@deksden-com/dd-flow-cli 0.9.0-beta.142 → 0.9.0-beta.143

package/dist/services/run-control.js

@@ -892,7 +892,42 @@ export function nativeInventoryVersion(directory, operations = retainedDaemonOpe
     const keys = ["schema_id", "daemon_id", "config", "pid", "provider_pid", "shutdown_state", "shutdown", "active_operation", "active_tree", "sessions", "descendants", "root_session_id", "resource_process", "provider_process", "owned_processes"];
     // Only these native verbs are read-only. Unknown verbs remain guarded.
     const productive = operations.filter(operation => !isObservationOperation(operation.operation));
-    return crypto.createHash("sha256").update(JSON.stringify([Object.fromEntries(keys.map(key => [key, state[key]])), productive])).digest("hex");
+    const knownSchema = ["dd-opencode/daemon-state@2", "dd-codex/daemon-state@1", "dd-grok/daemon-state@1", "dd-zcode/daemon-state@1", "dd-agy/daemon-state@1", "dd-droid/daemon-state@1"].includes(String(state.schema_id));
+    const inventory = knownSchema ? Object.fromEntries(keys.map(key => [key, state[key]])) : { ...state };
+    const canonical = (value) => Array.isArray(value) ? value.map(canonical)
+        : value && typeof value === "object" ? Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => [key, canonical(item)])) : value;
+    // Sets have no observation order. Unknown schemas/fields remain guarded;
+    // only the proven derived OpenCode adapter alias is not ownership authority.
+    for (const key of ["sessions", "descendants", "owned_processes"]) {
+        const values = inventory[key];
+        if (!Array.isArray(values))
+            continue;
+        const seen = new Set();
+        inventory[key] = values.map(value => {
+            if (!value || typeof value !== "object" || Array.isArray(value)) {
+                if (state.schema_id === "dd-opencode/daemon-state@2")
+                    throw new AppError("native_inventory_invalid", `Invalid native ${key} record`, 1);
+                return value;
+            }
+            const record = value;
+            const identity = record.provider_session_id ?? record.process_id ?? record.pid;
+            if (identity === undefined && state.schema_id !== "dd-opencode/daemon-state@2")
+                return record;
+            if (!(typeof identity === "string" && identity.length > 0 || typeof identity === "number" && Number.isSafeInteger(identity) && identity > 0) || seen.has(String(identity)))
+                throw new AppError("native_inventory_invalid", `Invalid or duplicate native ${key} identity`, 1);
+            seen.add(String(identity));
+            if (state.schema_id === "dd-opencode/daemon-state@2" && key === "sessions") {
+                if (record.adapter_session_id !== undefined && record.adapter_session_id !== record.provider_session_id)
+                    throw new AppError("native_inventory_invalid", "Native Session adapter identity differs", 1);
+                const authority = { ...record };
+                delete authority.adapter_session_id;
+                return authority;
+            }
+            return record;
+        }).map(canonical).sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));
+    }
+    const productiveInventory = productive.map(canonical).sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));
+    return crypto.createHash("sha256").update(JSON.stringify(canonical([inventory, productiveInventory]))).digest("hex");
 }
 export function isObservationOperation(operation) {
     return ["session.inspect", "daemon.status"].includes(String(operation));

