@deksden-com/dd-flow-cli 0.9.0-beta.145 → 0.9.0-beta.149

package/CHANGELOG.md

@@ -1,5 +1,76 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.149
+
+### Patch Changes
+
+- 54899ed: Publish explicit proven Codex and OpenCode shutdown activity, reject unknown activity as clean settlement, and decode OpenCode finite log synchronization markers consistently for revision and completion.
+
+## 0.9.0-beta.148
+
+### Patch Changes
+
+- Validate lifecycle issuance before accessing storage, and align native readiness,
+  shutdown and overload regression fixtures with the current execution contract.
+
+## 0.9.0-beta.147
+
+### Patch Changes
+
+- Use the shared setup startup budget for silent prerequisite probes and preserve
+  typed subprocess failure diagnostics for init and upgrade without leaking output.
+
+## 0.9.0-beta.146
+
+### Patch Changes
+
+- d031e09: Add owned, trajectory-bound read-only AGY node-state inspection for native qualification. Capture parent executor idle independently from required-tree readiness, native task inventories and pending completion messages. Preserve qualified production prompt/stop ordering and owned fixture cleanup in native acceptance tooling.
+- acee374: Dispatch independent architectural criticism for Memory Bank audits when their accepted architecture aspect is applicable, matching the frozen review instructions.
+- 709f281: Reject diagnostic citation hash mismatches as correctable no-effect proposal errors, returning only the assigned relative path and computed digest. Retain bounded lifecycle correction, strict evidence acceptance and fatal snapshot/custody protection.
+- 18b0593: Treat unchanged-scope coverage annotations as correctable proposal errors and assign global diagnostic finding IDs from exact completed Work results during analysis settlement. Preserve strict scope, content, source and independent-review custody checks.
+- 7457963: Reject rewritten diagnostic focus as a bounded, no-effect proposal correction
+  requiring an exact copy of the accepted predecessor. Foreign focus modes,
+  changed aspect applicability and ownership violations remain fatal; no changed
+  focus is accepted and no frozen source selection is rewritten.
+- 1b315bf: Issue the exact immediate predecessor in diagnostic coordinator bindings and
+  align the frozen schema's list bound with the runtime contract. Transitive
+  history is a correctable proposal shape error; foreign direct bindings still
+  fail without acceptance.
+- da5bbf0: Allow diagnostics to record newly discovered unavailable sources without treating
+  them as a scope change. Retain accepted source-gap observations independently of
+  coordinator paraphrasing, while keeping focus, coverage and source-custody guards.
+- 6825b76: Allow diagnostic reports to disclose additional limitations while retaining all reviewed evidence, decisions and existing uncertainty unchanged.
+- e779d4d: Express diagnostic analyst/critic field restrictions in the frozen Work schema.
+  An analyst supplying review decisions remains rejected, but uses the existing
+  correctable schema-output path rather than a fatal foreign-aspect error.
+- 9939c87: Carry accepted predecessor and independently settled Work limitations into diagnostic analytical and review results in the CLI. Preserve coordinator annotations and raw proposals; retain schema bounds, scope, evidence and independent-review checks.
+- b765022: Clarify that generated review observations are not original project evidence.
+  Reject missing snapshot citations as correctable no-effect result errors while
+  preserving fatal containment, non-file and filesystem-access failures.
+- 249e5e3: Express preflight and analytical coordinator output boundaries in the frozen
+  stage schema, so unsupported findings or review decisions use existing format
+  correction while independent review remains mandatory.
+- 6f4011f: Separate required native execution readiness from owned resource retirement across harnesses. Require versioned, incarnation-bound shutdown phase proofs and retain process birth identities before provider shutdown. Qualify AGY daemon readiness independently from physical cleanup; ambiguous ancestry and native service identities remain unproven.
+
+  Fence retained recovery by the current control generation and preserve late activity during shutdown publication. Add metadata-bound AGY native tree control for typed services, gated by complete native qualification; control acknowledgements never substitute for physical retirement.
+
+- a5461c9: Preserve validated repair authority through lifecycle settlement, atomically issue
+  nonterminal successors, and retain accepted HITL context across same-session
+  overload continuation. Support versioned bounded runner and browser evidence,
+  and separate AGY physical shutdown from current native idle proof.
+- e00cda9: Use the verified relocated engine when launching a forked hybrid RUN. Preserve
+  the original bundle and manifest bytes as provenance; reject changed executable
+  content, semantic manifest metadata, or an unbound relocation path.
+- 759138b: Start restored generic-flow coordinator sessions in the current admitted RUN
+  workspace instead of the historical frozen execution path, without changing
+  retained execution bytes or profiles.
+- 5bea245: Use the verified current RUN project and workspace paths when settling restored
+  descriptor stages and terminal RUNs. Preserve frozen provenance, ownership,
+  Git-drift checks and exact replay rather than querying historical project roots.
+- 42cb47b: Read retained descriptor stage-input custody through trusted RUN publication
+  relocations after restore, preserving original packet bytes and rejecting
+  ambiguous or changed custody.
+
 ## 0.9.0-beta.145
 
