ran>"], artifacts: artifacts.items, finished_at: finishedAt };
+            const repaired = { ...receipt, ...(receipt.runner_evidence_required ? { runner_evidence: runnerEvidence ?? null } : {}), completion_path: receipt.completion_path || path.join(path.dirname(pendingReceipt.receipt_path), "completion.json"), required_artifacts: receipt.required_artifacts ?? [], ...(status === "aborted" ? { abort_reason: "completion_marker_missing" } : {}), status, exit_code: exitCode, after_fingerprint: after.fingerprint, mutation_paths: workspaceUnchanged ? [] : ["<workspace changed while detached check ran>"], artifacts: artifacts.items, finished_at: finishedAt };
             writeReceipt(pendingReceipt.receipt_path, repaired);
             reconciled.push(repaired);
         }
@@ -472,10 +511,10 @@ function reserveOrReuseReceipt(context, input) {
                 throw new AppError("retry_check_invalid", "The requested retry already has a terminal outcome; choose its failed receipt for another retry", 2, { check_receipt_id: successor.id, retry_of_receipt_id: retryId, status: successor.status });
             }
         }
-        // Only success is reusable evidence. A new finish attempt must execute a
-        // failed check again: repairing dependencies/services need not change any
-        // tracked input. Lifecycle invocation replay owns command idempotency;
-        // the running-receipt guard above still prevents concurrent execution.
+        // An unchanged failed contract needs a concrete restored-condition retry,
+        // not repeated coordinator finish until it happens to become green.
+        if (prior && ["failed", "aborted"].includes(prior.status) && !retryId)
+            return { receipt: prior };
         if (prior?.status === "passed" && !retryIds.has(prior.id) && input.group.reusable && reusablePrior)
             return { receipt: prior };
         let ordinal = (context.db.get("SELECT COALESCE(MAX(reservation_sequence), 0) + 1 AS sequence FROM check_receipts WHERE project_id = ? AND run_id = ?", [input.projectId, input.runId])?.sequence ?? 1);
@@ -522,10 +561,10 @@ export function validateFailedCheckRetry(context, input) {
 export function checkReceipts(context, input) {
     const where = input.workId ? "project_id = ? AND run_id = ? AND work_id = ?" : "project_id = ? AND run_id = ?";
     const params = input.workId ? [input.projectId, input.runId, input.workId] : [input.projectId, input.runId];
-    return context.db.all(`SELECT id, declaration_id, check_refs_json, gate, scope, work_id, command, input_hash, verification_epoch, retry_of_receipt_id, retry_reason, status, exit_code, stdout_path, stderr_path, receipt_path, workspace_fingerprint, before_fingerprint, after_fingerprint, profile_hash, mutation_paths_json, artifacts_json, started_at, finished_at FROM check_receipts WHERE ${where} ORDER BY reservation_sequence, rowid`, params).map((row) => ({ ...row, local_id: row.id.slice(row.id.lastIndexOf("/") + 1), check_refs: parseArray(row.check_refs_json, [row.declaration_id]), mutation_paths: parseArray(row.mutation_paths_json, []), resources: readReceiptResources(row.receipt_path), ...resolvedReceiptArtifacts(row.receipt_path, JSON.parse(row.artifacts_json)) }));
+    return context.db.all(`SELECT id, declaration_id, check_refs_json, gate, scope, work_id, command, input_hash, verification_epoch, retry_of_receipt_id, retry_reason, status, exit_code, stdout_path, stderr_path, receipt_path, workspace_fingerprint, before_fingerprint, after_fingerprint, profile_hash, mutation_paths_json, artifacts_json, started_at, finished_at FROM check_receipts WHERE ${where} ORDER BY reservation_sequence, rowid`, params).map((row) => ({ ...row, local_id: row.id.slice(row.id.lastIndexOf("/") + 1), check_refs: parseArray(row.check_refs_json, [row.declaration_id]), mutation_paths: parseArray(row.mutation_paths_json, []), resources: readReceiptResources(row.receipt_path), ...resolvedReceiptArtifacts(row.receipt_path, JSON.parse(row.artifacts_json), row) }));
 }
 /** File bytes remain immutable; only the reader projects their current location. */
-function resolvedReceiptArtifacts(receiptPath, artifacts) {
+function resolvedReceiptArtifacts(receiptPath, artifacts, binding) {
     let original = {};
     try {
         original = JSON.parse(fs.readFileSync(receiptPath, "utf8"));
@@ -537,7 +576,14 @@ function resolvedReceiptArtifacts(receiptPath, artifacts) {
         const relative = path.relative(oldRoot, file);
         return !path.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path.sep}`) ? path.join(currentRoot, relative) : file;
     };
