@deksden-com/dd-flow-cli 0.9.0-beta.149 → 0.9.0-beta.150

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.150
+
+### Patch Changes
+
+- Retain bound test-runtime failure diagnostics, reconcile AGY native task
+  completion and cancellation without model calls, keep cleanup retry available
+  until owned resources settle, and disable auto-update for managed AGY launches.
+
 ## 0.9.0-beta.149
 
 ### Patch Changes

package/dist/build-info.json

@@ -1,8 +1,8 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.149",
-  "cli_commit": "7d17167f768483ffdb5d37f64cc385035c7d4658",
-  "built_at": "2026-10-24T10:44:58.080Z",
+  "cli_version": "0.9.0-beta.150",
+  "cli_commit": "ad05c70447949f295e588546fe27f6abc4640c3f",
+  "built_at": "2026-10-24T17:47:48.856Z",
   "built_with_canon": {
     "version": "4.1.2",
     "commit": "925ef10ecc0b683f7feba6f74913e15560842500",

package/dist/harness-runtime/lib/daemon-operations.mjs

@@ -65,7 +65,7 @@ function ownedSnapshot(snapshot, rootPid) {
 const mergeProcesses = (...snapshots) => [...new Map(snapshots.flat().map(item => [`${item.pid}:${item.started}`, item])).values()];
 
 /** The same incarnation may retry remaining cleanup, never a native Turn. */
-export async function completeDaemonShutdown(root, state, persist, prepare, phases) {
+export async function completeDaemonShutdown(root, state, persist, prepare, phases, reconcileResources) {
   const daemonId = state.daemon_id ?? state.config?.daemonId;
   let shutdown = state.shutdown;
   if (shutdown && shutdown.schema_id !== NATIVE_SHUTDOWN_CONTRACT) throw Object.assign(new Error("shutdown contract mismatch; retain historical owner evidence"), { code: "native_contract_mismatch" });
@@ -84,10 +84,23 @@ export async function completeDaemonShutdown(root, state, persist, prepare, phas
       // Compute ancestry within each snapshot, not across recycled parent PIDs.
       const resources = mergeProcesses(shutdown.owned_processes, ownedSnapshot(await processSnapshot(), state.pid));
       shutdown = { ...shutdown, phases: { execution: true }, owned_processes: resources,
-        inventory_complete: state.pid === process.pid, tree_observed_at: new Date().toISOString(), result: result ?? {} };
+        inventory_complete: state.pid === process.pid, tree_observed_at: new Date().toISOString(), preparation_clean: result?.clean !== false, result: result ?? {} };
       await persist({ shutdown, shutdown_state: "stopping" });
     }
     commitDaemonShutdown(root);
+    if (reconcileResources && !shutdown.phases.owned_resources) {
+      const revision = state.native_execution_revision, generation = dispatchGenerations.get(root) ?? shutdown.generation;
+      const resources = await reconcileResources();
+      const prior = shutdown.result?.native_resources;
+      if ((state.daemon_id ?? state.config?.daemonId) !== daemonId || state.native_execution_revision !== revision
+        || (dispatchGenerations.get(root) ?? shutdown.generation) !== generation || state.active_tree !== false || state.unclaimed_activity
+        || !resources || resources.schema_id !== 'native-resources@1' || resources.owner_daemon_id !== daemonId
+        || resources.generation !== prior?.generation || resources.revision !== prior?.revision || !Array.isArray(resources.entries)
+        || resources.entries.some(item => item.owner_daemon_id !== daemonId || item.generation !== resources.generation))
+        throw Object.assign(new Error('native resource reconciliation lost its owner/execution fence'), { code: 'native_resources_unproven' });
+      shutdown = { ...shutdown, result: { ...shutdown.result, native_resources: resources } };
+      await persist({ shutdown });
+    }
     for (const [phase, action] of phases) {
       if (phase === "daemon_resource" && !shutdown.phases.owned_resources) {
         if (!shutdown.inventory_complete) throw Object.assign(new Error("owned resource coverage is unknown"), { code: "native_resources_unproven" });
@@ -99,12 +112,16 @@ export async function completeDaemonShutdown(root, state, persist, prepare, phas
         const remaining = await processSnapshot();
         if ((shutdown.owned_processes ?? []).some(retained => remaining.some(item => item.pid === retained.pid && item.started === retained.started && !item.zombie))) throw Object.assign(new Error("owned resources remain live"), { code: "native_resources_unproven" });
         const nativeResources = shutdown.result?.native_resources;
-        const resourceGap = nativeResources?.entries?.some(resource => resource.state !== "stopped"
+        const resourceGap = nativeResources?.entries?.some(resource => resource.observation_conflict === true || resource.state !== "stopped"
           && !(resource.classification === "required_work" && shutdown.result?.native_settled === true && shutdown.result?.settled === true)
           && !(shutdown.owned_processes ?? []).some(item => resource.pid === item.pid && resource.started === item.started));
         shutdown = { ...shutdown, phases: { ...shutdown.phases, owned_resources: !resourceGap },
           resource_retirement: { confirmed: !resourceGap, reason: resourceGap ? "native_resource_identity_unproven" : "owned_processes_retired" } };
         await persist({ shutdown });
+        // Keep the technical cleanup owner/endpoint available for a later
+        // read-only reconciliation. Retiring its lease here would make the
+        // actual daemon exit before the retained resources can converge.
+        if (resourceGap) throw Object.assign(new Error("native resource retirement remains unproven"), { code: "native_resources_unproven" });
       }
       if (shutdown.phases[phase]) continue;
       await action();
@@ -120,7 +137,7 @@ export async function completeDaemonShutdown(root, state, persist, prepare, phas
     shutdown = { ...shutdown, generation: dispatchGenerations.get(root) ?? shutdown.generation };
     const { result: ignored, ...proof } = shutdown; void ignored;
     let result = { ...shutdown.result, daemon_id: daemonId, stopped: true, physical_stopped: physicalStopped,
-      settled: nativeSettled, native_settled: nativeSettled, clean: shutdown.result?.clean !== false && nativeSettled && physicalStopped,
+      settled: nativeSettled, native_settled: nativeSettled, clean: (shutdown.preparation_clean ?? shutdown.result?.clean !== false) && nativeSettled && physicalStopped,
       resource_retirement: shutdown.resource_retirement,
       shutdown_contract: NATIVE_SHUTDOWN_CONTRACT, shutdown_proof: proof, _shutdown: true };
     shutdown = { ...shutdown, result };