 ### Patch Changes

package/dist/build-info.json

@@ -1,15 +1,15 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.145",
-  "cli_commit": "52851c6a5c8419e93b543fd6a53e71f9aa359d9f",
-  "built_at": "2026-10-21T17:32:05.034Z",
+  "cli_version": "0.9.0-beta.149",
+  "cli_commit": "7d17167f768483ffdb5d37f64cc385035c7d4658",
+  "built_at": "2026-10-24T10:44:58.080Z",
   "built_with_canon": {
     "version": "4.1.2",
-    "commit": "51f7d7155f578e877e4db5c3d022772084ecea5a",
+    "commit": "925ef10ecc0b683f7feba6f74913e15560842500",
     "flow_contract": "dd-flow-canonical-2026-08",
-    "repo_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-canon-release-145",
-    "memorybank_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-canon-release-145/.memory-bank",
-    "flow_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-canon-release-145/.memory-bank/dd-flow",
+    "repo_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-canon-release146",
+    "memorybank_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-canon-release146/.memory-bank",
+    "flow_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-canon-release146/.memory-bank/dd-flow",
     "layout": "dot_memory_bank"
   }
 }

package/dist/cli/command-inputs.js

@@ -15,7 +15,8 @@ const control = "project-root run";
 const protocolTransitionInput = route(1, "to", `${scoped} payload-file json-file reason`, "force");
 const setupInput = route(0, "request-id trust-file", "canon-source canon-version release-registry channel profile profile-file save-profile-intent", "non-interactive skip-agent-setup", "", { channel: ["stable", "preview", "development"] });
 const memoryInitInput = route(0, "project-root workspace-root request-id", "intake-file intake-sha256 profile profile-file stage-profile work-profile max-parallel delegation native-config-home git-route integration-branch", "detach non-interactive prepare-only allow-live-probe", "stage-profile work-profile", { "git-route": ["integration_branch_direct", "feature_worktree"], delegation: ["external", "native"] });
-export const commandAliases = { transition: "protocol transition", init: "flow mb-init", upgrade: "flow mb-upgrade" };
+const diagnosticInput = route(0, "project-root request-id", "intake-file profile profile-file stage-profile work-profile max-parallel", "detach non-interactive prepare-only", "stage-profile work-profile");
+export const commandAliases = { transition: "protocol transition", init: "flow mb-init", upgrade: "flow mb-upgrade", review: "flow project-review" };
 /** Path-shaped arguments default to physical paths unless the route explicitly
  * opts into contextualPaths. This inventory does not expand arbitrary strings. */
 export const physicalPathOptions = new Set(words("canon-source trust-file root project-root workspace-root workspace-path workspace-path path dir file schema-dir output result-file semantic-file data decision-file verification-file reason-file task-file intake-file context-file observations-file observation-file summary-file question-file answer-file payload-file json-file task-profile-file execution-routing-file protocol-override-file manifest-file routing-file config-file input-file report-file snapshot-file output-dir state-dir capture-root capture-path destination source archive snapshot plan-file backup-path database backup source-home target-home stdout stderr adapter-executable memory-bank flow stage-report dashboard report"));
@@ -35,10 +36,13 @@ export const commandInputs = {
     "init": memoryInitInput,
     "flow mb-upgrade": memoryInitInput,
     "upgrade": memoryInitInput,
+    "flow mb-audit": diagnosticInput,
+    "flow project-review": diagnosticInput,
+    "review": diagnosticInput,
     "runtime storage admit": route(0, "operation", "", "", "", { operation: ["memory-init", "memory-upgrade"] }),
     "runtime storage qualify": route(0, "operation", "", "", "", { operation: ["memory-upgrade"] }),
     "runtime storage transition": route(0, "action project-root workspace-root request-id selection-sha256", "expected-sha256 recovery-id", "offline", "", { action: ["plan", "apply", "status", "recovery-plan", "recover", "recovery-status"] }),
-    "runtime flow admit": route(0, "operation", "", "", "", { operation: ["memory-init", "memory-upgrade"] }),
+    "runtime flow admit": route(0, "operation", "", "", "", { operation: ["memory-init", "memory-upgrade", "mb-audit", "project-review"] }),
     "completion bash": route(0),
     "completion zsh": route(0),
     "completion fish": route(0),

