@deksden-com/dd-flow-cli 0.9.0-beta.137 → 0.9.0-beta.138

package/dist/harness-runtime/lib/dd-zcode-daemon.mjs

@@ -1,7 +1,9 @@
+import { managedFlowEnv } from './managed-flow-env.mjs';
 import { SETUP_STARTUP_MS, startupObserver, observationDetails } from './setup-progress.mjs';
 import { callDaemonObserved } from './daemon-observation.mjs';
 import { admitNativeRequestBuffer } from "./native-streams.mjs";
 import { ObservationClock } from "./observation-clock.mjs";
+import { prepareDaemonRequest } from "./native-request-proof.mjs";
 import { spawn } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { chmod, lstat, mkdir, open, readFile, rename, unlink, writeFile } from "node:fs/promises";
@@ -90,7 +92,7 @@ async function removeSocket(socket, dir) {
 const errorPayload = errorRecord;
 
 export async function callDaemon(stateDir, operation, params = {}, timeoutMs = 30_000) {
-  const request = { schema_id: REQUEST_SCHEMA, id: process.env.DD_EVAL_OPERATION_ID ?? randomUUID(), operation, params };
+  const request = prepareDaemonRequest({ schema_id: REQUEST_SCHEMA, id: process.env.DD_EVAL_OPERATION_ID ?? randomUUID(), operation, params });
   return await callDaemonObserved({ stateDir, socket: locations(stateDir).socket, request, responseSchema: RESPONSE_SCHEMA, harness: 'zcode', timeoutMs });
 }
 
@@ -110,22 +112,21 @@ function sameConfig(state, config) {
 }
 
 export async function startDaemon(options) {
+  if (options.noFlow) options = { ...options, ddFlowHome: undefined, ddFlowBin: undefined, projectRoot: undefined };
   const paths = locations(options.stateDir);
   const hasFlowContext = Boolean(options.ddFlowHome || options.projectRoot || options.ddFlowBin);
-  if (hasFlowContext && (!options.ddFlowHome || !options.projectRoot)) {
-    throw new DaemonError("flow_context_incomplete", "--dd-flow-home and --project-root must be provided together for ZCode lifecycle forwarding");
+  if (hasFlowContext && (!options.ddFlowHome || !options.projectRoot || !options.ddFlowBin)) {
+    throw new DaemonError("flow_context_incomplete", "--dd-flow-home, --dd-flow-bin and --project-root must be provided together for ZCode lifecycle forwarding");
   }
   const config = {
     cwd: absolute(options.cwd, "--cwd"),
     journal: absolute(options.journal, "--journal"),
     bin: options.bin ?? null,
     zcodePath: options.zcodePath ?? null,
-    // The worker itself invokes `dd-flow` from PATH.  Use that same executable
-    // for the trusted event bridge unless a pinned executable was supplied.
-    ddFlowBin: hasFlowContext ? (options.ddFlowBin ? absolute(options.ddFlowBin, "--dd-flow-bin") : "dd-flow") : null,
+    ddFlowBin: hasFlowContext ? absolute(options.ddFlowBin, "--dd-flow-bin") : null,
     ddFlowHome: options.ddFlowHome ? absolute(options.ddFlowHome, "--dd-flow-home") : null,
     projectRoot: options.projectRoot ? absolute(options.projectRoot, "--project-root") : null,
-    resourceHome: process.env.DD_FLOW_RESOURCE_HOME ? absolute(process.env.DD_FLOW_RESOURCE_HOME, "DD_FLOW_RESOURCE_HOME") : null,
+    resourceHome: !options.noFlow && process.env.DD_FLOW_RESOURCE_HOME ? absolute(process.env.DD_FLOW_RESOURCE_HOME, "DD_FLOW_RESOURCE_HOME") : null,
     env: { ...nativeRoutingEnv(), ...(options.ddFlowHome ? { DD_FLOW_HOME: absolute(options.ddFlowHome, "--dd-flow-home"), ...(options.ddFlowBin ? { DD_FLOW_BIN: absolute(options.ddFlowBin, "--dd-flow-bin") } : {}) } : {}) },
     livenessTimeoutMs: positiveDuration(options.livenessTimeoutMs, "livenessTimeoutMs", DEFAULT_LIVENESS_TIMEOUT_MS),
     requestTimeoutMs: optionalDuration(options.requestTimeoutMs, "requestTimeoutMs", DEFAULT_REQUEST_TIMEOUT_MS),
@@ -683,8 +684,7 @@ export class DaemonRuntime {
 }
 
 export function zcodeBridgeEnv(config, daemonId) {
-  return { ...config.env, DD_FLOW_DAEMON_ID: daemonId,
-    DD_FLOW_RUNTIME_OWNER: config.runtime_owner ? JSON.stringify(config.runtime_owner) : undefined };
+  return { ...config.env, ...managedFlowEnv(config, daemonId) };
 }
 
 export async function serveDaemon(stateDir) {

package/dist/harness-runtime/lib/delegation-instructions.mjs

@@ -49,7 +49,7 @@ export function delegationContract(harness) {
   return `dd-flow/delegation/${key}@${["codex", "opencode"].includes(key) ? 2 : 1}`;
 }
 
