@deksden-com/dd-flow-cli 0.9.0-beta.144 → 0.9.0-beta.149

package/dist/schemas/memory-repair-work-result.schema.json

@@ -9,7 +9,7 @@
     "work_id": { "type": "string", "minLength": 1, "maxLength": 256 },
     "packet_sha256": { "$ref": "#/$defs/hash" },
     "wave": { "type": "integer", "minimum": 1, "maximum": 2 },
-    "outcome": { "enum": ["accepted", "blocked"] },
+    "outcome": { "enum": ["accepted", "reconciled", "blocked"] },
     "summary": { "type": "string", "minLength": 1, "maxLength": 16384 },
     "changes": {
       "type": "array", "maxItems": 512,
@@ -29,12 +29,19 @@
         "properties": {
           "finding_id": { "type": "string", "minLength": 1, "maxLength": 128 },
           "summary": { "type": "string", "minLength": 1, "maxLength": 16384 },
-          "delta_paths": { "type": "array", "minItems": 1, "maxItems": 512, "uniqueItems": true, "items": { "type": "string", "minLength": 1, "maxLength": 4096 } },
+          "delta_paths": { "type": "array", "maxItems": 512, "uniqueItems": true, "items": { "type": "string", "minLength": 1, "maxLength": 4096 } },
           "evidence": { "type": "array", "minItems": 1, "maxItems": 256, "items": { "$ref": "#/$defs/reference" } }
         }
       }
     }
   },
+  "allOf": [
+    { "if": { "properties": { "outcome": { "const": "accepted" } } },
+      "then": { "properties": { "changes": { "type": "array", "minItems": 1 }, "resolutions": { "type": "array", "minItems": 1, "items": { "type": "object", "properties": { "delta_paths": { "type": "array", "minItems": 1 } } } } } } },
+    { "if": { "properties": { "outcome": { "const": "reconciled" } } },
+      "then": { "properties": { "changes": { "type": "array", "maxItems": 0 }, "resolutions": { "type": "array", "minItems": 1,
+        "items": { "type": "object", "properties": { "delta_paths": { "type": "array", "maxItems": 0 } } } } } } }
+  ],
   "$defs": {
     "hash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
     "reference": {

package/dist/schemas/project-flow-pack-manifest.schema.json

@@ -81,7 +81,7 @@
       "uniqueItems": true,
       "items": {
         "type": "string",
-        "enum": ["mb-init.md", "mb-upgrade.md", "mb-distill.md"]
+        "enum": ["mb-init.md", "mb-upgrade.md", "mb-distill.md", "mb-audit.md", "review.md"]
       }
     },
     "generated_allow_patterns": {

package/dist/schemas/release-impact.schema.json

@@ -7,10 +7,10 @@
   "required": ["schema_id", "from_version", "to_version", "minimum_upgrade_mode", "domains", "path_migration", "runtime_migration", "required_checks"],
   "properties": {
     "schema_id": {"const": "dd-flow/release-impact@1"},
-    "from_version": {"type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"},
-    "to_version": {"type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"},
+    "from_version": {"type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[A-Za-z0-9.-]+)?$"},
+    "to_version": {"type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[A-Za-z0-9.-]+)?$"},
     "minimum_upgrade_mode": {"enum": ["patch", "targeted_minor", "full_migration"]},
-    "domains": {"type": "array", "items": {"enum": ["canonical_layer", "root_structure", "product", "system", "engineering", "operations", "adr", "plans", "scenarios", "ui", "guides", "protocol_evidence", "skills", "archive", "code_traceability"]}, "uniqueItems": true},
+    "domains": {"type": "array", "items": {"enum": ["canonical_layer", "flow_contracts", "root_structure", "product", "system", "engineering", "operations", "adr", "plans", "scenarios", "ui", "guides", "protocol_evidence", "skills", "archive", "code_traceability"]}, "uniqueItems": true},
     "path_migration": {"type": "boolean"},
     "runtime_migration": {"type": "boolean"},
     "required_checks": {"type": "array", "items": {"type": "string"}, "minItems": 1},

package/dist/schemas/stage-start-response.schema.json

@@ -19,6 +19,10 @@
     "stage_root": {"type": "string", "minLength": 1},
     "archive_path": {"type": ["string", "null"]},
     "prompt_path": {"type": "string", "minLength": 1},
+    "prompt_delivery": {
+      "type": "object", "additionalProperties": false, "required": ["path", "sha256"],
+      "properties": {"path": {"type": "string", "minLength": 1}, "sha256": {"type": "string", "pattern": "^[a-f0-9]{64}$"}}
+    },
     "aliases": {"type": "object", "additionalProperties": {"type": "string"}},
     "resolved_context": {"type": "object", "additionalProperties": true},
     "plan_ref": {"type": "string", "pattern": "^\\.memory-bank/protocol/[^/]+/plan\\.json$"},

