@deksden-com/dd-flow-cli 0.9.0-beta.136 → 0.9.0-beta.138

package/dist/services/stage-report-renderer.js

@@ -4,6 +4,69 @@ import crypto from "node:crypto";
 import { AppError } from "../shared/errors.js";
 import { withProjectionLock } from "../storage/projection-lock.js";
 import { writeJsonAtomic } from "../storage/paths.js";
+import { assertRunBundleSqlAuthority } from "./runs.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+/** Accepted bytes come from SQL receipts, never from the mutable publication.
+ * Stage completion and its independent committed checksum must agree. This is
+ * byte custody, not a substitute for the registered handler's semantic gates.
+ */
+export function readAcceptedStageData(context, scope) {
+    function refuse() { throw new AppError("stage_data_custody_invalid", "Accepted stage data lacks matching committed SQL byte custody", 1, { run_id: scope.runId, stage: scope.stage }); }
+    const run = context.db.get("SELECT index_json, run_root, run_dir FROM runs WHERE project_id = ? AND id = ?", [scope.projectId, scope.runId]);
+    if (!run)
+        refuse();
+    const index = JSON.parse(run.index_json);
+    assertRunBundleSqlAuthority(context, scope, index.execution_bundle);
+    const stage = index.stage_runs?.find((item) => item.stage === scope.stage);
+    const portable = (value) => typeof value === "string" && Boolean(value) && !path.posix.isAbsolute(value) && !path.win32.isAbsolute(value) && !value.includes("\\") && !value.includes("\0") && value.split("/").every(part => Boolean(part) && part !== "." && part !== "..");
+    if (!stage || stage.status !== "done" || !portable(stage.dir) || !portable(stage.data)
+        || typeof stage.attempt !== "string" || !/^try-[0-9]{3,}$/.test(stage.attempt)
+        || typeof stage.data_sha256 !== "string" || !/^[a-f0-9]{64}$/.test(stage.data_sha256))
+        refuse();
+    const root = run.run_root ?? run.run_dir;
+    if (!path.isAbsolute(root))
+        refuse();
+    const relative = `${stage.dir}/${stage.data}`, destination = path.resolve(root, relative);
+    const rows = context.db.all("SELECT event_type, payload_json FROM audit_events WHERE project_id = ? AND event_type IN ('flow_run.stage_packet', 'flow_run.stage_report') AND json_extract(payload_json, '$.run_id') = ? AND json_extract(payload_json, '$.stage') = ? AND json_extract(payload_json, '$.attempt') = ? LIMIT 33", [scope.projectId, scope.runId, scope.stage, stage.attempt]);
+    if (rows.length > 32)
+        refuse();
+    let accepted;
+    for (const row of rows) {
+        if (Buffer.byteLength(row.payload_json) > 8 * 1024 * 1024)
+            refuse();
+        const receipt = JSON.parse(row.payload_json);
+        if (receipt.sha256 !== stage.data_sha256)
+            continue;
+        const locator = row.event_type === "flow_run.stage_packet" ? receipt.file : typeof receipt.root === "string" ? path.join(receipt.root, "stage-report.json") : null;
+        if (typeof locator !== "string" || resolveStagePublicationPath(context, scope.projectId, scope.runId, locator) !== destination)
+            continue;
+        let bytes;
+        if (row.event_type === "flow_run.stage_packet") {
+            if (typeof receipt.base64 !== "string")
+                refuse();
+            bytes = Buffer.from(receipt.base64, "base64");
+            if (bytes.toString("base64") !== receipt.base64)
+                refuse();
+        }
+        else {
+            if (typeof receipt.bytes?.json !== "string")
+                refuse();
+            bytes = Buffer.from(receipt.bytes.json);
+        }
+        if (!bytes.length || bytes.length > 1024 * 1024 || crypto.createHash("sha256").update(bytes).digest("hex") !== stage.data_sha256)
+            refuse();
+        if (accepted && !accepted.equals(bytes))
+            refuse();
+        accepted = bytes;
+    }
+    if (!accepted)
+        refuse();
+    return { bytes: Buffer.from(accepted), result: { path: relative, sha256: stage.data_sha256 },
+        input_sha256: stage.input_sha256, data_schema_id: stage.data_schema_id,
+        authority_sha256: hybridDigest({ scope, attempt: stage.attempt, directory: stage.dir, data: stage.data,
+            input_sha256: stage.input_sha256 ?? null, data_schema_id: stage.data_schema_id ?? null,
+            anchor: index.execution_bundle ?? null, data_sha256: stage.data_sha256 }) };
+}
 /** Deterministic JSON -> Markdown/HTML projection shared by every stage. */
 export function writeStageReport(root, report) {
     const json = path.join(root, "stage-report.json");
@@ -164,6 +227,19 @@ export function reconcileRunStageReports(context, projectId, runId, exceptStage)
 }
 function normalizeStageReport(report) {
     const semantic = object(report.semantic);
+    if (semantic.materialization !== undefined) {
+        const value = object(semantic.materialization);
+        const authored = object(value.authored_result);
+        const relative = (item) => typeof item === "string" && item.length > 0 && !path.isAbsolute(item) && !item.split(/[\\/]/).includes("..");
+        if (value.schema_id !== "dd-flow/protocolize-materialization@1" || value.run_id !== report.run_id || report.stage !== "protocolize" || value.stage !== "protocolize"
+            || !["create", "link", "update", "not_applicable"].includes(String(value.action)) || value.status !== "passed"
+            || authored.role !== "authored_input" || !relative(authored.run_relative_path) || !/^[a-f0-9]{64}$/.test(String(authored.sha256))
+            || !(value.feature_path === null || relative(value.feature_path)) || !Array.isArray(value.protocol_ids) || value.protocol_ids.some(id => typeof id !== "string")
+            || !Array.isArray(value.documents) || value.documents.some(item => { const ref = object(item); return !relative(ref.path) || !/^[a-f0-9]{64}$/.test(String(ref.sha256)); })
+            || !Array.isArray(value.owned_links) || value.owned_links.some(item => { const edge = object(item); return !relative(edge.feature_path) || !relative(edge.protocol_path) || !value.protocol_ids.includes(edge.protocol_id); })) {
+            throw new AppError("stage_report_materialization_invalid", "PROTOCOLIZE materialization receipt is malformed or out of scope", 1);
+        }
+    }
     const sourceArtifacts = object(report.artifacts);
     return {
         ...report,