package/dist/harness-runtime/lib/dd-agy-daemon.mjs

@@ -22,7 +22,7 @@ import { agyWorkspaceHooks } from "./agy-hooks.mjs";
 import { durableDaemonDispatch, completeDaemonShutdown, assertDaemonDispatch, assertDaemonRestartable, trackDaemonConnections, retireDaemonEndpoint, retireFailedDaemon } from "./daemon-operations.mjs";
 import path from "node:path";
 import { observeModel } from "./model-observations.mjs";
-import { AGY_VERSION_TIMEOUT_MS, AgyError, agyTerminalFailure, agyModelArgs, assertProfile, executable, observedProfile, runAgy, usageSnapshot } from "./dd-agy.mjs";
+import { AGY_VERSION_TIMEOUT_MS, AgyError, agyTerminalFailure, agyModelArgs, assertProfile, executable, observedProfile, runAgy, usageSnapshot, managedAgyEnv } from "./dd-agy.mjs";
 import { recoveredAgyErrorBoundary } from "./agy-error-boundary.mjs";
 import { settledNativeTree, nativeExecutionReceipt } from "./native-children.mjs";
 import { retainStartupFailure, prepareRuntimeOwner, cleanupFailedStart, cleanupFailedDaemonStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, stopProcessGroup } from "./managed-daemon.mjs";
@@ -34,16 +34,43 @@ class DaemonError extends AgyError {}
 // classify services. This transcript format has no tool-call IDs: parallel
 // calls therefore retain unknown resources, never FIFO-derived authority.
 export function agyTranscriptFacts(text, source, sessionId) {
-  const children = [], resources = [], calls = [];
-  if (!source?.locator || !source?.sha256 || !sessionId) return { children, resources };
-  for (const line of text.trim().split('\n')) {
+  const children = [], resources = new Map(), calls = [];
+  const result = () => ({ children, resources: [...resources.values()] });
+  if (!source?.locator || !source?.sha256 || !sessionId) return result();
+  const lines = text.split('\n');
+  for (let index = 0; index < lines.length; index++) {
+    const line = lines[index];
+    if (!line && index === lines.length - 1) continue;
     let event;
-    try { event = JSON.parse(line); } catch { return { children: [], resources: [] }; }
+    try { event = JSON.parse(line); } catch {
+      // A writer may have appended only part of the last record. Retain the
+      // valid prefix; a malformed newline-terminated record is a real gap.
+      return index === lines.length - 1 ? result() : { ...result(), gap: 'agy_transcript_invalid_record' };
+    }
+    if (!event || typeof event !== 'object' || Array.isArray(event)) return { ...result(), gap: 'agy_transcript_invalid_record' };
+    const content = typeof event.content === 'string' ? event.content : '';
+    const native_source = { ...source, step_index: event.step_index };
+    if (event.source === 'SYSTEM' && event.type === 'SYSTEM_MESSAGE' && event.status === 'DONE') {
+      const terminal = content.match(/(?:^|\n)\[Message\] timestamp=[^\n]+ sender=([\w-]+\/task-\d+) priority=MESSAGE_PRIORITY_(?:HIGH|LOW) content=Task id "([\w-]+\/task-\d+)" (finished with result:\nCommand exited with code (-?\d+)\.|was canceled with result:\nTool execution was canceled)(?:\n|$)/);
+      if (terminal && terminal[1] === terminal[2]) {
+        const prior = resources.get(terminal[1]);
+        if (prior) resources.set(prior.resource_id, mergeAgyResource(prior, { ...prior, state: 'stopped', native_outcome: terminal[4] === undefined ? 'cancelled' : Number(terminal[4]) === 0 ? 'completed' : 'failed', terminal_source: native_source }));
+      }
+      continue;
+    }
     if (event.source !== 'MODEL') continue;
     if (event.type === 'PLANNER_RESPONSE') { calls.length = 0; if (Array.isArray(event.tool_calls) && event.tool_calls.length === 1) calls.push(event.tool_calls[0]); continue; }
     if (event.type !== 'GENERIC') continue;
-    const call = calls.shift(), content = typeof event.content === 'string' ? event.content : '';
