@deksden-com/dd-flow-cli 0.9.0-beta.145 → 0.9.0-beta.149

package/dist/services/frozen-engine.js

@@ -11,6 +11,7 @@ import { hybridDigest } from "./hybrid-contracts.js";
 import { isMemoryInitResourceStorageFacts } from "./memory-init-resource-storage.js";
 import { memoryInitStartupInputSchemas } from "./memory-init-startup-custody.js";
 import { SETUP_STARTUP_MS } from "../harness-runtime/lib/setup-progress.mjs";
+import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
 function storageProbeRefuse(reason, probe) {
     const summary = probe ? ` (${probe.error_code ?? probe.signal ?? `exit ${probe.status}`})` : "";
     throw new AppError("frozen_engine_storage_incompatible", `Selected frozen engine cannot admit memory-flow storage${summary}`, 1, { reason, effect: "no_effect", ...(probe ? { probe } : {}) });
@@ -76,6 +77,37 @@ export class AdmittedFrozenEngine {
             refuse("invalid_selection_identity");
         return AdmittedFrozenEngine.fromIdentity(identity, expectedManifestSha256);
     }
+    /** Physical relocation preserves the original manifest as provenance. It
+     * cannot authorize a different executable or different semantic metadata. */
+    static admitRelocation(binding, retained, expectedSha256, target) {
+        if (hash(retained) !== expectedSha256 || !shape("run-engine-binding", binding)
+            || !shape("run-engine-binding", target) || binding.run_id !== target.run_id)
+            refuse("invalid_relocation_identity");
+        const value = json(retained);
+        if (!shape("engine-manifest", value))
+            refuse("invalid_manifest_shape");
+        const original = value;
+        if (original.snapshot_root !== binding.engine.snapshot_root
+            || original.package_name !== binding.engine.package_name || original.package_version !== binding.engine.package_version
+            || original.engine_version !== binding.engine.engine_version || original.integrity.checksum !== binding.engine.integrity_checksum
+            || Object.entries(binding.engine).some(([key, value]) => key !== "snapshot_root" && value !== target.engine[key])) {
+            refuse("foreign_relocation_identity");
+        }
+        try {
+            const bytes = readBoundedReleaseFile(path.join(target.engine.snapshot_root, "engine.json"), 1024 * 1024);
+            const selected = AdmittedFrozenEngine.admit(target, hash(bytes));
+            const semantic = (manifest) => Object.fromEntries(Object.entries(manifest)
+                .filter(([key]) => !["snapshot_root", "package_root", "installed_at", "install_source"].includes(key)));
+            if (hybridDigest(semantic(original)) !== hybridDigest(semantic(selected.manifest())))
+                refuse("relocated_manifest_changed");
+            return selected;
+        }
+        catch (error) {
+            if (error instanceof AppError && error.code === "frozen_engine_invalid")
+                throw error;
+            return refuse("snapshot_unavailable_or_unreadable");
+        }
+    }
     static fromIdentity(identity, expectedManifestSha256) {
         try {
             const root = path.resolve(identity.snapshot_root);
@@ -125,6 +157,9 @@ export class AdmittedFrozenEngine {
     admitMemoryUpgradeFlow(source) {
         return this.#admitMemoryFlow(source, "mb-upgrade");
     }
+    admitDiagnosticFlow(source, flowId) {
+        return this.#admitMemoryFlow(source, flowId);
+    }
     #admitMemoryFlow(source, flowId, startupInputSchema) {
         const fail = (reason, details = {}) => {
             throw new AppError("frozen_engine_flow_incompatible", `Selected frozen engine cannot admit ${flowId} handlers`, 1, { ...details, reason, phase: "prepare", effect: "no_effect" });
@@ -156,7 +191,7 @@ export class AdmittedFrozenEngine {
         const flow = source.resolveRegisteredFlow();
         if (flow.descriptor.id !== flowId)
             fail("foreign_flow_source");
-        const expected = { schema_id: flowId === "mb-upgrade" ? "dd-flow/memory-upgrade-engine-flow@1"
+        const expected = { schema_id: isDiagnosticFlow(flowId) ? "dd-flow/diagnostic-engine-flow@1" : flowId === "mb-upgrade" ? "dd-flow/memory-upgrade-engine-flow@1"
                 : startupInputSchema === undefined ? "dd-flow/memory-init-engine-flow@1" : "dd-flow/memory-init-engine-flow@2",
             ...(startupInputSchema === undefined ? {} : { startup_input_schema: startupInputSchema }),
             flow_id: flowId, source_sha256: source.sha256,
@@ -164,7 +199,7 @@ export class AdmittedFrozenEngine {
         revalidate();
         const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !["NODE_OPTIONS", "NODE_PATH"].includes(key) && !key.startsWith("DD_FLOW_")));
         const started = performance.now();
-        const result = spawnSync(this.nodeExecutable, [this.entrypoint, "runtime", "flow", "admit", "--operation", flowId === "mb-init" ? "memory-init" : "memory-upgrade", "--json"], { input, cwd: this.#manifest.snapshot_root, env: { ...env, DD_FLOW_ENGINE_MODE: "1", DD_FLOW_ENGINE_HOME: this.#manifest.snapshot_root },
+        const result = spawnSync(this.nodeExecutable, [this.entrypoint, "runtime", "flow", "admit", "--operation", isDiagnosticFlow(flowId) ? flowId : flowId === "mb-init" ? "memory-init" : "memory-upgrade", "--json"], { input, cwd: this.#manifest.snapshot_root, env: { ...env, DD_FLOW_ENGINE_MODE: "1", DD_FLOW_ENGINE_HOME: this.#manifest.snapshot_root },
             // This is cold startup of a selected CLI, not an already-loaded handler.
             // Admission is bounded local validation; no provider operation is started.
             timeout: SETUP_STARTUP_MS, maxBuffer: 1024 * 1024, shell: false, windowsHide: true });

