@deksden-com/dd-flow-cli 0.9.0-beta.144 → 0.9.0-beta.149

package/dist/services/prompt-delivery.js

@@ -0,0 +1,71 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { AppError } from "../shared/errors.js";
+import { publishImmutableInput } from "../storage/immutable-input.js";
+const digest = (text) => crypto.createHash("sha256").update(text).digest("hex");
+/** Describe the exact delivery before the existing operation receipt is settled.
+ * This does not issue commands or replace the original semantic prompt. */
+export function preparePromptDelivery(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return value;
+    const packet = value, text = packet.worker_prompt_markdown;
+    if (typeof text !== "string" || typeof packet.prompt_path !== "string")
+        return value;
+    if (!path.isAbsolute(packet.prompt_path))
+        throw new AppError("prompt_delivery_invalid", "Prompt delivery requires an absolute original prompt path", 1, { effect: "committed" });
+    const sha256 = digest(text);
+    let file = path.join(path.dirname(packet.prompt_path), "prompt-deliveries", `${sha256}.md`);
+    try {
+        if (fs.lstatSync(packet.prompt_path).isFile() && !fs.lstatSync(packet.prompt_path).isSymbolicLink()
+            && fs.readFileSync(packet.prompt_path, "utf8") === text)
+            file = packet.prompt_path;
+    }
+    catch { /* A retained delivery can republish an absent original without replay. */ }
+    const retained = packet.prompt_delivery;
+    if (retained && (retained.sha256 !== sha256 || retained.path !== file)) {
+        // An original file may disappear after commit. Keep the exact retained locator.
+        if (retained.sha256 !== sha256 || !path.isAbsolute(retained.path)
+            || retained.path !== packet.prompt_path && retained.path !== path.join(path.dirname(packet.prompt_path), "prompt-deliveries", `${sha256}.md`)) {
+            throw new AppError("prompt_delivery_invalid", "Retained delivery differs from its committed bytes", 1, { effect: "committed" });
+        }
+        file = retained.path;
+    }
+    const delivery = { path: file, sha256 };
+    // Keep the locator visible even when native tools clip verbose JSON metadata.
+    return Object.assign({ prompt_delivery: delivery }, packet, { prompt_delivery: delivery });
+}
+/** Publish only retained bytes, after commit and before advertising the locator. */
+export function publishPromptDelivery(value) {
+    if (!value || typeof value !== "object")
+        return;
+    const packet = value, delivery = packet.prompt_delivery;
+    if (!delivery)
+        return;
+    const text = packet.worker_prompt_markdown;
+    try {
+        if (typeof text !== "string" || digest(text) !== delivery.sha256 || !path.isAbsolute(delivery.path))
+            throw new Error("Delivery checksum mismatch");
+        if (typeof packet.prompt_path !== "string" || !path.isAbsolute(packet.prompt_path))
+            throw new Error("Delivery has no original prompt directory");
+        // Revalidate retained routing before touching the filesystem. System path
+        // aliases (/var on macOS) are allowed; a delivery-directory symlink is not.
+        preparePromptDelivery(packet);
+        const directory = path.dirname(delivery.path);
+        if (delivery.path !== packet.prompt_path) {
+            const stat = fs.lstatSync(directory, { throwIfNoEntry: false });
+            if (stat && (!stat.isDirectory() || stat.isSymbolicLink()))
+                throw new Error("Delivery directory is not an owned regular directory");
+        }
+        fs.mkdirSync(path.dirname(delivery.path), { recursive: true, mode: 0o700 });
+        if (delivery.path !== packet.prompt_path
+            && fs.realpathSync(directory) !== path.join(fs.realpathSync(path.dirname(packet.prompt_path)), "prompt-deliveries"))
+            throw new Error("Delivery directory escaped its original prompt directory");
+        publishImmutableInput(delivery.path, Buffer.from(text), "prompt_delivery_conflict");
+        fs.accessSync(delivery.path, fs.constants.R_OK);
+    }
+    catch (cause) {
+        throw new AppError("prompt_delivery_pending", "Operation committed; reconcile its retained delivery before continuing. Do not repeat the lifecycle operation or execute the old prompt", 1, { effect: "committed", publication_pending: true, path: delivery.path, sha256: delivery.sha256, cause: cause instanceof Error ? cause.message : String(cause) });
+    }
+}
+export const promptDeliveryInstruction = "Read the complete plain Markdown file at prompt_delivery.path; it is the exact current instruction packet (SHA-256 in prompt_delivery.sha256). Read all chunks if needed. The JSON response is routing metadata, not the primary prompt. If prompt_delivery is absent on a legacy response, read the complete worker_prompt_markdown from response_file. If publication is pending, stop and reconcile the existing operation; never replay Stage/Work start or use an old prompt.";