package/dist/services/stage-work-graph.js

@@ -7,6 +7,23 @@ export function stageAttempt(context, projectId, runId, stage) {
     return [...stages].reverse().find(item => item.stage === stage)?.attempt ?? "try-001";
 }
 export function bindStageWork(context, input) {
+    context.db.writeTransaction(() => bindStageWorkOwned(context, input), "stage-work.bind");
+}
+function bindStageWorkOwned(context, input) {
+    const run = context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [input.projectId, input.runId]);
+    const index = run ? JSON.parse(run.index_json) : null;
+    if (index?.execution_bundle) {
+        // Stage attachment already admitted the frozen descriptor outside the writer.
+        // Membership checks here consume only authoritative SQLite facts.
+        const stage = index.stage_runs.find(item => item.stage === input.stage && item.status === "running");
+        const work = context.db.get("SELECT parent_work_id FROM works WHERE project_id = ? AND run_id = ? AND work_id = ?", [input.projectId, input.runId, input.workId]);
+        const parentOwned = !work?.parent_work_id || context.db.get("SELECT 1 FROM works WHERE project_id = ? AND run_id = ? AND work_id = ?", [input.projectId, input.runId, work.parent_work_id]);
+        const currentStage = index.current_stage ?? (index.execution_bundle.flow_id === "sdlc" ? index.stage_runs.at(-1)?.stage : undefined);
+        if (!stage || currentStage !== input.stage || !work || !parentOwned || input.attempt !== undefined && input.attempt !== (stage.attempt ?? "try-001")
+            || input.cycle !== undefined && input.cycle !== stageCycle(context, input.projectId, input.runId, input.stage)) {
+            throw new AppError("stage_work_scope_invalid", "Work membership does not belong to the active frozen stage scope", 1, { run_id: input.runId, stage: input.stage, work_id: input.workId });
+        }
+    }
     context.db.run("INSERT OR IGNORE INTO stage_work_memberships (project_id, run_id, work_id, stage, attempt, cycle) VALUES (?, ?, ?, ?, ?, ?)", [input.projectId, input.runId, input.workId, input.stage, input.attempt ?? stageAttempt(context, input.projectId, input.runId, input.stage), input.cycle ?? stageCycle(context, input.projectId, input.runId, input.stage)]);
 }
 export function stageCycle(context, projectId, runId, stage) {

package/dist/services/vnext-code.js

@@ -498,7 +498,7 @@ export function prepareVnextCodeRepair(context, input) {
 export function addVnextCodeRepair(context, input, prepared = prepareVnextCodeRepair(context, input)) {
     const { project, run } = prepared;
     if (prepared.kind === "replay")
-        return { ok: true, run_id: run.id, repair_work_id: prepared.previous.work_id, start_command: workStartCommand(context, prepared.previous), reused: true };
+        return { ok: true, run_id: run.id, repair_work_id: prepared.previous.work_id, start_command: workStartCommand(context, prepared.previous, { preview: true }), reused: true };
     const { parentWorkId, items, key, receipt } = prepared;
     const create = () => String(addWorkBatch(context, { parentWorkId, prepared: items, stage: input.stage ?? (input.reviewCycle ? "code-review" : "code"), ...(input.reviewCycle ? { cycle: input.reviewCycle } : {}) }).work_ids[key]);
     const id = input.registrationOwned ? create() : ensureRepairIntent(context, {
@@ -513,7 +513,7 @@ export function addVnextCodeRepair(context, input, prepared = prepareVnextCodeRe
         ...(receipt ? { check_receipt_id: receipt.id } : prepared.input.reviewFindings?.length ? { review_finding_ids: prepared.input.reviewFindings.map((finding) => finding.finding_ref) } : { semantic_unresolved: prepared.input.semanticUnresolved })
     });
     refreshRunWorkProjection(context, project.id, run.id);
-    return { ok: true, run_id: run.id, repair_work_id: id, start_command: workStartCommand(context, work) };
+    return { ok: true, run_id: run.id, repair_work_id: id, start_command: workStartCommand(context, work, { preview: true }) };
 }
 /** Retain the causal declaration for worker context; run_at still records its original gate. */
 export function selectRepairChecks(input) {
@@ -730,7 +730,7 @@ async function ensureCodeWorkspaceReady(context, projectId, run, root, readiness
     const profile = JSON.parse(run.index_json);
     const bootstrap = profile.execution_profile?.settings?.code_bootstrap;
     if (!bootstrap || typeof bootstrap.command !== "string" || typeof bootstrap.policy_ref !== "string") {
-        throw new AppError("execution_profile_invalid", "CODE requires a frozen bootstrap command in the RUN execution profile", 1, { run_id: run.id });
+        throw new AppError("execution_profile_invalid", "CODE requires an evidenced bootstrap command and policy in the frozen RUN profile; configure code_bootstrap before starting a code-ready RUN", 1, { run_id: run.id });
     }
     const receiptPath = path.join(root, "workspace-readiness.json");
     const ownerId = context.env.DD_FLOW_CODE_READINESS_OWNER;