-    return { completion_path: path.join(currentRoot, "completion.json"), required_artifacts: original.required_artifacts ?? [], inputs: original.inputs ?? [], artifacts: artifacts.map((artifact) => ({ ...artifact, path: relocate(artifact.path) })) };
+    let evidence = null;
+    if (original.runner_evidence_required && original.id && original.command && original.input_hash && original.verification_epoch) {
+        const root = path.join(currentRoot, "artifacts");
+        const retained = collectCheckArtifacts(root, [original.runner_evidence_required.path]);
+        if (retained.complete && JSON.stringify(retained.items) === JSON.stringify(artifacts))
+            evidence = readRunnerEvidence(root, original.runner_evidence_required, { invocation_id: binding.id, check_id: binding.id, command: binding.command, input_hash: binding.input_hash, verification_epoch: binding.verification_epoch });
+    }
+    return { completion_path: path.join(currentRoot, "completion.json"), required_artifacts: original.required_artifacts ?? [], inputs: original.inputs ?? [], artifacts: artifacts.map((artifact) => ({ ...artifact, path: relocate(artifact.path) })), ...(original.runner_evidence_required ? { runner_evidence_required: original.runner_evidence_required, runner_evidence: evidence } : {}) };
 }
 export function workspaceFingerprint(root) { return workspaceState(root).fingerprint; }
 /** One NUL-aware source of truth for paths differing from HEAD. Rename/copy
@@ -604,12 +650,12 @@ function deduplicate(checks, commands) {
         const reusable = check.reuse === "deterministic";
         // Stage labels identify obligations, not different processes in this gate.
         // Cross-invocation reuse still requires the explicit deterministic contract.
-        const key = JSON.stringify([commands[index], artifacts, ports, inputs, reusable]);
+        const key = JSON.stringify([commands[index], artifacts, ports, inputs, reusable, check.runner_evidence ?? null]);
         const current = groups.get(key);
         if (current)
             current.declarations.push(check);
         else
-            groups.set(key, { gate: check.run_at, command: commands[index], declarations: [check], requiredArtifacts: artifacts, ports, inputs, reusable });
+            groups.set(key, { gate: check.run_at, command: commands[index], declarations: [check], requiredArtifacts: artifacts, ports, inputs, reusable, ...(check.runner_evidence ? { runnerEvidence: check.runner_evidence } : {}) });
     });
     return [...groups.values()].map(group => ({ ...group, gate: [...group.declarations].map(check => check.run_at).sort()[0], declarations: [...group.declarations].sort((left, right) => checkRef(left).localeCompare(checkRef(right))) }));
 }
@@ -657,7 +703,7 @@ function checkRef(check) { return check.canonical_ref ?? check.id; }
 function assertConsistentDeclarations(checks, commands) {
     const seen = new Map();
     for (const [index, check] of checks.entries()) {
-        const contract = JSON.stringify([check.run_at, commands[index], [...(check.required_artifacts ?? [])].sort(), [...(check.ports ?? [])].sort(), normalizedInputs(check.inputs ?? []), check.reuse ?? null]);
+        const contract = JSON.stringify([check.run_at, commands[index], [...(check.required_artifacts ?? [])].sort(), [...(check.ports ?? [])].sort(), normalizedInputs(check.inputs ?? []), check.reuse ?? null, check.runner_evidence ?? null]);
         const ref = checkRef(check), prior = seen.get(ref);
         if (prior && prior !== contract)
             throw new AppError("check_declaration_conflict", "The same check reference has conflicting execution definitions", 2, { check_ref: ref });
@@ -760,11 +806,20 @@ function explicitInputFiles(root, inputs, ignoredRoots) {
         visit(path.resolve(root, input), input, new Set());
     return [...result.entries()];
 }
-function checkInputHash(workspaceRoot, group, profileHash, inputFingerprint) { return crypto.createHash("sha256").update(JSON.stringify({ workspace_root: path.resolve(workspaceRoot), gate: group.reusable ? null : group.gate, command: group.command, required_artifacts: group.requiredArtifacts, ports: group.ports, inputs: group.inputs, profile_hash: profileHash, environment: environmentFingerprint(workspaceRoot), input_fingerprint: inputFingerprint })).digest("hex"); }
+function checkInputHash(workspaceRoot, group, profileHash, inputFingerprint) { return crypto.createHash("sha256").update(JSON.stringify({ workspace_root: path.resolve(workspaceRoot), gate: group.reusable ? null : group.gate, command: group.command, required_artifacts: group.requiredArtifacts, ports: group.ports, inputs: group.inputs, ...(group.runnerEvidence ? { runner_evidence: group.runnerEvidence } : {}), profile_hash: profileHash, environment: environmentFingerprint(workspaceRoot), input_fingerprint: inputFingerprint })).digest("hex"); }