-    const native_source = { ...source, step_index: event.step_index };
+    const call = calls.shift();
+    if (call?.name === 'manage_task' && event.status === 'DONE') {
+      const decode = value => { try { return JSON.parse(value); } catch { return value; } };
+      const id = decode(call.args?.TaskId), action = decode(call.args?.Action);
+      const prior = resources.get(id);
+      if (prior && action === 'kill' && content.match(/^Created At: [^\n]+\nCompleted At: [^\n]+\nTask "([\w-]+\/task-\d+)" cancelled\.(?:\n|$)/)?.[1] === id)
+        resources.set(id, mergeAgyResource(prior, { ...prior, state: 'stopped', native_outcome: 'cancelled', terminal_source: native_source }));
+      const status = action === 'status' && content.match(/^Created At: [^\n]+\nCompleted At: [^\n]+\nTask: ([\w-]+\/task-\d+)\nStatus: (COMPLETED|FAILED|CANCELLED)\n/);
+      if (prior && status?.[1] === id) resources.set(id, mergeAgyResource(prior, { ...prior, state: 'stopped', native_outcome: status[2].toLowerCase(), terminal_source: native_source }));
+    }
     if (call?.name === 'invoke_subagent' && event.status === 'DONE') {
       const match = content.match(/^Created At: [^\n]+\nCompleted At: [^\n]+\nCreated the following subagent:\n(\{[\s\S]*?\})\nThe subagent will send you a message/);
       if (!match) continue;
@@ -57,10 +84,28 @@ export function agyTranscriptFacts(text, source, sessionId) {
     if (!task || !task[1].startsWith(`${sessionId}/`)) continue;
     let daemon = call?.name === 'run_command' ? call.args?.IsDaemon : null;
     if (typeof daemon === 'string') { try { daemon = JSON.parse(daemon); } catch { daemon = null; } }
-    resources.push({ resource_id: task[1], provider_session_id: sessionId, classification: daemon === true ? 'support_service' : daemon === false ? 'required_work' : 'unknown', state: 'unknown', native_source,
-      ...(typeof daemon === 'boolean' ? { native_classification: { tool: 'run_command', IsDaemon: daemon } } : {}) });
+    const resource = { resource_id: task[1], provider_session_id: sessionId, classification: daemon === true ? 'support_service' : daemon === false ? 'required_work' : 'unknown', state: 'unknown', native_source,
+      ...(typeof daemon === 'boolean' ? { native_classification: { tool: 'run_command', IsDaemon: daemon } } : {}) };
+    resources.set(resource.resource_id, mergeAgyResource(resources.get(resource.resource_id), resource));
   }
-  return { children, resources };
+  return result();
+}
+export function mergeAgyResource(prior, next) {
+  if (!prior) return next;
+  if (prior.provider_session_id !== next.provider_session_id || prior.native_source?.locator !== next.native_source?.locator)
+    return { ...prior, state: 'unknown', observation_conflict: true };
+  if (prior.native_source?.step_index !== next.native_source?.step_index)
+    return { ...prior, state: 'unknown', observation_conflict: true };
+  if (prior.observation_conflict || next.observation_conflict || prior.native_outcome && next.native_outcome && prior.native_outcome !== next.native_outcome)
+    return { ...prior, state: 'unknown', observation_conflict: true };
+  if (next.native_outcome && (!Number.isSafeInteger(next.native_source?.step_index) || !Number.isSafeInteger(next.terminal_source?.step_index) || next.terminal_source.step_index <= next.native_source.step_index))
+    return { ...prior, state: 'unknown', observation_conflict: true };
+  if (prior.state === 'stopped' && next.state !== 'stopped') {
+    if (next.native_source?.step_index > (prior.terminal_source?.step_index ?? prior.native_source?.step_index))
+      return { ...prior, state: 'unknown', observation_conflict: true };
+    return prior;
+  }
+  return { ...prior, ...next };
 }
 export const agyTranscriptResources = (text, source, sessionId) => agyTranscriptFacts(text, source, sessionId).resources;