package/dist/services/vnext-execution-profile.js

@@ -93,8 +93,8 @@ export function validateVnextExecutionProfile(value) {
         || profile.merge_delivery?.strategy !== "local"
         || !["retain", "delete_after_success"].includes(String(profile.merge_cleanup?.source))
         || !["code_completed", "code_review_completed", "merge_completed"].includes(String(profile.stop_target))
-        || !profile.code_bootstrap || typeof profile.code_bootstrap.command !== "string" || !profile.code_bootstrap.command.trim()
-        || typeof profile.code_bootstrap.policy_ref !== "string" || !profile.code_bootstrap.policy_ref.trim()
+        || (profile.code_bootstrap !== undefined && (!profile.code_bootstrap || typeof profile.code_bootstrap.command !== "string" || !profile.code_bootstrap.command.trim()
+            || typeof profile.code_bootstrap.policy_ref !== "string" || !profile.code_bootstrap.policy_ref.trim()))
         || (profile.execution === undefined ? profile.schema_id === "dd-flow/project-execution@3" : !isExecutionRouting(profile.execution))) {
         throw new AppError("execution_profile_invalid", "Project execution profile does not match its supported dd-flow schema", 1);
     }

package/dist/services/vnext-fanout.js

@@ -3,14 +3,16 @@ import path from "node:path";
 import { AppError } from "../shared/errors.js";
 import { resolveProjectRoot } from "../storage/paths.js";
 import { requireProjectByRoot } from "./projects.js";
-import { getFlowRunVariables, appendFlowRunTimelineEvent } from "./runs.js";
+import { getFlowRunVariables, appendFlowRunTimelineEvent, readFlowRunExecutionBundle } from "./runs.js";
 import { resolveExecutionPolicy } from "./execution-policy.js";
-import { listWorks, failWork, cancelWork } from "./work-registry.js";
+import { listWorks, failWork, cancelWork, readWorkBatchCustody } from "./work-registry.js";
 import { storageSessionId } from "./session-identity.js";
 import { reconcileUnfinishedChecks } from "./code-checks.js";
 import { vnextStageDirectory } from "../domain/stage-catalog.js";
 import { stageWorkIds, stageGraphScope } from "./stage-work-graph.js";
 import { eligibleCodexChildOverload } from "./codex-capacity.js";
+import { readDescriptorRootWork } from "./descriptor-root-work.js";
+import { selectMemoryCompositionRegistration } from "./memory-composition-registration.js";
 import { safeNativeFailure } from "../harness-runtime/lib/native-children.mjs";
 export const subagentCapacityKey = "runtime.subagent.available_slots";
 /** External concurrency is policy, never evidence of native child qualification. */
@@ -20,17 +22,85 @@ export function getStageFanoutCapacity(context, input) {
     const run = context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [project.id, input.runId]);
     if (!run)
         throw new AppError("not_found", "RUN is unavailable", 1);
-    const frozen = JSON.parse(run.index_json).execution_profile;
-    if (frozen?.settings.execution) {
+    const index = JSON.parse(run.index_json);
+    const bundle = index.execution_bundle ? readFlowRunExecutionBundle(context, { projectRoot, runId: input.runId }) : null;
+    const generic = bundle?.execution.work(input.stage).delegation;
+    if (generic?.mode === "external")
+        return input.nativeOnly
+            ? { run_key: null, available_slots: null, source: "harness_qualification" }
+            : { run_key: null, available_slots: generic.max_parallel, source: "external_policy" };
+    // Generic native admission already requires a scoped capacity receipt whose
+    // observed count covers this frozen limit. Mutable legacy variables cannot
+    // replace that receipt or silently prevent its productive dispatch.
+    if (generic?.mode === "native")
+        return { run_key: null, available_slots: generic.max_parallel, source: "harness_qualification" };
+    const frozen = index.execution_profile;
+    if (!bundle && frozen?.settings.execution) {
         if (!frozen.agent_profiles)
             throw new AppError("execution_profile_not_frozen", "Fan-out needs the RUN's frozen profiles", 1);
         const resolved = resolveExecutionPolicy({ ddFlowHome: context.ddFlowHome, policy: frozen.settings.execution, profiles: frozen.agent_profiles, stage: input.stage });
-        if (resolved.delegation.mode === "external")
+        if (resolved.delegation.mode === "external" && !input.nativeOnly)
             return { run_key: null, available_slots: resolved.delegation.max_parallel, source: "external_policy" };
     }
     const variables = getFlowRunVariables(context, { projectRoot, runId: input.runId });
     const available = variables.variables[subagentCapacityKey];
-    return { run_key: subagentCapacityKey, available_slots: typeof available === "number" && Number.isInteger(available) && available >= 0 ? available : null, source: "harness_qualification" };
+    return { run_key: subagentCapacityKey, available_slots: typeof available === "number" && Number.isInteger(available) && available >= 0 ? Math.min(available, generic?.max_parallel ?? available) : null, source: "harness_qualification" };
+}
+function nativeFailureController(context, projectId, runId, stage, parent) {
+    if (!context.db.get("SELECT 1 FROM sqlite_master WHERE type='table' AND name='run_controllers'"))
+        return null;
+    const rows = context.db.all("SELECT controller_id,generation,state_json FROM run_controllers WHERE project_id=? AND run_id=? AND status NOT IN ('completed','cancelled','superseded')", [projectId, runId]);
+    const matching = rows.filter(row => {
+        try {
+            const state = JSON.parse(row.state_json);
+            return state.stage === stage && state.sessions?.[state.current_session]?.id === parent;
+        }