package/dist/cli/command-metadata.js

@@ -1,4 +1,4 @@
-import { commandInputs, physicalPathOptions } from "./command-inputs.js";
+import { commandInputs, commandAliases, physicalPathOptions } from "./command-inputs.js";
 import { runtimeOptionDescriptions } from "./command-option-descriptions.js";
 const optionDescriptions = {
     "intake-sha256": "SHA-256 of the exact original intake file bytes. Fresh execution verifies the bytes; replay compares the retained hash without reopening the original file.",
@@ -61,6 +61,20 @@ const memoryInitOptions = {
     "non-interactive": "Never open the first-flow executor dialog, even on a terminal. Without an explicit profile/file or configured default, refuse before project effects; init cannot skip its executor."
 };
 const commandOptionDescriptions = {
+    "flow mb-audit": {
+        "project-root": "Canonical absolute project identity. The runtime creates an isolated read-only source snapshot; neither the project nor its Memory Bank is a write destination.",
+        "intake-file": "Bounded UTF-8 original diagnostic request, including audit mode/focus and constraints. Required for a fresh request; optional on exact replay, where supplied bytes must match.",
+        "stage-profile": "Repeatable preflight/audit/review/report=profile override. Each stage may occur once and all profiles are frozen before dispatch.",
+        "prepare-only": "Retain the request, source snapshot and RUN without starting its controller or provider Sessions. Runtime state is created; this is not a dry run.",
+        "max-parallel": "External Work concurrency from 1 to 64; default 1. Never claims native child qualification."
+    },
+    "flow project-review": {
+        "project-root": "Canonical absolute project identity, assessed through an isolated read-only snapshot. Findings never authorize implicit repair.",
+        "intake-file": "Bounded UTF-8 original project-conformance review request and focus. Required fresh; supplied replay bytes must match the retained objective.",
+        "stage-profile": "Repeatable preflight/analyze/review/report=profile override. This is project review, not the SDLC CODE-REVIEW stage.",
+        "prepare-only": "Retain the request, source snapshot and RUN without launching a controller or provider Sessions. Not a dry run.",
+        "max-parallel": "External Work concurrency from 1 to 64; default 1."
+    },
     "flow mb-init": memoryInitOptions,
     init: memoryInitOptions,
     "flow mb-upgrade": { ...memoryInitOptions, "stage-profile": "Repeatable stage=profile assignment for preflight, diff-analysis, upgrade, verify, review or finish. The original selection is frozen before dispatch.", "prepare-only": "Prepare or replay the upgrade RUN and accepted storage/bootstrap selection without launching its controller or a productive Session. This is not a dry run; it does not publish the upgraded canonical layer or accept semantic preservation." },
@@ -162,7 +176,8 @@ export function optionsForCommand(input, command) {
     }));
 }
 function optionDescription(name, command) {
-    const description = (command ? commandOptionDescriptions[command]?.[name] : undefined) ?? optionDescriptions[name] ?? runtimeOptionDescriptions[name];
+    const description = (command ? commandOptionDescriptions[command]?.[name]
+        ?? commandOptionDescriptions[commandAliases[command] ?? command]?.[name] : undefined) ?? optionDescriptions[name] ?? runtimeOptionDescriptions[name];
     if (!description)
         throw new Error(`Missing CLI option documentation: ${command ?? "inventory"} --${name}`);
     return description;
@@ -182,6 +197,7 @@ export function optionsForCommandTree(command) {
 export function routerNativeRoute(key) {
     return key === "version" || key.startsWith("engine ") || key === "schema validate"
         || key === "flow list" || key === "flow show" || key === "flow mb-init" || key === "init" || key === "flow mb-upgrade" || key === "upgrade"
+        || key === "flow mb-audit" || key === "flow project-review" || key === "review"
         || key === "run reconcile" || key === "runtime storage admit" || key === "runtime storage qualify" || key === "runtime storage transition"
         || key === "runtime flow admit"
         || key.startsWith("profiles ") || key.startsWith("models ") || key.startsWith("harnesses ") || key.startsWith("completion ") || key === "setup" || key.startsWith("setup ")

package/dist/cli/diagnostic-invocation.js

@@ -0,0 +1,46 @@
+import path from "node:path";
+import { AppError } from "../shared/errors.js";
+import { diagnosticFlowStages } from "../domain/diagnostic-flows.js";
+import { prepareCommandRoute } from "./command-inputs.js";
+function refuse(message) { throw new AppError("usage", message, 2, { effect: "no_effect" }); }
+/** Parser only: no files, operator settings, project mutation or runtime state. */
+export function prepareDiagnosticInvocation(args) {
+    const route = prepareCommandRoute(args), options = route.parsed.options;
+    const flowId = route.key === "flow mb-audit" ? "mb-audit"
+        : ["review", "flow project-review"].includes(route.key) ? "project-review" : refuse("Use flow mb-audit or review / flow project-review");
+    const value = (key) => options.get(key)?.[0];
+    const projectRoot = value("project-root"), requestId = value("request-id");
+    if (!path.isAbsolute(projectRoot) || path.resolve(projectRoot) !== projectRoot
+        || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,95}$/.test(requestId))
+        refuse("Use a canonical absolute project root and a bounded request ID");
+    if (value("profile") && value("profile-file"))
+        refuse("Use either --profile or --profile-file");
+    if (options.has("detach") && options.has("prepare-only"))
+        refuse("--detach and --prepare-only are exclusive");
+    const execution = {};
+    if (value("profile"))
+        execution.rootProfile = value("profile");
+    const stageProfiles = {};
+    for (const assignment of options.get("stage-profile") ?? []) {
+        const match = /^([^=]+)=([^=]+)$/.exec(assignment);
+        if (!match || !diagnosticFlowStages[flowId].includes(match[1]) || Object.hasOwn(stageProfiles, match[1]))
+            refuse("--stage-profile requires one known stage=profile assignment per stage");
+        stageProfiles[match[1]] = match[2];
+    }
+    if (Object.keys(stageProfiles).length)
+        execution.stageProfiles = stageProfiles;
+    const workProfiles = options.get("work-profile");
+    if (workProfiles) {
+        if (workProfiles.some(id => !id.trim()) || new Set(workProfiles).size !== workProfiles.length)
+            refuse("Work profiles must be nonempty and unique");
+        execution.workProfiles = [...workProfiles];
+    }
+    if (value("max-parallel") !== undefined) {
+        const raw = value("max-parallel"), n = Number(raw);
+        if (!/^[1-9][0-9]*$/.test(raw) || !Number.isSafeInteger(n) || n > 64)
+            refuse("--max-parallel must be an integer from 1 to 64");
+        execution.delegation = { mode: "external", max_parallel: n };
+    }
+    return { scope: { projectRoot, requestId, flowId }, execution, profileFile: value("profile-file"), intakeFile: value("intake-file"),
+        detach: options.has("detach"), prepareOnly: options.has("prepare-only"), nonInteractive: options.has("non-interactive") };
+}