package/dist/services/stage-pause.js

@@ -7,6 +7,7 @@ import { AppError } from "../shared/errors.js";
 import { entityReferenceVariants, shortEntityReference } from "../shared/entity-references.js";
 import { resolveProjectRoot } from "../storage/paths.js";
 import { publishImmutableInput } from "../storage/immutable-input.js";
+import { acceptStagePacket, prepareStagePacket } from "./stage-report-renderer.js";
 import { resolveWorkReference } from "../storage/work-references.js";
 import { findRecentMatchingHookEvent, claimStageResumeHookEvent, stageResumeMatchKey } from "./hooks.js";
 import { requireProjectByRoot } from "./projects.js";
@@ -15,6 +16,8 @@ import { bindSessionForResume, refreshRunWorkProjection } from "./work-registry.
 import { assertRunMutationAllowed } from "./run-recovery.js";
 import { runtimeCommand } from "./runtime-command.js";
 import { prepareAgentOutputFile } from "../storage/agent-output.js";
+import { latestRunVerificationMatrix } from "./verification-matrix.js";
+import { validateAcceptedIntentReview } from "./accepted-intent.js";
 export { flowCommand } from "./runtime-command.js";
 export function prepareStagePause(context, input) {
     if (typeof input.question !== "string" || !input.question.trim())
@@ -28,6 +31,8 @@ export function prepareStagePause(context, input) {
     if (work.status !== "running")
         throw new AppError("invalid_work_state", "Only a running Work can pause", 1, { work_id: work.work_id, status: work.status });
     const question = input.question;
+    if (Buffer.byteLength(question) > 1024 * 1024)
+        throw new AppError("accepted_intent_source_invalid", "HITL question exceeds the bounded source contract", 2);
     const stage = requireStage(run, input.stage, "running");
     requireRunHome(run);
     return { projectRoot, project, run, work, question, stage };
@@ -39,6 +44,7 @@ export function pauseStageForUser(context, input) {
     const questionPath = path.join(pauseRoot, "question.md");
     fs.mkdirSync(pauseRoot, { recursive: true });
     publishImmutableInput(questionPath, Buffer.from(question), "hitl_question_conflict");
+    const questionPacket = prepareStagePacket(questionPath, Buffer.from(question));
     const answerInputPath = prepareAgentOutputFile(path.join(pauseRoot, "answer-input.md"));
     const now = context.now();
     context.db.writeTransaction(() => {
@@ -46,6 +52,7 @@ export function pauseStageForUser(context, input) {
         if (paused.changes !== 1)
             throw new AppError("invalid_work_state", "Work changed before pause could be accepted", 1, { work_id: work.work_id });
         pauseFlowRunStage(context, { projectRoot, runId: run.id, stage: stage.stage, workId: work.work_id, pauseId, questionPath });
+        acceptStagePacket(context, { projectId: project.id, runId: run.id, stage: stage.stage, prepared: questionPacket });
         context.db.afterCommit(() => refreshRunWorkProjection(context, project.id, run.id));
     });
     const resume = stageResumeCommand(context, { runId: run.id, stage: stage.stage, workId: work.work_id, projectRoot, answerInputPath });
@@ -103,9 +110,12 @@ export function resumeStageAfterUser(context, input) {
     }).eventKey;
     const now = context.now();
     const answerPath = path.join(path.dirname(pause.question_path), `answer-${crypto.createHash("sha256").update(`${pause.id}\0${input.answer}`).digest("hex")}.md`);
+    if (Buffer.byteLength(input.answer) > 1024 * 1024)
+        throw new AppError("accepted_intent_source_invalid", "Delivered user answer exceeds the bounded source contract", 2);
     // The answer is an immutable, content-addressed input. Prepare it before
     // reserving SQLite's writer; an unreferenced candidate has no flow authority.
     publishImmutableInput(answerPath, Buffer.from(input.answer), "hitl_answer_conflict");
+    const answerPacket = prepareStagePacket(answerPath, Buffer.from(input.answer));
     context.db.writeTransaction(() => {
         const identity = claimStageResumeHookEvent(context, { projectId: project.id, runId: run.id, stage: stage.stage, workId: work.work_id, projectRoot, eventKey: hookEventId });
         if (workSession.session_id !== identity.sessionId) {
@@ -117,11 +127,30 @@ export function resumeStageAfterUser(context, input) {
         if (resumed.changes !== 1)
             throw new AppError("invalid_work_state", "Work changed before resume could be accepted", 1, { work_id: work.work_id });
         resumeFlowRunStage(context, { projectRoot, runId: run.id, stage: stage.stage, workId: work.work_id, answerPath });
+        acceptStagePacket(context, { projectId: project.id, runId: run.id, stage: stage.stage, prepared: answerPacket });
         appendFlowRunTimelineEvent(context, project.id, run.id, { type: "stage_resume_session_bound", stage: stage.stage, work_id: work.work_id, session_id: identity.sessionId });
         context.db.afterCommit(() => refreshRunWorkProjection(context, project.id, run.id));
     });
     const prompt = evidence.prompt;
     const retryCommands = lifecycleRetryCommands(context, stage.stage);
+    const intentInstructions = [];
+    if (["plan-review", "code-review"].includes(stage.stage)) {
+        try {
+            const home = requireRunHome(run), source = latestRunVerificationMatrix(context, project.id, run.id, stage.stage, "input");
+            const reviewContext = path.join(home, stage.stage === "plan-review" ? "04-plan-review/work-context.json" : "06-code-review/review-context.json");
+            const retainedContext = fs.existsSync(reviewContext) ? JSON.parse(fs.readFileSync(reviewContext, "utf8")) : null;
+            validateAcceptedIntentReview(context, { projectId: project.id, runId: run.id, home, stage: stage.stage, decisionFrozen: Boolean(retainedContext?.accepted_decision) }, source?.metadata.accepted_sources, retainedContext?.accepted_intent_review_fingerprint);
+        }
+        catch (error) {
+            if (!(error instanceof AppError))
+                throw error;
+            intentInstructions.push(`Accepted-input review boundary: ${error.code}: ${error.message}`);
+            if (error.code === "accepted_intent_review_ack_required")
+                intentInstructions.push(`Apply/classify this own-stage clarification through the existing coordinator correction/repair route. Include this exact field in the decision: ${JSON.stringify({ accepted_intent_acknowledgement: error.details.accepted_intent_acknowledgement })}. Independent reviewer results prove only the earlier retained inputs; do not claim they reviewed the new answer.`);
+            else
+                intentInstructions.push("Do not accept stale independent review as coverage of this answer; report the actionable upstream revision/evidence blocker.");
+        }
+    }
     const continuation = [
         prompt.trimEnd(),
         "",
@@ -130,6 +159,7 @@ export function resumeStageAfterUser(context, input) {
         `- Question source: ${pause.question_path}`,
         `- Answer source: ${answerPath}`,
         "- Continue the same stage, Work and attempt. Do not call stage start or repeat completed preparation.",
+        ...intentInstructions,
         ...(retryCommands.length ? ["- A prior no-effect lifecycle rejection now has these authoritative replacement commands; correct the rejected input and use only these replacements:", ...retryCommands.map(command => `  ${command}`)] : []),
         "",
         "<user_question>",