+        catch {
+            return false;
+        }
+    });
+    return matching.length === 1 ? matching[0] : null;
+}
+/** Failure metadata authored by a Work is not native evidence. Require the
+ * independently recorded reconciliation and its exact current registry links. */
+export function verifiedNativeWorkFailure(context, input) {
+    const b = input.receipt.native_binding;
+    if (!b || b.schema_id !== "dd-flow/native-work-failure@1")
+        return;
+    const project = requireProjectByRoot(context, input.projectRoot);
+    const scope = stageGraphScope(context, project.id, input.runId, input.stage);
+    const controller = nativeFailureController(context, project.id, input.runId, input.stage, input.parentSessionId);
+    if (!controller || b.controller_id !== controller.controller_id || b.generation !== controller.generation
+        || b.project_id !== project.id || b.run_id !== input.runId || b.stage !== input.stage
+        || b.stage_attempt_id !== scope.attempt || b.stage_cycle !== scope.cycle
+        || b.work_id !== input.workId || b.parent_work_id !== input.parentWorkId
+        || b.parent_provider_session_id !== input.parentSessionId || b.terminal_turn_id !== input.receipt.terminal_turn_id
+        || input.receipt.source !== "native_child_observation" || input.receipt.outcome !== "failed")
+        return;
+    const link = context.db.get(`SELECT ws.id FROM work_sessions ws JOIN works w ON w.work_id=ws.work_id JOIN sessions s ON s.project_id=w.project_id AND s.session_id=ws.session_id
+    WHERE ws.id=? AND w.project_id=? AND w.run_id=? AND w.work_id=? AND w.parent_work_id=? AND ws.status='failed' AND w.status='failed' AND s.parent_session_id=? AND s.provider_session_id=? AND s.harness=?`, [b.work_session_id, project.id, input.runId, input.workId, input.parentWorkId, storageSessionId({ harness_id: b.harness_id, session_id: input.parentSessionId }), b.provider_session_id, b.harness_id]);
+    if (!link)
+        return;
+    const run = context.db.get("SELECT run_root FROM runs WHERE project_id=? AND id=?", [project.id, input.runId]);
+    try {
+        const events = fs.readFileSync(path.join(run.run_root, "timeline.jsonl"), "utf8").trim().split("\n");
+        const proof = events.some(line => {
+            const event = JSON.parse(line);
+            if (event.type !== "native_child_reconciliation" || event.stage !== input.stage)
+                return false;
+            const terminal = event.observations?.children?.find((child) => child.session_id === b.provider_session_id && child.terminal_turn_id === b.terminal_turn_id);
+            if (event.observations?.parent_session_id !== b.parent_provider_session_id || event.observations?.harness_id !== b.harness_id
+                || terminal?.status !== "failed" || terminal.terminal_observed_at !== input.receipt.terminal_observed_at
+                || JSON.stringify(safeNativeFailure(terminal.provider_error)) !== JSON.stringify(safeNativeFailure(input.receipt.provider_error)))
+                return false;
+            return event.reconciled?.some((entry) => entry.outcome === "failed"
+                && entry.native_binding && Object.keys(b).every(key => b[key] === entry.native_binding[key]));
+        });
+        return proof ? b : undefined;
+    }
+    catch {
+        return;
+    }
 }
 export function fanoutState(input) {
     if (!input.hasWork)
@@ -57,17 +127,64 @@ export function readFanoutDescriptor(stageRoot) {
     }
     return value;
 }
+/** Memory graphs are SQL-owned; a mutable/missing fanout.json is not their
+ * dispatch authority. Domain registrations and Work launch owners still fence
+ * productive assignments, including reviewer/correction waves.
+ */
+export function memoryStageFanoutDescriptor(context, input) {
+    if (!["compose", "review"].includes(input.stage))
+        return null;
+    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    const run = context.db.get("SELECT flow_kind,index_json FROM runs WHERE project_id=? AND id=?", [project.id, input.runId]);
+    if (run?.flow_kind !== "mb-init")
+        return null;
+    const bundle = readFlowRunExecutionBundle(context, input);
+    if (!bundle || bundle.descriptor.descriptor.id !== "mb-init")
+        throw new AppError("stage_graph_compatibility_required", "Memory graph requires its admitted RUN bundle", 1);
+    const index = JSON.parse(run.index_json);
+    if (index.current_stage !== input.stage || !index.stage_runs.some(stage => stage.stage === input.stage && stage.status === "running"))
+        return null;
+    const root = readDescriptorRootWork(context, { projectId: project.id, runId: input.runId }, bundle);
+    const scope = stageGraphScope(context, project.id, input.runId, input.stage), members = stageWorkIds(context, project.id, input.runId, input.stage);
+    if (root.status !== "running" || !members.has(root.workId))
+        throw new AppError("stage_graph_conflict", "Memory graph lost its active coordinator", 1);
+    for (const id of members) {
+        if (id === root.workId)
+            continue;
+        const work = context.db.get("SELECT parent_work_id,result_schema FROM works WHERE project_id=? AND run_id=? AND work_id=?", [project.id, input.runId, id]);
+        const schemas = input.stage === "compose" ? ["dd-flow/memory-composition-work-result@1"] : ["dd-flow/memory-review-work-result@1", "dd-flow/memory-repair-work-result@1"];
+        if (!work || work.parent_work_id !== root.workId || !schemas.includes(work.result_schema ?? ""))
+            throw new AppError("stage_graph_conflict", "Memory graph contains an unassigned Work", 1);
+        const custody = readWorkBatchCustody(context, id);