package/dist/services/hybrid-contracts.js

@@ -249,6 +249,8 @@ export function validateHybridContract(name, input, context = {}) {
             fail("foreign_bundle_canon", "/canon");
         if (hybridDigest(data.project_pack) !== hybridDigest(context.bundleProvenance.project_pack))
             fail("foreign_bundle_project_pack", "/project_pack");
+        if ((data.flow_id === "mb-audit" || data.flow_id === "project-review") !== (data.project_pack === null))
+            fail("invalid_bundle_project_pack_role", "/project_pack");
         const memoryFlow = data.flow_id === "mb-init" || data.flow_id === "mb-upgrade";
         if (memoryFlow && context.bootstrapIdentity?.projectRoot !== context.bundleProjectRoot)
             fail("foreign_bootstrap_identity", "/bootstrap_receipts");

package/dist/services/installed-flow-source.js

@@ -6,7 +6,9 @@ import { readSetupStatus } from "./setup.js";
 import { readBoundedReleaseFile } from "./release-source.js";
 import { hybridDigest, validateHybridShape } from "./hybrid-contracts.js";
 import { admitBundledFlow } from "./stage-handlers.js";
+import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
 const limit = 1024 * 1024;
+const flowIds = ["mb-init", "mb-upgrade", "mb-audit", "project-review"];
 const hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
 function refuse(reason) {
     throw new AppError("installed_flow_source_invalid", "Installed flow source is not the selected verified canon", 1, { reason, phase: "prepare", effect: "no_effect" });
@@ -50,7 +52,7 @@ export class PreparedInstalledFlowSource {
     }
     static fromInstalledRelease(home, expectedInstallationSha256, flowId) {
         try {
-            if (!path.isAbsolute(home) || !/^[a-f0-9]{64}$/.test(expectedInstallationSha256) || !["mb-init", "mb-upgrade"].includes(flowId))
+            if (!path.isAbsolute(home) || !/^[a-f0-9]{64}$/.test(expectedInstallationSha256) || !flowIds.includes(flowId))
                 refuse("invalid_selection");
             const selected = readSetupStatus(home);
             if (!selected.installation || selected.installation_readiness !== "installed")
@@ -95,6 +97,26 @@ export class PreparedInstalledFlowSource {
                     folded.set(reference.path.toLowerCase(), reference.path);
                     blobs.set(reference.path, Buffer.from(content));
                 }
+            if (isDiagnosticFlow(flowId)) {
+                const support = ["mbb/index.md", "mbb/memory-bank-structure.md", "mbb/frontmatter-standards.md", "mbb/cross-references.md", "mbb/named-deferrals-guide.md",
+                    ...fs.readdirSync(path.join(memoryRoot, "mbb/aspects")).filter(name => name.endsWith(".md")).map(name => `mbb/aspects/${name}`),
+                    "dd-flow/mb-sdlc/review/aspects.md", "dd-flow/mb-sdlc/review/critics/universal.md", "dd-flow/mb-sdlc/review/critics/architectural-harmonization.md",
+                    ...fs.readdirSync(path.join(flowRoot, "mb-audit/aspects")).filter(name => name.endsWith(".md")).map(name => `dd-flow/mb-audit/aspects/${name}`)];
+                for (const logical of support) {
+                    const content = readBoundedReleaseFile(containedFile(memoryRoot, logical), limit), name = `support/${logical}`;
+                    if (!content.length || (total += content.length) > 32 * limit || folded.has(name.toLowerCase()))
+                        refuse("invalid_support_inventory");
+                    new TextDecoder("utf-8", { fatal: true }).decode(content);
+                    folded.set(name.toLowerCase(), name);
+                    blobs.set(name, Buffer.from(content));
+                }
+                const workSchema = "schemas/diagnostic-work-result.schema.json";
+                const content = readBoundedReleaseFile(containedFile(flowRoot, workSchema), limit);
+                if (!content.length || (total += content.length) > 32 * limit || folded.has(workSchema.toLowerCase()))
+                    refuse("invalid_support_inventory");
+                JSON.parse(content.toString("utf8"));
+                blobs.set(workSchema, Buffer.from(content));
+            }
             // Verify compressed/expanded archive identity again after collecting bytes.
             // A coherent descriptor+prompt edit cannot become a new trusted selection.
             const final = readSetupStatus(home);
@@ -144,7 +166,7 @@ export class PreparedInstalledFlowSource {
                 || typeof value.canon.archive_sha256 !== "string" || !/^[a-f0-9]{64}$/.test(value.canon.archive_sha256)
                 || typeof value.canon.version !== "string" || !/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/.test(value.canon.version)
                 || !value.descriptor || Object.keys(value.descriptor).sort().join() !== "path,sha256"
-                || !["mb-init/flow-descriptor.json", "mb-upgrade/flow-descriptor.json"].includes(value.descriptor.path) || typeof value.descriptor.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(value.descriptor.sha256)
+                || !flowIds.some(id => value.descriptor.path === `${id}/flow-descriptor.json`) || typeof value.descriptor.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(value.descriptor.sha256)
                 || !Array.isArray(value.blobs) || value.blobs.length < 1 || value.blobs.length > 129)
                 refuse("invalid_retained_source");
             const blobs = new Map(), folded = new Set();
@@ -166,7 +188,7 @@ export class PreparedInstalledFlowSource {
             const descriptor = blobs.get(value.descriptor.path);
             if (!descriptor || hash(descriptor) !== value.descriptor.sha256)
                 refuse("retained_source_changed");
-            const flowId = value.descriptor.path.startsWith("mb-upgrade/") ? "mb-upgrade" : "mb-init";
+            const flowId = value.descriptor.path.slice(0, -"/flow-descriptor.json".length);
             const declared = JSON.parse(descriptor.toString("utf8"));
             if (validateHybridShape("flow-descriptor", declared).length || declared.id !== flowId || declared.origin !== "canon")
                 refuse("invalid_retained_source");