package/dist/cli/diagnostic.js

@@ -0,0 +1,120 @@
+import { createContext } from "../runtime/context.js";
+import { AppError, errorRecord } from "../shared/errors.js";
+import { resolveDdFlowHome, resolveProjectRoot } from "../storage/paths.js";
+import { readSetupStatus } from "../services/setup.js";
+import { PreparedInstalledFlowSource } from "../services/installed-flow-source.js";
+import { selectMemoryInitInstalledEngine } from "../services/memory-init-engine-release.js";
+import { readOperatorProfiles, readOperatorProfileInput } from "../services/operator-profiles.js";
+import { FrozenGenericExecution } from "../services/generic-execution.js";
+import { openMemoryInitStores } from "../services/memory-init-stores.js";
+import { registerProject, requireProjectByRoot } from "../services/projects.js";
+import { diagnosticSnapshotRoot } from "../services/diagnostic-snapshot.js";
+import { readDiagnosticRequest, retainDiagnosticRequest, startDiagnosticRun } from "../services/diagnostic-start.js";
+import { readFlowRunExecutionBundle } from "../services/runs.js";
+import { hybridDigest } from "../services/hybrid-contracts.js";
+import { onboardExecutor } from "../services/executor-onboarding.js";
+import { askExecutorChoice } from "./executor-onboarding.js";
+import { prepareDiagnosticInvocation } from "./diagnostic-invocation.js";
+import { parseOutputOptions } from "./output-options.js";
+import { prepareResponseDestination } from "./response-file.js";
+import { prepareFileBytes } from "./input-preparation.js";
+import { writePreparationError } from "./error-output.js";
+import { launchAndObserveMemoryFlow } from "./memory-init.js";
+import { publishSetup } from "../harness-runtime/lib/setup-progress.mjs";
+export async function runDiagnosticCli(args, env = process.env, io = process) {
+    let context, effects = false;
+    try {
+        const output = parseOutputOptions(args), invocation = prepareDiagnosticInvocation(output.args), home = resolveDdFlowHome(env);
+        if (output.responseFile)
+            prepareResponseDestination(output.responseFile);
+        const scope = invocation.scope;
+        if (resolveProjectRoot(scope.projectRoot) !== scope.projectRoot)
+            throw new AppError("usage", "Project root must be canonical", 2, { effect: "no_effect" });
+        const reader = createContext(env, "read_existing");
+        let retained = null;
+        try {
+            const project = reader.db.get("SELECT status FROM projects WHERE root=?", [scope.projectRoot]);
+            if (project?.status && project.status !== "active")
+                throw new AppError("diagnostic_project_inactive", "Activate the selected project explicitly before diagnosis", 2, { effect: "no_effect" });
+            if (project)
+                retained = readDiagnosticRequest(reader, scope);
+        }
+        finally {
+            reader.db.close?.();
+        }
+        if (invocation.profileFile)
+            invocation.execution.rootProfile = readOperatorProfileInput(invocation.profileFile);
+        const readIntake = () => {
+            if (!invocation.intakeFile)
+                throw new AppError("usage", "Fresh diagnosis requires --intake-file with the requested focus and constraints", 2, { effect: "no_effect" });
+            const bytes = prepareFileBytes(invocation.intakeFile, "diagnostic intake", 64 * 1024).bytes;
+            let text;
+            try {
+                text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+            }
+            catch {
+                throw new AppError("usage", "Diagnostic intake must be UTF-8", 2, { effect: "no_effect" });
+            }
+            if (!text.trim())
+                throw new AppError("usage", "Diagnostic intake cannot be empty", 2, { effect: "no_effect" });
+            return text;
+        };
+        if (retained) {
+            if (Object.entries(invocation.execution).some(([key, value]) => !Object.hasOwn(retained.selection, key) || hybridDigest(value) !== hybridDigest(retained.selection[key]))
+                || invocation.intakeFile && readIntake() !== retained.objective)
+                throw new AppError("diagnostic_request_conflict", "Supplied selectors differ from the original diagnostic request", 2, { effect: "no_effect" });
+        }
+        const objective = retained?.objective ?? readIntake();
+        let source, engine;
+        let rootProfile = invocation.execution.rootProfile;
+        if (!retained) {
+            const setup = readSetupStatus(home), installation = setup.installation;
+            if (!installation || setup.installation_readiness !== "installed")
+                throw new AppError("diagnostic_setup_required", "Install the desired canon and CLI with setup before diagnosis", 2, { effect: "no_effect" });
+            publishSetup("dependency_check_completed", "diagnostic:installation");
+            source = PreparedInstalledFlowSource.fromInstalledRelease(home, installation.manifest_sha256, scope.flowId);
+            publishSetup("dependency_check_completed", "diagnostic:canon");
+            engine = selectMemoryInitInstalledEngine(home, installation.manifest_sha256);
+            publishSetup("dependency_check_completed", "diagnostic:engine");
+            engine.admitDiagnosticFlow(source, scope.flowId);
+            publishSetup("dependency_check_completed", "diagnostic:handlers");
+            const stdin = io.stdin ?? process.stdin;
+            const selected = await onboardExecutor({ ...(typeof rootProfile === "string" ? { profileId: rootProfile } : {}),
+                ...(invocation.profileFile ? { profileFile: invocation.profileFile } : {}) }, () => readOperatorProfiles(home), { allowSkip: false, nonInteractive: invocation.nonInteractive || output.json || output.progressJsonl
+                    || !stdin.isTTY || !io.stderr.isTTY }, settings => askExecutorChoice(settings, { stdin, stderr: io.stderr }, { allowSave: false, allowSkip: false }));
+            if (!selected.profile)
+                throw new AppError("diagnostic_executor_required", "Select an executor profile before diagnosis", 2, { effect: "no_effect" });
+            rootProfile ??= selected.profile;
+        }
+        effects = true;
+        context = openMemoryInitStores(env, { scope: { projectRoot: scope.projectRoot, workspaceRoot: scope.projectRoot, requestId: scope.requestId },
+            selectionSha256: hybridDigest({ scope, objective, selection: retained?.selection ?? invocation.execution }) }).context;
+        publishSetup("dependency_check_completed", "diagnostic:stores");
+        registerProject(context, { root: scope.projectRoot });
+        if (!retained) {
+            const project = requireProjectByRoot(context, scope.projectRoot);
+            const workspace = diagnosticSnapshotRoot(context, { projectId: project.id, projectRoot: scope.projectRoot, sourceRoot: scope.projectRoot,
+                requestId: scope.requestId, flowId: scope.flowId });
+            const execution = FrozenGenericExecution.prepare(source.resolveRegisteredFlow(), readOperatorProfiles(home), {
+                ...invocation.execution, ...(rootProfile !== undefined ? { rootProfile } : {}), execution: "managed", stageSessionMode: "new_session",
+                delegation: invocation.execution.delegation ?? { mode: "external", max_parallel: 1 }
+            }, { requestId: scope.requestId, projectRoot: scope.projectRoot, workspace });
+            retainDiagnosticRequest(context, { scope, source: source, execution, engine: engine, objective, selection: invocation.execution });
+        }
+        const started = startDiagnosticRun(context, scope), bundle = readFlowRunExecutionBundle(context, { projectRoot: scope.projectRoot, runId: started.runId });
+        if (!bundle)
+            throw new AppError("diagnostic_bundle_missing", "Restore the retained diagnostic bundle", 1, { effect: "committed" });
+        return await launchAndObserveMemoryFlow(context, { ...invocation,
+            scope: { projectRoot: scope.projectRoot, workspaceRoot: bundle.execution.snapshot().scope.workspace, requestId: scope.requestId } }, started, scope.flowId, output, env, io);
+    }
+    catch (error) {
+        const record = errorRecord(error);
+        if (effects)
+            record.details = { ...record.details, effect: ["unknown", "committed", "partial"].includes(String(record.details.effect)) ? record.details.effect : "partial", next_action: "reconcile_exact_request" };
+        writePreparationError(io, args, record);
+        return record.exitCode;
+    }
+    finally {
+        context?.db.close?.();
+    }
+}