package/dist/services/provider-capacity.js

@@ -1,8 +1,52 @@
 import { setTimeout as delay } from "node:timers/promises";
 import crypto from "node:crypto";
-import { CAPACITY_POLICY, MAX_OVERLOAD_RETRIES, capacityBackoff, nativeItemsSettled, normalizeProviderFailure, overloadExhausted, parseCapacityOperation, refusalObservation, terminalProviderOverload } from "../harness-runtime/lib/provider-overload-policy.mjs";
+import { CAPACITY_POLICY, MAX_OVERLOAD_RETRIES, capacityBackoff, nativeItemsSettled, normalizeProviderFailure, overloadExhausted, parseCapacityOperation, refusalObservation, terminalProviderOverload, streamRequestKey } from "../harness-runtime/lib/provider-overload-policy.mjs";
 import { AppError } from "../shared/errors.js";
 import { isObservationLoss } from "../harness-runtime/lib/operation-errors.mjs";
+import { parseLifecycleCommand, commandOption } from "./lifecycle-command.js";
+import { nativeTreeReadiness } from "../harness-runtime/lib/native-children.mjs";
+import { ObservationClock } from "../harness-runtime/lib/observation-clock.mjs";
+/** Native output is evidence, not authority: match the committed current scope. */
+export function ownedProviderBoundary(context, input, boundary) {
+    if (typeof boundary.native_hook_event_key !== "string" || typeof boundary.daemon_instance !== "string"
+        || !context.db.get("SELECT 1 FROM hook_events WHERE project_id = ? AND event_key = ? AND daemon_id = ? AND provider_session_id = ? AND status = 'claimed'", [input.projectId, boundary.native_hook_event_key, boundary.daemon_instance, input.sessionId]))
+        return false;
+    const invocation = context.db.get("SELECT scope_json, outcome_json, command FROM lifecycle_invocations WHERE event_key = ? AND status = 'settled'", [boundary.native_hook_event_key]);
+    if (!invocation)
+        return false;
+    const scope = JSON.parse(invocation.scope_json);
+    const outcome = JSON.parse(invocation.outcome_json);
+    if (scope.runId !== input.runId || scope.daemonId !== boundary.daemon_instance || scope.rootSessionId !== input.sessionId || scope.generation !== input.generation
+        || outcome.error || outcome.effect !== undefined && outcome.effect !== "committed" || outcome.result?.ok !== true
+        || outcome.result.effect !== undefined && outcome.result.effect !== "committed")
+        return false;
+    const parsed = parseLifecycleCommand(invocation.command);
+    if (parsed.kind === "none" || parsed.kind === "compound" && !(parsed.supported === true && parsed.invocations?.length === 1) || !["stage_pause", "stage_finish", "work_finish"].includes(parsed.invocation.operation)
+        || boundary.outcome === "completed" && parsed.invocation.operation === "stage_pause" || boundary.outcome === "paused" && parsed.invocation.operation !== "stage_pause"
+        || boundary.lifecycle_operation !== undefined && boundary.lifecycle_operation !== parsed.invocation.operation
+        || parsed.invocation.operation !== "work_finish" && commandOption(parsed.invocation, "stage") !== input.stage)
+        return false;
+    const result = outcome.result;
+    if (result.run_id !== undefined && result.run_id !== input.runId || result.stage !== undefined && result.stage !== input.stage
+        || boundary.outcome === "paused" && (result.pause?.id !== boundary.pause?.id || result.outcome !== "paused")
+        || boundary.work_id !== undefined && result.work_id !== undefined && boundary.work_id !== result.work_id)
+        return false;
+    if (boundary.run_id !== undefined && boundary.run_id !== input.runId || boundary.stage !== undefined && boundary.stage !== input.stage
+        || boundary.work_id !== undefined && input.workId && boundary.work_id !== input.workId)
+        return false;
+    const run = context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [input.projectId, input.runId]);
+    const index = JSON.parse(run?.index_json ?? "null");
+    const stage = index?.stage_runs?.find(item => item.stage === input.stage);
+    if (!stage?.attempt)
+        return false;
+    const workId = input.workId ?? (typeof boundary.work_id === "string" ? boundary.work_id : null);
+    const rows = context.db.all(`SELECT DISTINCT w.work_id, w.status FROM works w JOIN work_sessions ws ON ws.work_id = w.work_id JOIN sessions s ON s.project_id = w.project_id AND s.session_id = ws.session_id JOIN stage_work_memberships m ON m.project_id = w.project_id AND m.run_id = w.run_id AND m.work_id = w.work_id WHERE w.project_id = ? AND w.run_id = ? AND ws.status IN ('running', 'completed') AND s.provider_session_id = ? AND m.stage = ? AND m.attempt = ? AND (? IS NULL OR w.work_id = ?) ${!workId && input.scope === "stage" ? "AND w.parent_work_id IS NULL" : ""}`, [input.projectId, input.runId, input.sessionId, input.stage, stage.attempt, workId, workId]);
+    if (rows.length !== 1 || boundary.work_id !== undefined && boundary.work_id !== rows[0].work_id)
+        return false;
+    if (boundary.outcome === "paused")
+        return rows[0].status === "paused" && stage.pause?.work_id === rows[0].work_id && stage.pause.id === boundary.pause?.id;
+    return boundary.outcome === "completed" && (input.scope === "work" ? rows[0].status === "completed" : stage.status === "done");
+}
 export function providerChildFailure(child) {
     return child.provider_failure ?? { code: child.native_source ? "provider_capacity_transient" : "turn_interrupted", details: { native_source: child.native_source, provider_session_id: child.session_id, turn_id: child.terminal_turn_id, native_turn_id: child.terminal_turn_id, terminal_status: child.status, observed_at: child.terminal_observed_at ?? null, provider_error: child.provider_error, native_turn_items: child.native_turn_items } };
 }
@@ -12,26 +56,9 @@ export function eligibleProviderChildOverload(child, parentSessionId) {
 }
 /** A terminal root is not a settled tree. Only the daemon's exact owned tree
  * with a settled root and positively live descendants permits waiting. */
-export function capacityReadiness(seen, sessionId, operationId, turnId, items, allowDescendants = false) {