-export const lifecycleCommandCompletionInstruction = "Run runtime-issued lifecycle CLI calls in the foreground, never with a native background or detached-shell option. A shell tool may yield before the lifecycle process exits. Retain and poll its exact process/session handle to completion, including inside a tool wrapper; empty interim output is not a CLI result. Read final stdout or response_file before deciding continuation, and never reissue the command while it is pending.";
+export const lifecycleCommandCompletionInstruction = "Run runtime-issued lifecycle CLI calls in the foreground, never with a native background or detached-shell option. A shell tool may yield before the lifecycle process exits. Retain and poll its exact process/session handle to completion, including inside a tool wrapper; empty interim output is not a CLI result. If a wrapper returns 'Script running with cell ID …', use that wrapper's wait tool to finish the same cell before expecting an inner shell session handle; do not execute the command again. Read final stdout or response_file before deciding continuation, and never reissue the command while it is pending.";
 
 export const lifecycleRetryInstruction = `${lifecycleCommandCompletionInstruction} A failure is not permission to replay a lifecycle command. For proven effect=no_effect with recoverable=true and retry_command, correct the input and execute that exact issued successor. A check failure can retain receipts while leaving Work running: correct the evidenced cause first, then use the CLI's exact retry_command for an intentional fresh check attempt; never replay a check merely because Work is unsettled. If a successful CODE finish returns outcome=verification_required, inspect the retained receipts, update its verification file, and use only next.finish_command: the Stage is still running and the previous invocation ID is consumed. If continuation.kind=repair_required, or a successful result has outcome=repair_required and a repair Work ID, end this Turn for the registered repair child; use any retry_command only after that repair settles and verification is refreshed. Unknown effects require reconciliation, never replay. A committed effect without an explicit continuation is not retryable. A native shell launch refusal before the CLI starts permits correcting only that shell-form error and retrying the same exact command. Otherwise report the primary error and stop; never invent IDs, call hooks directly, or run status as a substitute.`;
 
@@ -71,7 +71,9 @@ export function workerDelegationTask({ workId, startCommand, launchPolicy }) {
     "Your first technical action must be this exact lifecycle command:",
     startCommand,
     "Execute the issued operation and target exactly. Lifecycle invocation IDs are internal runtime authority and are intentionally omitted; never add or invent them. Preserve any explicit native receipt handle that the command does contain.",
-    "Use the native shell's inherited working directory. Do not set or override a workdir/cwd field for this lifecycle command.",
+    startCommand.startsWith("cd '")
+      ? "Execute the literal cd shell prefix exactly; it routes this command into its runtime-owned private execution copy. Do not invent native spawn fields. After start, obey the packet's read_only/write scopes and prefix subsequent issued lifecycle commands with the same literal cd route. A review copy never grants permission to write reviewed inputs. The runtime independently checks the CLI process directory."
+      : "Use the native shell's inherited working directory. Do not set or override a workdir/cwd field for this lifecycle command.",
     "Continue only if it succeeds and returns the authoritative Work packet.",
     lifecycleRetryInstruction,
     "After a successful start, complete the assigned Work, write its required result, invoke its exact work finish command, then stop.",
@@ -109,7 +111,7 @@ export function renderDelegationInstructions({ harness, stage, capacity, works =
 
 export function renderCapacityInstructions({ harness, maximum }) {
   const adapter = requireAdapter(harness);
-  if (!Number.isInteger(maximum) || maximum < 1) throw new Error("Invalid native capacity limit");
+  if (!Number.isInteger(maximum) || maximum < 1 || maximum > 15) throw new Error("Native capacity limit must be an integer from 1 through 15");
   return [
     `Adapter delegation contract: ${delegationContract(harness)}.`,
     "This is a technical native-subagent capacity qualification, not product work.",