package/dist/cli/help.js

@@ -2,6 +2,41 @@ import { AppError } from "../shared/errors.js";
 import { commandInputs, commandAliases } from "./command-inputs.js";
 import { commandKeyForPositions, globalOptionDocumentation, optionsForCommandTree, routerNativeRoute } from "./command-metadata.js";
 const helpPages = new Map([
+    ["flow mb-audit", `dd-flow flow mb-audit - read-only Memory Bank audit
+
+Usage:
+  dd-flow flow mb-audit --project-root /absolute/project --request-id ID --intake-file /absolute/request.txt [--profile ID] --json
+
+Describe quick/full or focused audit scope in the original intake. Stages are
+preflight → audit → review → report. Applicable aspects use assigned read-only
+Work and independent critics. Missing evidence and active DEFs remain visible.
+Reports and runtime state live in DD_FLOW_HOME; project files are not repaired.
+The snapshot includes selected dirty/untracked source, excluding private inputs.
+
+Profiles, engine, canon and objective are frozen before dispatch. Exact replay
+may omit intake/profile selectors; supplied selectors must match the original.
+--prepare-only creates the snapshot and RUN without Sessions; --detach returns
+the controller receipt. Neither is a dry run. Default execution is managed,
+with fresh stage Sessions and external Work (concurrency 1).
+Use existing run drive status and run control commands for observation/recovery.`],
+    ["flow project-review", `dd-flow review / flow project-review - read-only project-conformance review
+
+Usage:
+  dd-flow review --project-root /absolute/project --request-id ID --intake-file /absolute/request.txt [--profile ID] --json
+
+Both spellings share validation and effects. Describe the review focus and
+constraints in the original intake. Stages are preflight → analyze → review →
+report. Compare specs, features, ADRs, scenarios and policy with actual code and
+evidence. This is not SDLC CODE-REVIEW and never implicitly repairs the project.
+All baseline aspects retain applicability and coverage; independent criticism,
+rejected findings and uncertainty remain in runtime evidence.
+
+Execution uses an isolated read-only snapshot and frozen global canon. No local
+Memory Bank installation is required. Profiles and the original request remain
+pinned on replay. --prepare-only creates runtime state without Sessions;
+--detach returns the accepted controller receipt. Default execution is managed,
+with fresh stage Sessions and external Work. Use run drive status / run control
+to observe, answer, stop or reconcile the exact retained RUN.`],
     ["runtime storage qualify", `dd-flow runtime storage qualify - pre-probe selected-engine capability
 
 --operation memory-upgrade checks existing storage with the executing engine.