-    if (seen.provider_session_id !== sessionId || seen.terminal_turn_id !== undefined && seen.terminal_turn_id !== turnId || !nativeItemsSettled(items))
-        return "unproven";
-    const ids = Array.isArray(seen.tree_session_ids) ? seen.tree_session_ids : [];
-    if (!ids.length || ids[0] !== sessionId || ids.some(id => typeof id !== "string" || !id) || new Set(ids).size !== ids.length)
-        return "unproven";
-    const observations = Array.isArray(seen.tree_observations) ? seen.tree_observations : [];
-    const exactTree = observations.length === ids.length && ids.every(id => observations.filter(item => item.provider_session_id === id).length === 1);
-    const settlement = seen.settlement;
-    const budgetSettled = !settlement || settlement.state === "not_required" || settlement.state === "settled" && settlement.operation_ids?.includes(operationId) === true;
-    const treeSettled = allowDescendants ? exactTree && observations.every(item => item.settled === true) && Array.isArray(seen.unsettled_sessions) && seen.unsettled_sessions.length === 0 : ids.length === 1;
-    if (seen.settled === true && treeSettled && budgetSettled)
-        return "ready";
-    if (!allowDescendants || seen.settled !== false || !exactTree || ids.length < 2 || observations[0]?.provider_session_id !== sessionId || observations[0].settled !== true
-        || settlement && settlement.state !== "not_required" && !(settlement.state === "pending" && settlement.reason === "tree_unsettled"))
-        return "unproven";
-    const live = observations.filter(item => item.settled === false);
-    const unsettled = seen.unsettled_sessions;
-    const knownLive = live.length > 0 && live.every(item => item.provider_session_id !== sessionId && ["active", "running", "inProgress"].includes(String(typeof item.status === "object" && item.status ? item.status.type : item.status)));
-    return knownLive && observations.every(item => typeof item.settled === "boolean") && Array.isArray(unsettled) && unsettled.length === live.length && live.every(item => unsettled.includes(item.provider_session_id)) ? "owned_children_live" : "unproven";
+export function capacityReadiness(seen, sessionId, operationId, turnId, items, allowDescendants = false, requestProof) {
+    const readiness = nativeTreeReadiness(seen, { sessionId, operationId, turnId, allowDescendants, requestProof });
+    return readiness === "inspection_pending" ? readiness : nativeItemsSettled(items) ? readiness : "unproven";
 }
 /** Permit acquisition must still belong to the original task, not merely an
  * open RUN. Controls/inspection and ordinary successor prompts are unaffected. */
@@ -237,9 +264,13 @@ export async function continueProviderCapacity(input) {
     const decide = async (observedOperationId = operationId) => {
         input.signal?.throwIfAborted();
         input.assertCurrent();
-        const decision = await observe(async () => await input.decision?.() ?? "continue", observedOperationId);
+        const normalized = normalizeProviderFailure(error, input.sessionId);
+        const candidate = normalized?.request_proof.kind === "stream_request" ? normalized.primary_error.details?.recovered_error_boundary : undefined;
+        const decision = await observe(async () => await input.decision?.(candidate?.receipt) ?? "continue", observedOperationId);
         input.signal?.throwIfAborted();
         input.assertCurrent();
+        if (normalized?.request_proof.kind === "stream_request" && ["completed", "paused"].includes(decision) && !candidate?.receipt)
+            throw blocked("Stream refusal has no ordered evidence of recovery before the committed boundary");
         if (decision === "reconciliation_blocked")
             throw new AppError("capacity_continuation_blocked", "Native refusal cannot be reconciled with its durable owner boundary", 1, { primary_error: error, root_operation_id: rootId, provider_session_id: input.sessionId });
         if (decision === "continue" && input.deadline !== undefined && Date.now() >= input.deadline)
@@ -254,9 +285,11 @@ export async function continueProviderCapacity(input) {
                 return null;
             throw error;
         }
-        const completed = await decide();
-        if (completed)
-            return completed;
+        if (normalizeProviderFailure(error, input.sessionId)?.request_proof.kind !== "stream_request") {
+            const completed = await decide();
+            if (completed)
+                return completed;
+        }
         const prior = await observe(() => input.inspectOperation(operationId));
         const failure = prior.error;
         const confirmed = normalizeProviderFailure(failure, input.sessionId);
@@ -266,25 +299,71 @@ export async function continueProviderCapacity(input) {
         if (prior.primary_error)
             throw prior.primary_error;
         if (prior.operation_id !== operationId || prior.operation !== "session.prompt" || prior.session_id !== input.sessionId
-            || prior.state !== "failed" || prior.primary_error || !turnId || !terminalProviderOverload(failure, input.sessionId, turnId)) {
+            || prior.state !== "failed" || prior.primary_error || !turnId || !terminalProviderOverload(failure, input.sessionId, turnId)
+            || confirmed?.request_proof.kind === "stream_request" && confirmed.request_proof.operation_id !== operationId) {
             throw blocked("Retained predecessor does not prove the exact terminal overloaded Turn");
         }
+        let pendingClock;
         const readiness = async () => {
             input.signal?.throwIfAborted();
             input.assertCurrent();
-            const seen = await observe(() => input.inspectSession(turnId));
+            const seen = await observe(() => input.inspectSession(confirmed?.request_proof.kind === "stream_request" ? undefined : turnId));
             input.signal?.throwIfAborted();
             input.assertCurrent();
             // An unloaded exact-Turn snapshot is not conflicting tool evidence.
             // Preserve the bound failure receipt, but never hide a pending item.