package/dist/harness-runtime/lib/lifecycle-command.mjs

@@ -255,6 +255,7 @@ export function parseCommandArgs(argv) {
   const positional = [], options = new Map();
   for (let index = 0; index < argv.length; index++) {
     const value = argv[index];
+    if (value === "--") { positional.push(...argv.slice(index + 1)); break; }
     if (value?.startsWith("--")) {
       const equals = value.indexOf("=");
       if (equals > 2) { const key = value.slice(2, equals); options.set(key, [...(options.get(key) ?? []), value.slice(equals + 1)]); continue; }

package/dist/harness-runtime/lib/managed-daemon.d.mts

@@ -8,5 +8,6 @@ export function confirmDaemonProcess(config: RuntimeConfig, record: ProcessBindi
 export function assertDaemonOwnership(stateDir: string, dispatch?: Record<string, unknown>, assertCurrent?: () => void): Promise<void>;
 export function heartbeatDaemonProcess(config: RuntimeConfig, record: ProcessBinding | null | undefined): Promise<void>;
 export function finishDaemonProcess(config: RuntimeConfig, record: ProcessBinding | null | undefined, state?: string, reason?: string): Promise<void>;
+export function cleanupFailedDaemonStart(config: RuntimeConfig, record: ProcessBinding | null, child: ChildProcess | null, original: Error & { details?: Record<string, unknown> }, readState: () => Promise<Record<string, unknown>>, daemonId: string): Promise<void>;
 export function completeBudgetOperation(stateDir: string, request: { id: string; operation: string; params?: { sessionId?: string } }, result: unknown, observe?: () => Promise<Record<string, unknown>>): Promise<Record<string, unknown>>;
 export function stopProcessGroup(child: ChildProcess | null | undefined, graceMs?: number, options?: { detached?: boolean; settlementMs?: number }): Promise<void>;