package/dist/services/verification-matrix.js

@@ -6,6 +6,7 @@ import { vnextStageDirectory } from "../domain/stage-catalog.js";
 import { checkReceiptEvidenceValid, checkReceipts, effectiveCheckDeclarations } from "./code-checks.js";
 import { acceptStagePacket, prepareStagePacket, publishStagePacket, resolveStagePublicationPath } from "./stage-report-renderer.js";
 import { assertRunMutationAllowed } from "./run-recovery.js";
+import { acceptedIntentContract, acceptedIntentSourceRole, prepareAcceptedIntentSources } from "./accepted-intent.js";
 export const verificationMatrixContract = "dd-flow/verification-matrix@1";
 export const finalCheckCoverageContract = "dd-flow/final-check-coverage@1";
 /** A view of already validated facts: never a gate or a receipt selector. */
@@ -55,7 +56,9 @@ export function verificationMatrixInstruction(metadata, runHome, task) {
     const contract = `<verification_evidence_contract>\nCheck prerequisites must be executable in the check command or supported project policy; purpose prose and list order do not prepare an environment. A readiness gate is final verification, not implicit setup before the first CODE Work. PLAN and PLAN-REVIEW must compare claimed prerequisites with the actual launch path: a description saying migrate-before-check cannot repair a command that checks before migration. Prefer the existing self-contained project verification alias.\nBrowser checks must prove the expected surface exists and the measured set is nonempty before asserting layout geometry. An empty DOM is not evidence of no overlap. Derive navigation from the actual UI and accepted specification. Review whether the test can fail for the intended defect; a green named contour does not prove complete product semantics. Keep native test outcome separate from observation/cleanup: passed assertions with unknown cleanup are neither PASS nor a product assertion failure. Use retained native diagnostics and proof limits; generic timeouts or infrastructure errors do not authorize source repair. Do not patch the candidate product outside the assigned flow Work.\n</verification_evidence_contract>\n`;
     if (!metadata)
         return contract;
-    return `${contract}<verification_matrix>\nRuntime generated the technical verification matrix: ${safePath(runHome, metadata.markdown.path, false)}; structured data: ${safePath(runHome, metadata.json.path, false)}. Source fingerprint: ${metadata.source_fingerprint}; completeness: ${metadata.completeness}. Read it before ${task}. This is a derived view of the named accepted requirements, PLAN and receipts, not semantic acceptance. Do not edit these generated files or manually duplicate receipt IDs/hashes/results. Record insufficient proof or violated criteria in the ordinary Stage/Work result with evidence references; modify only your assigned source/test/result documents. Review inputs remain read-only. A passed check proves only its named contour and limits, not all business semantics or production readiness.\n</verification_matrix>\n`;
+    const originals = metadata.accepted_sources?.length ? ["Original accepted inputs (ordered intake, then question/answer pairs):", "A question is retained only to interpret its delivered user answer. Agent recommendations and options are not accepted decisions unless that answer explicitly adopts them.", ...metadata.accepted_sources.map(source => `- ${source.role}: ${safePath(runHome, source.path, false)} (sha256 ${source.sha256})`)].join("\n") : "Original accepted-input coverage is unavailable for this historical RUN. Do not treat SPECIFY as the original user input or claim that semantic preservation was verified.";
+    const originalContract = `<accepted_intent_sources>\n${originals}\nCompare original accepted inputs with SPECIFY, effective amendments, PLAN and observable implementation. Preserve material actors, operations, UI/API surfaces, state transitions and exceptions when applicable. API evidence does not prove UI behavior. Later text supersedes an earlier accepted decision only when explicitly accepted as such; unresolved conflicts are material questions, not last-text-wins. Report lost obligations with source and R/AC references. Never edit immutable accepted SPECIFY to conceal a finding. Use the supported upstream correction route; if unavailable or a wholly missing R/AC needs a new accepted revision, report an actionable blocker rather than repairing only PLAN. Do not fabricate HITL references. A structurally complete matrix is not semantic acceptance.\n</accepted_intent_sources>\n`;
+    return `${contract}${originalContract}<verification_matrix>\nRuntime generated the technical verification matrix: ${safePath(runHome, metadata.markdown.path, false)}; structured data: ${safePath(runHome, metadata.json.path, false)}. Source fingerprint: ${metadata.source_fingerprint}; completeness: ${metadata.completeness}. Read it before ${task}. This is a derived view of the named accepted requirements, PLAN and receipts, not semantic acceptance. Do not edit these generated files or manually duplicate receipt IDs/hashes/results. Record insufficient proof or violated criteria in the ordinary Stage/Work result with evidence references; modify only your assigned source/test/result documents. Review inputs remain read-only. A passed check proves only its named contour and limits, not all business semantics or production readiness.\n</verification_matrix>\n`;