 function bindReceipt(receipt, group) { return { ...receipt, gate: group.gate, declaration_id: group.declarations[0].id, check_refs: group.declarations.map(checkRef), required_artifacts: group.requiredArtifacts, inputs: group.inputs }; }
-export function checkReceiptEvidenceValid(receipt) { if (receipt.status !== "passed" || receipt.exit_code !== 0 || receipt.before_fingerprint !== receipt.after_fingerprint || !fs.existsSync(receipt.completion_path) || readCompletion(receipt.completion_path)?.exit_code !== 0)
-    return false; const stored = readReceipt(receipt.receipt_path); if (!stored || stored.status !== "passed" || stored.input_hash !== receipt.input_hash || stored.profile_hash !== receipt.profile_hash)
-    return false; const artifacts = collectCheckArtifacts(path.join(path.dirname(receipt.receipt_path), "artifacts"), stored.required_artifacts ?? []); return artifacts.complete && JSON.stringify(artifacts.items) === JSON.stringify(stored.artifacts ?? []); }
+export function checkReceiptEvidenceValid(receipt) {
+    if (receipt.status !== "passed" || receipt.exit_code !== 0 || receipt.before_fingerprint !== receipt.after_fingerprint || !fs.existsSync(receipt.completion_path) || readCompletion(receipt.completion_path)?.exit_code !== 0)
+        return false;
+    const stored = readReceipt(receipt.receipt_path);
+    if (!stored || stored.status !== "passed" || stored.input_hash !== receipt.input_hash || stored.profile_hash !== receipt.profile_hash)
+        return false;
+    const root = path.join(path.dirname(receipt.receipt_path), "artifacts");
+    if (stored.runner_evidence_required && !runnerEvidencePass(readRunnerEvidence(root, stored.runner_evidence_required, { invocation_id: receipt.id, check_id: receipt.id, command: receipt.command, input_hash: receipt.input_hash, verification_epoch: receipt.verification_epoch })))
+        return false;
+    const artifacts = collectCheckArtifacts(root, stored.required_artifacts ?? []);
+    return artifacts.complete && JSON.stringify(artifacts.items) === JSON.stringify(stored.artifacts ?? []);
+}
 function parseArray(value, fallback) { try {
     const parsed = JSON.parse(value);
     return Array.isArray(parsed) && parsed.every((item) => typeof item === "string") ? parsed : fallback;
@@ -826,6 +881,7 @@ function listFiles(root) {
 }
 export function runCheck(command, cwd, environment, stdout, stderr, heartbeat, onSpawn, renewLease, observation = {}) {
     const inactivityTimeoutMs = validateObservationDuration(observation.inactivityTimeoutMs ?? 30 * 60_000);
+    const { startupMs: runnerStartupMs, executionMs: runnerExecutionMs } = runnerObservationDurations(environment.DD_FLOW_CHECK_RUNNER_PROGRESS_PATH ? environment : {});
     return new Promise((resolve) => {
         const started = Date.now();
         const child = spawn("/bin/sh", ["-c", checkShellScript()], { cwd, env: { ...environment, DD_FLOW_CHECK_COMMAND: command }, stdio: ["pipe", "pipe", "pipe"], detached: process.platform !== "win32" });
@@ -839,6 +895,10 @@ export function runCheck(command, cwd, environment, stdout, stderr, heartbeat, o
         let renewalTimer;
         const clock = new ObservationClock({ timeoutMs: inactivityTimeoutMs });
         let outputCursor = 0;
+        let runnerSequence = 0;
+        let runnerPhase = "startup";
+        const runnerProgress = environment.DD_FLOW_CHECK_RUNNER_PROGRESS_PATH;
+        const runnerClock = runnerProgress ? new ObservationClock({ timeoutMs: runnerStartupMs }) : null;
         const outputs = [fs.createWriteStream("", { fd: stdout, autoClose: false }), fs.createWriteStream("", { fd: stderr, autoClose: false })];
         const flushed = outputs.map(output => new Promise(resolve => { output.once("finish", resolve); output.once("error", () => resolve()); }));
         const stop = (cause) => {
@@ -863,6 +923,18 @@ export function runCheck(command, cwd, environment, stdout, stderr, heartbeat, o
         const observationTimer = setInterval(() => {
             if (stopping || closed || observation.phase?.() === "serving")
                 return;
+            if (runnerClock && runnerProgress) {
+                for (const event of readRunnerProgress(runnerProgress, environment.DD_FLOW_CHECK_INVOCATION_ID ?? "", runnerSequence)) {
+                    runnerSequence = event.sequence;
+                    runnerPhase = event.phase;
+                    runnerClock.sample(runnerSequence, Date.parse(event.at));
+                }
+                // The outer guard includes the runner's bounded cleanup tail.