 export async function captureAgyTranscript(runtimeRoot, child, rootSessionId, ownedSessionIds = [rootSessionId], inspect = null) {
@@ -99,7 +144,7 @@ async function writeJson(file, value) { const temporary = `${file}.${process.pid
 async function readState(dir) { try { return JSON.parse(await readFile(locations(dir).state, "utf8")); } catch (error) { if (error.code === "ENOENT") return null; throw error; } }
 async function removeSocket(paths) { try { if (!(await lstat(paths.socket)).isSocket()) throw new DaemonError("unsafe_socket", "refusing to replace a non-socket daemon path"); await unlink(paths.socket); } catch (error) { if (error.code !== "ENOENT") throw error; } }
 const shell = value => `'${String(value).replaceAll("'", `'"'"'`)}'`;
-export function sanitizedEnv(config) { const env = { ...process.env, TMPDIR: config.temporary, DD_AGY_HOOK_NODE: process.execPath, DD_AGY_HOOK_ENTRY: config.entryPath, DD_AGY_STATE_DIR: config.stateDir, DD_AGY_DAEMON_ID: config.daemonId }; for (const key of ["GEMINI_API_KEY","GOOGLE_API_KEY","ANTHROPIC_API_KEY","OPENAI_API_KEY"]) env[key] = undefined; return { ...env, ...managedFlowEnv(config) }; }
+export function sanitizedEnv(config) { const env = { ...process.env, TMPDIR: config.temporary, DD_AGY_HOOK_NODE: process.execPath, DD_AGY_HOOK_ENTRY: config.entryPath, DD_AGY_STATE_DIR: config.stateDir, DD_AGY_DAEMON_ID: config.daemonId }; for (const key of ["GEMINI_API_KEY","GOOGLE_API_KEY","ANTHROPIC_API_KEY","OPENAI_API_KEY"]) env[key] = undefined; return managedAgyEnv({ ...env, ...managedFlowEnv(config) }); }
 const errorPayload = errorRecord;
 async function forwardUsage(config, sessionId, result, tools, descendants) {
   if (!config.ddFlowBin || !config.projectRoot) return;
@@ -439,7 +484,8 @@ export class Runtime {
       const events = parent === root && root
         ? await captureAgyTranscript(this.paths.runtime, child, root, [root, ...ancestors], (text, source) => {
           const facts = agyTranscriptFacts(text, source, child.provider_session_id);
-          for (const resource of facts.resources) this.nativeResources.set(resource.resource_id, resource);
+          for (const resource of facts.resources) this.nativeResources.set(resource.resource_id, mergeAgyResource(this.nativeResources.get(resource.resource_id), resource));
+          if (facts.gap) { this.state.native_topology_error = facts.gap; this.invalidateSettlement(root); }
           for (const discovered of facts.children) {
             const expected = path.join(this.paths.runtime, 'brain', discovered.provider_session_id, '.system_generated', 'logs', 'transcript.jsonl');
             const sourceBrain = path.resolve(path.dirname(fileURLToPath(source.locator)), '../../..');
@@ -1040,7 +1086,10 @@ async function dispatch(runtime, request) {
     }
     catch (error) { await runtime.rejectHook(error, params.event, params.payload ?? {}, current); throw error; }
   }
-  if (request.operation === "daemon.stop") return await completeDaemonShutdown(runtime.paths.dir, runtime.state, patch => runtime.persist(patch), () => runtime.prepareStop(params.cancelTree === true), [["provider", () => runtime.close(false)], ["daemon_resource", () => runtime.finishResource()]]);
+  if (request.operation === "daemon.stop") return await completeDaemonShutdown(runtime.paths.dir, runtime.state, patch => runtime.persist(patch), () => runtime.prepareStop(params.cancelTree === true), [["provider", () => runtime.close(false)], ["daemon_resource", () => runtime.finishResource()]], async () => {
+    await runtime.captureChildTools();
+    return runtime.receipt().native_resources;
+  });
   throw new DaemonError("unknown_operation", `unknown dd-agy daemon operation: ${request.operation}`);
 }
 import { authorizeRetainedDaemonResume } from "./driver-recovery.mjs";