 }
 /** Attachment and packet authority share a short transaction, then both files
  * must be visible before the prompt claims they are ready. */
@@ -86,6 +89,12 @@ export function prepareRunVerificationMatrix(context, input) {
     const owning = index.stage_runs?.find(item => item.stage === input.stage);
     const attempt = input.stageAttempt ?? owning?.attempt ?? "try-001";
     const sources = [], packets = [];
+    const intentContract = index.accepted_intent_contract;
+    if (intentContract !== undefined && intentContract !== acceptedIntentContract)
+        throw new AppError("accepted_intent_contract_unsupported", "Unknown accepted-input custody contract", 1, { contract: intentContract });
+    const intent = prepareAcceptedIntentSources(context, { projectId: input.projectId, runId: input.runId, home, stageDirectory: vnextStageDirectory(input.stage), marked: index.accepted_intent_contract === acceptedIntentContract });
+    sources.push(...intent.sources);
+    packets.push(...intent.packets);
     const readSource = (role, root, relative, expected) => {
         const file = safePath(root === "run" ? home : workspace, relative), bytes = fs.readFileSync(file), sha = digest(bytes);
         if (expected && sha !== expected)
@@ -258,6 +267,8 @@ export function prepareRunVerificationMatrix(context, input) {
     const markdown = prepareStagePacket(safePath(home, `${root}/verification-matrix.md`), Buffer.from(renderVerificationMatrix(matrix)));
     packets.push(json, markdown);
     const metadata = { contract: verificationMatrixContract, role: header.role, completeness: header.completeness, source_fingerprint: matrix.header.source_fingerprint, json: { path: slash(path.relative(home, json.file)), sha256: json.sha256 }, markdown: { path: slash(path.relative(home, markdown.file)), sha256: markdown.sha256 } };
+    if (intent.sources.length)
+        metadata.accepted_sources = intent.sources;
     if (index.final_check_coverage_contract === finalCheckCoverageContract)
         metadata.coverage_contract = finalCheckCoverageContract;
     const predecessors = (index.stage_runs ?? []).filter(item => item.stage !== input.stage && item.status === "done").map(item => ({ stage: item.stage, ...(item.attempt ? { attempt: item.attempt } : {}), ...(item.data_sha256 ? { data_sha256: item.data_sha256 } : {}) }));
@@ -294,6 +305,8 @@ export function latestRunVerificationMatrix(context, projectId, runId, stage, ro
     if (!run?.run_root)
         return null;
     const index = JSON.parse(run.index_json);
+    if (index.accepted_intent_contract !== undefined && index.accepted_intent_contract !== acceptedIntentContract)
+        throw new AppError("accepted_intent_contract_unsupported", "Unknown accepted-input custody contract", 1, { contract: index.accepted_intent_contract });
     const attempt = index.stage_runs?.find(item => item.stage === stage)?.attempt;
     const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id = ? AND event_type = 'flow_run.stage_packet' ORDER BY id DESC", [projectId]);
     for (const row of rows) {
@@ -319,9 +332,14 @@ export function latestRunVerificationMatrix(context, projectId, runId, stage, ro
         const md = { file: mdFile, bytes: mdBytes, sha256: paired.sha256 };
         const json = { file: packet.file, bytes, sha256: packet.sha256 };
         const metadata = { contract: verificationMatrixContract, role: matrix.header.role, completeness: matrix.header.completeness, source_fingerprint: matrix.header.source_fingerprint, json: { path: slash(path.relative(run.run_root, packet.file)), sha256: packet.sha256 }, markdown: { path: slash(path.relative(run.run_root, mdFile)), sha256: md.sha256 } };
+        const acceptedSources = matrix.sources.filter(source => acceptedIntentSourceRole(source.role)).sort((a, b) => a.role === "accepted_intake" ? -1 : b.role === "accepted_intake" ? 1 : compare(a.role, b.role));
+        if (index.accepted_intent_contract === acceptedIntentContract && !acceptedSources.some(source => source.role === "accepted_intake"))
+            throw new AppError("accepted_intent_source_gap", "Marked matrix is missing its original accepted intake", 1, { stage, run_id: runId });
+        if (acceptedSources.length)
+            metadata.accepted_sources = acceptedSources;
         if (index.final_check_coverage_contract === finalCheckCoverageContract)
             metadata.coverage_contract = finalCheckCoverageContract;
-        const sourcePackets = matrix.sources.filter(source => (source.role.startsWith("plan:") || source.role === "code_work_batch") && source.root === "run").map(source => {
+        const sourcePackets = matrix.sources.filter(source => (source.role.startsWith("plan:") || source.role === "code_work_batch" || acceptedIntentSourceRole(source.role)) && source.root === "run").map(source => {
             const file = safePath(run.run_root, source.path, false);
             const retained = rows.map(row => JSON.parse(row.payload_json)).find(item => item.run_id === runId && item.stage === stage && item.attempt === attempt && resolveStagePublicationPath(context, projectId, runId, item.file) === file && item.sha256 === source.sha256);
             if (!retained)