             const freshItems = seen.native_turn_items;
-            const items = (seen.terminal_turn_id === turnId && seen.terminal_status === "failed"
+            const stream = confirmed?.request_proof.kind === "stream_request";
+            const streamMetadata = seen.terminal_metadata;
+            const exactFresh = stream ? streamRequestKey(streamMetadata?.request_proof) === turnId : seen.terminal_turn_id === turnId && seen.terminal_status === "failed";
+            const items = (exactFresh
                 && !(freshItems?.observed === false && freshItems.pending !== true) ? freshItems : confirmed?.native_turn_items);
-            return capacityReadiness(seen, input.sessionId, operationId, turnId, items, input.allowSettledDescendants);
+            if (confirmed?.request_proof.kind === "stream_request") {
+                const metadata = seen.terminal_metadata;
+                if (streamRequestKey(metadata?.request_proof) !== turnId)
+                    return "unproven";
+            }
+            const current = capacityReadiness(seen, input.sessionId, operationId, turnId, items, input.allowSettledDescendants, confirmed?.request_proof);
+            if (current === "inspection_pending") {
+                const saved = seen.native_settlement.observation_clock;
+                pendingClock ??= new ObservationClock({ timeoutMs: saved.timeout_ms, saved, snapshotIsLive: true });
+                if (pendingClock.sample(saved.cursor, saved.observed_at ?? undefined))
+                    return "unproven";
+            }
+            return current;
         };
-        const ready = await readiness();
+        // Pending is a bound observer, not a refusal or an intent to write. Resolve
+        // it before retaining a productive retry. Its producer owns the old clock.
+        const waitForReadiness = async (initial) => {
+            let current = initial;
+            while (current === "owned_children_live" || current === "inspection_pending") {
+                await delay(250, undefined, { signal: input.signal });
+                const boundary = await decide();
+                if (boundary)
+                    return boundary;
+                current = await readiness();
+            }
+            if (current !== "ready")
+                throw blocked("Native predecessor readiness became unproven");
+            return null;
+        };
+        let ready = await readiness();
+        while (ready === "inspection_pending") {
+            await delay(250, undefined, { signal: input.signal });
+            const boundary = await decide();
+            if (boundary)
+                return boundary;
+            ready = await readiness();
+        }
         if (ready === "unproven")
             throw blocked("Native predecessor readiness is unproven; do not cancel or replay to manufacture proof");
+        if (ready === "ready") {
+            const completed = await decide();
+            if (completed)
+                return completed;
+            if (confirmed?.request_proof.kind === "stream_request" && confirmed.primary_error.details?.recovered_error_boundary)
+                throw blocked("Recovered native error does not match its current durable owner boundary");
+        }
         const native = normalizeProviderFailure(failure, input.sessionId, turnId);
         let refusal = refusals.find(item => item.ordinal === ordinal - 1);
         if (refusal && (refusal.turn_id !== turnId || refusal.session_id !== input.sessionId || refusal.policy !== CAPACITY_POLICY))
@@ -332,26 +411,13 @@ export async function continueProviderCapacity(input) {
             throw new AppError("capacity_owner_deadline_exceeded", "Continuation wait exceeds its original owner deadline", 1, { primary_error: failure, deadline: input.deadline ?? null });
         }
         if (!existing) {
-            const intent = { predecessor: operationId, operation_id: nextId, turn_id: turnId, ordinal, prompt_sha256: promptSha, not_before: new Date(Date.now() + wait).toISOString(), policy: CAPACITY_POLICY, root_operation_id: rootId, session_id: input.sessionId, deadline: input.deadline ?? null, refusal };
+            const intent = { predecessor: operationId, operation_id: nextId, turn_id: turnId, request_key: native.request_key, request_proof: native.request_proof, ordinal, prompt_sha256: promptSha, not_before: new Date(Date.now() + wait).toISOString(), policy: CAPACITY_POLICY, root_operation_id: rootId, session_id: input.sessionId, deadline: input.deadline ?? null, refusal };
             input.retainIntent(intent);
             history.push(intent);
         }
         // Intent/refusal are durable before the first wait; no permit or writer is
         // held here, and live siblings are never cancelled as a settlement proof.
-        const waitForOwnedChildren = async (initial) => {
-            let current = initial;
-            while (current === "owned_children_live") {
-                await delay(250, undefined, { signal: input.signal });
-                const boundary = await decide();
-                if (boundary)
-                    return boundary;
-                current = await readiness();
-            }
-            if (current !== "ready")
-                throw blocked("Owned native child readiness became unproven");
-            return null;
-        };
-        const childBoundary = await waitForOwnedChildren(ready);
+        const childBoundary = await waitForReadiness(ready);
         if (childBoundary)
             return childBoundary;
         // Node timers truncate large delays. Bounded slices preserve cancellation
@@ -366,7 +432,7 @@ export async function continueProviderCapacity(input) {
         const afterWait = await decide();
         if (afterWait)
             return afterWait;
-        const refreshedBoundary = await waitForOwnedChildren(await readiness());
+        const refreshedBoundary = await waitForReadiness(await readiness());
         if (refreshedBoundary)
             return refreshedBoundary;
         const beforeDispatch = await decide();