package/dist/harness-runtime/lib/managed-daemon.mjs

@@ -61,14 +61,16 @@ export async function prepareRuntimeOwner(config, stateDir, env = process.env) {
 export async function assertDaemonOwnership(stateDir, dispatch = {}, assertCurrent = () => {}, progress = async () => {}, waiting = async () => {}) {
   const gate = async () => {
     assertCurrent();
+    let confirmed = false;
     for (const lease of leases.values()) {
       if (lease.stateDir !== path.resolve(stateDir)) continue;
       await reconfirmLease(lease, assertCurrent);
       assertCurrent();
+      confirmed = true;
     }
+    if (confirmed) await progress('ownership_confirmed');
   };
   await gate();
-  await progress('ownership_confirmed');
   const state = JSON.parse(await readFile(path.join(stateDir, "daemon.json"), "utf8"));
   const owner = bindRuntimeOwner({ runtime_owner: state.config?.runtime_owner ?? null }, {});
   if (!owner) return;
@@ -264,7 +266,7 @@ async function executeRuntimeProcess(config, action, options = {}, { timeoutMs,
   const poisonKey = token => JSON.stringify([path.resolve(resourceHome), options.id, token ?? null]);
   if (action !== "status" && options.id) {
     const poison = maintenancePoison.get(poisonKey(options["lease-token"])) ?? maintenancePoison.get(poisonKey(null));
-    if (poison) throw poison;
+    if (poison && !(action === "finish" && poison.finish === JSON.stringify(options))) throw poison.error;
   }
   const args = ["runtime", "process", action];
   for (const [key, value] of Object.entries(options)) if (value !== null && value !== undefined) args.push(`--${key}`, String(value));
@@ -275,9 +277,13 @@ async function executeRuntimeProcess(config, action, options = {}, { timeoutMs,
     try { output = await runBoundedCommand({ bin: ddFlowBin, args: [...args, "--json"], cwd: config.cwd,
       env: { ...(config.env ?? {}), DD_FLOW_HOME: ddFlowHome, DD_FLOW_RESOURCE_HOME: resourceHome }, timeoutMs,
       timeoutCode: action === "heartbeat" ? "process_heartbeat_timeout" : "process_maintenance_timeout", inheritDeadline: false, cleanupWithinBudget: true,
-      maintenanceProgress: { action, processId: options.id ?? null, startupMs: Math.min(timeoutMs, RENEWAL_POLICY.startupMs), inactivityMs: RENEWAL_POLICY.attemptMs }, signal }); }
+      // Storage silence is not loss of authority: the original command/lease
+      // deadline remains finite, including slow I/O and multiple bounded reads.
+      maintenanceProgress: { action, processId: options.id ?? null, startupMs: Math.min(timeoutMs, RENEWAL_POLICY.startupMs), inactivityMs: timeoutMs }, signal }); }
     catch (error) {
-      if (action !== "status" && options.id && error.details?.cleanup_unconfirmed) maintenancePoison.set(poisonKey(options["lease-token"]), error);
+      if (action !== "status" && options.id && error.details?.cleanup_unconfirmed) maintenancePoison.set(poisonKey(options["lease-token"]), {
+        error, ...(action === "finish" && error.code === "process_maintenance_timeout" ? { finish: JSON.stringify(options) } : {})
+      });
       throw error;
     }
     let result;
@@ -393,7 +399,9 @@ export async function heartbeatDaemonProcess(config, record) {
   if (lease.closing) throw Object.assign(new Error("Managed process is closing"), { code: "process_closing" });
   if (lease.lost) throw lease.error;
   if (lease.error && !maintenanceRetryable(lease.error)) throw lease.error;
-  if (!renewalRemaining(lease.renewal)) throw lease.error;
+  if (!renewalRemaining(lease.renewal)) throw lease.error ?? Object.assign(new Error("Managed lease authority has expired before heartbeat dispatch"), {
+    code: "process_ownership_unknown", details: { process_id: record.id, reason: "lease_authority_expired" }
+  });
   if (lease.pending) return await lease.pending;
   lease.pending = (async () => {
     try {
@@ -425,7 +433,7 @@ export async function finishDaemonProcess(config, process, state = "stopped", re
     // A predecessor owns its transport fence; finish gets an independent
     // settlement window only after that flight physically settled.
     const settlement = createRenewalState(); settlement.uncertainSince = performance.now();
-    const result = await retryBookkeeping(timeoutMs => runtimeProcess(config, "finish", { id: process.id, "lease-token": process.lease_token, state, reason }, { timeoutMs }), settlement);
+    const result = await retryBookkeeping(timeoutMs => runtimeProcess(config, "finish", { id: process.id, "lease-token": process.lease_token, state, reason }, { timeoutMs }), settlement, true);
     if (result?.ok !== true) throw Object.assign(new Error("managed process finish was not accepted"), { code: "process_lease_lost", details: { process_id: process.id } });
     leases.delete(key);
   }
@@ -453,11 +461,16 @@ async function reconfirmLease(lease, assertCurrent) {
     return;
   }
 }
-async function retryBookkeeping(action, renewal = createRenewalState()) {
+async function retryBookkeeping(action, renewal = createRenewalState(), repeatFinish = false) {
   renewal.uncertainSince ??= performance.now();
   for (;;) {
     try { return await action(renewalRemaining(renewal)); }
-    catch (error) { if (!maintenanceRetryable(error) || !renewalFailure(renewal)) throw error; await new Promise(resolve => setTimeout(resolve, Math.min(renewalDelay(renewal), renewalRemaining(renewal)))); }
+    catch (error) {
+      // Exact finish is an idempotent terminal-state CAS, not productive IO.
+      // Its old helper may still commit the same finish; all other writes stay fenced.
+      if (!(maintenanceRetryable(error) || repeatFinish && error.code === "process_maintenance_timeout" && error.details?.cleanup_unconfirmed === true) || !renewalFailure(renewal)) throw error;
+      await new Promise(resolve => setTimeout(resolve, Math.min(renewalDelay(renewal), renewalRemaining(renewal))));
+    }
   }
 }
 
@@ -482,7 +495,10 @@ function requireTimelyMaintenance(renewal, action, receipt, record) {
 export async function cleanupFailedStart(config, record, child, original) {
   try {
     await stopProcessGroup(child);
+    const stopped = child?.pid ? { pid: child.pid, pgid: process.platform === "win32" ? null : child.pid,
+      settled: true, physical_exit: "ESRCH", observed_at: new Date().toISOString() } : undefined;
     await finishDaemonProcess(config, record, "failed", original.code ?? "startup_failed");
+    return stopped;
   } catch (cleanup) {
     original.details = { ...original.details, cleanup_failed: errorRecord(cleanup), process_id: record?.id ?? null, pid: child?.pid ?? null };
   }
@@ -491,7 +507,7 @@ export async function cleanupFailedStart(config, record, child, original) {
 /** The provider has its own process group. A failed daemon start must settle
  * that exact retained process as well as the daemon; PID-only cleanup is unsafe. */
 export async function cleanupFailedDaemonStart(config, daemonRecord, daemonChild, original, readState, daemonId) {
-  await cleanupFailedStart(config, daemonRecord, daemonChild, original);
+  const stopped = await cleanupFailedStart(config, daemonRecord, daemonChild, original);
   if (!daemonRecord) return;
   try {
     const state = await readState();
@@ -502,6 +518,15 @@ export async function cleanupFailedDaemonStart(config, daemonRecord, daemonChild
     }
     const provider = state.provider_process;
     if (provider) await runtimeProcess(config, "stop", { id: provider.id, "lease-token": provider.lease_token });
+    // Confirmation can fail before the registry learns the child's PID. The
+    // owned child handle still proves its physical exit, not a productive ACK.
+    if (stopped && !original.details?.cleanup_failed && !original.details?.provider_cleanup_failed && state.pid === stopped.pid && !provider && state.provider_pid == null && owner) {
+      original.details = { ...original.details, startup_child_cleanup: {
+        ...stopped, daemon_id: daemonId, process_id: daemonRecord.id,
+        owner_id: owner.owner_id, project_id: owner.project_id, run_id: owner.run_id,
+        operation_id: owner.operation_id, state_dir: owner.state_dir
+      } };
+    }
   } catch (cleanup) {
     original.details = { ...original.details, provider_cleanup_failed: errorRecord(cleanup) };
   }
@@ -587,29 +612,39 @@ async function stopOwnedChild(child, graceMs, detached, settlementMs) {
 