package/dist/services/accepted-intent.js

@@ -15,12 +15,24 @@ export function acceptedIntentReviewFingerprint(sources) {
  * clarification may use the existing coordinator correction, explicitly named
  * as such; it never retroactively expands the independent review's coverage. */
 export function validateAcceptedIntentReview(context, scope, reviewedSources, contextFingerprint, acknowledgement) {
+    // Keep file validation outside callers' SQL writer; the prepared validator
+    // below consumes only accepted bytes/ordered SQL events.
     const reviewed = acceptedIntentReviewFingerprint(reviewedSources);
     if (!reviewed)
-        return null; // Historical source contract has no new authority.
+        return null;
     if (contextFingerprint !== reviewed)
         throw new AppError("accepted_intent_review_stale", "Review context does not bind the retained accepted inputs", 1, { stage: scope.stage });
     const currentSources = prepareAcceptedIntentSources(context, { ...scope, stageDirectory: "intake", marked: true }).sources;
+    return validatePreparedAcceptedIntentReview(context, scope, reviewedSources, contextFingerprint, currentSources, acknowledgement);
+}
+export function validatePreparedAcceptedIntentReview(context, scope, reviewedSources, contextFingerprint, currentSources, acknowledgement) {
+    const reviewed = acceptedIntentReviewFingerprint(reviewedSources);
+    if (!reviewed)
+        return null; // Historical source contract has no new authority.
+    if (contextFingerprint !== reviewed)
+        throw new AppError("accepted_intent_review_stale", "Review context does not bind the retained accepted inputs", 1, { stage: scope.stage });
+    if (currentSources.length > 256)
+        throw new AppError("accepted_intent_source_invalid", "Accepted intent source count exceeds its bound", 1);
     const current = acceptedIntentReviewFingerprint(currentSources);
     const reviewedEvent = Math.max(0, ...(reviewedSources ?? []).filter(source => source.role.startsWith("accepted_hitl:")).map(source => Number(source.role.split(":")[1])));
     const rows = context.db.all("SELECT id, payload_json FROM audit_events WHERE project_id = ? AND event_type = 'flow_run.stage_resumed' AND json_extract(payload_json, '$.run_id') = ? AND id > ? ORDER BY id LIMIT 256", [scope.projectId, scope.runId, reviewedEvent]);

package/dist/services/canon.js

@@ -3,6 +3,8 @@ import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { AppError } from "../shared/errors.js";
 import { prepareError } from "../cli/input-preparation.js";
+import { resolveDdFlowHome } from "../storage/paths.js";
+import { readSetupStatus } from "./setup.js";
 const canonRootKey = "canon.root";
 export function prepareCanonRegistration(context, input) {
     if (typeof input.root !== "string" || !input.root.trim())
@@ -41,16 +43,21 @@ export function getCanonStatus(context, input = {}) {
 export function resolveCanonRoot(context, input = {}) {
     return resolveCanonCandidates(canonCandidates(context, input));
 }
-/** Read only: resolve an explicit/environment/nearby canon without opening DD_FLOW_HOME. */
+/** Read only: resolve canonical data without opening SQLite or running migrations. */
 export function resolveCanonRootBeforeContext(env, input = {}) {
     const candidates = [];
     if (input.explicitRoot)
         candidates.push(validateCanonCandidate("explicit", input.explicitRoot));
     else if (env.DD_MEMORYBANK)
         candidates.push(validateCanonCandidate("env", env.DD_MEMORYBANK));
-    else
-        for (const known of knownCanonRoots())
-            candidates.push(validateCanonCandidate("known", known));
+    else {
+        const installed = installedCanonCandidate(resolveDdFlowHome(env));
+        if (installed)
+            candidates.push(installed);
+        else
+            for (const known of knownCanonRoots())
+                candidates.push(validateCanonCandidate("known", known));
+    }
     return resolveCanonCandidates(uniqueBy(candidates, (candidate) => `${candidate.source}:${candidate.root}`));
 }
 function resolveCanonCandidates(candidates) {
@@ -67,7 +74,7 @@ function resolveCanonCandidates(candidates) {
         const memorybankRoot = candidate.memorybank_root ?? root;
         const mbbRoot = candidate.mbb_root ?? path.join(memorybankRoot, "mbb");
         const layout = candidate.layout ?? "legacy_root";
-        const metadata = readCanonMetadata(root, flowRoot);
+        const metadata = candidate.metadata ?? readCanonMetadata(root, flowRoot);
         return {
             ok: true,
             canon: {
@@ -114,6 +121,30 @@ function resolveCanonCandidates(candidates) {
         ]
     };
 }
+/** Archive provenance belongs to the selected release, not an ancestor Git
+ * checkout. A damaged installation is not permission to select nearby code. */
+function installedCanonCandidate(home) {
+    if (!fs.existsSync(path.join(home, "installation.json")))
+        return null;
+    const status = readSetupStatus(home), installation = status.installation;
+    const invalid = (root, reason) => ({
+        source: "installed", root, realpath: null, valid: false, blockers: [reason]
+    });
+    if (!installation || status.installation_readiness !== "installed")
+        return invalid(home, "Installed canonical release is degraded; reconcile setup before selecting its canon.");
+    const roots = fs.readdirSync(installation.canon_root);
+    if (roots.length !== 1)
+        return invalid(installation.canon_root, "Installed canonical archive has no unique root.");
+    const candidate = validateCanonCandidate("installed", path.join(installation.canon_root, roots[0]));
+    if (!candidate.valid)
+        return candidate;
+    const version = readTrimmed(path.join(candidate.root, "VERSION"));
+    const flowContract = readFlowContractId(candidate.flow_root);
+    if (version !== installation.manifest.canon.version || !flowContract)
+        return invalid(candidate.root, "Installed canonical metadata differs from its release selection.");
+    return { ...candidate, metadata: { version, commit: installation.manifest.canon.commit,
+            flow_contract: flowContract, status: "present", diagnostics: [] } };
+}
 function canonCandidates(context, input) {
     const candidates = [];
     if (input.explicitRoot) {
@@ -129,8 +160,13 @@ function canonCandidates(context, input) {
             candidates.push(validateCanonCandidate("registered", registered.root));
         }
     }
-    for (const known of knownCanonRoots()) {
-        candidates.push(validateCanonCandidate("known", known));
+    if (!candidates.length) {
+        const installed = installedCanonCandidate(context.ddFlowHome);
+        if (installed)
+            return [installed];
+        for (const known of knownCanonRoots()) {
+            candidates.push(validateCanonCandidate("known", known));
+        }
     }
     return uniqueBy(candidates, (candidate) => `${candidate.source}:${candidate.root}`);
 }