+        if (custody.scope.project_id !== scope.project_id || custody.scope.run_id !== scope.run_id || custody.scope.attempt !== scope.attempt
+            || custody.scope.cycle !== scope.cycle || custody.scope.stage !== input.stage || custody.scope.parent_work_id !== root.workId)
+            throw new AppError("stage_graph_conflict", "Memory graph contains foreign allocation custody", 1);
+    }
+    if (input.stage === "compose") {
+        const children = context.db.all("SELECT work_id FROM works WHERE project_id=? AND run_id=? AND parent_work_id=?", [project.id, input.runId, root.workId]).filter(work => members.has(work.work_id));
+        const registered = context.db.get("SELECT 1 FROM audit_events WHERE project_id=? AND event_type='memory.composition_registration' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.scope.attempt')=? AND json_extract(payload_json,'$.scope.cycle')=? LIMIT 1", [project.id, input.runId, scope.attempt, scope.cycle]);
+        if (children.length || registered) {
+            const registration = selectMemoryCompositionRegistration(context, { ...scope, stage: "compose", parent_work_id: root.workId });
+            const ids = new Set(Object.values(registration.work_ids));
+            if (ids.size !== children.length || children.some(work => !ids.has(work.work_id)))
+                throw new AppError("stage_graph_conflict", "Memory composition differs from its registered graph", 1);
+        }
+    }
+    return { schema_id: "dd-flow/work-fanout@2", kind: "work_fanout", scope, stage: input.stage, parent_work_id: root.workId, dispatch: "none", capacity_required: true };
+}
 /** Read-only projection for an external orchestrator.  dd-flow keeps the graph authority. */
 export function getVnextFanoutStatus(context, input) {
     const projectRoot = resolveProjectRoot(input.projectRoot);
     const project = requireProjectByRoot(context, projectRoot);
-    const run = context.db.get("SELECT run_root FROM runs WHERE project_id = ? AND id = ?", [project.id, input.runId]);
+    const run = context.db.get("SELECT run_root, index_json FROM runs WHERE project_id = ? AND id = ?", [project.id, input.runId]);
     if (!run)
         throw new AppError("not_found", "RUN is not registered", 1, { run_id: input.runId });
     if (!run.run_root)
         throw new AppError("runtime_artifact_missing", "RUN artifact root is unavailable", 1, { run_id: input.runId });
-    const stageRoot = path.join(run.run_root, vnextStageDirectory(input.stage));
-    let descriptor = readFanoutDescriptor(stageRoot);
+    const index = JSON.parse(run.index_json);
+    const bundle = index.execution_bundle ? readFlowRunExecutionBundle(context, { projectRoot, runId: input.runId }) : null;
+    const stageRoot = path.join(run.run_root, bundle ? bundle.descriptor.stage(input.stage).directory : vnextStageDirectory(input.stage));
+    let descriptor = memoryStageFanoutDescriptor(context, input) ?? readFanoutDescriptor(stageRoot);
     // Registration is authoritative even if projection publication was interrupted,
     // or an otherwise review-off stage acquired an aggregate repair graph.
     if (!descriptor && context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'repair_intents'")) {
@@ -177,12 +294,21 @@ export async function reconcileVnextFanout(context, input) {
             continue;
         }
         const providerError = safeNativeFailure(child.provider_error);
+        const controller = nativeFailureController(context, project.id, input.runId, input.stage, value.parent_session_id);
+        const scope = stageGraphScope(context, project.id, input.runId, input.stage);
+        const terminalTime = typeof child.terminal_observed_at === "string" ? Date.parse(child.terminal_observed_at) : NaN;
+        const nativeBinding = child.status === "failed" && controller && typeof child.terminal_turn_id === "string" && child.terminal_turn_id.length > 0 && child.terminal_turn_id.length <= 256 && Number.isFinite(terminalTime)
+            ? { schema_id: "dd-flow/native-work-failure@1", project_id: project.id, run_id: input.runId, stage: input.stage, stage_attempt_id: scope.attempt, stage_cycle: scope.cycle,
+                parent_work_id: status.orchestration.parent_work_id, work_id: link.work_id, work_session_id: link.id, harness_id: value.harness_id,
+                parent_provider_session_id: value.parent_session_id, provider_session_id: String(child.session_id), terminal_turn_id: child.terminal_turn_id,
+                controller_id: controller.controller_id, generation: controller.generation } : undefined;
         const reason = JSON.stringify({ source: "native_child_observation", harness_id: value.harness_id, session_id: child.session_id, work_session_id: link.id, outcome: child.status,
+            ...(nativeBinding ? { native_binding: nativeBinding } : {}),
             ...(typeof child.terminal_turn_id === "string" ? { terminal_turn_id: child.terminal_turn_id } : {}),
             ...(typeof child.terminal_observed_at === "string" ? { terminal_observed_at: child.terminal_observed_at } : {}),
             ...(providerError ? { provider_error: providerError } : {}) });
         const result = await (child.status === "failed" ? failWork : cancelWork)(context, link.work_id, reason);
-        reconciled.push({ work_id: link.work_id, work_session_id: link.id, outcome: child.status, result });
+        reconciled.push({ work_id: link.work_id, work_session_id: link.id, outcome: child.status, ...(nativeBinding ? { native_binding: nativeBinding } : {}), result });
     }
     appendFlowRunTimelineEvent(context, project.id, input.runId, { type: "native_child_reconciliation", stage: input.stage, observations: value, issues, reconciled });
     return { ok: true, issues, reconciled };