 /** A daemon acknowledgement is not a completed stop until its endpoint closes. */
 export async function confirmDaemonStopped(request, socket, timeoutMs = 30_000, { readState } = {}) {
-  const deadline = performance.now() + timeoutMs;
   const expected = await readState?.();
   const identity = state => state?.daemon_id ?? state?.config?.daemonId;
   if (readState && (!identity(expected) || !Number.isSafeInteger(expected?.pid) || expected.pid < 1)) throw Object.assign(new Error('daemon stop has no retained incarnation/PID proof'), { code: 'daemon_cleanup_identity_mismatch' });
   const failure = async observer => {
     const state = await readState?.();
-    if (expected && identity(state) !== identity(expected)) throw Object.assign(new Error("daemon incarnation changed during stop"), { code: "daemon_identity_mismatch" });
+    if (expected && (identity(state) !== identity(expected) || state?.pid !== expected.pid)) throw Object.assign(new Error("daemon incarnation changed during stop"), { code: "daemon_identity_mismatch" });
     const primary = state?.shutdown_state === "cleanup_failed" ? state.cleanup_error : null;
     if (primary) throw Object.assign(new Error(primary.message), primary, { details: { ...primary.details, socket, phase: "confirm_daemon_stop", observer_error: errorRecord(observer) } });
     throw observer;
   };
-  let result;
+  let result, observationError;
   try { result = await request(); }
-  catch (error) { return await failure(error); }
-  if (result?.stopped !== true) return await failure(Object.assign(new Error("stop acknowledgement does not prove shutdown"), { code: "daemon_stop_incomplete" }));
+  catch (error) {
+    if (!expected || !["daemon_timeout", "daemon_not_running", "daemon_connection_closed", "operation_observation_lost"].includes(error.code)) return await failure(error);
+    observationError = error;
+  }
+  if (!observationError && result?.stopped !== true) return await failure(Object.assign(new Error("stop acknowledgement does not prove shutdown"), { code: "daemon_stop_incomplete" }));
+  // The RPC wait and physical retirement are separate phases. A lost ACK
+  // consumes the former, not the existing confirmation budget.
+  const deadline = performance.now() + timeoutMs;
   for (;;) {
     const state = await readState?.();
-    if (expected && identity(state) !== identity(expected)) return await failure(Object.assign(new Error("daemon incarnation changed"), { code: "daemon_identity_mismatch" }));
+    if (expected && (identity(state) !== identity(expected) || state?.pid !== expected.pid)) return await failure(Object.assign(new Error("daemon incarnation changed"), { code: "daemon_identity_mismatch" }));
+    if (state?.shutdown_state === "cleanup_failed") return await failure(observationError ?? Object.assign(new Error("daemon cleanup failed"), { code: "daemon_stop_incomplete" }));
     let endpointPresent = true;
     try { await lstat(socket); } catch (error) { if (error.code === "ENOENT") endpointPresent = false; else throw error; }
     let daemonPresent = false;
     if (expected?.pid) { try { process.kill(expected.pid, 0); daemonPresent = true; } catch (error) { if (error.code !== "ESRCH") daemonPresent = true; } }
     if (!endpointPresent && !daemonPresent) {
+      if (observationError) {
+        if (state?.shutdown_state === "clean" && state.active_tree === false && !state.cleanup_error) return { stopped: true, clean: true };
+        return await failure(observationError);
+      }
       if (readState && result.clean === true && (state?.shutdown_state !== 'clean' || state.active_tree !== false)) return await failure(Object.assign(new Error('daemon clean ACK conflicts with its retained state'), { code: 'daemon_stop_incomplete' }));
       return result;
     }