package/dist/services/check-environment.js

@@ -0,0 +1,21 @@
+import path from "node:path";
+import { AppError } from "../shared/errors.js";
+export function validateCheckEnvironment(value) {
+    if (value === undefined)
+        return undefined;
+    const entries = value && typeof value === "object" && !Array.isArray(value) ? Object.entries(value) : [];
+    if (!entries.length || entries.some(([key, selected]) => !["CODEX_HOME", "PLAYWRIGHT_BROWSERS_PATH"].includes(key)
+        || typeof selected !== "string" || !selected || selected.length > 4096 || selected.includes("\0") || !path.isAbsolute(selected)))
+        throw new AppError("invalid_check_environment", "Owned checks require absolute known resource paths", 2, { effect: "no_effect" });
+    return { ...value };
+}
+export function retainedBrowserEnvironment(environment) {
+    return environment.PLAYWRIGHT_BROWSERS_PATH === undefined ? undefined
+        : validateCheckEnvironment({ PLAYWRIGHT_BROWSERS_PATH: environment.PLAYWRIGHT_BROWSERS_PATH });
+}
+export function ownedCheckEnvironment(environment, requested) {
+    const selected = validateCheckEnvironment(requested), retained = retainedBrowserEnvironment(environment);
+    if (retained?.PLAYWRIGHT_BROWSERS_PATH && selected?.PLAYWRIGHT_BROWSERS_PATH && retained.PLAYWRIGHT_BROWSERS_PATH !== selected.PLAYWRIGHT_BROWSERS_PATH)
+        throw new AppError("invalid_check_environment", "Owned browser resource cannot be rebound", 2, { effect: "no_effect" });
+    return retained || selected ? { ...retained, ...selected } : undefined;
+}