package/dist/services/lifecycle-invocations.js

@@ -24,6 +24,9 @@ import { runtimeCommand, shellArgument } from "./runtime-command.js";
 // Process-local custody: an executing SQL row or ambient variable alone cannot
 // recreate admission after a CLI restart, or in another resource database.
 const currentAdmissions = new WeakMap();
+// A same-stage finish continuation is not authority until its predecessor's
+// outcome commits. Process death before that commit leaves no issued successor.
+const stagedContinuations = new WeakMap();
 export function currentLifecycleAdmission(context, id) {
     const owned = currentAdmissions.get(context.db)?.get(id);
     if (!owned || context.env.DD_FLOW_CURRENT_INVOCATION !== id || owned.pid !== process.pid
@@ -379,8 +382,9 @@ export function assertLifecycleOutcomes(context, scope) {
       AND NOT EXISTS (SELECT 1 FROM lifecycle_invocations newer WHERE newer.scope_json = a.scope_json AND newer.fingerprint = a.fingerprint AND newer.rowid > a.rowid)
     ORDER BY a.rowid`, [scope.projectRoot, scope.runId, scope.generation]);
     for (const row of rows) {
-        const error = (row.outcome_json ? JSON.parse(row.outcome_json) : null)?.error;
-        if (typeof error?.code === "string" && !isCorrectableLifecycleRejection(error.code, error.details) && !isRegisteredRepair(context, error.details?.continuation, { projectId: project.id, runId: scope.runId }))
+        const outcome = row.outcome_json ? JSON.parse(row.outcome_json) : null;
+        const error = outcome?.error;
+        if (typeof error?.code === "string" && !committedSuccessor(context, row, outcome) && !isCorrectableLifecycleRejection(error.code, error.details) && !isRegisteredRepair(context, error.details?.continuation, { projectId: project.id, runId: scope.runId }))
             throw new AppError(error.code, typeof error.message === "string" ? error.message : "Mandatory lifecycle failed", 1, { ...(error.details ?? {}), invocation_id: row.id });
     }
 }
@@ -489,14 +493,27 @@ export function observeLifecycleCommand(context, command, nativeEvent) {
             }
         }
         const registeredContinuation = error && registeredLifecycleContinuation(context, error, anchor.project_id, anchor.run_id);
-        const retainedSuccessor = error && typeof error.details.retry_command === "string"
-            && typeof error.details.rejection_signature === "string"
+        const retainedRejections = error && typeof error.details.retry_command === "string"
             && context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'lifecycle_invocations'")
-            && context.db.get(`SELECT 1 FROM lifecycle_invocations a JOIN hook_events h ON h.event_key = a.event_key
-        JOIN projects p ON p.id = h.project_id WHERE h.id = ? AND h.project_id = ? AND a.status = 'settled'
-        AND json_extract(a.scope_json,'$.projectRoot') = p.root AND json_extract(a.scope_json,'$.runId') = ?
-        AND json_extract(a.scope_json,'$.generation') = ? AND json_extract(a.outcome_json,'$.error.details.retry_command') = ?
-        AND json_extract(a.outcome_json,'$.error.details.rejection_signature') = ?`, [anchor.hook_event_id, anchor.project_id, anchor.run_id, anchor.generation, error.details.retry_command, error.details.rejection_signature]);
+            ? context.db.all(`SELECT a.* FROM lifecycle_invocations a JOIN hook_events h ON h.event_key = a.event_key
+        WHERE h.id = ? AND h.project_id = ? AND a.status = 'settled'
+        AND json_extract(a.scope_json,'$.runId') = ?
+        AND json_extract(a.scope_json,'$.generation') = ? AND json_extract(a.outcome_json,'$.error.code') = ?
+        AND json_extract(a.outcome_json,'$.error.details.retry_command') = ?`, [anchor.hook_event_id, anchor.project_id, anchor.run_id, anchor.generation, error.code, error.details.retry_command]) : [];
+        const projectRoot = context.db.get("SELECT root FROM projects WHERE id = ?", [anchor.project_id])?.root;
+        const ownedRejections = retainedRejections.filter(row => {
+            try {
+                return projectRoot !== undefined && canonicalPath(JSON.parse(row.scope_json).projectRoot, false) === projectRoot;
+            }
+            catch {
+                return false;
+            }
+        });
+        const retainedRejection = ownedRejections.length === 1 ? ownedRejections[0] : undefined;
+        // A committed exact successor is authority; reclassifying its sanitized
+        // error would discard the original validated check capability again.
+        const retainedSuccessor = retainedRejection && (committedSuccessor(context, retainedRejection, JSON.parse(retainedRejection.outcome_json ?? "null"))
+            ?? (error && currentIssuedCommand(context, retainedRejection.scope_json, String(error.details.retry_command))));
         const hookOnlyArgumentDefect = error && !invocationId && !context.env.DD_FLOW_INVOCATION_SCOPE
             && !retainedSuccessor
             && ["missing_required_option", "missing_option_value", "empty_option_value", "invalid_number", "invalid_choice", "duplicate_option"].includes(String(error.details.reason));
@@ -535,7 +552,7 @@ export function observeLifecycleCommand(context, command, nativeEvent) {
             }
         }
         const correctable = error && !hookOnlyArgumentDefect && error.details.recoverable !== false && error.details.effect !== "unknown"
-            && (registeredContinuation || error.details.effect === "no_effect" && isCorrectableLifecycleRejection(error.code, error.details)