+                runnerClock.timeoutMs = runnerPhase === "execution" ? runnerExecutionMs : runnerStartupMs;
+                if (runnerClock.sample(runnerSequence))
+                    stop(new AppError("operation_observation_lost", "Structured test runner stopped making progress", 1, { phase: runnerPhase, sequence: runnerSequence }));
+                return;
+            }
             if (clock.sample(outputCursor))
                 stop(new AppError("operation_observation_lost", "Owned command has no confirmed progress within its inactivity window", 1, { phase: observation.phase?.() ?? "finite", inactivity_timeout_ms: inactivityTimeoutMs }));
         }, Math.min(1000, inactivityTimeoutMs));
@@ -871,7 +943,10 @@ export function runCheck(command, cwd, environment, stdout, stderr, heartbeat, o
         child.once("error", (value) => { error = value.message; });
         for (const [index, stream] of [child.stdout, child.stderr].entries()) {
             outputs[index].once("error", stop);
-            stream.on("data", () => { outputCursor++; clock.sample(outputCursor); });
+            stream.on("data", () => { if (!runnerClock) {
+                outputCursor++;
+                clock.sample(outputCursor);
+            } });
             stream.pipe(outputs[index]);
         }
         child.stdin.on("error", stop);
@@ -898,6 +973,13 @@ export function runCheck(command, cwd, environment, stdout, stderr, heartbeat, o
             stop(cause);
             return;
         }
+        if (observation.leaseExpiresAt) {
+            const expiry = observation.leaseExpiresAt();
+            if (!expiry || !renewalConfirmed(renewal, performance.now(), expiry)) {
+                stop("check confirmation has no current authority");
+                return;
+            }
+        }
         child.stdin.end("admitted\n");
         clock.sample(outputCursor);
         const renew = () => {
@@ -926,7 +1008,7 @@ export function runCheck(command, cwd, environment, stdout, stderr, heartbeat, o
                     if (expiry <= Date.now())
                         throw Object.assign(new Error("Check renewal receipt expired before acknowledgement"), { code: "process_maintenance_timeout" });
                 }
-                if (!renewalRemaining(renewal) || !renewalConfirmed(renewal)) {
+                if (!renewalConfirmed(renewal, performance.now(), typeof receipt === "object" && receipt.owned ? receipt.lease_expires_at : null)) {
                     stop("managed process renewal budget exhausted");
                     return;
                 }

package/dist/services/compatibility-preflight.js

@@ -1,12 +1,19 @@
 import { AppError } from "../shared/errors.js";
 import { getCliBuildInfo } from "./build-info.js";
 import { classifyCliOperation } from "./cli-operation-classifier.js";
-import { resolveOperationProjectRoot, selectEngine } from "./engines.js";
-export function preflightCliCompatibility(context, args, env = process.env, resolvedProjectRoot) {
+import { parseCommandArgs } from "./lifecycle-command.js";
+export async function preflightCliCompatibility(context, args, env = process.env, resolvedProjectRoot) {
     const classification = classifyCliOperation(args, env);
     if (classification.mode === "router_native") {
         return { ok: true, classification, compatibility: null };
     }
+    // Internal scope-free ownership maintenance has no project compatibility
+    // work. Keep the engine/protocol/canon graph out of that cold path.