package/dist/services/check-runner-evidence.js

@@ -5,14 +5,24 @@ import path from "node:path";
 import { parse } from "shell-quote";
 import { AppError } from "../shared/errors.js";
 import { validateObservationDuration } from "../harness-runtime/lib/observation-clock.mjs";
+import { isDeepStrictEqual } from "node:util";
+import { fileURLToPath } from "node:url";
 function object(value) { return Boolean(value) && typeof value === "object" && !Array.isArray(value); }
 function boundedString(value, bytes) { return typeof value === "string" && Buffer.byteLength(value) <= bytes; }
 const validatedBrowserProofs = new WeakSet();
+const unsupportedObservationContracts = new WeakSet();
+const validatedNativeProofs = new WeakSet();
+const validatedChildren = new WeakMap();
+const validatedReports = new WeakMap();
+const hash = (value) => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+const absoluteFile = (value) => typeof value === "string" && value.length > 0 && value.length <= 4096 && !value.includes("\0") && path.isAbsolute(value);
+export function candidateAbsencesValid(value) { return Array.isArray(value) && value.length <= 64 && value.every(item => object(item) && absoluteFile(item.file) && item.path_state === "missing" && object(item.declaration) && absoluteFile(item.declaration.file) && hash(item.declaration.sha256)); }
 function relativeProofPath(value) { return typeof value === "string" && value.length > 0 && Buffer.byteLength(value) <= 4096 && !path.isAbsolute(value) && !value.includes("\\") && value.split("/").every(part => part !== "" && part !== "." && part !== ".."); }
 function proofArtifact(value) { return object(value) && relativeProofPath(value.relative_path) && typeof value.sha256 === "string" && /^[a-f0-9]{64}$/.test(value.sha256); }
 function browserProofShape(proof) {
     const attempt = proof.attempt, step = proof.step;
-    return proof.native_code === "PLAYWRIGHT_ACTION_INACTIVITY" && object(attempt) && boundedString(attempt.invocation_id, 4096) && boundedString(attempt.test_id, 4096) && Boolean(attempt.test_id)
+    return (proof.observation_contract === undefined || proof.observation_contract === "dd-tasks/browser-observation@2" && object(proof.target) && [proof.target.page_id, proof.target.context_id].every(value => boundedString(value, 256) && Boolean(value)) && Number.isSafeInteger(proof.window_epoch) && Number(proof.window_epoch) > 0)
+        && proof.native_code === "PLAYWRIGHT_ACTION_INACTIVITY" && object(attempt) && boundedString(attempt.invocation_id, 4096) && boundedString(attempt.test_id, 4096) && Boolean(attempt.test_id)
         && [attempt.retry, attempt.repeat_each_index, attempt.worker_index].every(value => Number.isSafeInteger(value) && value >= 0)
         && object(step) && boundedString(step.id, 4096) && Boolean(step.id) && ["pw:api", "expect"].includes(String(step.category)) && step.file === proof.file && Number.isSafeInteger(step.line) && step.line > 0
         && proofArtifact(proof.worker_snapshot) && proofArtifact(proof.native_result);
@@ -29,6 +39,21 @@ export function runnerFailureValid(value) {
         return false;
     if (value.repair_evidence !== undefined) {
         const proof = value.repair_evidence;
+        if (object(proof) && proof.rule === "candidate_test_runtime_error")
+            return ["TypeError", "ReferenceError"].includes(String(proof.exception_type))
+                && absoluteFile(proof.file) && hash(proof.file_sha256) && ["test", "setup", "collection"].includes(String(proof.phase))
+                && [proof.line, proof.column].every(value => Number.isSafeInteger(value) && Number(value) > 0) && proofArtifact(proof.native_artifact);
+        if (object(proof) && proof.rule === "candidate_migration_sql")
+            return proof.native_code === "42601" && absoluteFile(proof.file) && hash(proof.file_sha256)
+                && boundedString(proof.operation_id, 4096) && Boolean(proof.operation_id) && proofArtifact(proof.native_artifact) && object(proof.world)
+                && boundedString(proof.world.invocation_id, 4096) && typeof proof.world.world_id === "string" && /^[a-f0-9]{32}$/.test(proof.world.world_id)
+                && boundedString(proof.world.role, 128) && Boolean(proof.world.role) && hash(proof.world.migrations_sha256) && proof.world.phase === "migrating" && proof.world.setup_completed === false;
+        if (object(proof) && proof.rule === "candidate_tool_diagnostic")
+            return absoluteFile(proof.file) && proofArtifact(proof.native_artifact)
+                && object(proof.tool) && { biome: "2.5.6", typescript: "5.9.3", docs: "1", "value-absence": "1" }[String(proof.tool.name)] === proof.tool.version
+                && object(proof.step) && boundedString(proof.step.id, 256) && Boolean(proof.step.id) && Number.isSafeInteger(proof.step.ordinal) && proof.step.ordinal >= 0 && hash(proof.step.command_sha256)
+                && boundedString(proof.diagnostic_code, 256) && (proof.tool.name === "biome" ? ["format", "assist/source/organizeImports"].includes(String(proof.diagnostic_code)) || /^lint\/[\w/-]+$/.test(String(proof.diagnostic_code)) : proof.tool.name === "typescript" ? /^TS\d+$/.test(String(proof.diagnostic_code)) : proof.tool.name === "docs" ? ["required_path_missing", "docs_contract"].includes(String(proof.diagnostic_code)) : proof.diagnostic_code === "value_absence")
+                && (proof.path_state === "present" && hash(proof.file_sha256) || proof.path_state === "missing" && proof.tool.name === "docs" && proof.diagnostic_code === "required_path_missing" && proof.file_sha256 === null && object(proof.declaration) && absoluteFile(proof.declaration.file) && hash(proof.declaration.sha256));
         if (!object(proof) || !boundedString(proof.rule, 128) || !boundedString(proof.native_code, 128) || !boundedString(proof.file, 4096) || !object(proof.world))
             return false;
         const world = proof.world;
@@ -45,23 +70,132 @@ function candidateFile(root, file) {
     if (!root || !path.isAbsolute(file))
         return false;
     try {
-        const relative = path.relative(fs.realpathSync(root), fs.realpathSync(file));
-        return relative !== "" && relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative) && fs.statSync(file).isFile();
+        const realRoot = fs.realpathSync(root), relative = path.relative(realRoot, fs.realpathSync(file));
+        if (!relative || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative))