+            && (registeredContinuation || retainedSuccessor || error.details.effect === "no_effect" && isCorrectableLifecycleRejection(error.code, error.details)
                 && typeof error.details.retry_command === "string");
         const correlationKey = parsed.kind === "standalone" ? fingerprint(parsed.invocation)
             : JSON.stringify([auxiliary.operation, auxiliary.operation === "stage_block" ? auxiliary.args.positional[2] ?? null : auxiliary.args.options.get("run")?.[0] ?? null, auxiliary.args.options.get("stage")?.[0] ?? null]);
@@ -645,18 +662,60 @@ export function lifecycleRetryCommands(context, stage) {
             .flatMap((row) => {
             try {
                 const outcome = row.outcome_json ? JSON.parse(row.outcome_json) : null;
-                const retry = outcome?.error?.details?.retry_command;
+                const retry = outcome?.error?.details?.retry_command ?? outcome?.result?.next?.finish_command;
                 const parsed = invocation(row.command);
                 if (typeof retry !== "string" || parsed.operation !== "stage_finish" || commandOption(parsed, "stage") !== stage)
                     return [];
-                const latest = context.db.get("SELECT * FROM lifecycle_invocations WHERE scope_json = ? AND fingerprint = ? ORDER BY rowid DESC LIMIT 1", [row.scope_json, row.fingerprint]);
-                return latest?.status === "issued" && (latest.deadline === null || latest.deadline > Date.now()) ? [retry] : [];
+                const successor = outcome?.successor_invocation_id
+                    ? context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ? AND scope_json = ?", [outcome.successor_invocation_id, row.scope_json])
+                    : currentIssuedCommand(context, row.scope_json, retry);
+                return successor?.status === "issued" && successor.fingerprint === scopedCommandFingerprint(context, row.scope_json, retry)
+                    && (successor.deadline === null || successor.deadline > Date.now()) ? [publicInvocationCommand(context, successor, successor.command)] : [];
             }
             catch {
                 return [];
             }
         }))];
 }
+function currentIssuedCommand(context, scope, command) {
+    const rows = context.db.all("SELECT * FROM lifecycle_invocations WHERE scope_json = ? AND fingerprint = ? AND status = 'issued'", [scope, scopedCommandFingerprint(context, scope, command)])
+        .filter(row => row.deadline === null || row.deadline > Date.now());
+    if (rows.length > 1)
+        throw new AppError("invocation_ambiguous", "Multiple current lifecycle successors match this command", 1);
+    return rows[0] ?? null;
+}
+function scopedCommandFingerprint(context, scope, command) {
+    return fingerprint(invocation(canonicalManagedCommand(context, command, JSON.parse(scope))));
+}
+function committedSuccessor(context, prior, outcome) {
+    if (typeof outcome?.successor_invocation_id !== "string" || outcome.successor_invocation_id === prior.id)
+        return null;
+    const command = outcome.error?.details?.retry_command ?? outcome.result?.next?.finish_command;
+    if (typeof command !== "string")
+        return null;
+    const next = context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ? AND scope_json = ?", [outcome.successor_invocation_id, prior.scope_json]);
+    return next && next.status !== "expired" && (next.status !== "issued" || next.deadline === null || next.deadline > Date.now())
+        && next.fingerprint === scopedCommandFingerprint(context, prior.scope_json, command) ? next : null;
+}
+function invocationRecoverySnapshot(context, scope) {
+    return JSON.stringify(context.db.get(`SELECT g.generation,g.status,g.recovery_id FROM run_recovery_guards g
+    JOIN projects p ON p.id=g.project_id WHERE p.root=? AND g.run_id=? ORDER BY g.generation DESC LIMIT 1`, [scope.projectRoot, scope.runId]) ?? null);
+}
+/** Resolve authority, never reconstruct it from an old prompt or issue on read. */
+export function currentStageFinishCommand(context, stage) {
+    const scope = context.env.DD_FLOW_INVOCATION_SCOPE;
+    if (!scope || !context.db.get("SELECT 1 FROM sqlite_master WHERE name='lifecycle_invocations'"))
+        return null;
+    const rows = context.db.all("SELECT * FROM lifecycle_invocations WHERE scope_json = ? AND status = 'issued'", [scope])
+        .filter(row => {
+        const parsed = invocation(row.command);
+        return parsed.operation === "stage_finish" && commandOption(parsed, "stage") === stage
+            && (row.deadline === null || row.deadline > Date.now());
+    });
+    if (rows.length > 1)
+        throw new AppError("invocation_ambiguous", "Stage has multiple current finish authorities", 1, { stage });
+    return rows[0] ? publicInvocationCommand(context, rows[0], rows[0].command) : null;
+}
 export function managedInvocationContext(context, input) {
     const env = { ...context.env, DD_FLOW_CURRENT_INVOCATION: undefined, DD_FLOW_INVOCATION_SCOPE: undefined };
     if (!["zcode-acp", "codex-desktop", "grok-acp", "antigravity-cli", "droid-cli", "opencode-server"].includes(input.harness))
@@ -712,6 +771,21 @@ export function managedLifecycleCommand(context, command, options = {}) {
         return publicInvocationCommand(context, retained, command);
     }
     storage(context);
+    const predecessorId = context.env.DD_FLOW_CURRENT_INVOCATION;
+    const predecessor = predecessorId ? load(context, predecessorId) : null;
+    if (predecessor?.status === "executing" && predecessor.scope_json === configured