package/dist/services/recovery-snapshot-database.js

@@ -74,7 +74,7 @@ export function captureRecoveryDatabase(source, output, projectId, runId, protoc
             const bootstrapReceipts = `EXISTS (SELECT 1 FROM run_bundle_authorities b JOIN runs r
         ON r.project_id=b.project_id AND r.id=b.run_id
         WHERE (b.project_id,b.run_id) IN (SELECT * FROM capture_scope)
-          AND json_extract(r.index_json,'$.execution_bundle.flow_id')='mb-init'
+          AND json_extract(r.index_json,'$.execution_bundle.flow_id') IN ('mb-init','mb-upgrade')
           AND (audit_events.project_id IS NULL OR audit_events.project_id=b.project_id)
           AND (
             (event_type IN ('memory.init_git_policy','memory.init_release_selection','memory.init_startup_input','memory.init_startup_input_intent','memory.init_project_bootstrap_intent',
@@ -109,6 +109,33 @@ export function captureRecoveryDatabase(source, output, projectId, runId, protoc
               AND ((event_type='memory.bootstrap_ready' AND json_extract(payload_json,'$.schema_id')='dd-flow/memory-bootstrap-authority@1')
                 OR (event_type='memory.bootstrap_readiness_intent' AND json_extract(payload_json,'$.schema_id')='dd-flow/memory-bootstrap-readiness-intent@1')))))`;
             rules.audit_events = `(${rules.audit_events}) OR (${bootstrapReceipts})`;
+            // Upgrade selection/storage bytes are request-owned historical evidence,
+            // not ambient Home configuration. Keep only the bundle's original scope.
+            const upgradeScope = `SELECT 1 FROM run_bundle_authorities b JOIN runs r
+        ON r.project_id=b.project_id AND r.id=b.run_id
+        WHERE (b.project_id,b.run_id) IN (SELECT * FROM capture_scope)
+          AND json_extract(r.index_json,'$.execution_bundle.flow_id')='mb-upgrade'`;
+            rules.runtime_config = `CASE WHEN key GLOB 'mb-upgrade.storage.*' THEN EXISTS (${upgradeScope}
+        AND key='mb-upgrade.storage.' || b.project_id || '.' || json_extract(b.admission_json,'$.executionScope.requestId')
+        AND json_extract(value_json,'$.project_id')=b.project_id
+        AND json_extract(value_json,'$.scope.requestId')=json_extract(b.admission_json,'$.executionScope.requestId')
+        AND json_extract(value_json,'$.scope.projectRoot')=json_extract(b.admission_json,'$.executionScope.projectRoot')
+        AND json_extract(value_json,'$.scope.workspaceRoot')=json_extract(b.admission_json,'$.executionScope.workspace')) ELSE 0 END`;
+            rules.audit_events = `(${rules.audit_events}) OR (event_type='memory.upgrade_storage_ready'
+        AND EXISTS (${upgradeScope} AND audit_events.project_id=b.project_id
+          AND json_extract(payload_json,'$.request_id')=json_extract(b.admission_json,'$.executionScope.requestId')
+          AND json_extract(payload_json,'$.project_root')=json_extract(b.admission_json,'$.executionScope.projectRoot')
+          AND json_extract(payload_json,'$.workspace_root')=json_extract(b.admission_json,'$.executionScope.workspace')))`;
+            const publication = `CASE WHEN key GLOB 'memory_upgrade_publication:*' THEN EXISTS (${upgradeScope}
+        AND json_extract(value_json,'$.binding.scope.project_id')=b.project_id
+        AND json_extract(value_json,'$.binding.scope.run_id')=b.run_id
+        AND json_extract(value_json,'$.binding.scope.stage')='upgrade') ELSE 0 END`;
+            rules.runtime_config = `(${rules.runtime_config}) OR (${publication})`;
+            rules.audit_events = `(${rules.audit_events}) OR (event_type IN ('memory.upgrade_publication_intent','memory.upgrade_publication_complete')
+        AND EXISTS (SELECT 1 FROM runtime_config WHERE ${publication}
+          AND key='memory_upgrade_publication:' || json_extract(audit_events.payload_json,'$.scope_sha256')
+          AND json_extract(value_json,'$.binding.scope.project_id')=audit_events.project_id
+          AND json_extract(value_json,'$.binding.scope.run_id')=json_extract(audit_events.payload_json,'$.run_id')))`;
         }
         // Batch and composition registration are portable RUN evidence, not a host lease. Keep their
         // independent receipt alongside the selected Works, never a neighboring
@@ -361,7 +388,7 @@ export function captureRecoveryDatabase(source, output, projectId, runId, protoc
       AND json_extract(payload_json,'$.readiness_sha256') NOT GLOB '*[^0-9a-f]*'
       AND EXISTS (SELECT 1 FROM runs r,json_each(r.index_json,'$.stage_runs') f,json_each(r.index_json,'$.stage_runs') v
         WHERE r.project_id=audit_events.project_id AND r.id=json_extract(audit_events.payload_json,'$.run_id')
-          AND json_extract(r.index_json,'$.execution_bundle.flow_id')='mb-init'
+          AND json_extract(r.index_json,'$.execution_bundle.flow_id') IN ('mb-init','mb-upgrade')
           AND json_extract(r.index_json,'$.execution_bundle.manifest_sha256')=json_extract(audit_events.payload_json,'$.bundle_sha256')
           AND json_extract(f.value,'$.stage')='finish'
           AND json_extract(f.value,'$.attempt')=json_extract(audit_events.payload_json,'$.attempt')
@@ -379,12 +406,13 @@ export function captureRecoveryDatabase(source, output, projectId, runId, protoc
       AND json_extract(payload_json,'$.evidence_sha256') NOT GLOB '*[^0-9a-f]*'
       AND EXISTS (SELECT 1 FROM runs r,json_each(r.index_json,'$.stage_runs') f
         WHERE r.project_id=audit_events.project_id AND r.id=json_extract(audit_events.payload_json,'$.run_id')
-          AND json_extract(r.index_json,'$.execution_bundle.flow_id')='mb-init'
+          AND json_extract(r.index_json,'$.execution_bundle.flow_id') IN ('mb-init','mb-upgrade')
           AND json_extract(r.index_json,'$.execution_bundle.manifest_sha256')=json_extract(audit_events.payload_json,'$.bundle_sha256')
           AND json_extract(f.value,'$.stage')='finish' AND json_extract(f.value,'$.status')='done'
           AND json_extract(f.value,'$.attempt')=json_extract(audit_events.payload_json,'$.attempt')
           AND json_extract(f.value,'$.input_sha256')=json_extract(audit_events.payload_json,'$.input_sha256')
-          AND json_extract(f.value,'$.data_schema_id')='dd-flow/mb-init-finish-result@1'
+          AND json_extract(f.value,'$.data_schema_id')=CASE json_extract(r.index_json,'$.execution_bundle.flow_id')
+            WHEN 'mb-upgrade' THEN 'dd-flow/mb-upgrade-stage-result@1' ELSE 'dd-flow/mb-init-finish-result@1' END
           AND json_extract(f.value,'$.data_sha256')=json_extract(audit_events.payload_json,'$.result_sha256'))`;
         rules.audit_events = `(${rules.audit_events}) OR (${ownProject} AND (${memoryFinishAcceptance}))`;
         const descriptorRunSettlementReceipt = `event_type = 'flow_run.descriptor_run_settlement'

package/dist/services/release-cache.js

@@ -6,7 +6,9 @@ import { inspectReleaseArchive } from "./release-archive.js";
 import { verifyReleaseArchive } from "./release-manifest.js";
 import { acquireInstallationLock } from "./installation-lock.js";
 import { hybridDigest } from "./hybrid-contracts.js";
+import { publishSetup } from "../harness-runtime/lib/setup-progress.mjs";
 const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
+let cacheVerificationPass = 0;
 function refuse(reason) {
     throw new AppError("cache_integrity", "Release cache cannot be published", 1, { reason, phase: "cache_publication", effect: "no_effect", help: "setup" });
 }
@@ -33,6 +35,8 @@ function write(target, bytes, mode) {
     }
 }
 function retained(target, archive, entries) {
+    const observation = `release-cache:${++cacheVerificationPass}:${target}`;
+    publishSetup("probe_started", observation);
     if (!fs.lstatSync(target).isDirectory())
         refuse("unsafe_retained_cache");
     const archiveFile = path.join(target, "archive.tgz");
@@ -53,6 +57,7 @@ function retained(target, archive, entries) {
             directories.add(parts.slice(0, index).join("/"));
     }
     const seen = new Set();
+    let checked = 0;
     const visit = (root, relative) => {
         if (!fs.lstatSync(root).isDirectory())
             refuse("unsafe_retained_cache");
@@ -70,12 +75,15 @@ function retained(target, archive, entries) {
                 if (!stat.isFile() || entry?.kind !== "file" || stat.size !== entry.bytes.length || digest(fs.readFileSync(full)) !== digest(entry.bytes) || (stat.mode & 0o111) !== (entry.mode & 0o111))
                     refuse("retained_cache_changed");
                 seen.add(logical);
+                if (++checked % 64 === 0)
+                    publishSetup("identity_digest_progress", `${observation}:${checked}`);
             }
         }
     };
     visit(payload, "");
     if (seen.size !== entries.length)
         refuse("retained_cache_changed");
+    publishSetup("identity_digest_completed", observation);
 }
 /** Verify retained compressed and expanded bytes without executing or activating them. */
 export function verifyPublishedReleaseCache(target, archive) {