+            return false;
+        let current = file;
+        while (fs.realpathSync(current) !== realRoot) {
+            if (fs.lstatSync(current).isSymbolicLink())
+                return false;
+            const parent = path.dirname(current);
+            if (parent === current)
+                return false;
+            current = parent;
+        }
+        return fs.statSync(file).isFile();
     }
     catch {
         return false;
     }
 }
 export function candidateFailureFiles(evidence, root) {
-    return [...new Set((evidence?.failures ?? []).flatMap(failure => failure.file && candidateFile(root, failure.file) ? [failure.file] : []))];
+    return [...new Set((evidence?.failures ?? []).flatMap(failure => {
+            const child = validatedChildren.get(failure);
+            if (child)
+                return candidateFailureFiles({ ...child.evidence, failures: [child.failure] }, root);
+            const proof = failure.repair_evidence;
+            const checksum = proof && "file_sha256" in proof ? proof.file_sha256 : undefined;
+            try {
+                return failure.file && candidateFile(root, failure.file) && (checksum === undefined || checksum === crypto.createHash("sha256").update(fs.readFileSync(failure.file)).digest("hex")) ? [failure.file] : [];
+            }
+            catch {
+                return [];
+            }
+        }))];
+}
+function absentCandidate(root, file) {
+    if (!root || !absoluteFile(file))
+        return false;
+    try {
+        let current = path.resolve(file);
+        try {
+            fs.lstatSync(current);
+            return false;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                return false;
+        }
+        for (;;) {
+            try {
+                if (fs.lstatSync(current).isSymbolicLink())
+                    return false;
+                break;
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    return false;
+                const parent = path.dirname(current);
+                if (parent === current)
+                    return false;
+                current = parent;
+            }
+        }
+        const realRoot = fs.realpathSync(root), relative = path.relative(realRoot, fs.realpathSync(current));
+        if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative))
+            return false;
+        while (fs.realpathSync(current) !== realRoot) {
+            if (fs.lstatSync(current).isSymbolicLink())
+                return false;
+            current = path.dirname(current);
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
 }
-function candidateFailure(failure, evidence, root, capturedFiles) {
-    const owned = (file) => capturedFiles === undefined ? candidateFile(root, file) : capturedFiles.includes(file);
+export function candidateFailureAbsences(evidence, root) {
+    return (evidence?.failures ?? []).flatMap(failure => {
+        const child = validatedChildren.get(failure);
+        if (child)
+            return candidateFailureAbsences({ ...child.evidence, failures: [child.failure] }, root);
+        try {
+            const proof = failure.repair_evidence;
+            if (proof?.rule !== "candidate_tool_diagnostic" || proof.path_state !== "missing" || !proof.declaration || !validatedNativeProofs.has(proof)
+                || !absentCandidate(root, proof.file) || !candidateFile(root, proof.declaration.file) || crypto.createHash("sha256").update(fs.readFileSync(proof.declaration.file)).digest("hex") !== proof.declaration.sha256)
+                return [];
+            return [{ file: proof.file, declaration: proof.declaration, path_state: "missing" }];
+        }
+        catch {
+            return [];
+        }
+    });
+}
+function candidateFailure(failure, evidence, root, capturedFiles, capturedAbsences) {
+    const child = validatedChildren.get(failure);
+    if (child)
+        return candidateFailure(child.failure, child.evidence, root, capturedFiles, capturedAbsences);
+    const owned = (file) => {
+        if (capturedFiles !== undefined)
+            return capturedFiles.includes(file);
+        if (!candidateFile(root, file))
+            return false;
+        const proof = failure.repair_evidence;
+        try {
+            return !proof || !("file_sha256" in proof) || proof.file_sha256 === crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+        }
+        catch {
+            return false;
+        }
+    };
     if (failure.origin === "tooling" || failure.origin === "unknown")
         return false;
     if (failure.category === "assertion")
         return failure.origin === undefined || failure.origin === "candidate" && failure.file !== undefined && owned(failure.file);
     const proof = failure.repair_evidence;
+    if (proof?.rule === "candidate_test_runtime_error")
+        return validatedNativeProofs.has(proof) && failure.category === "unclassified" && failure.origin === "candidate"
+            && failure.phase === proof.phase && failure.native_code === proof.exception_type && failure.file === proof.file && owned(proof.file);
+    if (proof?.rule === "candidate_migration_sql" || proof?.rule === "candidate_tool_diagnostic") {
+        if (!validatedNativeProofs.has(proof) || failure.category !== "unclassified" || failure.origin !== "candidate" || failure.file !== proof.file || !["setup", "collection", "test"].includes(failure.phase ?? ""))
+            return false;
+        if (proof.rule === "candidate_migration_sql")
+            return failure.phase === "setup" && failure.native_code === "42601" && proof.world.invocation_id === evidence.binding.invocation_id && owned(proof.file);
+        if (failure.phase !== "collection" || failure.native_code !== proof.diagnostic_code)
+            return false;
+        return proof.path_state === "missing" ? Boolean(proof.declaration && (capturedAbsences ?? (root ? candidateFailureAbsences(evidence, root) : [])).some(item => item.file === proof.file && isDeepStrictEqual(item.declaration, proof.declaration))) : owned(proof.file);
+    }
     if (proof?.rule === "candidate_browser_action_inactivity")
         return validatedBrowserProofs.has(proof) && failure.category === "unclassified" && failure.phase === "test" && failure.origin === "candidate" && failure.native_code === proof.native_code && failure.file === proof.file && failure.test_id === proof.attempt.test_id && proof.attempt.invocation_id === evidence.binding.invocation_id && owned(proof.file);