+        && parsed.operation === "stage_finish" && invocation(predecessor.command).operation === "stage_finish"
+        && commandOption(parsed, "stage") === commandOption(invocation(predecessor.command), "stage")) {
+        let staged = stagedContinuations.get(context.db);
+        if (!staged)
+            stagedContinuations.set(context.db, staged = new Map());
+        const prior = staged.get(predecessor.id);
+        if (prior && prior.fingerprint !== fingerprint(parsed))
+            throw new AppError("invocation_continuation_conflict", "One finish may publish only one exact successor", 1);
+        const next = prior ?? prepareIssuedInvocation(command, scope);
+        staged.set(predecessor.id, next);
+        return publicInvocationCommand(context, next, command);
+    }
     return context.db.writeTransaction(() => {
         const prior = options.freshWorkAttempt ? undefined : context.db.get("SELECT * FROM lifecycle_invocations WHERE scope_json = ? AND fingerprint = ? ORDER BY rowid DESC LIMIT 1", [JSON.stringify(scope), fingerprint(parsed)]);
         if (prior && prior.id !== context.env.DD_FLOW_CURRENT_INVOCATION) {
@@ -792,17 +866,35 @@ export function settleLifecycleRejection(context, id, error) {
     // Only this settlement may publish a successor; inherited help is not authority.
     delete error.details.retry_command;
     delete error.details.retry_instruction;
-    const details = { ...error.details };
+    // A producer may have rendered help before throwing. Only the decision below
+    // may publish replacement authority for a rejected operation.
+    stagedContinuations.get(context.db)?.delete(id);
+    // Validate process-local receipt capabilities BEFORE diagnostic cloning.
+    // Only this local preparation crosses into the SQL commit below; public
+    // category fields/serialized receipts cannot recreate the decision.
+    const prepared = {
+        invocation: JSON.stringify(load(context, id)),
+        recovery: invocationRecoverySnapshot(context, JSON.parse(load(context, id).scope_json)),
+        retryable: isRetryableLifecycleRejection(error.code, error.details),
+        receipts: ["work_checks_failed", "code_gate_failed", "code_review_gate_failed", "merge_gate_failed"].includes(error.code) && Array.isArray(error.details.failures)
+            ? error.details.failures.map(receipt => ({ receipt, row: context.db.get("SELECT * FROM check_receipts WHERE id = ?", [receipt.id]) })) : []
+    };
+    if (prepared.receipts.some(({ receipt, row }) => !row || row.status !== receipt.status || row.verification_epoch !== receipt.verification_epoch || row.command !== receipt.command || row.input_hash !== receipt.input_hash))
+        prepared.retryable = false;
+    const serialized = errorRecord(error);
+    const details = { ...serialized.details };
     try {
         context.db.writeTransaction(() => {
             const prior = load(context, id);
-            if (prior.status !== "executing")
-                throw new AppError("invocation_settlement_conflict", "Attempt is no longer executing", 1, { invocation_id: id });
+            if (prior.status !== "executing" || JSON.stringify(prior) !== prepared.invocation
+                || invocationRecoverySnapshot(context, JSON.parse(prior.scope_json)) !== prepared.recovery
+                || prepared.receipts.some(({ receipt, row }) => JSON.stringify(context.db.get("SELECT * FROM check_receipts WHERE id = ?", [receipt.id])) !== JSON.stringify(row)))
+                throw new AppError("invocation_settlement_conflict", "Attempt or bound check receipts changed before settlement", 1, { invocation_id: id });
             const storageRetry = error.code === "storage_write_failed" && error.details.effect === "no_effect"
                 && !context.db.get("SELECT 1 FROM lifecycle_invocations WHERE scope_json = ? AND fingerprint = ? AND json_extract(outcome_json, '$.error.details.storage_retry') = 1 LIMIT 1", [prior.scope_json, prior.fingerprint]);
-            if (isRetryableLifecycleRejection(error.code, error.details) || storageRetry) {
-                const failures = ["work_checks_failed", "code_gate_failed", "code_review_gate_failed", "merge_gate_failed"].includes(error.code) ? error.details.failures : undefined;
-                const retry = retryLifecycleInvocationCommand(context, id, failures?.[0]?.id);
+            if (prepared.retryable || storageRetry) {
+                const failures = prepared.receipts.map(value => value.receipt);
+                const retry = retryLifecycleInvocationCommand(context, id, failures[0]?.id);
                 details.retry_command = retry;
                 details.effect = "no_effect";
                 details.recoverable = true;
@@ -824,7 +916,9 @@ export function settleLifecycleRejection(context, id, error) {
             else {
                 details.recoverable = false;
             }
-            settleLifecycleInvocation(context, id, { error: { ...error, details } });
+            const successor = stagedContinuations.get(context.db)?.get(id)
+                ?? (typeof details.retry_command === "string" ? currentIssuedCommand(context, prior.scope_json, details.retry_command) : null);
+            settleLifecycleInvocation(context, id, { error: { ...serialized, details }, ...(successor ? { successor_invocation_id: successor.id } : {}) });
         });
     }
     catch (persistence) {
@@ -963,15 +1057,22 @@ export function prepareLifecycleIssuance(command, value) {
     return { command, scope, parsed };
 }
 export function issueLifecycleInvocation(context, command, scope) {