package/dist/harness-runtime/lib/dd-agy.mjs

@@ -8,6 +8,8 @@ import { classifyProviderError, safeProviderError, streamRequestKey } from "./pr
 
 const DEFAULT_MODEL = "gemini-3.1-pro-high";
 export const AGY_VERSION_TIMEOUT_MS = 30_000;
+// Managed binaries are immutable qualification inputs, including doctor probes.
+export const managedAgyEnv = (env = {}) => ({ ...process.env, ...env, AGY_CLI_DISABLE_AUTO_UPDATE: "true" });
 
 export class AgyError extends Error {
   constructor(code, message, retryable = false, details) { super(message); this.code = code; this.retryable = retryable; this.details = details; }
@@ -44,7 +46,7 @@ export function executable(bin, args = []) {
 }
 
 export async function runAgy(bin, args, options = {}) {
-  const stdout = await commandText(bin, args, { cwd: options.cwd, env: options.env, input: options.stdin ?? "", timeoutMs: options.timeoutMs, startupMs: options.startupMs ?? options.timeoutMs ?? SETUP_STARTUP_MS, phase: "native-doctor" });
+  const stdout = await commandText(bin, args, { cwd: options.cwd, env: managedAgyEnv(options.env), input: options.stdin ?? "", timeoutMs: options.timeoutMs, startupMs: options.startupMs ?? options.timeoutMs ?? SETUP_STARTUP_MS, phase: "native-doctor" });
   return { stdout, stderr: "", code: 0 };
 }
 