package/dist/services/vnext-merge.js

@@ -232,6 +232,7 @@ export function applyVnextMerge(context, input) {
             throw new AppError("merge_apply_receipt_invalid", "Existing merge apply receipt does not match the active request", 1, { receipt_path: receiptFile });
         return receipt;
     }
+    requireBootstrapCommand(requireRun(context, request.project_id, request.run_id));
     heartbeatLaneLock(context, { projectRoot: input.projectRoot, lane: "merge", workerId: request.executor_work_id, workspacePath: request.target_workspace, ttlSeconds: 7200 });
     assertExecutionBaseline(request);
     input.progress?.(`applying ${request.source_commit} to ${request.target_branch}`);
@@ -316,7 +317,7 @@ export async function finishVnextMerge(context, input, prepared = prepareVnextMe
     if (failed.length) {
         context.db.run("UPDATE merge_requests SET status = 'action_required', last_error_json = ?, updated_at = ? WHERE merge_request_id = ?", [JSON.stringify({ code: "merge_gate_failed", failures: failed }), context.now(), request.merge_request_id]);
         const sourceRepair = failed.every(receipt => checkRepairDisposition(receipt) === "source_repair");
-        throw new AppError("merge_gate_failed", "Integrated target checks failed. Only assertion-backed failures permit source repair; tooling or unknown evidence requires diagnosis/settlement first.", 2, { failures: failed, ...(sourceRepair ? { repair_command: repairCommand(context, request, projectRoot) } : { outcome: "blocked", recoverable: false }), continuation: { ...recoveryEvidenceInput(run.run_root, failed[0].id), command_after_input: finishCommand(context, run.id, request, projectRoot, failed[0].id) } });
+        throw new AppError("merge_gate_failed", "Integrated target checks failed. Only candidate-source-backed failures permit source repair; tooling or unknown evidence requires diagnosis/settlement first.", 2, { failures: failed, ...(sourceRepair ? { repair_command: repairCommand(context, request, projectRoot), continuation: { ...recoveryEvidenceInput(run.run_root, failed[0].id), command_after_input: finishCommand(context, run.id, request, projectRoot, failed[0].id) } } : { outcome: "blocked", recoverable: false }) });
     }
     const passedRefs = new Set(receipts.flatMap((receipt) => receipt.check_refs));
     const missingRefs = frozenGateRefs(gate).filter((ref) => !passedRefs.has(ref));
@@ -567,10 +568,14 @@ function protocolIds(home) { const root = path.join(home, "03-plan"); if (!fs.ex
 function workspaceRoute(home) { const file = path.join(home, "02-protocolize", "workspace-route.json"); const value = JSON.parse(fs.readFileSync(file, "utf8")); if (!value.policy?.integration_branch)
     throw new AppError("workspace_route_missing", "MERGE requires the frozen integration branch", 1, { file }); return { integration_branch: value.policy.integration_branch }; }
 function executionSettings(run) { return JSON.parse(run.index_json).execution_profile?.settings ?? {}; }
-async function runBootstrap(context, run, cwd, mergeId, progress) {
+function requireBootstrapCommand(run) {
     const command = executionSettings(run).code_bootstrap?.command;
     if (!command)
-        throw new AppError("execution_profile_invalid", "MERGE requires a frozen workspace bootstrap command", 2);
+        throw new AppError("execution_profile_invalid", "MERGE requires an evidenced bootstrap command in the frozen RUN profile; configure code_bootstrap before starting a code-ready RUN", 2);
+    return command;
+}
+async function runBootstrap(context, run, cwd, mergeId, progress) {
+    const command = requireBootstrapCommand(run);
     const result = await runWorkspaceBootstrap(context, { projectId: run.project_id, runId: run.id, runHome: requireHome(run), workspaceRoot: cwd, command, artifactDir: `${stageDir}/${mergeId}/readiness`, progress });
     if (result.exit_code !== 0 || result.error)
         throw new AppError("merge_bootstrap_failed", "Integrated target bootstrap failed; inspect its retained logs", 2, { command, ...result });

package/dist/services/vnext-plan-review.js

@@ -1,6 +1,6 @@
 import { managedLifecycleCommand } from "./lifecycle-invocations.js";
 import crypto from "node:crypto";
-import { withStageSettlement, prepareFlowRunStageAttachment, prepareFlowRunStageCompletion } from "./runs.js";
+import { withStageSettlement, prepareFlowRunStageAttachment, prepareFlowRunStageCompletion, readFlowRunExecutionBundle } from "./runs.js";
 import fs from "node:fs";
 import path from "node:path";
 import { AppError } from "../shared/errors.js";
@@ -132,6 +132,7 @@ export function startVnextPlanReview(context, input, prepared = prepareVnextPlan
         commitVerificationMatrixStart(context, prepared.matrix, () => attachFlowRunStage(context, attachmentInput, attachment));
         const reportGit = gitFacts(run.workspace_root);
         const next = codeSuccessor(context, run.id, projectRoot);
+        const completionBundle = readFlowRunExecutionBundle(context, { projectRoot, runId: run.id });
         return withStageSettlement(context, () => {
             const registered = addWorkBatch(context, { parentWorkId: rootWork, prepared: prepared.codeItems, stage: "code" });