-    const { parsed } = prepareLifecycleIssuance(command, scope);
+    const row = prepareIssuedInvocation(command, scope);
     storage(context);
+    insertIssuedInvocation(context, row);
+    return { id: row.id, command: row.command };
+}
+function prepareIssuedInvocation(command, scope) {
+    const { parsed } = prepareLifecycleIssuance(command, scope);
     const id = crypto.randomUUID();
     const prepared = commandWithInvocationId(command, id);
     // Validate the actual inserted argv, including quoted heredoc boundaries.
-    const row = { id, command: prepared, scope_json: JSON.stringify(scope), fingerprint: fingerprint(parsed) };
+    const row = { id, command: prepared, scope_json: JSON.stringify(scope), fingerprint: fingerprint(parsed), status: "issued", event_key: null, identity_json: null, deadline: null, outcome_json: null };
     checkCommand(row, prepared);
-    context.db.run("INSERT INTO lifecycle_invocations (id, scope_json, command, fingerprint, status, created_at, updated_at) VALUES (?, ?, ?, ?, 'issued', ?, ?)", [id, row.scope_json, prepared, row.fingerprint, context.now(), context.now()]);
-    return { id, command: prepared };
+    return row;
+}
+function insertIssuedInvocation(context, row) {
+    context.db.run("INSERT INTO lifecycle_invocations (id, scope_json, command, fingerprint, status, created_at, updated_at) VALUES (?, ?, ?, ?, 'issued', ?, ?)", [row.id, row.scope_json, row.command, row.fingerprint, context.now(), context.now()]);
 }
 /** Prepare outside a write transaction; the Work retry CAS owns issuance. */
 export function prepareWorkStartAuthority(context, command, previousId) {
@@ -1935,6 +2036,9 @@ export async function awaitLifecycleInvocation(context, input) {
                 const { recoverCommittedStageResume } = await import("./stage-pause.js");
                 const result = recoverCommittedStageResume(context, { id: row.id, projectRoot: scope.projectRoot, runId: scope.runId, generation: scope.generation, stage: commandOption(parsed, "stage") ?? "", workId: commandOption(parsed, "work") ?? "" });
                 if (result) {
+                    const project = requireProjectByRoot(context, scope.projectRoot);
+                    const { publishStagePacket } = await import("./stage-report-renderer.js");
+                    publishStagePacket(context, project.id, scope.runId, commandOption(parsed, "stage") ?? "", String(result.resume_source_path));
                     const { preparePromptDelivery } = await import("./prompt-delivery.js");
                     const delivered = preparePromptDelivery(result);
                     const previousScope = context.env.DD_FLOW_INVOCATION_SCOPE;
@@ -1948,7 +2052,6 @@ export async function awaitLifecycleInvocation(context, input) {
                         else
                             context.env.DD_FLOW_INVOCATION_SCOPE = previousScope;
                     }
-                    const project = requireProjectByRoot(context, scope.projectRoot);
                     const event = row.event_key ? context.db.get("SELECT id FROM hook_events WHERE project_id = ? AND event_key = ?", [project.id, row.event_key]) : null;
                     if (event)
                         observeLifecycleCommand(context, row.command, { project_id: project.id, id: event.id })({ result: delivered });
@@ -2022,14 +2125,24 @@ export async function awaitLifecycleInvocation(context, input) {
     }
 }
 export function settleLifecycleInvocation(context, id, outcome) {
-    currentAdmissions.get(context.db)?.delete(id);
-    const encoded = JSON.stringify(outcome);
-    if (encoded === undefined)
-        throw new AppError("invocation_outcome_invalid", "Invocation outcome must be JSON", 1);
-    const changed = context.db.run("UPDATE lifecycle_invocations SET status = 'settled', outcome_json = ?, updated_at = ? WHERE id = ? AND status = 'executing'", [encoded, context.now(), id]);
-    if (changed.changes !== 1) {
+    const successor = stagedContinuations.get(context.db)?.get(id);
+    context.db.writeTransaction(() => {
         const row = load(context, id);
-        if (row.status !== "settled" || row.outcome_json !== encoded)
-            throw new AppError("invocation_settlement_conflict", "Attempt cannot be settled with a different outcome", 1, { invocation_id: id });
-    }
+        const retained = successor && outcome && typeof outcome === "object" ? { ...outcome, successor_invocation_id: successor.id } : outcome;
+        const encoded = JSON.stringify(retained);
+        if (encoded === undefined)
+            throw new AppError("invocation_outcome_invalid", "Invocation outcome must be JSON", 1);
+        if (row.status === "settled") {
+            if (row.outcome_json !== encoded)
+                throw new AppError("invocation_settlement_conflict", "Attempt cannot be settled with a different outcome", 1, { invocation_id: id });
+            return;
+        }
+        if (row.status !== "executing")
+            throw new AppError("invocation_settlement_conflict", "Attempt is no longer executing", 1, { invocation_id: id });
+        if (successor)
+            insertIssuedInvocation(context, successor);
+        if (context.db.run("UPDATE lifecycle_invocations SET status = 'settled', outcome_json = ?, updated_at = ? WHERE id = ? AND status = 'executing'", [encoded, context.now(), id]).changes !== 1)
+            throw new AppError("invocation_settlement_conflict", "Lifecycle outcome changed before commit", 1, { invocation_id: id });
+    });
+    currentAdmissions.get(context.db)?.delete(id);
 }