     return failure.category === "unclassified" && failure.origin === "candidate" && ["test", "setup"].includes(failure.phase ?? "") && proof?.rule === "candidate_sql_integrity" && ["23502", "23503", "23505", "23514"].includes(proof.native_code) && failure.native_code === proof.native_code && failure.file === proof.file && proof.world.invocation_id === evidence.binding.invocation_id && owned(proof.file);
@@ -107,7 +241,7 @@ export function readRunnerProgress(file, invocationId, lastSequence = 0, now = D
             if (!value || typeof value !== "object" || Array.isArray(value) || value.schema_id !== "dd-flow/check-runner-progress@1" || value.invocation_id !== invocationId
                 || !Number.isSafeInteger(value.sequence) || value.sequence <= 0 || typeof value.at !== "string" || !Number.isFinite(Date.parse(value.at))
                 || !["startup", "execution"].includes(value.phase)
-                || !["setup_step_completed", "run_started", "module_collected", "test_started", "test_completed", "step_completed", "run_completed"].includes(value.event))
+                || !["setup_step_completed", "run_started", "module_collected", "test_started", "test_completed", "step_started", "step_completed", "run_completed"].includes(value.event))
                 throw new Error("Malformed official progress record");
             if (value.sequence <= lastSequence || Date.parse(value.at) > now)
                 continue;
@@ -164,6 +298,9 @@ function readProofArtifact(root, ref, limit = 256 * 1024) {
 function matches(actual, expected) { return object(actual) && Object.entries(expected).every(([key, value]) => actual[key] === value); }
 function validateBrowserArtifacts(root, proof, binding) {
     const snapshot = readProofArtifact(root, proof.worker_snapshot), native = readProofArtifact(root, proof.native_result);
+    if (proof.observation_contract !== undefined && (proof.observation_contract !== "dd-tasks/browser-observation@2" || snapshot.observation_contract !== proof.observation_contract || native.observation_contract !== proof.observation_contract
+        || !isDeepStrictEqual(snapshot.target, proof.target) || !isDeepStrictEqual(native.target, proof.target) || snapshot.window_epoch !== proof.window_epoch || native.window_epoch !== proof.window_epoch))
+        return false;
     if (!Array.isArray(native.errors) || native.errors.length < 1 || native.errors.length > 64 || native.errors.some(error => !boundedString(error, 4096) || !/^(?:Error: )?(?:[A-Za-z][\w.]*: )?Test timeout of [1-9]\d*ms exceeded\.(?:\nCall log:[\s\S]*)?$/.test(stripVTControlCharacters(String(error)))))
         return false;
     if (!matches(snapshot.binding, binding) || !matches(native.binding, binding) || !matches(snapshot.attempt, proof.attempt) || !matches(native.attempt, proof.attempt)
@@ -175,7 +312,13 @@ function validateBrowserArtifacts(root, proof, binding) {
     return Number.isSafeInteger(quiet) && quiet > 0 && [last, deadline, observed, health, ended].every(Number.isFinite) && Math.abs(deadline - last - quiet) <= 2 && observed >= last && observed <= deadline && health <= observed && health >= last && deadline - health <= Math.min(1000, quiet / 4) && ended >= deadline && ended <= Date.now() && ended - deadline <= 5000;
 }
 export function runnerProofArtifacts(evidence) {
-    return [...new Set((evidence?.failures ?? []).flatMap(failure => { const proof = failure.repair_evidence; return [...(failure.diagnostic_artifact ? [failure.diagnostic_artifact.relative_path] : []), ...(proof?.rule === "candidate_browser_action_inactivity" ? [proof.worker_snapshot.relative_path, proof.native_result.relative_path] : [])]; }))];
+    return [...new Set([...(evidence?.failures ?? []).flatMap(failure => {
+                const child = validatedChildren.get(failure);
+                if (child && failure.child_evidence)
+                    return [failure.child_evidence.report.relative_path, ...runnerProofArtifacts(child.evidence).map(file => path.posix.join(path.posix.dirname(failure.child_evidence.report.relative_path), file))];
+                const proof = failure.repair_evidence;
+                return [...(failure.diagnostic_artifact ? [failure.diagnostic_artifact.relative_path] : []), ...(proof?.rule === "candidate_browser_action_inactivity" ? [proof.worker_snapshot.relative_path, proof.native_result.relative_path] : proof && "native_artifact" in proof ? [proof.native_artifact.relative_path] : [])];
+            }), ...(evidence ? validatedReports.get(evidence) ?? [] : []).flatMap(child => [child.report.relative_path, ...runnerProofArtifacts(child.evidence).map(file => path.posix.join(path.posix.dirname(child.report.relative_path), file))])])];
 }
 export function runnerContractsValid(value) {
     if (value === undefined)
@@ -186,13 +329,15 @@ export function runnerContractsValid(value) {
         if (!raw || typeof raw !== "object" || Array.isArray(raw))
             return false;
         const contract = raw;
-        return alias.startsWith("@check/") && contract.schema_id === "dd-flow/check-runner-evidence@1" && typeof contract.path === "string" && contract.path.length > 0 && contract.path.split("/")[0] !== "engine-outcome.json" && !contract.path.includes("\\") && !path.isAbsolute(contract.path) && !contract.path.split("/").some(part => part === ".." || part === "" || part === ".");
+        return alias.startsWith("@check/") && ["dd-flow/check-runner-evidence@1", "dd-flow/check-runner-evidence@2"].includes(String(contract.schema_id)) && typeof contract.path === "string" && contract.path.length > 0 && contract.path.split("/")[0] !== "engine-outcome.json" && !contract.path.includes("\\") && !path.isAbsolute(contract.path) && !contract.path.split("/").some(part => part === ".." || part === "" || part === ".");
     });
 }
-export function readRunnerEvidence(root, contract, binding) {
+export function readRunnerEvidence(root, contract, binding, depth = 0, budget = { reports: 0 }) {
     try {
+        if (depth > 4 || ++budget.reports > 64)
+            return null;
         let current = root;
-        if (!fs.lstatSync(current).isDirectory())
+        if (!fs.lstatSync(current).isDirectory() || fs.lstatSync(current).isSymbolicLink())
             return null;
         for (const part of contract.path.split(/[\\/]/)) {
             current = path.join(current, part);
@@ -200,34 +345,141 @@ export function readRunnerEvidence(root, contract, binding) {