package/dist/services/vnext-code-review.js

@@ -28,6 +28,7 @@ import { assertRunMutationAllowed } from "./run-recovery.js";
 import { prepareJsonFile, prepareOutputFile } from "../cli/input-preparation.js";
 import { reviewerSourceInputs, reviewerSourceInstruction } from "./review-copy.js";
 import { reviewDefEvidence } from "./review-deferral.js";
+import { acceptedIntentReviewFingerprint, validateAcceptedIntentReview, assertAcceptedIntentReviewCurrent } from "./accepted-intent.js";
 import { stageSuccessor } from "./vnext-contracts.js";
 const stage = "code-review";
 const stageDir = vnextStageDirectory(stage);
@@ -93,7 +94,7 @@ export function startVnextCodeReview(context, input, prepared = prepareVnextCode
     freezeFlowRunReviewMode(context, { projectRoot, runId: run.id, review: "code", mode: mode.mode, source: mode.source, reason: mode.reason });
     const promptPath = path.join(root, "stage-prompt.md");
     const reviewContextPath = path.join(root, "review-context.json");
-    fs.writeFileSync(reviewContextPath, `${JSON.stringify({ schema_id: "dd-flow/code-review-context@1", reviewer_inputs: prepared.reviewerInputs, cycle, mode: mode.mode, mode_source: mode.source, mode_reason: mode.reason, ...(mode.mode !== "off" ? { read_only_input: { parent_work_id: rootWork.work_id, version: 3 } } : {}), code_report_sha256: codeReportSha256, review_batch_sha256: sha256Value(`${JSON.stringify(batch, null, 2)}\n`), aspect_map_checksums: aspectMapChecksums }, null, 2)}\n`);
+    fs.writeFileSync(reviewContextPath, `${JSON.stringify({ schema_id: "dd-flow/code-review-context@1", accepted_intent_review_fingerprint: acceptedIntentReviewFingerprint(prepared.matrix?.metadata.accepted_sources), reviewer_inputs: prepared.reviewerInputs, cycle, mode: mode.mode, mode_source: mode.source, mode_reason: mode.reason, ...(mode.mode !== "off" ? { read_only_input: { parent_work_id: rootWork.work_id, version: 3 } } : {}), code_report_sha256: codeReportSha256, review_batch_sha256: sha256Value(`${JSON.stringify(batch, null, 2)}\n`), aspect_map_checksums: aspectMapChecksums }, null, 2)}\n`);
     if (mode.mode === "off") {
         fs.writeFileSync(path.join(root, "decision.json"), `${JSON.stringify(disabledReviewDecision(), null, 2)}\n`);
         const prompt = `<stage_identity>\n- RUN: ${run.id}\n- stage: code-review\n- mode: off\n</stage_identity>\n\nCODE-REVIEW is disabled by the frozen RUN configuration. Finish with: ${finishCommand(context, run.id, projectRoot, path.join(root, "decision.json"))}\n${stageLifecycleInstruction}\n`;
@@ -197,6 +198,7 @@ export async function finishVnextCodeReview(context, input) {
         ? disabledDecision
         : readCodeReviewDecision(decisionFile, reviewContext.accepted_decision, Boolean(input.decisionFile), input.decision);
     validateSchema({ schemaName: "code-review-decision", file: decisionFile, data: decision, projectRoot: run.workspace_root, ddFlowHome: context.ddFlowHome, runId: run.id, runRoot: home });
+    const intentEvidence = mode === "off" ? null : validateAcceptedIntentReview(context, { projectId: project.id, runId: run.id, home, stage, decisionFrozen: Boolean(reviewContext.accepted_decision) }, latestRunVerificationMatrix(context, project.id, run.id, stage, "input")?.metadata.accepted_sources, reviewContext.accepted_intent_review_fingerprint, decision.accepted_intent_acknowledgement);
     const cycle = reviewContext.cycle ?? "initial";
     const reviewers = reviewerWorks(context, project.id, run.id, cycle);
     const defEvidence = decision.findings.filter(item => item.disposition === "defer").map(item => reviewDefEvidence(run.workspace_root, item.def_id));
@@ -218,13 +220,20 @@ export async function finishVnextCodeReview(context, input) {
             throw new AppError("review_decision_changed", "The accepted CODE-REVIEW decision cannot change during repair", 2, { decision_file: decisionFile });
         const fixIds = canonical.fix_ids;
         if (fixIds.length && repairs.length === 0) {
+            // The fresh repair sees the coordinator's newly accepted clarification,
+            // without pretending that the earlier independent review covered it.
+            if (intentEvidence?.coordinator_clarification_refs.length) {
+                const correctionMatrix = prepareRunVerificationMatrix(context, { projectId: project.id, runId: run.id, stage, role: "output", semanticFile: decisionFile });
+                context.db.writeTransaction(() => { assertAcceptedIntentReviewCurrent(context, { projectId: project.id, runId: run.id }, intentEvidence); acceptVerificationMatrix(context, correctionMatrix); });
+                publishVerificationMatrix(context, correctionMatrix);
+            }
             // Accept the value once. Repairs consume this decision, not a mutable
             // operator file. Reuse the existing context artifact and review cycle.
             const contextFile = path.join(root, "review-context.json"), temporary = `${contextFile}.tmp-${crypto.randomUUID()}`;
             fs.writeFileSync(temporary, `${JSON.stringify({ ...reviewContext, accepted_decision: decision, def_evidence: defEvidence }, null, 2)}\n`);
             fs.renameSync(temporary, contextFile);
             const repair = addVnextCodeReviewRepair(context, { projectRoot, runId: run.id, findingIds: fixIds, checkRefsByFinding, decisionReasonsByFinding: Object.fromEntries(canonical.decision.findings.map((item) => [item.finding_ref, item.reason])), objective: `Resolve accepted CODE-REVIEW findings: ${fixIds.join(", ")}` });
-            const retained = latestRunVerificationMatrix(context, project.id, run.id, stage, "input");
+            const retained = latestRunVerificationMatrix(context, project.id, run.id, stage, intentEvidence?.coordinator_clarification_refs.length ? "output" : "input");
             return { ok: true, run_id: run.id, stage, outcome: "repair_required", repair, ...(retained ? { verification_matrix: retained.metadata } : {}), instruction: `The repair Work is already registered: do not invoke its start_command in this coordinator Session. End this Turn so the controller can launch it in a fresh child Session. When it completes, invoke next.finish_command; this review cycle uses the decision already accepted by the runtime.\n${verificationMatrixInstruction(retained?.metadata ?? null, home, "the accepted review decision and repair")}`, next: { finish_command: finishCommand(context, run.id, projectRoot, decisionFile) } };
         }
         repairs = reviewRepairWorks(context, project.id, run.id, root, cycle);
@@ -273,9 +282,12 @@ export async function finishVnextCodeReview(context, input) {
     if (JSON.stringify(defEvidence) !== JSON.stringify(decision.findings.filter(item => item.disposition === "defer").map(item => reviewDefEvidence(run.workspace_root, item.def_id))))
         throw new AppError("deferral_invalid", "DEF evidence changed while final checks ran", 2);
     Object.assign(report.semantic, { def_evidence: defEvidence });
+    if (intentEvidence)
+        Object.assign(report.semantic, { accepted_intent_review: intentEvidence });
     const preparedReport = prepareStageReport(report);
     const completionInput = { projectRoot, runId: run.id, stage, status: "done", data: "stage-report.json", dataSchemaId: "dd-flow/stage-report@1", report: "stage-report.md", stageReport: "stage-report.html", dataSha256: preparedReport.sha256, git: report.mechanical.git };
     withStageSettlement(context, () => {
+        assertAcceptedIntentReviewCurrent(context, { projectId: project.id, runId: run.id }, intentEvidence);
         assertRunMutationAllowed(context, project.id, run.id, generation);
         const currentReviewers = reviewerWorks(context, project.id, run.id, cycle);
         const currentRepairs = reviewRepairWorks(context, project.id, run.id, root, cycle);