package/dist/services/memory-init-contexts.js

@@ -7,6 +7,22 @@ import { publishImmutableInput } from "../storage/immutable-input.js";
 import { readBoundedReleaseFile } from "./release-source.js";
 import { readMemoryInitStartupInput } from "./memory-init-startup-custody.js";
 import { readUpgradeStorageReadiness } from "./memory-upgrade-storage-readiness.js";
+import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+import { readDiagnosticRequest } from "./diagnostic-start.js";
+export function prepareDiagnosticContextsFromRequest(context, bundle, directory) {
+    const scope = bundle.execution.snapshot().scope, flowId = bundle.manifest.flow_id;
+    if (!isDiagnosticFlow(flowId))
+        throw new AppError("diagnostic_context_invalid", "Diagnostic bundle required", 2, { effect: "no_effect" });
+    const request = readDiagnosticRequest(context, { projectRoot: scope.projectRoot, requestId: scope.requestId, flowId });
+    if (!request || request.execution_sha256 !== bundle.execution.sha256)
+        throw new AppError("diagnostic_context_invalid", "Original diagnostic objective required", 2, { effect: "no_effect" });
+    return { ...prepareMemoryContexts(bundle, request.objective, directory, flowId), objective: request.objective };
+}
+export function publishDiagnosticContexts(bundle, objective, directory, expectedSha256, expectedOwner) {
+    if (!isDiagnosticFlow(bundle.manifest.flow_id))
+        throw new AppError("diagnostic_context_invalid", "Diagnostic bundle required", 2, { effect: "no_effect" });
+    return publishMemoryContexts(bundle, objective, directory, expectedSha256, expectedOwner, bundle.manifest.flow_id);
+}
 /** Original upgrade intake comes from the independently retained storage
  * selection, including after project publication changes the old tree. */
 export function prepareMemoryUpgradeContextsFromStartup(context, bundle, directory) {

package/dist/services/memory-init-controller-start.js

@@ -11,6 +11,9 @@ import { requireRun } from "./run-controller-state.js";
 import { prepareRunControllerLaunch } from "./run-controller.js";
 import { prepareMemoryInitContextsFromStartup, publishMemoryInitContexts, prepareMemoryUpgradeContextsFromStartup, publishMemoryUpgradeContexts } from "./memory-init-contexts.js";
 import { parseRuntimeBudget } from "./runtime-budget.js";
+import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+import { startDiagnosticRun } from "./diagnostic-start.js";
+import { prepareDiagnosticContextsFromRequest, publishDiagnosticContexts } from "./memory-init-contexts.js";
 function refuse(reason) {
     throw new AppError("memory_init_controller_start_invalid", "Init controller requires its exact published startup request", 1, { reason, effect: "no_effect", next_action: "reconcile_exact_request" });
 }
@@ -24,6 +27,9 @@ export function prepareMemoryInitControllerStart(context, scope) {
 export function prepareMemoryUpgradeControllerStart(context, scope) {
     return prepareMemoryControllerStart(context, scope, "mb-upgrade");
 }
+export function prepareDiagnosticControllerStart(context, scope, flowId) {
+    return prepareMemoryControllerStart(context, scope, flowId);
+}
 function prepareMemoryControllerStart(context, scope, flowId) {
     validateMemoryInitStartupScope(scope);
     if (context.db.isOwnedWriteTransaction?.())
@@ -41,15 +47,17 @@ function prepareMemoryControllerStart(context, scope, flowId) {
         refuse("published_run_required");
     // Restores the exact request and verifies independent SQL/physical root
     // ownership without consulting current canon/profiles or creating a RUN.
-    const started = flowId === "mb-init" ? startMemoryInitRun(context, scope) : startMemoryUpgradeRun(context, scope);
+    const started = isDiagnosticFlow(flowId) ? startDiagnosticRun(context, { projectRoot: scope.projectRoot, requestId: scope.requestId, flowId })
+        : flowId === "mb-init" ? startMemoryInitRun(context, scope) : startMemoryUpgradeRun(context, scope);
     const run = requireRun(context, project.id, started.runId);
     const bundle = readFlowRunExecutionBundle(context, { projectRoot: scope.projectRoot, runId: run.id });
     if (!bundle || bundle.sha256 !== started.bundleSha256)
         refuse("retained_bundle_required");
     if (bundle.execution.settings.execution !== "managed")
         refuse("managed_execution_required");
-    const contexts = flowId === "mb-init" ? prepareMemoryInitContextsFromStartup(context, bundle, run.run_root)
-        : prepareMemoryUpgradeContextsFromStartup(context, bundle, run.run_root);
+    const contexts = isDiagnosticFlow(flowId) ? prepareDiagnosticContextsFromRequest(context, bundle, run.run_root)
+        : flowId === "mb-init" ? prepareMemoryInitContextsFromStartup(context, bundle, run.run_root)
+            : prepareMemoryUpgradeContextsFromStartup(context, bundle, run.run_root);
     const input = { projectRoot: scope.projectRoot, runId: run.id, requestId: scope.requestId,
         contextFile: contexts.file, contextSha256: contexts.sha256 };
     const controllers = context.db.get("SELECT 1 FROM sqlite_schema WHERE type='table' AND name='run_controllers'")
@@ -83,7 +91,7 @@ function prepareMemoryControllerStart(context, scope, flowId) {
     });
     if (!rootOwner || !Number.isSafeInteger(rootOwner.dev) || !Number.isSafeInteger(rootOwner.ino))
         refuse("root_owner_changed");
-    const publish = flowId === "mb-init" ? publishMemoryInitContexts : publishMemoryUpgradeContexts;
+    const publish = isDiagnosticFlow(flowId) ? publishDiagnosticContexts : flowId === "mb-init" ? publishMemoryInitContexts : publishMemoryUpgradeContexts;
     publish(bundle, contexts.objective, run.run_root, contexts.sha256, rootOwner);
     try {
         return { input, prepared: prepareRunControllerLaunch(context, input) };