package/dist/harness-runtime/lib/managed-flow-env.mjs

@@ -0,0 +1,15 @@
+/** Final native overlay: launch-bound routing, never inherited invocation authority. */
+export function managedFlowEnv(config, daemonId = config.daemonId) {
+  const managed = !config.noFlow && Boolean(config.ddFlowHome && config.ddFlowBin && daemonId);
+  return {
+    DD_FLOW_DAEMON_ID: managed ? daemonId : undefined,
+    DD_FLOW_HOME: managed ? config.ddFlowHome : undefined,
+    DD_FLOW_BIN: managed ? config.ddFlowBin : undefined,
+    DD_FLOW_RESOURCE_HOME: config.resourceHome ?? undefined,
+    DD_FLOW_RUNTIME_OWNER: managed && config.runtime_owner ? JSON.stringify(config.runtime_owner) : undefined,
+    DD_FLOW_INVOCATION_SCOPE: undefined, DD_FLOW_CURRENT_INVOCATION: undefined,
+    DD_FLOW_SESSION_ID: undefined, DD_FLOW_WORK_ID: undefined, DD_FLOW_CONTROLLER_TOKEN: undefined,
+    DD_FLOW_CONTROL_TOKEN: undefined, DD_FLOW_SCOPE_CONTROL_TOKEN: undefined,
+    DD_FLOW_HOOK_DEADLINE_AT: undefined,
+  };
+}

package/dist/harness-runtime/lib/native-hook-command.mjs

@@ -62,7 +62,7 @@ export async function readNativeHookFailures(stateDir, requests, current, reject
 }
 
 /** The caller supplies its qualified native limit; phases share that deadline. */
-export function hookBudget(timeoutMs = 25_000, deadlineAt = process.env.DD_FLOW_HOOK_DEADLINE_AT === undefined ? null : Number(process.env.DD_FLOW_HOOK_DEADLINE_AT)) {
+export function hookBudget(timeoutMs = 25_000, deadlineAt = process.env.DD_FLOW_HOOK_DEADLINE_AT ? Number(process.env.DD_FLOW_HOOK_DEADLINE_AT) : null) {
   if (deadlineAt !== null && (!Number.isSafeInteger(deadlineAt) || deadlineAt < 0)) throw Object.assign(new Error("Invalid native hook deadline"), { code: "hook_deadline_invalid", details: { effect: "unknown" } });
   const started = performance.now();
   const duration = Math.max(0, Math.min(timeoutMs, Number.isFinite(deadlineAt) ? deadlineAt - Date.now() : timeoutMs));

package/dist/harness-runtime/lib/native-request-proof.d.mts

@@ -0,0 +1,2 @@
+export function nativeCommandFingerprint(input: { executable: string; args: string[]; cwd: string; env: Record<string, string | undefined>; operationId: string }): string;
+export function prepareDaemonRequest<T extends { id: string; operation: string; params?: Record<string, unknown> }>(request: T): T & { invocation_sha256?: string };