package/dist/services/repair-intents.js

@@ -28,15 +28,4 @@ export function ensureRepairIntent(context, input, create) {
         return { schema_id: "dd-flow/continuation@1", kind: "repair_required", project_id: input.projectId, run_id: input.runId, stage: input.stage, attempt, identity, work_id: workId };
     });
 }
-export function isRegisteredRepair(context, value, scope) {
-    if (!value || typeof value !== "object")
-        return false;
-    const receipt = value;
-    if (receipt.schema_id !== "dd-flow/continuation@1" || receipt.kind !== "repair_required")
-        return false;
-    if (scope && (receipt.project_id !== scope.projectId || receipt.run_id !== scope.runId))
-        return false;
-    if (!context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'repair_intents'"))
-        return false;
-    return Boolean(context.db.get("SELECT 1 FROM repair_intents i JOIN works w ON w.work_id = i.work_id AND w.project_id = i.project_id AND w.run_id = i.run_id WHERE i.identity = ? AND i.project_id = ? AND i.run_id = ? AND i.stage = ? AND i.attempt = ? AND i.work_id = ?", [receipt.identity, receipt.project_id, receipt.run_id, receipt.stage, receipt.attempt, receipt.work_id]));
-}
+export { isRegisteredRepair } from "./repair-receipt.js";

package/dist/services/repair-receipt.js

@@ -0,0 +1,13 @@
+/** Read-only receipt validation must not load repair execution on hook admission. */
+export function isRegisteredRepair(context, value, scope) {
+    if (!value || typeof value !== "object")
+        return false;
+    const receipt = value;
+    if (receipt.schema_id !== "dd-flow/continuation@1" || receipt.kind !== "repair_required")
+        return false;
+    if (scope && (receipt.project_id !== scope.projectId || receipt.run_id !== scope.runId))
+        return false;
+    if (!context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'repair_intents'"))
+        return false;
+    return Boolean(context.db.get("SELECT 1 FROM repair_intents i JOIN works w ON w.work_id = i.work_id AND w.project_id = i.project_id AND w.run_id = i.run_id WHERE i.identity = ? AND i.project_id = ? AND i.run_id = ? AND i.stage = ? AND i.attempt = ? AND i.work_id = ?", [receipt.identity, receipt.project_id, receipt.run_id, receipt.stage, receipt.attempt, receipt.work_id]));
+}