package/dist/services/vnext-plan-review.js

@@ -25,6 +25,7 @@ import { stageLifecycleInstruction } from "../harness-runtime/lib/delegation-ins
 import { prepareRunVerificationMatrix, acceptVerificationMatrix, commitVerificationMatrixStart, resumeVerificationMatrix, verificationMatrixInstruction, latestRunVerificationMatrix } from "./verification-matrix.js";
 import { reviewerSourceInputs, reviewerSourceInstruction } from "./review-copy.js";
 import { reviewDefEvidence } from "./review-deferral.js";
+import { acceptedIntentReviewFingerprint, validateAcceptedIntentReview, assertAcceptedIntentReviewCurrent } from "./accepted-intent.js";
 import { stageSuccessor } from "./vnext-contracts.js";
 const stage = "plan-review";
 const stageDir = vnextStageDirectory(stage);
@@ -171,7 +172,7 @@ export function startVnextPlanReview(context, input, prepared = prepareVnextPlan
     const workSessionId = String(binding.work_session_id);
     const sessionId = String(binding.session_id);
     const orchestration = writeFanoutDescriptor(root, { stage, parent_work_id: workId, dispatch: "plan-review", capacity_required: true, scope: stageGraphScope(context, project.id, run.id, stage) });
-    writeJson(path.join(root, "work-context.json"), { schema_id: "dd-flow/plan-review-context@1", reviewer_inputs: prepared.reviewerInputs, read_only_input: { parent_work_id: workId, version: 3 }, system: { run_id: run.id, work_id: workId, stage, requested_mode: requested, effective_mode: effective, plan_sources: readJson(prepared.batch).sources.map(source => ({ ...source, content_sha256: planContentHash(readJson(path.join(run.workspace_root, ".memory-bank", "protocol", source.protocol_id, "plan.json"))) })), plan_revision: prepared.revision, plan_checksum: planChecksum, batch_checksum: batchChecksum }, groups, workspace: { project_root: projectRoot, workspace_root: run.workspace_root, stage_root: root, plan_root: planRoot } });
+    writeJson(path.join(root, "work-context.json"), { schema_id: "dd-flow/plan-review-context@1", accepted_intent_review_fingerprint: acceptedIntentReviewFingerprint(prepared.matrix?.metadata.accepted_sources), reviewer_inputs: prepared.reviewerInputs, read_only_input: { parent_work_id: workId, version: 3 }, system: { run_id: run.id, work_id: workId, stage, requested_mode: requested, effective_mode: effective, plan_sources: readJson(prepared.batch).sources.map(source => ({ ...source, content_sha256: planContentHash(readJson(path.join(run.workspace_root, ".memory-bank", "protocol", source.protocol_id, "plan.json"))) })), plan_revision: prepared.revision, plan_checksum: planChecksum, batch_checksum: batchChecksum }, groups, workspace: { project_root: projectRoot, workspace_root: run.workspace_root, stage_root: root, plan_root: planRoot } });
     refreshRunWorkProjection(context, project.id, run.id);
     appendFlowRunTimelineEvent(context, project.id, run.id, { type: "work_session_started", stage, work_id: workId, id: workSessionId, session_id: sessionId });
     return { ok: true, run_id: run.id, stage, outcome: "review_required", work_id: workId, id: workSessionId, ...currentStagePrompt(context, promptPath), ...(externalContext ? { external_context: externalContext } : {}), orchestration, plan_review: { requested_mode: requested, effective_mode: effective, policy_source: policySource(run), groups }, next: { dispatch_command: dispatchCommand(context, run.id, projectRoot), finish_command: finishCommand(context, run.id, projectRoot, path.join(root, "decision.json")) } };
@@ -280,6 +281,7 @@ function finishPlanReviewOwned(context, input) {
         return withStageSettlement(context, () => finishTerminalReview(context, { projectRoot, projectId: project.id, run, root, parentWorkId: parent.work_id, decision, now, decisionReceipt, preparedReport, completionInput, preparedCompletion }));
     }
     const latestChildren = latestReviewChildren(children);
+    const intentEvidence = validateAcceptedIntentReview(context, { projectId: project.id, runId: run.id, home, stage }, latestRunVerificationMatrix(context, project.id, run.id, stage, "input")?.metadata.accepted_sources, contextFile.accepted_intent_review_fingerprint, decision.accepted_intent_acknowledgement);
     const evidenceFailures = reviewerEvidenceFailures(context, { projectId: project.id, parentWorkId: parent.work_id, children: latestChildren, groups, planRevision: reviewedPlanRevision, workspaceRoot: run.workspace_root, runHome: home, runId: run.id });
     if (evidenceFailures.length)
         throw new AppError("review_evidence_invalid", "PLAN-REVIEW reviewer evidence is incomplete, stale, or not isolated", 2, { errors: evidenceFailures });
@@ -332,11 +334,14 @@ function finishPlanReviewOwned(context, input) {
     const matrix = prepareRunVerificationMatrix(context, { projectId: project.id, runId: run.id, stage, role: "output", semanticFile: decisionPath });
     const completionBundle = readFlowRunExecutionBundle(context, { projectRoot, runId: run.id });
     return withStageSettlement(context, () => {
+        assertAcceptedIntentReviewCurrent(context, { projectId: project.id, runId: run.id }, intentEvidence);
         const registered = addWorkBatch(context, { parentWorkId: codeParentId, prepared: codeItems, stage: "code" });
         const now = context.now();
         settleReviewParent(context, { projectRoot, projectId: project.id, runId: run.id, parentWorkId: parent.work_id, status: "completed", result: decision.summary, reason: "plan_review_completed", resultPath: path.join(root, "stage-report.json") });
         const report = reportFor(context, { run, mode: contextFile.system?.effective_mode ?? "standard", requested: contextFile.system?.requested_mode ?? "auto", outcome: "accepted", groups, batchChecksum: contextFile.system?.batch_checksum ?? finalBatchChecksum, planChecksum: contextFile.system?.plan_checksum ?? finalPlanChecksum, finalBatchChecksum, finalPlanChecksum, initialPlanRevision: reviewedPlanRevision, finalPlanRevision: planRevision, code: registered, now, projectRoot, decision, children: latestChildren, flow: flowCommand(context), git: reportGit, ...(next.command ? { nextCommand: next.command } : {}) });
         Object.assign(report.semantic, { def_evidence: defEvidence });
+        if (intentEvidence)
+            Object.assign(report.semantic, { accepted_intent_review: intentEvidence });
         applyReviewResults(home, latestChildren, decision);
         if (matrix)
             Object.assign(report.semantic, { verification_matrix: matrix.metadata });