package/dist/cli/memory-flow-admission.js

@@ -6,6 +6,7 @@ import { hybridDigest } from "../services/hybrid-contracts.js";
 import { AppError, errorRecord } from "../shared/errors.js";
 import { writePreparationError } from "./error-output.js";
 import { memoryInitStartupInputSchemas } from "../services/memory-init-startup-custody.js";
+import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
 /** Executing engine's real handler admission only. The caller owns independent
  * release/source selection; this command never opens storage or creates a RUN. */
 export async function runMemoryFlowAdmissionCli(args, io = process) {
@@ -20,7 +21,8 @@ export async function runMemoryFlowAdmissionCli(args, io = process) {
             throw new AppError("usage", "Flow admission requires an exact source snapshot and independent digest", 2, { effect: "no_effect" });
         }
         const selected = input;
-        const flowId = route.parsed.options.get("operation")?.[0] === "memory-upgrade" ? "mb-upgrade" : "mb-init";
+        const operation = route.parsed.options.get("operation")?.[0] ?? "";
+        const flowId = isDiagnosticFlow(operation) ? operation : operation === "memory-upgrade" ? "mb-upgrade" : "mb-init";
         const startupSchema = memoryInitStartupInputSchemas.find(schema => schema === selected.startup_input_schema);
         if (Object.hasOwn(selected, "startup_input_schema") && (startupSchema === undefined || flowId !== "mb-init")) {
             throw new AppError("usage", "Executing engine does not support the requested startup input schema", 2, { effect: "no_effect" });
@@ -32,7 +34,7 @@ export async function runMemoryFlowAdmissionCli(args, io = process) {
         const flow = source.resolveRegisteredFlow();
         if (flow.descriptor.id !== flowId)
             throw new AppError("usage", "Flow source does not match the requested engine admission operation", 2, { effect: "no_effect" });
-        const facts = { schema_id: flowId === "mb-upgrade" ? "dd-flow/memory-upgrade-engine-flow@1"
+        const facts = { schema_id: isDiagnosticFlow(flowId) ? "dd-flow/diagnostic-engine-flow@1" : flowId === "mb-upgrade" ? "dd-flow/memory-upgrade-engine-flow@1"
                 : startupSchema === undefined ? "dd-flow/memory-init-engine-flow@1" : "dd-flow/memory-init-engine-flow@2",
             ...(startupSchema === undefined ? {} : { startup_input_schema: startupSchema }),
             flow_id: flowId, source_sha256: source.sha256,

package/dist/cli/memory-init.js

@@ -28,6 +28,8 @@ import { onboardExecutor } from "../services/executor-onboarding.js";
 import { readOperatorProfiles, readOperatorProfileInput } from "../services/operator-profiles.js";
 import { resolveDdFlowHome } from "../storage/paths.js";
 import { askExecutorChoice } from "./executor-onboarding.js";
+import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+import { prepareDiagnosticControllerStart } from "../services/memory-init-controller-start.js";
 /** Backpressure bounds the observing client's output; closing it never controls the RUN. */
 export async function writeMemoryInitObservation(stdout, text) {
     const disconnected = () => Boolean(stdout.destroyed);
@@ -175,7 +177,7 @@ export async function runMemoryInitCli(args, env = process.env, io = process) {
 /** Shared foreground observer only; the existing RUN-bound controller owns
  * physical Sessions. Neither alias gains another orchestration lifecycle. */
 export async function launchAndObserveMemoryFlow(context, invocation, started, flowId, output, env, io) {
-    const action = flowId === "mb-init" ? "flow_mb_init" : "flow_mb_upgrade";
+    const action = `flow_${flowId.replaceAll("-", "_")}`;
     if (invocation.prepareOnly) {
         const run = requireRun(context, requireProjectByRoot(context, invocation.scope.projectRoot).id, started.runId);
         const response = { ok: true, action: `${action}_prepared`, flow_id: flowId, ...started,
@@ -184,7 +186,8 @@ export async function launchAndObserveMemoryFlow(context, invocation, started, f
         await writeMemoryInitObservation(io.stdout, `${JSON.stringify(writeResponseFile(response, output), null, output.json || output.progressJsonl ? undefined : 2)}\n`);
         return 0;
     }
-    const launch = (flowId === "mb-init" ? prepareMemoryInitControllerStart : prepareMemoryUpgradeControllerStart)(context, invocation.scope);
+    const launch = isDiagnosticFlow(flowId) ? prepareDiagnosticControllerStart(context, invocation.scope, flowId)
+        : (flowId === "mb-init" ? prepareMemoryInitControllerStart : prepareMemoryUpgradeControllerStart)(context, invocation.scope);
     // Use the existing RUN-bound router: a global CLI must not launch its own
     // controller code in place of the independently frozen RUN executable.
     const receiptChunks = [];