package/dist/services/check-runner-evidence.js

@@ -40,7 +40,7 @@ export function runnerFailureValid(value) {
     if (value.repair_evidence !== undefined) {
         const proof = value.repair_evidence;
         if (object(proof) && proof.rule === "candidate_test_runtime_error")
-            return ["TypeError", "ReferenceError"].includes(String(proof.exception_type))
+            return ["TypeError", "ReferenceError", "Error"].includes(String(proof.exception_type)) && (proof.exception_type !== "Error" || proof.phase === "test")
                 && absoluteFile(proof.file) && hash(proof.file_sha256) && ["test", "setup", "collection"].includes(String(proof.phase))
                 && [proof.line, proof.column].every(value => Number.isSafeInteger(value) && Number(value) > 0) && proofArtifact(proof.native_artifact);
         if (object(proof) && proof.rule === "candidate_migration_sql")
@@ -332,8 +332,33 @@ export function runnerContractsValid(value) {
         return alias.startsWith("@check/") && ["dd-flow/check-runner-evidence@1", "dd-flow/check-runner-evidence@2"].includes(String(contract.schema_id)) && typeof contract.path === "string" && contract.path.length > 0 && contract.path.split("/")[0] !== "engine-outcome.json" && !contract.path.includes("\\") && !path.isAbsolute(contract.path) && !contract.path.split("/").some(part => part === ".." || part === "" || part === ".");
     });
 }
+function diagnostic(context, value) {
+    // Diagnostics are locators, never another copy of untrusted report content.
+    if (context.diagnostics.length >= 64 || context.bytes + Buffer.byteLength(JSON.stringify(value)) > 32 * 1024 - 64) {
+        context.truncated = true;
+        return;
+    }
+    context.diagnostics.push(value);
+    context.bytes += Buffer.byteLength(JSON.stringify(value));
+}
+export function readRunnerEvidenceDetailed(root, contract, binding) {
+    const context = { diagnostics: [], bytes: 0, truncated: false };
+    const evidence = readRunnerEvidenceInternal(root, contract, binding, 0, { reports: 0 }, context, "");
+    return { evidence, diagnostics: context.diagnostics, ...(context.truncated ? { diagnostics_truncated: true } : {}) };
+}
 export function readRunnerEvidence(root, contract, binding, depth = 0, budget = { reports: 0 }) {
+    return readRunnerEvidenceInternal(root, contract, binding, depth, budget, { diagnostics: [], bytes: 0, truncated: false }, "");
+}
+function readRunnerEvidenceInternal(root, contract, binding, depth, budget, context, prefix) {
+    const report = relativeProofPath(contract.path) ? path.posix.join(prefix, contract.path) : "<invalid-report-path>";
+    const count = context.diagnostics.length;
+    let accepted = false;
+    let failureReason = "invalid_shape";
+    const invalid = () => { if (context.diagnostics.length === count)
+        diagnostic(context, { reason: failureReason, report }); return null; };
     try {
+        if (!relativeProofPath(contract.path))
+            return invalid();
         if (depth > 4 || ++budget.reports > 64)
             return null;
         let current = root;
@@ -344,15 +369,27 @@ export function readRunnerEvidence(root, contract, binding, depth = 0, budget =
             if (fs.lstatSync(current).isSymbolicLink())
                 return null;
         }
-        const evidence = JSON.parse(readBoundedProofFile(current, 1024 * 1024).toString("utf8"));
+        const bytes = readBoundedProofFile(current, 1024 * 1024);
+        failureReason = "invalid_json";
+        const evidence = JSON.parse(bytes.toString("utf8"));
+        failureReason = "invalid_shape";
+        if (!object(evidence))
+            return invalid();
         if (!["dd-flow/check-runner-evidence@1", "dd-flow/check-runner-evidence@2"].includes(contract.schema_id))
             return null;
         const partial = evidence.failure_projection;
         if (partial !== undefined && (evidence.schema_id !== "dd-flow/check-runner-evidence@2" || !object(partial) || partial.state !== "partial" || !["count_bound", "byte_bound", "interrupt"].includes(partial.reason)
             || ![partial.represented, partial.omitted].every(value => Number.isSafeInteger(value) && value >= 0)))
             return null;
-        if (evidence.schema_id !== contract.schema_id || !evidence.binding || Object.entries(binding).some(([key, value]) => evidence.binding[key] !== value)
-            || typeof evidence.runner?.name !== "string" || !evidence.runner.name || typeof evidence.runner.version !== "string" || !evidence.runner.version || typeof evidence.completed !== "boolean" || !evidence.counts
+        if (evidence.schema_id !== contract.schema_id) {
+            diagnostic(context, { reason: "invalid_shape", report, expected: contract.schema_id, observed: ["dd-flow/check-runner-evidence@1", "dd-flow/check-runner-evidence@2"].includes(evidence.schema_id) ? evidence.schema_id : "unsupported" });
+            return null;
+        }
+        if (!evidence.binding || Object.entries(binding).some(([key, value]) => evidence.binding[key] !== value)) {
+            diagnostic(context, { reason: "binding_mismatch", report });
+            return null;
+        }
+        if (typeof evidence.runner?.name !== "string" || !evidence.runner.name || typeof evidence.runner.version !== "string" || !evidence.runner.version || typeof evidence.completed !== "boolean" || !evidence.counts