             const report = reportFor(context, { run, mode: effective, requested, outcome: "off", groups: [], batchChecksum, planChecksum, code: registered, now, projectRoot, flow: flowCommand(context), git: reportGit, ...(next.command ? { nextCommand: next.command } : {}) });
@@ -141,7 +142,7 @@ export function startVnextPlanReview(context, input, prepared = prepareVnextPlan
             const preparedReport = prepareStageReport(report);
             acceptStageReport(context, { projectId: project.id, runId: run.id, stage, root, prepared: preparedReport });
             const completionInput = { projectRoot, runId: run.id, stage, status: "done", data: "stage-report.json", dataSchemaId: "dd-flow/stage-report@1", report: "stage-report.md", stageReport: "stage-report.html", dataSha256: preparedReport.sha256, git: reportGit };
-            completeFlowRunStage(context, completionInput, prepareFlowRunStageCompletion(context, completionInput));
+            completeFlowRunStage(context, completionInput, prepareFlowRunStageCompletion(context, completionInput, completionBundle));
             advanceFlowRun(context, { settlementStage: "plan-review", projectRoot, runId: run.id, status: "running", verdict: "plan_review_off", nextAction: "start_code" });
             appendFlowRunTimelineEvent(context, project.id, run.id, { type: "plan_review_opened", mode: effective, outcome: "off" });
             return { ok: true, run_id: run.id, stage, outcome: "review_off", ...(externalContext ? { external_context: externalContext } : {}), plan_review: { requested_mode: requested, effective_mode: effective, policy_source: policySource(run), reason: "No applicable independent review group." }, next };
@@ -209,7 +210,7 @@ export function dispatchVnextPlanReview(context, input) {
     }
     const created = context.db.all("SELECT work_id, task, status, launch_policy, created_at FROM works WHERE project_id = ? AND run_id = ? AND parent_work_id = ?", [project.id, run.id, parent.work_id]);
     const reviews = groups.map((group) => { const work = created.find((item) => item.task === group.task); if (!work)
-        throw new AppError("runtime_missing", "Reviewer Work was not created", 1, { group: group.key }); const ready = work.status === "created" && isReviewWorkReady(context, work.work_id); return { group: group.key, work_id: work.work_id, status: work.status, depends_on: group.depends_on, ready, ...(ready ? { start_command: workStartCommand(context, { ...work, project_id: project.id, run_id: run.id }) } : {}) }; });
+        throw new AppError("runtime_missing", "Reviewer Work was not created", 1, { group: group.key }); const ready = work.status === "created" && isReviewWorkReady(context, work.work_id); return { group: group.key, work_id: work.work_id, status: work.status, depends_on: group.depends_on, ready, ...(ready ? { start_command: workStartCommand(context, { ...work, project_id: project.id, run_id: run.id }, { preview: true }) } : {}) }; });
     refreshRunWorkProjection(context, project.id, run.id);
     appendFlowRunTimelineEvent(context, project.id, run.id, { type: "plan_review_dispatched", work_id: parent.work_id, groups: reviews.map((item) => ({ group: item.group, work_id: item.work_id })) });
     const waves = plannedReviewWaves(groups, capacity.availableSlots);
@@ -329,6 +330,7 @@ function finishPlanReviewOwned(context, input) {
     const reportGit = gitFacts(run.workspace_root);
     const next = codeSuccessor(context, run.id, projectRoot);
     const matrix = prepareRunVerificationMatrix(context, { projectId: project.id, runId: run.id, stage, role: "output", semanticFile: decisionPath });
+    const completionBundle = readFlowRunExecutionBundle(context, { projectRoot, runId: run.id });
     return withStageSettlement(context, () => {
         const registered = addWorkBatch(context, { parentWorkId: codeParentId, prepared: codeItems, stage: "code" });
         const now = context.now();
@@ -343,7 +345,7 @@ function finishPlanReviewOwned(context, input) {
         acceptStagePacket(context, { projectId: project.id, runId: run.id, stage, prepared: decisionReceipt });
         acceptStageReport(context, { projectId: project.id, runId: run.id, stage, root, prepared: preparedReport });
         const completionInput = { projectRoot, runId: run.id, stage, status: "done", data: "stage-report.json", dataSchemaId: "dd-flow/stage-report@1", report: "stage-report.md", stageReport: "stage-report.html", dataSha256: preparedReport.sha256, git: reportGit };
-        completeFlowRunStage(context, completionInput, prepareFlowRunStageCompletion(context, completionInput));
+        completeFlowRunStage(context, completionInput, prepareFlowRunStageCompletion(context, completionInput, completionBundle));
         refreshRunWorkProjection(context, project.id, run.id);
         advanceFlowRun(context, { settlementStage: "plan-review", projectRoot, runId: run.id, status: "running", verdict: "plan_review_accepted", nextAction: "start_code" });
         appendFlowRunTimelineEvent(context, project.id, run.id, { type: "plan_review_accepted", work_id: parent.work_id, code: registered });