                 return null;
         }
         const evidence = JSON.parse(readBoundedProofFile(current, 1024 * 1024).toString("utf8"));
+        if (!["dd-flow/check-runner-evidence@1", "dd-flow/check-runner-evidence@2"].includes(contract.schema_id))
+            return null;
+        const partial = evidence.failure_projection;
+        if (partial !== undefined && (evidence.schema_id !== "dd-flow/check-runner-evidence@2" || !object(partial) || partial.state !== "partial" || !["count_bound", "byte_bound", "interrupt"].includes(partial.reason)
+            || ![partial.represented, partial.omitted].every(value => Number.isSafeInteger(value) && value >= 0)))
+            return null;
         if (evidence.schema_id !== contract.schema_id || !evidence.binding || Object.entries(binding).some(([key, value]) => evidence.binding[key] !== value)
             || typeof evidence.runner?.name !== "string" || !evidence.runner.name || typeof evidence.runner.version !== "string" || !evidence.runner.version || typeof evidence.completed !== "boolean" || !evidence.counts
             || ![evidence.counts.passed, evidence.counts.failed, evidence.counts.skipped].every(n => Number.isSafeInteger(n) && n >= 0)
             || !Array.isArray(evidence.failures) || evidence.failures.length > 64 || evidence.failures.some(f => !runnerFailureValid(f))
-            || evidence.counts.failed > evidence.failures.length || evidence.observation_unknown !== undefined && typeof evidence.observation_unknown !== "boolean")
+            || !partial && evidence.counts.failed > evidence.failures.length || evidence.observation_unknown !== undefined && typeof evidence.observation_unknown !== "boolean")
             return null;
+        const children = new Map();
+        const consumed = new Map();
+        if (evidence.steps !== undefined) {
+            if (!Array.isArray(evidence.steps) || evidence.steps.length > 64)
+                return null;
+            const ids = new Set(), invocations = new Set();
+            let stopped = false;
+            for (const [ordinal, step] of evidence.steps.entries()) {
+                if (!step || !boundedString(step.id, 256) || !step.id || ids.has(step.id) || step.ordinal !== ordinal || !hash(step.command_sha256) || !["passed", "failed", "unreached"].includes(step.state))
+                    return null;
+                ids.add(step.id);
+                if (step.state === "unreached") {
+                    if (!stopped || step.binding !== undefined || step.report !== undefined || step.exit_code !== undefined)
+                        return null;
+                    continue;
+                }
+                if (stopped)
+                    return null;
+                if (step.state === "failed")
+                    stopped = true;
+                if (!step.binding || !proofArtifact(step.report) || !Number.isSafeInteger(step.exit_code) || step.state === "passed" && step.exit_code !== 0 || step.state === "failed" && step.exit_code === 0 || invocations.has(step.binding.invocation_id) || step.binding.invocation_id === binding.invocation_id)
+                    return null;
+                if (step.binding.invocation_id !== `${binding.invocation_id}:step:${step.id}` || step.binding.check_id !== `${binding.check_id}/${step.id}` || step.binding.verification_epoch !== binding.verification_epoch || step.binding.input_hash !== crypto.createHash("sha256").update(JSON.stringify([binding.input_hash, step.command_sha256])).digest("hex"))
+                    return null;
+                if (crypto.createHash("sha256").update(step.binding.command).digest("hex") !== step.command_sha256)
+                    return null;
+                invocations.add(step.binding.invocation_id);
+                readProofArtifact(root, step.report, 1024 * 1024);
+                const child = readRunnerEvidence(path.join(root, path.dirname(step.report.relative_path)), { schema_id: contract.schema_id, path: path.basename(step.report.relative_path) }, step.binding, depth + 1, budget);
+                if (!child || step.state === "passed" && (child.counts.failed !== 0 || child.failures.length !== 0) || step.state === "failed" && !child.failures.length && child.completed && !child.observation_unknown)
+                    return null;
+                if (!child.completed || child.observation_unknown)
+                    stopped = true;
+                children.set(step.id, child);
+            }
+            for (const key of ["passed", "failed", "skipped"])
+                if (evidence.counts[key] !== [...children.values()].reduce((total, child) => total + child.counts[key], 0))
+                    return null;
+        }
         for (const failure of evidence.failures) {
+            if (failure.child_evidence) {
+                const ref = failure.child_evidence, step = evidence.steps?.find(item => item.id === ref.step_id), child = children.get(ref.step_id);
+                if (!step || !child || !isDeepStrictEqual(ref.binding, step.binding) || !isDeepStrictEqual(ref.report, step.report))
+                    return null;
+                const original = { ...failure };
+                delete original.child_evidence;
+                const used = consumed.get(child) ?? new Set();
+                consumed.set(child, used);
+                const index = child.failures.findIndex((item, index) => { const native = { ...item }; delete native.child_evidence; return !used.has(index) && isDeepStrictEqual(native, original); });
+                if (index < 0)
+                    return null;
+                used.add(index);
+                const matched = child.failures[index];
+                if (!matched.child_evidence && matched.repair_evidence?.rule === "candidate_tool_diagnostic" && !isDeepStrictEqual(matched.repair_evidence.step, { id: step.id, ordinal: step.ordinal, command_sha256: step.command_sha256 }))
+                    return null;
+                validatedChildren.set(failure, { failure: matched, evidence: child });
+                continue;
+            }
             if (failure.diagnostic_artifact && !matches(readProofArtifact(root, failure.diagnostic_artifact, 2 * 1024 * 1024).binding, binding))
                 return null;
             const proof = failure.repair_evidence;
+            if (proof?.rule === "candidate_migration_sql" || proof?.rule === "candidate_tool_diagnostic" || proof?.rule === "candidate_test_runtime_error") {