             || ![evidence.counts.passed, evidence.counts.failed, evidence.counts.skipped].every(n => Number.isSafeInteger(n) && n >= 0)
             || !Array.isArray(evidence.failures) || evidence.failures.length > 64 || evidence.failures.some(f => !runnerFailureValid(f))
             || !partial && evidence.counts.failed > evidence.failures.length || evidence.observation_unknown !== undefined && typeof evidence.observation_unknown !== "boolean")
@@ -384,8 +421,10 @@ export function readRunnerEvidence(root, contract, binding, depth = 0, budget =
                 if (crypto.createHash("sha256").update(step.binding.command).digest("hex") !== step.command_sha256)
                     return null;
                 invocations.add(step.binding.invocation_id);
+                failureReason = "artifact_mismatch";
                 readProofArtifact(root, step.report, 1024 * 1024);
-                const child = readRunnerEvidence(path.join(root, path.dirname(step.report.relative_path)), { schema_id: contract.schema_id, path: path.basename(step.report.relative_path) }, step.binding, depth + 1, budget);
+                failureReason = "invalid_shape";
+                const child = readRunnerEvidenceInternal(path.join(root, path.dirname(step.report.relative_path)), { schema_id: contract.schema_id, path: path.basename(step.report.relative_path) }, step.binding, depth + 1, budget, context, path.posix.join(prefix, path.posix.dirname(step.report.relative_path)));
                 if (!child || step.state === "passed" && (child.counts.failed !== 0 || child.failures.length !== 0) || step.state === "failed" && !child.failures.length && child.completed && !child.observation_unknown)
                     return null;
                 if (!child.completed || child.observation_unknown)
@@ -397,6 +436,7 @@ export function readRunnerEvidence(root, contract, binding, depth = 0, budget =
                     return null;
         }
         for (const failure of evidence.failures) {
+            failureReason = "artifact_mismatch";
             if (failure.child_evidence) {
                 const ref = failure.child_evidence, step = evidence.steps?.find(item => item.id === ref.step_id), child = children.get(ref.step_id);
                 if (!step || !child || !isDeepStrictEqual(ref.binding, step.binding) || !isDeepStrictEqual(ref.report, step.report))
@@ -423,6 +463,7 @@ export function readRunnerEvidence(root, contract, binding, depth = 0, budget =
                 if (!isDeepStrictEqual(native.binding, binding) || Object.entries(facts).some(([key, value]) => !isDeepStrictEqual(native[key], value)))
                     return null;
                 if (proof.rule === "candidate_test_runtime_error") {
+                    failureReason = "attribution_unproven";
                     if (evidence.schema_id !== "dd-flow/check-runner-evidence@2" || native.executing_file !== proof.file || native.exception_name !== proof.exception_type
                         || !isDeepStrictEqual(native.top_frame, { file: proof.file, line: proof.line, column: proof.column }) || !boundedString(native.stack, 16384) || !String(native.stack).startsWith(`${proof.exception_type}:`))
                         return null;
@@ -447,6 +488,7 @@ export function readRunnerEvidence(root, contract, binding, depth = 0, budget =
                 validatedBrowserProofs.add(proof);
             }
         }
+        failureReason = "invalid_shape";
         const represented = [...consumed.values()].reduce((total, used) => total + used.size, 0), childFailures = [...children.values()].reduce((total, child) => total + child.failures.length, 0);
         if (partial) {
             if (children.size ? partial.represented !== represented || partial.omitted !== childFailures - represented : partial.represented !== evidence.failures.filter(failure => failure.code !== "report_truncated").length)
@@ -466,10 +508,26 @@ export function readRunnerEvidence(root, contract, binding, depth = 0, budget =
                 evidence.observation_unknown = true;
         }
         validatedReports.set(evidence, (evidence.steps ?? []).flatMap(step => step.report && children.has(step.id) ? [{ report: step.report, evidence: children.get(step.id) }] : []));
+        if (unsupportedObservationContracts.has(evidence))
+            diagnostic(context, { reason: "unsupported_observation_contract", report, expected: "dd-tasks/browser-observation@2", observed: "legacy" });
+        else if (!evidence.completed || evidence.observation_unknown)
+            diagnostic(context, { reason: "observation_incomplete", report });
+        for (const failure of evidence.failures)
+            if (failure.origin === "unknown" || failure.category === "unclassified" && !failure.repair_evidence) {
+                diagnostic(context, { reason: "attribution_unproven", report });
+                break;
+            }
+        accepted = true;
         return evidence;
     }
-    catch {
-        return null;
+    catch (error) {
+        if (error.code === "ENOENT")
+            failureReason = "missing";
+        return invalid();
+    }
+    finally {
+        if (!accepted && context.diagnostics.length === count)
+            diagnostic(context, { reason: failureReason, report });
     }
 }
 export function runnerEvidencePass(evidence) { return Boolean(evidence?.completed && !evidence.failure_projection && !evidence.observation_unknown && evidence.counts.failed === 0 && evidence.failures.length === 0); }