package/dist/services/vnext-protocolize.js

@@ -4,6 +4,7 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { parse as parseYaml } from "yaml";
 import { AppError } from "../shared/errors.js";
 import { projectFeatureWorktreePath, resolveProjectRoot } from "../storage/paths.js";
 import { previewNextEntityId } from "./ids.js";
@@ -189,6 +190,29 @@ export async function finishVnextProtocolize(context, input) {
     const resultFile = prepareProtocolizeResultPath(requireRunHome(run), input.resultFile);
     const result = input.result ?? readResult(resultFile, { projectRoot, ddFlowHome: context.ddFlowHome, runId: run.id, runRoot: requireRunHome(run) });
     validateSchema({ schemaName: "vnext-protocolize-result", file: resultFile, data: result, projectRoot, ddFlowHome: context.ddFlowHome, runId: run.id, runRoot: requireRunHome(run) });
+    const acceptedIndex = JSON.parse(context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [project.id, run.id]).index_json);
+    if (acceptedIndex.stage_runs.some(item => item.stage === stage && item.status === "done")) {
+        publishStageReport(context, project.id, run.id, stage, root);
+        const file = path.join(root, "stage-report.json");
+        if (!fs.existsSync(file))
+            throw new AppError("protocolize_report_missing", "Completed PROTOCOLIZE has no accepted report to replay", 1, { run_id: run.id });
+        const accepted = JSON.parse(fs.readFileSync(file, "utf8"));
+        const authoredSha = accepted.semantic.materialization?.authored_result?.sha256;
+        if (authoredSha && authoredSha !== sha256(fs.readFileSync(resultFile)))
+            throw new AppError("protocolize_intent_conflict", "Completed PROTOCOLIZE result differs from accepted input", 1, { run_id: run.id });
+        const currentStage = acceptedIndex.current_stage ?? [...acceptedIndex.stage_runs].reverse().find(item => item.status === "running" || item.status === "done")?.stage;
+        const activeReplay = currentStage === stage && acceptedIndex.status === "running";
+        const resolvedPolicy = activeReplay ? requireVnextWorkspaceRoute({ projectRoot, runId: run.id, runHome: requireRunHome(run), workspaceRoot: run.workspace_root, stage: "protocolize" }) : accepted.mechanical?.workspace_route;
+        if (activeReplay) {
+            if (acceptedIndex.verdict !== "protocolized")
+                advanceFlowRun(context, { settlementStage: "protocolize", projectRoot, runId: run.id, status: "running", verdict: "protocolized", nextAction: "start_plan" });
+            refreshRunWorkProjection(context, project.id, run.id);
+        }
+        const next = activeReplay ? stageSuccessor(context, { projectRoot, runId: run.id, stage: "plan", command: `${flowCommand(context)} stage start ${run.id} --stage plan --project-root ${JSON.stringify(projectRoot)} --json`, metadata: { cwd: run.workspace_root, session_mode: resolvedPolicy.stage_session_mode } }) : { kind: "complete", outcome: "already_completed" };
+        return { ok: true, outcome: "protocolized", run_id: run.id, protocol_ids: accepted.semantic.acceptance, workspace_root: run.workspace_root, git_policy: resolvedPolicy, next_action: activeReplay ? "await_plan" : acceptedIndex.next_action, ...("command" in next && next.command ? { next_command: next.command } : {}), next,
+            artifacts: { result: resultFile, report_json: file, report_markdown: path.join(root, "stage-report.md"), report_html: path.join(root, "stage-report.html"), protocols: accepted.semantic.acceptance.map(id => path.join(run.workspace_root, ".memory-bank/protocol", id, "summary.md")) } };
+    }
+    const resolvedPolicy = requireVnextWorkspaceRoute({ projectRoot, runId: run.id, runHome: requireRunHome(run), workspaceRoot: run.workspace_root, stage: "protocolize" });
     const acceptedObligations = acceptedSpecifyObligations(context, projectRoot, run.id, path.join(requireRunHome(run), "01-specify", "specify.json"));
     let obligations;
     try {
@@ -202,11 +226,11 @@ export async function finishVnextProtocolize(context, input) {
             throw error;
         throw new AppError(error.code, error.message, error.exitCode, { ...error.details, phase: "prepare", effect: "no_effect", recoverable: true });
     }
-    const resolvedPolicy = requireVnextWorkspaceRoute({ projectRoot, runId: run.id, runHome: requireRunHome(run), workspaceRoot: run.workspace_root, stage: "protocolize" });
     const receipt = readWorkspaceRouteReceipt(root);
     const workspaceRoot = run.workspace_root;
     const intent = await prepareProtocolizeIntent(context, run, resultFile, result, obligations);
     publishProtocolizeIntent(context, project.id, intent);
+    const materialization = verifyProtocolizeMaterialization(intent, result, path.relative(requireRunHome(run), resultFile));
     const protocolIds = intent.protocol_ids;
     const changedFiles = intent.changed_files;
     for (const protocolId of protocolIds)
@@ -216,9 +240,10 @@ export async function finishVnextProtocolize(context, input) {
             ensureManagedWorktreeRecorded(context, { protocolId, projectRoot, branch: requiredPolicyValue(resolvedPolicy.feature_branch, "feature branch"), base: requiredPolicyValue(resolvedPolicy.base_ref, "base ref"), created: receipt.created, bootstrap: receipt.bootstrap });
     }
     const now = context.now();
-    const workSession = completeWorkSession(context, work.work_id, resultFile, now);
+    const workSession = context.db.get("SELECT * FROM work_sessions WHERE work_id = ? AND status = 'running' ORDER BY created_at DESC LIMIT 1", [work.work_id]);
     const routedRun = requireRun(context, projectRoot, run.id);
     const report = stageReport(context, routedRun, resultFile, protocolIds, changedFiles, workSession?.session_id ?? null, now, resolvedPolicy);
+    Object.assign(report.semantic, { materialization });
     const reportJson = path.join(root, "stage-report.json");
     const reportMarkdown = path.join(root, "stage-report.md");
     const reportHtml = path.join(root, "stage-report.html");
@@ -235,6 +260,7 @@ export async function finishVnextProtocolize(context, input) {
         const completion = { projectRoot, runId: run.id, stage, status: "done", data: "protocolize-result.json", dataSchemaId: "dd-flow/vnext-protocolize-result@3", report: "stage-report.md", stageReport: "stage-report.html", dataSha256: crypto.createHash("sha256").update(fs.readFileSync(resultFile)).digest("hex") };
         const preparedCompletion = prepareFlowRunStageCompletion(context, completion);
         withStageSettlement(context, () => {
+            completeWorkSession(context, work.work_id, resultFile, now);
             acceptStageReport(context, { projectId: project.id, runId: run.id, stage, root, prepared: preparedReport });
             completeFlowRunStage(context, completion, preparedCompletion);
         });
@@ -367,6 +393,38 @@ function ensureManagedWorktreeRecorded(context, input) {
     recordManagedWorktree(context, input);
 }
 function sha256(bytes) { return crypto.createHash("sha256").update(bytes).digest("hex"); }
+export function verifyProtocolizeMaterialization(intent, result, authoredPath) {
+    const documents = intent.files.map(file => {
+        const target = path.resolve(intent.workspace_root, file.relative);
+        inside(path.join(intent.workspace_root, ".memory-bank"), target);
+        assertNoSymlinkPath(path.join(intent.workspace_root, ".memory-bank"), target);
+        const bytes = fs.readFileSync(target);
+        if (sha256(bytes) !== file.after_sha256)
+            throw new AppError("protocolize_materialization_invalid", "Published document differs from accepted intent", 1, { path: file.relative });
+        return { path: file.relative, sha256: file.after_sha256 };
+    });
+    const featurePaths = intent.changed_files.filter(file => /\/features\/FT-[^/]+\/index\.md$/.test(file));
+    const featurePath = result.feature.action === "not_applicable" ? null : featurePaths.length === 1 ? featurePaths[0] : null;
+    if (result.feature.action !== "not_applicable" && !featurePath)
+        throw new AppError("protocolize_materialization_invalid", "Accepted feature output is ambiguous or missing", 1);
+    const frontmatter = (relative) => {
+        const text = fs.readFileSync(path.join(intent.workspace_root, relative), "utf8");
+        const match = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(text);
+        const value = match ? parseYaml(match[1]) : null;
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            throw new AppError("protocolize_materialization_invalid", "Published document lacks frontmatter", 1, { path: relative });
+        return value;
+    };
+    const edges = featurePath ? intent.protocol_ids.map(protocolId => ({ feature_path: featurePath, protocol_id: protocolId, protocol_path: `.memory-bank/protocol/${protocolId}/summary.md` })) : [];
+    for (const edge of edges) {
+        const protocols = frontmatter(edge.feature_path).related_protocols;
+        const features = frontmatter(edge.protocol_path).related_features;
+        if (!Array.isArray(protocols) || !protocols.includes(edge.protocol_id) || !Array.isArray(features) || !features.includes(edge.feature_path))
+            throw new AppError("protocolize_materialization_invalid", "Owned feature/protocol links are not reciprocal", 1, edge);
+    }
+    return { schema_id: "dd-flow/protocolize-materialization@1", run_id: intent.run_id, stage: "protocolize", action: result.feature.action, feature_path: featurePath,
+        protocol_ids: intent.protocol_ids, authored_result: { role: "authored_input", run_relative_path: authoredPath, sha256: intent.result_sha256 }, documents, owned_links: edges, status: "passed" };
+}
 async function materialize(projectRoot, runId, runHome, result, obligations, ids, psetId) {
     const psetPath = psetId ? path.join(projectRoot, ".memory-bank", "protocol", "_set", `${psetId}.md`) : null;
     const created = [];