+                const native = readProofArtifact(root, proof.native_artifact, 2 * 1024 * 1024), facts = Object.fromEntries(Object.entries(proof).filter(([key]) => key !== "native_artifact"));
+                if (!isDeepStrictEqual(native.binding, binding) || Object.entries(facts).some(([key, value]) => !isDeepStrictEqual(native[key], value)))
+                    return null;
+                if (proof.rule === "candidate_test_runtime_error") {
+                    if (evidence.schema_id !== "dd-flow/check-runner-evidence@2" || native.executing_file !== proof.file || native.exception_name !== proof.exception_type
+                        || !isDeepStrictEqual(native.top_frame, { file: proof.file, line: proof.line, column: proof.column }) || !boundedString(native.stack, 16384) || !String(native.stack).startsWith(`${proof.exception_type}:`))
+                        return null;
+                    const firstFrame = String(native.stack).split("\n").find(line => /^\s*at\s/.test(line));
+                    const frame = firstFrame?.match(/^\s*at\s+(?:.*?\()?((?:file:\/\/)?\/[^\n]+):(\d+):(\d+)\)?$/);
+                    if (!frame || (frame[1].startsWith("file://") ? fileURLToPath(frame[1]) : frame[1]) !== proof.file || Number(frame[2]) !== proof.line || Number(frame[3]) !== proof.column)
+                        return null;
+                }
+                validatedNativeProofs.add(proof);
+            }
             if (proof?.rule === "candidate_browser_action_inactivity") {
-                if (!validateBrowserArtifacts(root, proof, binding))
+                if (proof.observation_contract === undefined && evidence.schema_id === "dd-flow/check-runner-evidence@1") {
+                    // Legacy diagnostics remain readable; they do not prove the new window/target guarantee.
+                    if (!validateBrowserArtifacts(root, proof, binding))
+                        return null;
+                    evidence.completed = false;
+                    unsupportedObservationContracts.add(evidence);
+                    continue;
+                }
+                if (proof.observation_contract !== "dd-tasks/browser-observation@2" || !validateBrowserArtifacts(root, proof, binding))
                     return null;
                 validatedBrowserProofs.add(proof);
             }
         }
+        const represented = [...consumed.values()].reduce((total, used) => total + used.size, 0), childFailures = [...children.values()].reduce((total, child) => total + child.failures.length, 0);
+        if (partial) {
+            if (children.size ? partial.represented !== represented || partial.omitted !== childFailures - represented : partial.represented !== evidence.failures.filter(failure => failure.code !== "report_truncated").length)
+                return null;
+            evidence.completed = false;
+        }
+        else if (represented !== childFailures)
+            return null;
+        // Valid but incomplete native observation is diagnostic evidence, not a
+        // malformed schema. Preserve the primary failure and references through
+        // every composite, including a parent that incorrectly claims completion.
+        if ([...children.values()].some(child => !child.completed || child.observation_unknown)) {
+            evidence.completed = false;
+            if ([...children.values()].some(child => unsupportedObservationContracts.has(child)))
+                unsupportedObservationContracts.add(evidence);
+            if (evidence.schema_id === "dd-flow/check-runner-evidence@1" && [...children.values()].some(child => !child.completed && !unsupportedObservationContracts.has(child)) || [...children.values()].some(child => child.observation_unknown))
+                evidence.observation_unknown = true;
+        }
+        validatedReports.set(evidence, (evidence.steps ?? []).flatMap(step => step.report && children.has(step.id) ? [{ report: step.report, evidence: children.get(step.id) }] : []));
         return evidence;
     }
     catch {
         return null;
     }
 }
-export function runnerEvidencePass(evidence) { return Boolean(evidence?.completed && !evidence.observation_unknown && evidence.counts.failed === 0 && evidence.failures.length === 0); }
+export function runnerEvidencePass(evidence) { return Boolean(evidence?.completed && !evidence.failure_projection && !evidence.observation_unknown && evidence.counts.failed === 0 && evidence.failures.length === 0); }
 export function checkRepairDisposition(receipt) {
     if (receipt.fingerprint_scope != null && receipt.fingerprint_scope !== "check_inputs")
         return "tooling_blocker";
     if (receipt.status === "running" || receipt.status === "aborted" || receipt.runner_evidence?.observation_unknown)
         return "settlement_required";
+    if (receipt.runner_evidence && unsupportedObservationContracts.has(receipt.runner_evidence) || receipt.runner_evidence?.failure_projection || receipt.runner_evidence?.schema_id === "dd-flow/check-runner-evidence@2" && !receipt.runner_evidence.completed)
+        return "tooling_blocker";
     if (receipt.status === "passed")
         return "passed";
     if (receipt.execution_failures?.length || receipt.mutation_paths?.length || receipt.before_fingerprint !== receipt.after_fingerprint || receipt.diagnostic_evidence_valid === false)
@@ -241,7 +493,7 @@ export function checkRepairDisposition(receipt) {
         return "tooling_blocker";
     if (!evidence.completed)
         return "unclassified";
-    if (evidence.failures.some(f => !runnerFailureValid(f) || !candidateFailure(f, evidence, receipt.candidate_root, receipt.candidate_files)))
+    if (evidence.failures.some(f => !runnerFailureValid(f) || !candidateFailure(f, evidence, receipt.candidate_root, receipt.candidate_files, receipt.candidate_absences)))
         return "unclassified";
     return "source_repair";
 }

package/dist/services/cli-operation-classifier.js

@@ -32,7 +32,7 @@ export function isMbUpgradeCliOperation(args, env = process.env) {
 export function requiresExplicitUpgradeAuthorization(args) {
     const positional = positionalArgs(args);
     const [family, command] = positional;
-    if (family === "migration" && command === "apply")
+    if (family === "migration" && ["apply", "readiness"].includes(command ?? ""))
         return true;
     if (family === "run" && command === "start" && optionValue(args, "flow-kind") === "mb-upgrade")
         return true;