package/dist/harness-runtime/lib/native-request-proof.mjs

@@ -0,0 +1,65 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { randomUUID } from 'node:crypto';
+import { hashJson } from './runner-events.mjs';
+
+const environmentKeys = ['HOME', 'CODEX_HOME', 'DD_FLOW_CONFIG_HOME', 'DD_FLOW_RESOURCE_HOME', 'DD_FLOW_HOME', 'DD_FLOW_BIN', 'DD_FLOW_ENGINE_HOME'];
+const fail = reason => { throw Object.assign(new Error('Native request proof does not match its prepared command'), {
+  code: 'native_request_proof_conflict', details: { reason, effect: 'no_effect' }
+}); };
+
+/** Independent transport identity: prepared by the caller before launching
+ * the adapter, and recomputed by the adapter's shared request builder. */
+export function nativeCommandFingerprint({ executable, args, cwd, env, operationId }) {
+  return hashJson({ executable, args, cwd, operation_id: operationId,
+    environment: Object.fromEntries(environmentKeys.map(key => [key, env[key] ?? null])) });
+}
+
+/** Called after the adapter's own argument preparation but before its RPC or
+ * daemon-start action. No provider response can supply this fingerprint. */
+export function prepareDaemonRequest(request) {
+  const file = process.env.DD_FLOW_NATIVE_REQUEST_PROOF_FILE;
+  const expected = process.env.DD_FLOW_NATIVE_COMMAND_SHA256;
+  const operation = process.env.DD_FLOW_NATIVE_REQUEST_OPERATION;
+  if (file === undefined && expected === undefined) return request;
+  // Control helpers may inspect status before their owned stop RPC. Status
+  // cannot consume the productive/control request's independently bound proof.
+  if (operation && request.operation !== operation) {
+    if (request.operation === 'daemon.status' && operation === 'daemon.stop') return request;
+    fail('operation_changed');
+  }
+  const ownerText = process.env.DD_FLOW_NATIVE_REQUEST_PROOF_OWNER;
+  // Never forward caller proof authority into the daemon/provider process.
+  delete process.env.DD_FLOW_NATIVE_REQUEST_PROOF_FILE;
+  delete process.env.DD_FLOW_NATIVE_COMMAND_SHA256;
+  delete process.env.DD_FLOW_NATIVE_REQUEST_OPERATION;
+  delete process.env.DD_FLOW_NATIVE_REQUEST_PROOF_OWNER;
+  if (!file || !path.isAbsolute(file) || !/^[a-f0-9]{64}$/.test(expected ?? '')
+    || typeof request.id !== 'string' || !request.id || typeof request.operation !== 'string' || request.operation !== operation) fail('invalid_owner');
+  const command = nativeCommandFingerprint({ executable: process.argv[1], args: process.argv.slice(2),
+    cwd: process.cwd(), env: process.env, operationId: request.id });
+  if (command !== expected || fs.realpathSync(path.dirname(file)) !== path.dirname(file)) fail('command_changed');
+  let owner;
+  try { owner = JSON.parse(ownerText ?? 'null'); } catch { fail('invalid_parent_owner'); }
+  const parent = fs.lstatSync(path.dirname(file));
+  if (!parent.isDirectory() || parent.dev !== owner?.dev || parent.ino !== owner?.ino) fail('proof_parent_changed');
+  const proof = { schema_id: 'dd-flow/native-request-proof@1', operation_id: request.id, operation: request.operation,
+    command_sha256: command, params_sha256: hashJson({ operation: request.operation, params: request.params ?? {} }),
+    session_id: request.params?.sessionId ?? null };
+  const temporary = `${file}.${randomUUID()}.tmp`;
+  const fd = fs.openSync(temporary, 'wx', 0o600);
+  try {
+    fs.writeFileSync(fd, JSON.stringify(proof)); fs.fsyncSync(fd);
+    const current = fs.lstatSync(path.dirname(file));
+    if (parent.dev !== current.dev || parent.ino !== current.ino || !current.isDirectory()) fail('proof_parent_changed');
+    try { fs.linkSync(temporary, file); }
+    catch (error) {
+      if (error.code !== 'EEXIST') throw error;
+      const stat = fs.lstatSync(file);
+      if (!stat.isFile() || stat.nlink !== 1 || stat.size > 16 * 1024
+        || hashJson(JSON.parse(fs.readFileSync(file, 'utf8'))) !== hashJson(proof)) fail('retained_request_changed');
+    }
+  } finally { fs.closeSync(fd); fs.unlinkSync(temporary); }
+  return { ...request, invocation_sha256: command };
+}

package/dist/harness-runtime/lib/opencode-plugin.mjs

@@ -1,4 +1,5 @@
 import path from "node:path";
+import { managedFlowEnv } from './managed-flow-env.mjs';
 import * as Plugin from "../vendor/opencode-plugin.mjs";
 import { hookBudget, invokeNativeHook } from "./native-hook-command.mjs";
 
@@ -26,6 +27,7 @@ export function makeOpenCodePlugin(binding, invoke = invokeNativeHook) {
       args: ["opencode", "event", "handle", "--project-root", binding.projectRoot, "--json"],
       payload, home: binding.ddFlowHome, timeoutMs: budget.remaining("admission", 15000) });
     await ctx.shell.hook("create.before", event => {
+      Object.assign(event.env, managedFlowEnv(binding));
       delete event.env.OPENCODE_PASSWORD; delete event.env.OPENCODE_SERVER_PASSWORD;
     });
     await ctx.tool.hook("execute.before", async event => {