package/dist/services/vnext-protocolize.js

@@ -1,6 +1,7 @@
 import { isControllerManagedInvocation, managedLifecycleCommand } from "./lifecycle-invocations.js";
 import { stageSuccessor } from "./vnext-contracts.js";
 import crypto from "node:crypto";
+import { assertDeliveredHitlReferences } from "./accepted-intent.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -220,6 +221,7 @@ export async function finishVnextProtocolize(context, input) {
     try {
         if (result.outcome !== "protocolized")
             throw new AppError("validation", "PROTOCOLIZE may finish only as protocolized; use stage pause for every user question", 2);
+        assertDeliveredHitlReferences(context, { projectId: project.id, runId: run.id }, (result.obligation_amendments ?? []).map(amendment => amendment.hitl_ref));
         obligations = effectiveObligations(result, acceptedObligations);
         validateDelivery(projectRoot, result, obligations);
     }

package/dist/services/vnext-specify.js

@@ -1,6 +1,7 @@
 import { managedLifecycleCommand } from "./lifecycle-invocations.js";
 import { stageSuccessor } from "./vnext-contracts.js";
 import crypto from "node:crypto";
+import { retainAcceptedIntake } from "./accepted-intent.js";
 import fs from "node:fs";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
@@ -40,6 +41,8 @@ export function prepareVnextSpecifyStart(context, input) {
     const discussion = intake.markdown.trim();
     if (!discussion)
         throw new AppError("validation", "SPECIFY intake must not be empty", 2);
+    if (Buffer.byteLength(intake.markdown) > 1024 * 1024)
+        throw new AppError("accepted_intent_source_invalid", "Accepted intake exceeds the bounded source contract", 2);
     const flow = assertFlowDefinition(projectRoot);
     const template = readRequiredFile(path.join(projectRoot, ".memory-bank", "dd-flow", "vnext", "specify.md"), "vNext SPECIFY prompt template");
     const startInput = { projectRoot, flowKind: flow.id === protocolizeFlowId ? "vnext_protocolize" : "vnext_specify", subjectType: "discussion", subjectId: "SPECIFY", slug: input.slug ?? "specify", nextAction: "await_work_session" };
@@ -128,6 +131,7 @@ export function launchVnextSpecify(context, input, prepared = prepareVnextSpecif
         status: "running",
         dataSchemaId: "dd-flow/specify@1"
     });
+    retainAcceptedIntake(context, { projectId: run.project_id, runId: run.id, file: discussionPath, bytes: Buffer.from(intake.markdown) });
     refreshRunWorkProjection(context, run.project_id, run.id);
     appendFlowRunTimelineEvent(context, run.project_id, run.id, {
         type: "work_waiting_for_agent",

package/dist/services/work-registry.js

@@ -39,6 +39,7 @@ import { lifecycleRetryInstruction } from "../harness-runtime/lib/delegation-ins
 import { acceptedDecisionPrecedence, loadExternalStageContext, renderRetainedStageContext, renderRunOperationalContext, runContextRelocations } from "./stage-context.js";
 import { reviewEnvironmentAllowed, reviewExecutionCopyHash, reviewSourceHash, reviewSourcePaths } from "./review-copy.js";
 import { latestRunVerificationMatrix, verificationMatrixInstruction, verificationMatrixContract } from "./verification-matrix.js";
+import { acceptedIntentSourceRole } from "./accepted-intent.js";
 const workColumns = "work_id, project_id, run_id, parent_work_id, task, launch_policy, result_schema, payload_json, depends_on_json, status, result, created_at, started_at, updated_at, completed_at";
 export function ensureWorkRegistry(context) { context.db.get("SELECT 1 FROM works LIMIT 1"); context.db.get("SELECT 1 FROM work_sessions LIMIT 1"); }
 function ownsPhysicalWorkSession(context, projectId, owner, identity) {
@@ -1418,7 +1419,7 @@ function assertSharedReviewInput(context, work, run, generation = recoveryGuard(
     if (matrix) {
         add("run", matrix.metadata.json.path, matrix.metadata.json.sha256);
         add("run", matrix.metadata.markdown.path, matrix.metadata.markdown.sha256);
-        for (const source of matrix.matrix.sources.filter(source => ["specify", "protocolize", "protocolize_report"].includes(source.role)))
+        for (const source of matrix.matrix.sources.filter(source => ["specify", "protocolize", "protocolize_report"].includes(source.role) || acceptedIntentSourceRole(source.role)))
             add(source.root, source.path, source.sha256);
     }
     for (const item of value.reviewer_inputs ?? [])
@@ -1823,7 +1824,8 @@ function renderWorkerPrompt(context, work, run, dependencies, commands, workspac
     const retainedContext = contextFile ? renderRetainedStageContext({ loaded: loadExternalStageContext({ file: contextFile, expectedSha256: contextInput.sha256, stage: contextStage }), receipts: relocationReceipts, ...(workspaceView ? { workspaceView } : {}) }) : "";
     const body = `${operational}\n\n${retainedContext}${renderWorkerPromptBody(context, work, run, dependencies, commands)}`;
     const matrixStage = kind === "plan-review" || kind === "code-review" ? kind : codePacket(work) ? "code" : null;
-    const matrix = matrixStage ? latestRunVerificationMatrix(context, work.project_id, work.run_id, matrixStage, kind === "plan-review" || kind === "code-review" ? "input" : undefined) : null;
+    const reviewRepairMatrix = codePacket(work)?.repair?.review_findings?.length ? latestRunVerificationMatrix(context, work.project_id, work.run_id, "code-review", "output") : null;
+    const matrix = reviewRepairMatrix ?? (matrixStage ? latestRunVerificationMatrix(context, work.project_id, work.run_id, matrixStage, kind === "plan-review" || kind === "code-review" ? "input" : undefined) : null);
     const sources = matrix?.matrix.sources.filter(source => ["specify", "protocolize", "protocolize_report"].includes(source.role)) ?? [];
     return ["<accepted_decision_precedence>", `Read ${path.join(requireRunHome(run), "01-specify", "specify.json")} and later accepted RUN decisions relevant to this Work.`, ...sources.map(source => `Accepted ${source.role}: ${path.join(source.root === "run" ? requireRunHome(run) : run.workspace_root, source.path)} (sha256 ${source.sha256}). PROTOCOLIZE includes the effective amendments; preserve SPECIFY non-goals.`), acceptedDecisionPrecedence, "</accepted_decision_precedence>", "", body, verificationMatrixInstruction(matrix?.metadata ?? null, requireRunHome(run), `assigned Work ${work.work_id}`)].join("\n");
 }