+    const parsed = parseCommandArgs(args);
+    if (resolvedProjectRoot === null && parsed.positional[0] === "runtime" && parsed.positional[1] === "process"
+        && !parsed.options.has("project-root") && !parsed.options.has("root"))
+        return { ok: true, classification, compatibility: null };
+    const { resolveOperationProjectRoot, selectEngine } = await import("./engines.js");
     const projectRoot = resolvedProjectRoot ?? resolveOperationProjectRoot(context, args);
     if (!projectRoot) {
         return { ok: true, classification, compatibility: null };

package/dist/services/dashboard.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
-import { spawnSync } from "node:child_process";
+import { commandResult } from '../harness-runtime/lib/process-json.mjs';
+import { SETUP_STARTUP_MS } from '../harness-runtime/lib/setup-progress.mjs';
 import { isActiveProtocolStatus, isActiveQueueStatus, isQueueHistoryStatus } from "../domain/contracts.js";
 import { AppError } from "../shared/errors.js";
 import { prepareOutputFile } from "../cli/input-preparation.js";
@@ -14,9 +15,9 @@ import { activeFlowSessionsForProject } from "./sessions.js";
 import { usageForRun } from "./usage.js";
 import { normalizeProtocolLifecycle } from "./protocol-lifecycle.js";
 import { planSummary, planWithProgress } from "./plan-runtime.js";
-export function getCmuxStatus(context, input) {
+export async function getCmuxStatus(context, input) {
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
-    return { ok: true, project_root: project.root, cmux: detectCmux(context) };
+    return { ok: true, project_root: project.root, cmux: await detectCmux(context) };
 }
 export function prepareDashboardRender(context, input) {
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
@@ -65,7 +66,7 @@ export function renderGlobalDashboard(context, input = {}) {
     writeMarkdown(output, markdown);
     return { ok: true, dashboard: { path: output, bytes: Buffer.byteLength(markdown) } };
 }
-export function openDashboard(context, input) {
+export async function openDashboard(context, input) {
     prepareDashboardOptions(input);
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
     const config = readProjectConfig(context, project.id);
@@ -75,20 +76,20 @@ export function openDashboard(context, input) {
         ok: true,
         project_root: project.root,
         dashboard: { path: dashboardPath },
-        open: openCmuxDashboard(context, project.root, dashboardPath, format)
+        open: await openCmuxDashboard(context, project.root, dashboardPath, format)
     };
 }
-export function openGlobalDashboard(context, input = {}) {
+export async function openGlobalDashboard(context, input = {}) {
     prepareDashboardOptions(input);
     const format = parseDashboardFormat(input.format, "html");
     const rendered = renderGlobalDashboard(context, { format });
     return {
         ok: true,
         dashboard: rendered.dashboard,
-        open: openDashboardPath(context, rendered.dashboard.path, format)
+        open: await openDashboardPath(context, rendered.dashboard.path, format)
     };
 }
-export function openProtocolDashboard(context, input) {
+export async function openProtocolDashboard(context, input) {
     prepareDashboardOptions(input);
     const format = parseDashboardFormat(input.format, "html");
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
@@ -103,7 +104,7 @@ export function openProtocolDashboard(context, input) {
         project_root: project.root,
         protocol_id: input.protocol,
         dashboard: rendered.dashboard,
-        open: openCmuxDashboard(context, project.root, rendered.dashboard.path, format)
+        open: await openCmuxDashboard(context, project.root, rendered.dashboard.path, format)
     };
 }
 export function prepareDashboardRefresh(context, input) {
@@ -138,7 +139,7 @@ function prepareRefreshOutputs(context, project, config, format, protocol) {
             prepareOutputFile(globalDashboardJsonPath(context));
     }
 }
-export function refreshDashboard(context, input) {
+export async function refreshDashboard(context, input) {
     const { project, config, format, openMode } = prepareDashboardRefresh(context, input);
     if (!config.dashboard.project) {
         return {
@@ -163,7 +164,7 @@ export function refreshDashboard(context, input) {
         dashboard: rendered.dashboard,
         project_summary: projectSummary,
         global_dashboard: global.dashboard,
-        open: shouldOpen ? openCmuxDashboard(context, project.root, rendered.dashboard.path, format) : { ok: true, skipped: true, reason: "open_disabled" }
+        open: shouldOpen ? await openCmuxDashboard(context, project.root, rendered.dashboard.path, format) : { ok: true, skipped: true, reason: "open_disabled" }