package/dist/harness-runtime/lib/operation-progress.mjs

@@ -64,7 +64,9 @@ export function publishOperationProgress(root, id, phase, metadata = {}) {
     const prior = await readOperationProgress(root, id);
     const observedAt = metadata.observed_at ?? new Date().toISOString();
     if (prior && Date.parse(observedAt)<Date.parse(prior.observed_at)) return prior;
-    if (prior && phase === prior.phase && phase !== 'native_progress') return prior;
+    // A later successful ownership gate is fresh liveness evidence while admission waits.
+    if (prior && phase === prior.phase && phase !== 'native_progress'
+      && (phase !== 'ownership_confirmed' || Date.parse(observedAt) <= Date.parse(prior.observed_at))) return prior;
     if (prior && phase === 'native_progress' && Date.parse(observedAt) - Date.parse(prior.observed_at) < 1_000) return prior;
     const value = { schema_id: OPERATION_PROGRESS_CONTRACT,
       ...Object.fromEntries(fields.map(field => [field, requested[field] ?? null])),

package/dist/runtime/context.js

@@ -11,7 +11,7 @@ export function createRouterContext(env, deadlineAt) {
 }
 export function createContext(env, mode = "initialize", importPermitId, options = {}) {
     const ddFlowHome = resolveDdFlowHome(env);
-    if (options.resourceDatabaseMode === "prepared_existing" || options.resourceDatabaseMode === "initialize")
+    if (options.resourceDatabaseMode === "prepared_existing" || options.resourceDatabaseMode === "initialize" || options.resourceDatabaseMode === "create_new")
         assertImportAdmission(ddFlowHome, importPermitId);
     return {
         ddFlowHome,

package/dist/schemas/discovery-result.schema.json

@@ -0,0 +1,184 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "dd-flow/discovery-result@1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_id",
+    "request_id",
+    "observed_at",
+    "probe_scope",
+    "live_authorization_receipt",
+    "entries"
+  ],
+  "properties": {
+    "schema_id": {
+      "const": "dd-flow/discovery-result@1"
+    },
+    "request_id": {
+      "type": "string",
+      "minLength": 1
+    },
+    "observed_at": {
+      "type": "string",
+      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]+)?Z$"
+    },
+    "probe_scope": {
+      "enum": [
+        "static",
+        "non-generative",
+        "live"
+      ]
+    },
+    "live_authorization_receipt": {
+      "anyOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "path",
+            "sha256"
+          ],
+          "properties": {
+            "path": {
+              "type": "string",
+              "pattern": "^[a-zA-Z0-9_-][a-zA-Z0-9_.-]*(/[a-zA-Z0-9_-][a-zA-Z0-9_.-]*)*$"
+            },
+            "sha256": {
+              "type": "string",
+              "pattern": "^[a-f0-9]{64}$"
+            }
+          }
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "entries": {
+      "type": "array",
+      "minItems": 0,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "harness",
+          "candidates",
+          "installed",
+          "compatible",
+          "protocol",
+          "auth",
+          "qualified",
+          "reason",
+          "evidence"
+        ],
+        "properties": {
+          "harness": {
+            "enum": [
+              "codex",
+              "zcode",
+              "agy",
+              "opencode",
+              "grok",
+              "droid"
+            ]
+          },
+          "candidates": {
+            "type": "array",
+            "minItems": 0,
+            "items": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": [
+                "path",
+                "version",
+                "selected"
+              ],
+              "properties": {
+                "path": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "version": {
+                  "anyOf": [
+                    {
+                      "type": "string",
+                      "minLength": 1
+                    },
+                    {
+                      "type": "null"
+                    }
+                  ]
+                },
+                "selected": {
+                  "type": "boolean"
+                }
+              }
+            }
+          },
+          "installed": {
+            "enum": [
+              "yes",
+              "no",
+              "unknown"
+            ]
+          },
+          "compatible": {
+            "enum": [
+              "yes",
+              "no",
+              "unknown"
+            ]
+          },
+          "protocol": {
+            "enum": [
+              "verified",
+              "incompatible",
+              "unknown"
+            ]
+          },
+          "auth": {
+            "enum": [
+              "verified",
+              "unavailable",
+              "unknown"
+            ]
+          },
+          "qualified": {
+            "enum": [
+              "yes",
+              "no",
+              "unknown"
+            ]
+          },
+          "reason": {
+            "type": "string",
+            "minLength": 1
+          },
+          "evidence": {
+            "type": "array",
+            "minItems": 0,
+            "items": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": [
+                "path",
+                "sha256"
+              ],
+              "properties": {
+                "path": {
+                  "type": "string",
+                  "pattern": "^[a-zA-Z0-9_-][a-zA-Z0-9_.-]*(/[a-zA-Z0-9_-][a-zA-Z0-9_.-]*)*$"
+                },
+                "sha256": {
+                  "type": "string",
+                  "pattern": "^[a-f0-9]{64}$"
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}