package/dist/services/run-control-worker.js

@@ -3,14 +3,14 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import { spawn } from "node:child_process";
-import { fileURLToPath } from "node:url";
 import { setTimeout as delay } from "node:timers/promises";
 import { AppError, errorRecord } from "../shared/errors.js";
 import { resolveProjectRoot } from "../storage/paths.js";
 import { requireProjectByRoot } from "./projects.js";
 import { getResourceDatabase } from "../storage/database.js";
-import { assertManagedProcessLease, confirmManagedProcess, finishManagedProcess, renewManagedProcess, managedProcessRuntimeHome, processIsAlive, processStartedAt, processTreeIsAlive, registerManagedProcess, resourceHome } from "./managed-processes.js";
+import { assertManagedProcessLease, confirmManagedProcess, prepareManagedProcessConfirmation, finishManagedProcess, renewManagedProcess, managedProcessRuntimeHome, processIsAlive, processStartedAt, processTreeIsAlive, registerManagedProcess, resourceHome } from "./managed-processes.js";
 import { managedLeaseMonitor } from "./managed-lease-monitor.js";
+import { physicalStartup } from "./physical-startup.js";
 import { interruptControlledSessions, observeControlledSessions, recordRunControlIntent, runControlStatus } from "./run-control.js";
 import { recoveryGuard, recordRecoveryCapture, sealRunRecovery } from "./run-recovery.js";
 import { createEvalRunSnapshot, verifyRecoverySnapshot } from "./eval-snapshots.js";
@@ -70,9 +70,7 @@ async function launchControlWorker(context, input) {
     if (!claimed && !reclaimControlWorker(context, input, project.id, token, home))
         return;
     try {
-        const entry = fileURLToPath(new URL("../cli.js", import.meta.url));
-        if (!fs.existsSync(entry))
-            throw new AppError("harness_runtime_unbuilt", "Build the CLI before launching its detached control owner", 1);
+        const entry = (await import("./engines.js")).boundRunEngineEntrypoint(context, { projectRoot: project.root, runId: input.runId });
         fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
         const log = path.join(directory, "control.log");
         const output = fs.openSync(log, "a", 0o600);
@@ -228,18 +226,19 @@ export async function serveRunControl(context, input) {
         throw new AppError("run_control_owner_mismatch", "Control registration is not authorized", 1);
     // Physical identity is committed with the sole RUN claim, before the worker
     // registers itself in the separate resource store or performs any dispatch.
-    const workerBirth = processStartedAt(process.pid);
-    context.db.writeTransaction(() => {
-        const claimed = context.db.run("UPDATE run_control_workers SET status = 'running', owner_pid = ?, updated_at = ? WHERE control_id = ? AND owner_token = ? AND status = 'starting' AND owner_pid IS NULL", [process.pid, context.now(), input.controlId, worker.owner_token]);
-        if (claimed.changes !== 1)
-            throw new AppError("run_control_already_owned", "A control owner has already claimed this request", 1);
-        const now = context.now();
-        context.db.run("INSERT INTO run_control_operations (operation_id, control_id, target_json, status, receipt_json, created_at, updated_at) VALUES (?, ?, ?, 'completed', ?, ?, ?)", [`${launchOperationId(input.controlId, worker.owner_token)}:worker-claim`, input.controlId, JSON.stringify({ kind: "control_worker_self_claim" }), JSON.stringify({ pid: process.pid, pid_started_at: workerBirth }), now, now]);
-    });
+    const startup = physicalStartup(context.databaseDeadlineAt);
+    const assertStartupCurrent = () => {
+        const current = context.db.get("SELECT * FROM run_control_workers WHERE control_id = ?", [input.controlId]);
+        const currentIntent = context.db.get("SELECT * FROM run_controls WHERE control_id = ?", [input.controlId]);
+        const guard = recoveryGuard(context, project.id, input.runId);
+        if (!current || current.owner_token !== worker.owner_token || current.owner_pid !== worker.owner_pid || current.status !== worker.status || current.process_id !== worker.process_id || current.process_lease_token !== worker.process_lease_token || !["requested", "settled"].includes(currentIntent?.status ?? "") || guard?.recovery_id !== intent.recovery_id || !["draining", "sealed"].includes(guard.status))
+            throw new AppError("run_control_owner_mismatch", "Control startup no longer owns this request", 1);
+    };
     const resourceContext = { ...context, env: { ...context.env, DD_FLOW_RESOURCE_HOME: worker.resource_home } };
     const lease = managedLeaseMonitor(attemptMs => renewManagedProcess({ ...resourceContext, resourceDatabaseMode: "prepared_existing", databaseDeadlineAt: Date.now() + attemptMs }, { id: worker.process_id, leaseToken: worker.process_lease_token }));
     let timerFailure;
     let primaryFailure;
+    let claimedByThisServe = false;
     const assertControlCurrent = () => {
         const latest = recoveryGuard(context, project.id, input.runId);
         if (latest?.recovery_id !== intent.recovery_id || !["draining", "sealed"].includes(latest.status))
@@ -250,8 +249,9 @@ export async function serveRunControl(context, input) {
             assertManagedProcessLease(resourceContext, { id: worker.process_id, leaseToken: worker.process_lease_token, pid: process.pid });
             assertControlCurrent();
         } };
+    let admitted = false;
     const heartbeat = setInterval(() => {
-        if (!worker.process_id)
+        if (!admitted)
             return;
         lease.background(assertControlCurrent, error => { timerFailure = error; });
     }, 10_000);
@@ -259,17 +259,33 @@ export async function serveRunControl(context, input) {
     let cleanupFailure;
     const result = await (async () => {
         try {
+            const workerBirth = (await startup.birth(assertStartupCurrent)).pid_started_at;
+            context.db.writeTransaction(() => {
+                assertStartupCurrent();
+                const claimed = context.db.run("UPDATE run_control_workers SET status = 'running', owner_pid = ?, updated_at = ? WHERE control_id = ? AND owner_token = ? AND status = 'starting' AND owner_pid IS NULL", [process.pid, context.now(), input.controlId, worker.owner_token]);
+                if (claimed.changes !== 1)
+                    throw new AppError("run_control_already_owned", "A control owner has already claimed this request", 1);
+                const now = context.now();
+                context.db.run("INSERT INTO run_control_operations (operation_id, control_id, target_json, status, receipt_json, created_at, updated_at) VALUES (?, ?, ?, 'completed', ?, ?, ?)", [`${launchOperationId(input.controlId, worker.owner_token)}:worker-claim`, input.controlId, JSON.stringify({ kind: "control_worker_self_claim" }), JSON.stringify({ pid: process.pid, pid_started_at: workerBirth }), now, now]);
+            });
+            worker.owner_pid = process.pid;
+            worker.status = "running";
+            claimedByThisServe = true;
             if (!worker.process_id) {
                 const log = path.join(worker.state_dir, "control.log");
                 const record = registerManagedProcess(resourceContext, { kind: "run-control", ownerId: input.controlId, projectId: project.id, runId: input.runId, operationId: `control:${input.controlId}`, uniqueActiveOperation: true, ownerPid: process.pid, stdoutPath: log, stderrPath: log, metadata: { control_id: input.controlId } });
                 worker.process_id = record.id;
                 worker.process_lease_token = record.lease_token;
-                context.db.run("UPDATE run_control_workers SET process_id = ?, process_lease_token = ?, updated_at = ? WHERE control_id = ? AND owner_token = ? AND owner_pid = ? AND status = 'running'", [record.id, record.lease_token, context.now(), input.controlId, worker.owner_token, process.pid]);
+                if (context.db.run("UPDATE run_control_workers SET process_id = ?, process_lease_token = ?, updated_at = ? WHERE control_id = ? AND owner_token = ? AND owner_pid = ? AND status = 'running'", [record.id, record.lease_token, context.now(), input.controlId, worker.owner_token, process.pid]).changes !== 1)
+                    throw new AppError("run_control_owner_mismatch", "Control owner changed during registration", 1);
             }
             if (!worker.process_lease_token)
                 throw new AppError("run_control_owner_mismatch", "Control owner has no resource lease", 1);
-            const confirmed = confirmManagedProcess(resourceContext, { id: worker.process_id, leaseToken: worker.process_lease_token, pid: process.pid, processGroupId: process.pid, ownerPid: process.pid });
+            const confirmation = { id: worker.process_id, leaseToken: worker.process_lease_token, pid: process.pid, processGroupId: process.pid, ownerPid: process.pid };
+            const originalLease = prepareManagedProcessConfirmation(resourceContext, confirmation).lease_expires_at;
+            const confirmed = await startup.observe(() => confirmManagedProcess(resourceContext, confirmation), assertStartupCurrent, originalLease);
             lease.retainAuthority(confirmed.lease_expires_at);
+            admitted = true;
             let priorObservation = null;
             try {
                 priorObservation = worker.snapshot_json ? JSON.parse(worker.snapshot_json) : null;
@@ -380,7 +396,7 @@ export async function serveRunControl(context, input) {
         catch (error) {
             primaryFailure = error;
             try {
-                context.db.run("UPDATE run_control_workers SET status = 'failed', error_json = ?, updated_at = ? WHERE control_id = ? AND owner_token = ?", [JSON.stringify(failure(error)), context.now(), input.controlId, worker.owner_token]);
+                context.db.run("UPDATE run_control_workers SET status = 'failed', error_json = ?, updated_at = ? WHERE control_id = ? AND owner_token = ? AND owner_pid IS ? AND process_id IS ? AND process_lease_token IS ? AND status = ?", [JSON.stringify(failure(error)), context.now(), input.controlId, worker.owner_token, claimedByThisServe ? process.pid : null, worker.process_id, worker.process_lease_token, claimedByThisServe ? "running" : "starting"]);
             }
             catch (secondary) {
                 process.stderr.write(`${JSON.stringify({ primary: failure(error), phase: "persist_control_failure", secondary: failure(secondary) })}\n`);
@@ -391,7 +407,8 @@ export async function serveRunControl(context, input) {
             lease.close();
             clearInterval(heartbeat);
             try {
-                if (worker.process_id && worker.process_lease_token)
+                const current = claimedByThisServe && context.db.get("SELECT * FROM run_control_workers WHERE control_id = ?", [input.controlId]);
+                if (current && current.owner_token === worker.owner_token && current.owner_pid === process.pid && current.process_id === worker.process_id && current.process_lease_token === worker.process_lease_token && worker.process_id && worker.process_lease_token)
                     finishManagedProcess(resourceContext, { id: worker.process_id, leaseToken: worker.process_lease_token, state: "stopped", reason: "control_owner_exited" });
             }
             catch (secondary) {