     };
 }
 export function refreshGlobalDashboard(context, input = {}) {
@@ -269,13 +270,13 @@ export function dashboardData(context, input) {
     }
     return { ok: true, dashboard: buildProjectDashboardData(context, project, projectDashboardHtmlPath(context, project.id)) };
 }
-function openCmuxDashboard(context, projectRoot, dashboardPath, format = "markdown") {
+async function openCmuxDashboard(context, projectRoot, dashboardPath, format = "markdown") {
     const project = requireProjectByRoot(context, resolveProjectRoot(projectRoot));
     const config = readProjectConfig(context, project.id);
     if (config.integrations.cmux.mode === "off") {
         return { ok: true, skipped: true, reason: "cmux_off" };
     }
-    const cmux = detectCmux(context);
+    const cmux = await detectCmux(context);
     if (!cmux.available) {
         if (config.integrations.cmux.mode === "required") {
             throw new AppError("cmux_unavailable", "cmux is required by project config but is unavailable", 1, { cmux });
@@ -286,20 +287,20 @@ function openCmuxDashboard(context, projectRoot, dashboardPath, format = "markdo
         return { ok: true, opened: false, dry_run: true, command: cmuxOpenCommand(format, dashboardPath) };
     }
     const command = cmuxOpenCommand(format, dashboardPath);
-    const result = spawnSync(command[0], command.slice(1), { encoding: "utf8" });
-    if (result.status !== 0) {
+    const result = await commandResult(command[0], command.slice(1), { startupMs: SETUP_STARTUP_MS });
+    if (result.exit_code !== 0) {
         if (config.integrations.cmux.mode === "required") {
             throw new AppError("cmux_open_failed", "cmux markdown open failed", 1, {
-                status: result.status,
+                status: result.exit_code,
                 stderr: result.stderr.trim()
             });
         }
-        return { ok: true, skipped: true, reason: "cmux_open_failed", status: result.status, stderr: result.stderr.trim() };
+        return { ok: true, skipped: true, reason: "cmux_open_failed", status: result.exit_code, stderr: result.stderr.trim() };
     }
     return { ok: true, opened: true, command };
 }
-function openDashboardPath(context, dashboardPath, format) {
-    const cmux = detectCmux(context);
+async function openDashboardPath(context, dashboardPath, format) {
+    const cmux = await detectCmux(context);
     if (!cmux.available) {
         return { ok: true, skipped: true, reason: "cmux_unavailable", cmux };
     }
@@ -307,9 +308,9 @@ function openDashboardPath(context, dashboardPath, format) {
         return { ok: true, opened: false, dry_run: true, command: cmuxOpenCommand(format, dashboardPath) };
     }
     const command = cmuxOpenCommand(format, dashboardPath);
-    const result = spawnSync(command[0], command.slice(1), { encoding: "utf8" });
-    if (result.status !== 0) {
-        return { ok: true, skipped: true, reason: "cmux_open_failed", status: result.status, stderr: result.stderr.trim() };
+    const result = await commandResult(command[0], command.slice(1), { startupMs: SETUP_STARTUP_MS });
+    if (result.exit_code !== 0) {
+        return { ok: true, skipped: true, reason: "cmux_open_failed", status: result.exit_code, stderr: result.stderr.trim() };
     }
     return { ok: true, opened: true, command };
 }
@@ -318,17 +319,23 @@ function cmuxOpenCommand(format, dashboardPath) {
         ? ["cmux", "browser", "open", pathToFileUrl(dashboardPath)]
         : ["cmux", "markdown", "open", dashboardPath];
 }
-function detectCmux(context) {
+async function detectCmux(context) {
     if (context.env.DD_FLOW_CMUX_AVAILABLE === "true") {
         return { available: true, source: "env" };
     }
     if (context.env.DD_FLOW_CMUX_AVAILABLE === "false") {
         return { available: false, source: "env", reason: "forced_unavailable" };
     }
-    const result = spawnSync("cmux", ["--version"], { encoding: "utf8" });
-    return result.status === 0
+    let result;
+    try {
+        result = await commandResult("cmux", ["--version"], { startupMs: SETUP_STARTUP_MS, phase: 'native-version' });
+    }
+    catch (error) {
+        return { available: false, source: 'path', reason: error instanceof Error ? error.message : String(error) };
+    }
+    return result.exit_code === 0
         ? { available: true, source: "path", version: result.stdout.trim() }
-        : { available: false, source: "path", reason: result.error?.message ?? result.stderr.trim() ?? "cmux not found" };
+        : { available: false, source: "path", reason: result.stderr.trim() || "cmux not found" };
 }
 export function prepareDashboardOptions(input) {
     if (input.format !== undefined)