package/dist/storage/database.js

@@ -1683,6 +1683,10 @@ function migrate(db) {
     ensureColumn(db, "check_receipts", "after_fingerprint", "ALTER TABLE check_receipts ADD COLUMN after_fingerprint TEXT NOT NULL DEFAULT ''");
     ensureColumn(db, "check_receipts", "profile_hash", "ALTER TABLE check_receipts ADD COLUMN profile_hash TEXT");
     ensureColumn(db, "check_receipts", "mutation_paths_json", "ALTER TABLE check_receipts ADD COLUMN mutation_paths_json TEXT NOT NULL DEFAULT '[]'");
+    ensureColumn(db, "check_receipts", "fingerprint_scope", "ALTER TABLE check_receipts ADD COLUMN fingerprint_scope TEXT");
+    ensureColumn(db, "check_receipts", "input_manifest_json", "ALTER TABLE check_receipts ADD COLUMN input_manifest_json TEXT");
+    ensureColumn(db, "check_receipts", "execution_failures_json", "ALTER TABLE check_receipts ADD COLUMN execution_failures_json TEXT");
+    ensureColumn(db, "check_receipts", "execution_contract_hash", "ALTER TABLE check_receipts ADD COLUMN execution_contract_hash TEXT");
     ensureColumn(db, "hook_events", "event_key", "ALTER TABLE hook_events ADD COLUMN event_key TEXT");
     ensureColumn(db, "hook_events", "match_key", "ALTER TABLE hook_events ADD COLUMN match_key TEXT");
     ensureColumn(db, "hook_events", "claimed_at", "ALTER TABLE hook_events ADD COLUMN claimed_at TEXT");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.142",
+  "version": "0.9.0-beta.143",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "packageManager": "pnpm@10.23.0",

package/tools/probe-codex-history.mjs

@@ -0,0 +1,37 @@
+/* global console */
+// Explicit non-generative contract probe. Never uses the operator's Codex home.
+import { mkdtemp, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { CodexBridge, codexReadPhase, readCodexHistory, readCodexRpc } from "../dist/harness-runtime/lib/dd-codex.mjs";
+import { errorRecord } from "../dist/harness-runtime/lib/operation-errors.mjs";
+
+const bin = process.argv[2];
+if (!bin || !path.isAbsolute(bin)) throw new Error("Usage: node tools/probe-codex-history.mjs /absolute/native/codex");
+const home = await mkdtemp(path.join(os.tmpdir(), "dd-codex-history-"));
+await writeFile(path.join(home, "config.toml"), "[features]\nplugins = false\nremote_models = false\n");
+const bridge = new CodexBridge({ bin, cwd: home, journal: path.join(home, "native.jsonl"),
+  env: { ...Object.fromEntries(Object.keys(process.env).map(key => [key, undefined])),
+    PATH: process.env.PATH, HOME: home, CODEX_HOME: home, CODEX_SQLITE_HOME: home, CODEX_LOG_DIR: home } });
+const report = { home, non_generative: true, reads: [] };
+try {
+  await bridge.start();
+  const created = await bridge.request("thread/start", { cwd: home, ephemeral: false, approvalPolicy: "never", sandbox: "read-only" });
+  report.session_id = created.thread.id;
+  report.history_mode = created.thread.historyMode;
+  const phase = codexReadPhase(bridge);
+  const compact = await readCodexRpc(bridge, "thread/read", { threadId: report.session_id, includeTurns: false }, phase);
+  report.compact = { id: compact.thread.id, status: compact.thread.status };
+  for (const method of ["thread/turns/list", "thread/read"]) {
+    const read = await readCodexHistory(bridge, method, { threadId: report.session_id,
+      ...(method === "thread/read" ? { includeTurns: true } : { limit: 20, itemsView: "summary" }) }, phase);
+    report.reads.push({ method, available: read.available, ...(read.error ? { error: read.error } : {}) });
+  }
+} catch (error) { report.error = errorRecord(error); process.exitCode = 1; }
+finally {
+  try { await bridge.close(); }
+  catch (error) { report.cleanup_error = errorRecord(error); process.exitCode = 1; }
+  await writeFile(path.join(home, "result.json"), JSON.stringify(report, null, 2) + "\n");
+}
+console.log(JSON.stringify(report, null, 2));