package/dist/cli/run-cli.js

@@ -65,6 +65,8 @@ import { isVnextCodeReviewRun, prepareCodeReviewDecision, prepareVnextCodeReview
 import { applyVnextMerge, getVnextMergeRequest, isVnextMergeRun, prepareVnextMergeFinish, prepareVnextMergeStart, repairVnextMerge, routeVnextMergeRequest } from "../services/vnext-merge.js";
 import { sdlcStageHandlers } from "../services/stage-handlers.js";
 import { startMemoryStage, finishMemoryStage, startMemoryUpgradeStage, finishMemoryUpgradeStage } from "../services/memory-stage-dispatch.js";
+import { startDiagnosticStage, finishDiagnosticStage } from "../services/diagnostic-stage-handlers.js";
+import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
 import { bindStageCoordinatorWork } from "../services/work-registry.js";
 import { registerMemoryCompositionFromStage, publishMemoryUpgradeFromStage } from "../services/memory-compose-handler.js";
 import { runMemoryVerificationChecks } from "../services/memory-verify-handler.js";
@@ -75,7 +77,7 @@ import { registerMemoryCorrectionsFromStage, registerMemorySecondCorrectionsFrom
 import { integrateMemoryFinishFromStage, registerMemoryFinishEvidenceFromStage } from "../services/memory-finish-handler.js";
 import { registerMemoryRepairBaselineFromStage, registerMemorySecondRepairBaselineFromStage, reserveMemoryRepairWriterCopyFromStage, reserveMemorySecondRepairCopyFromStage, materializeMemoryRepairWriterCopyFromStage, materializeMemorySecondRepairCopyFromStage, prepareMemoryRepairDispatchFromStage, prepareMemorySecondRepairDispatchFromStage, registerMemoryRepairCurrentViewFromStage, registerMemorySecondRepairCurrentViewFromStage, registerMemoryRepairPublicationSourceFromStage, reserveMemoryRepairPublicationAgainstSourceFromStage, reserveMemorySecondRepairPublicationFromStage, applyMemoryRepairPublicationFromStage, applyMemorySecondRepairPublicationFromStage, finishMemoryRepairPublicationFromStage, finishMemorySecondRepairPublicationFromStage } from "../services/memory-review-handler.js";
 import { mergeServerStatus, serveMergeRequests, stopMergeServer } from "../services/merge-server.js";
-import { getVnextFanoutStatus, memoryStageFanoutDescriptor, observeVnextNativeChildren, prepareNativeObservations, reconcileVnextFanout } from "../services/vnext-fanout.js";
+import { getVnextFanoutStatus, memoryStageFanoutDescriptor, diagnosticStageFanoutDescriptor, observeVnextNativeChildren, prepareNativeObservations, reconcileVnextFanout } from "../services/vnext-fanout.js";
 import { pauseStageForUser, resumeStageAfterUser, prepareStagePause, prepareStageResume, stagePauseCommand } from "../services/stage-pause.js";
 import { runtimeCommand } from "../services/runtime-command.js";
 import { managedLifecycleCommand } from "../services/lifecycle-invocations.js";
@@ -483,11 +485,9 @@ async function runCliRequest(args, io, env) {
                 if (isAppError(error)) {
                     delete error.details.retry_command;
                     delete error.details.retry_instruction;
-                    const settled = errorRecord(error);
-                    settleLifecycleRejection(invocationSettlement.context, invocationSettlement.id, settled);
-                    // Serialization owns a copy. Publish the committed settlement, not
-                    // the original rejection which has no successor authority.
-                    Object.assign(error.details, settled.details);
+                    // The common settlement classifies original validated proof before
+                    // errorRecord clones diagnostic objects and loses capability identity.
+                    settleLifecycleRejection(invocationSettlement.context, invocationSettlement.id, error);
                 }
                 else
                     settleLifecycleInvocation(invocationSettlement.context, invocationSettlement.id, { error: { code: "unexpected", message: String(error), exitCode: 1, details: {} } });
@@ -1232,7 +1232,7 @@ async function prepareCliInputValue(args, context, io, scopeProjectRoot, respons
             const bundle = readFlowRunExecutionBundle(context, { projectRoot: requiredOption(parsed, "project-root"), runId: requiredPosition(parsed, 0, "run-id") });
             if (bundle)
                 prepared.stageBindingBundle = { stage, bundle, ...(contextSha256 ? { contextSha256 } : {}) };
-            if (bundle && ["mb-init", "mb-upgrade"].includes(bundle.descriptor.descriptor.id)) {
+            if (bundle && (["mb-init", "mb-upgrade"].includes(bundle.descriptor.descriptor.id) || isDiagnosticFlow(bundle.descriptor.descriptor.id))) {
                 bundle.descriptor.stage(stage);
                 if (hasOption(parsed, "dir"))
                     throw new AppError("usage", "Memory stage layout belongs to its frozen descriptor", 2);
@@ -1240,7 +1240,7 @@ async function prepareCliInputValue(args, context, io, scopeProjectRoot, respons
                 if (loaded)
                     prepared.stageStart = { externalContext: loaded };
                 prepared.memoryStage = { operation: "start", bytes: loaded ? Buffer.from(loaded.bytes) : Buffer.alloc(0),
-                    flowId: bundle.descriptor.descriptor.id === "mb-upgrade" ? "mb-upgrade" : "mb-init" };
+                    flowId: isDiagnosticFlow(bundle.descriptor.descriptor.id) ? bundle.descriptor.descriptor.id : bundle.descriptor.descriptor.id === "mb-upgrade" ? "mb-upgrade" : "mb-init" };
                 return prepared;
             }
         }
@@ -1374,10 +1374,11 @@ async function prepareCliInputValue(args, context, io, scopeProjectRoot, respons
     const semanticFile = optionalOption(parsed, "semantic-file") ?? optionalOption(parsed, "data");
     const resultFile = optionalOption(parsed, "result-file") ?? semanticFile;
     const runtime = run(projectRoot, runId);
-    if (["mb-init", "mb-upgrade"].includes(JSON.parse(runtime.indexJson).execution_bundle?.flow_id)) {
+    const retainedFlowId = JSON.parse(runtime.indexJson).execution_bundle?.flow_id;
+    if (["mb-init", "mb-upgrade"].includes(retainedFlowId) || isDiagnosticFlow(retainedFlowId)) {