package/dist/services/memory-init-lint-capability.js

@@ -1,14 +1,14 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { AppError } from "../shared/errors.js";
 import { hybridDigest } from "./hybrid-contracts.js";
 import { PreparedMemoryInitTarget } from "./memory-init-preflight.js";
 import { readBoundedReleaseFile } from "./release-source.js";
-function refuse(reason) {
-    throw new AppError("memory_init_lint_capability_failed", "Selected mb-lint cannot validate Memory Bank documents", 1, { reason, effect: "no_effect", next_action: "repair_prerequisite_then_retry" });
+import { runMemoryToolProbe } from "./memory-tool-probe.js";
+function refuse(reason, diagnostics) {
+    throw new AppError("memory_init_lint_capability_failed", "Selected mb-lint cannot validate Memory Bank documents", 1, { reason, effect: "no_effect", next_action: "repair_prerequisite_then_retry", ...(diagnostics ? { tool_probe: diagnostics } : {}) });
 }
 const hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
 const logical = ".memory-bank/index.md";
@@ -105,9 +105,9 @@ export class PreparedMemoryInitLintCapability {
             const probeEnv = Object.fromEntries(Object.entries(env).filter(([key]) => !key.startsWith("GIT_")));
             const run = (status, rule, config) => {
                 ownDirectories();
-                const result = spawnSync(executable, ["--root", scratch, "--files", logical, "--format", "json", ...(config ? ["--config", config] : [])], { cwd: scratch, env: { ...probeEnv, GIT_OPTIONAL_LOCKS: "0" }, shell: false, windowsHide: true, timeout: 5000, maxBuffer: 256 * 1024 });
+                const { result, diagnostics } = runMemoryToolProbe(executable, ["--root", scratch, "--files", logical, "--format", "json", ...(config ? ["--config", config] : [])], { cwd: scratch, env: { ...probeEnv, GIT_OPTIONAL_LOCKS: "0" } });
                 if (result.error || result.signal || result.status !== status)
-                    refuse(config ? "temporary_configuration_not_supported" : "lint_probe_execution_failed");
+                    refuse(config ? "temporary_configuration_not_supported" : "lint_probe_execution_failed", { ...diagnostics, phase: "lint_probe", expected_status: status });
                 ownDirectories();
                 const actual = fs.lstatSync(file);
                 if (!actual.isFile() || actual.nlink !== 1 || !same(actual, fileOwner)

package/dist/services/memory-init-native-capacity.js

@@ -7,7 +7,7 @@ import { hybridDigest } from "./hybrid-contracts.js";
 import { resolveHarnessCommand, harnessRuntimeArguments } from "./harness-config.js";
 import { runHarnessAdapter, adapterSessionId } from "./harness-adapter.js";
 import { renderCapacityInstructions } from "../harness-runtime/lib/delegation-instructions.mjs";
-import { normalizeNativeChildren } from "../harness-runtime/lib/native-children.mjs";
+import { normalizeNativeChildren, nativeShutdownConfirmed } from "../harness-runtime/lib/native-children.mjs";
 import { readBoundedReleaseFile } from "./release-source.js";
 import { acquireInstallationLock } from "./installation-lock.js";
 import { inspectDaemonOperation } from "../harness-runtime/lib/daemon-operations.mjs";
@@ -115,7 +115,7 @@ export async function produceMemoryInitNativeCapacity(input) {
                 || hybridDigest(proof.children) !== hybridDigest(children) || proof.capacity !== children.length
                 || children.length < input.maximum || children.length > input.maximum || new Set(children.map(child => child.session_id)).size !== children.length
                 || children.some(child => child.session_id === rootSessionId || child.parent_session_id !== rootSessionId || child.provenance === "parent_mismatch")
-                || cleanup?.stopped !== true || cleanup.settled !== true || cleanup.shutdown_contract !== "dd-flow/daemon-shutdown@1"
+                || cleanup?.stopped !== true || cleanup.settled !== true || !nativeShutdownConfirmed(cleanup) || cleanup.shutdown_contract !== "dd-flow/daemon-shutdown@2"
                 || typeof start?.daemon_id !== "string" || cleanup.daemon_id !== start.daemon_id
                 || hybridDigest(cleanup) !== hybridDigest(read(path.join(root, "daemon-stop.json"))))
                 refuse("probe_not_qualified", "partial");
@@ -280,8 +280,8 @@ export async function produceMemoryInitNativeCapacity(input) {
             }
         }
         const children = rootSessionId && inspected ? normalizeNativeChildren(inspected, rootSessionId) : [];
-        const qualified = !failure && cleanup?.stopped === true && cleanup.settled === true
-            && cleanup.shutdown_contract === "dd-flow/daemon-shutdown@1" && typeof cleanup.daemon_id === "string"
+        const qualified = !failure && cleanup?.stopped === true && cleanup.settled === true && nativeShutdownConfirmed(cleanup)
+            && cleanup.shutdown_contract === "dd-flow/daemon-shutdown@2" && typeof cleanup.daemon_id === "string"
             && children.length === input.maximum && children.length <= 15
             && children.every(child => child.parent_session_id === rootSessionId && child.session_id !== rootSessionId && child.provenance !== "parent_mismatch");
         const proof = { schema_id: "dd-flow/memory-native-capacity@1", input: identity, root_session_id: rootSessionId,