package/dist/services/run-control.js

@@ -1,5 +1,6 @@
 import { setFlowRunRecoveryPaused } from "./runs.js";
 import crypto from "node:crypto";
+import { nativeShutdownConfirmed } from "../harness-runtime/lib/native-children.mjs";
 import fs from "node:fs";
 import { ensureRunControlStorage } from "../storage/database.js";
 import { canonicalPath, resolveProjectRoot } from "../storage/paths.js";
@@ -414,7 +415,7 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
             const unfinished = receipts.filter(receipt => !["completed", "failed", "interrupted"].includes(String(receipt.state)));
             if (unfinished.some(receipt => receipt.daemon_id !== daemonId || String(receipt.operation) !== "session.create" || receipt.session_id !== null))
                 throw new AppError("shutdown_operation_unsettled", "Closed daemon retains an unfinished non-create operation", 1);
-            const stopped = receipts.find(receipt => receipt.daemon_id === daemonId && receipt.operation === "daemon.stop" && receipt.state === "completed" && receipt.result?.stopped === true && receipt.result?.clean === true);
+            const stopped = receipts.find(receipt => receipt.daemon_id === daemonId && receipt.operation === "daemon.stop" && receipt.state === "completed" && receipt.result?.stopped === true && nativeShutdownConfirmed(receipt.result, { daemonId }));
             if (!stopped)
                 throw new AppError("shutdown_receipt_required", "Closed daemon has no clean native shutdown receipt for its current identity", 1);
             closedDaemons.set(directory, { source: "retained_clean_shutdown", daemon_id: daemonId, operation_id: stopped.operation_id, session_ids: state.sessions.map(item => typeof item === "string" ? item : adapterSessionId(item)), stopped: true, settled: true, processes: records.map(record => ({ process_id: record.id, pid: record.pid, pid_started_at: record.pid_started_at })), result: stopped.result });

package/dist/services/run-controller-adapter.js

@@ -12,6 +12,7 @@ import { canonicalNativeOperation } from "../harness-runtime/lib/adapter-timeout
 import { retainedDaemonReply } from "../harness-runtime/lib/daemon-observation.mjs";
 import { readOperationRecord } from "../harness-runtime/lib/operation-progress.mjs";
 import { readNativeDaemonState } from "./managed-daemon-binding.js";
+import { validateCheckEnvironment } from "./check-environment.js";
 /** A paused RUN admits only its controller's exact accepted answer Turn. */
 export function controllerHitlAdmission(context, record, input) {
     if (input.operation !== "session.prompt" || !input.operationId || !input.promptSha256)
@@ -76,7 +77,7 @@ export function sessionArguments(context, manifest, session) {
     return ["--dd-flow-bin", manifest.flow_executable, "--dd-flow-home", context.ddFlowHome, "--project-root", manifest.request.project_root, "--state-dir", session.state_dir, "--journal", session.journal, "--cwd", session.cwd, "--provider", profile.provider, "--model", profile.model, "--reasoning", profile.reasoning, "--mode", profile.mode, "--permission", profile.permission, ...manifest.adapters[runtimeHarness(profile)].runtime_args, "--json"];
 }
 export function controllerEnvironment(context, manifest, session) {
-    const env = { ...context.env, DD_FLOW_HOME: context.ddFlowHome, DD_FLOW_BIN: manifest.flow_executable, DD_FLOW_RESOURCE_HOME: manifest.resource_home, DD_FLOW_RUNTIME_BUDGET: manifest.budget ? JSON.stringify(manifest.budget) : undefined };
+    const env = { ...context.env, ...validateCheckEnvironment(manifest.check_environment), DD_FLOW_HOME: context.ddFlowHome, DD_FLOW_BIN: manifest.flow_executable, DD_FLOW_RESOURCE_HOME: manifest.resource_home, DD_FLOW_RUNTIME_BUDGET: manifest.budget ? JSON.stringify(manifest.budget) : undefined };
     for (const key of ["DD_FLOW_CONTROLLER_TOKEN", "DD_FLOW_CONTROL_TOKEN", "DD_FLOW_DAEMON_ID", "DD_FLOW_RUNTIME_OWNER", "DD_FLOW_WORK_ID", "DD_FLOW_SESSION_ID", "CODEX_THREAD_ID"])
         delete env[key];
     if (session?.codex_home)