         const bundle = readFlowRunExecutionBundle(context, { projectRoot, runId });
-        if (!bundle || !["mb-init", "mb-upgrade"].includes(bundle.descriptor.descriptor.id))
-            throw new AppError("cli_input_unprepared", "Memory RUN bundle is unavailable", 1);
+        if (!bundle || !["mb-init", "mb-upgrade"].includes(bundle.descriptor.descriptor.id) && !isDiagnosticFlow(bundle.descriptor.descriptor.id))
+            throw new AppError("cli_input_unprepared", "Registered RUN bundle is unavailable", 1);
         bundle.descriptor.stage(stage);
         if (["dir", "outcome", "decision-file", "verification-file", "retry-check", "reason", "reason-file", "request", "work"].some(option => hasOption(parsed, option)))
             throw new AppError("usage", "Memory stage finish requires its registered JSON result, not legacy result options", 2);
@@ -1386,7 +1387,7 @@ async function prepareCliInputValue(args, context, io, scopeProjectRoot, respons
         const bytes = resultStdin ? Buffer.from(await readStdin(io.stdin, 1024 * 1024)) : prepareFileBytes(resultFile, "Memory stage result", 1024 * 1024).bytes;
         if (!bytes.length || bytes.length > 1024 * 1024)
             throw new AppError("usage", "Memory stage result exceeds its byte bound", 2);
-        prepared.memoryStage = { operation: "finish", bytes, flowId: bundle.descriptor.descriptor.id === "mb-upgrade" ? "mb-upgrade" : "mb-init" };
+        prepared.memoryStage = { operation: "finish", bytes, flowId: isDiagnosticFlow(bundle.descriptor.descriptor.id) ? bundle.descriptor.descriptor.id : bundle.descriptor.descriptor.id === "mb-upgrade" ? "mb-upgrade" : "mb-init" };
         return prepared;
     }
     const terminalReplay = (name) => {
@@ -1780,7 +1781,7 @@ async function dispatch(args, context, io, scopeProjectRoot = null, classificati
                 matchKey: entityReferenceVariants(runId).map(reference => stageStartMatchKey(reference, stage, projectRoot, contextSha256)),
                 errorCode: "trusted_session_binding_required", operation: "Memory stage start"
             }).eventKey;
-            const work = (prepared.memoryStage.flowId === "mb-upgrade" ? startMemoryUpgradeStage : startMemoryStage)(context, { projectRoot, runId, stage, bytes: prepared.memoryStage.bytes });
+            const work = (isDiagnosticFlow(prepared.memoryStage.flowId) ? startDiagnosticStage : prepared.memoryStage.flowId === "mb-upgrade" ? startMemoryUpgradeStage : startMemoryStage)(context, { projectRoot, runId, stage, bytes: prepared.memoryStage.bytes });
             try {
                 const binding = bindStageCoordinatorWork(context, { workId: work.work_id, hookEventId: event, stage,
                     promptPath: work.prompt_path, resultPath: work.result_path, ...(contextSha256 ? { contextSha256 } : {}) });
@@ -1790,7 +1791,7 @@ async function dispatch(args, context, io, scopeProjectRoot = null, classificati
                 const finish = managedLifecycleCommand(context, runtimeCommand(context, ["stage", "finish", runId,
                     "--stage", stage, "--project-root", projectRoot, "--result-file", work.result_path, "--json"]));
                 const pause = stagePauseCommand(context, { projectRoot, runId, stage, workId: work.work_id });
-                const orchestration = memoryStageFanoutDescriptor(context, { projectRoot, runId, stage });
+                const orchestration = memoryStageFanoutDescriptor(context, { projectRoot, runId, stage }) ?? diagnosticStageFanoutDescriptor(context, { projectRoot, runId, stage });
                 const delivery = { ...work, binding, ...(orchestration ? { orchestration } : {}), next: { finish_command: finish, pause_command: pause },
                     worker_prompt_markdown: `${work.worker_prompt_markdown}\n## Current lifecycle commands\n\nWrite the semantic result to the assigned result path, then execute exactly:\n${finish}\n\nFor a required user choice, write the question file named by this command, then execute exactly:\n${pause}\n` };
                 bindLifecyclePublishedPacket(context, delivery.worker_prompt_markdown);
@@ -1899,7 +1900,7 @@ async function dispatch(args, context, io, scopeProjectRoot = null, classificati
             // Descriptor settlement validates exact coordinator custody and claims
             // the fresh hook atomically with result acceptance. Do not consume it
             // through the SDLC lifecycle owner before that settlement.
-            return controlledReply((prepared.memoryStage.flowId === "mb-upgrade" ? finishMemoryUpgradeStage : finishMemoryStage)(context, { projectRoot, runId, stage, bytes: prepared.memoryStage.bytes,
+            return controlledReply((isDiagnosticFlow(prepared.memoryStage.flowId) ? finishDiagnosticStage : prepared.memoryStage.flowId === "mb-upgrade" ? finishMemoryUpgradeStage : finishMemoryStage)(context, { projectRoot, runId, stage, bytes: prepared.memoryStage.bytes,
                 hookEventId: hookEventId ?? findRecentMatchingHookEvent(context, {
                     projectId: requireProjectByRoot(context, resolveProjectRoot(projectRoot)).id,
                     matchKey: entityReferenceVariants(runId).map(reference => stageLifecycleMatchKey("stage_finish", reference, stage, projectRoot)),

package/dist/cli.js

@@ -53,6 +53,12 @@ if (args[0] === "upgrade" || args[0] === "flow" && args[1] === "mb-upgrade") {
     const { runMemoryUpgradeCli } = await import("./cli/memory-upgrade.js");
     process.exit(await runMemoryUpgradeCli(args, process.env));
 }
+if (args[0] === "review" || args[0] === "flow" && ["mb-audit", "project-review"].includes(args[1] ?? "")) {
+    publishSetup('ingress_entered');
+    const { runDiagnosticCli } = await import("./cli/diagnostic.js");
+    publishSetup('imports_ready');
+    process.exit(await runDiagnosticCli(args, process.env));
+}
 if (args.slice(0, 3).join(" ") === "runtime storage admit") {
     const { runMemoryStorageAdmissionCli } = await import("./cli/memory-storage-admission.js");
     process.exit(runMemoryStorageAdmissionCli(args));