package/dist/services/code-checks.js

@@ -1,5 +1,5 @@
 import crypto from "node:crypto";
-import { candidateAbsencesValid, candidateFailureAbsences, candidateFailureFiles, checkRepairDisposition, readRunnerEvidence, readRunnerProgress, runnerContractsValid, runnerEvidencePass, runnerObservationDurations, runnerProofArtifacts } from "./check-runner-evidence.js";
+import { candidateAbsencesValid, candidateFailureAbsences, candidateFailureFiles, checkRepairDisposition, readRunnerEvidence, readRunnerEvidenceDetailed, readRunnerProgress, runnerContractsValid, runnerEvidencePass, runnerObservationDurations, runnerProofArtifacts } from "./check-runner-evidence.js";
 export { assertSourceRepairEligible, checkRepairDisposition } from "./check-runner-evidence.js";
 import { isGitlessWorkspace, ownedWorkspaceHookPath, projectServicePathFilter, workspaceGitFiles } from "./workspace-files.js";
 import { spawn, spawnSync } from "node:child_process";
@@ -656,7 +656,8 @@ async function runCodeChecksOwned(context, input, workspaceGateId, generation, s
             if (mutationPaths.length)
                 fs.appendFileSync(stderrPath, `\ncheck inputs changed while running: ${mutationPaths.join(", ")}\n`);
         }
-        const runnerEvidence = group.runnerEvidence ? readRunnerEvidence(evidenceDir, group.runnerEvidence, { invocation_id: id, check_id: id, command: group.command, input_hash: inputHash, verification_epoch: epoch }) : undefined;
+        const runnerRead = group.runnerEvidence ? readRunnerEvidenceDetailed(evidenceDir, group.runnerEvidence, { invocation_id: id, check_id: id, command: group.command, input_hash: inputHash, verification_epoch: epoch }) : undefined;
+        const runnerEvidence = runnerRead?.evidence;
         const physicalFailures = executionFailures({ fingerprintScope: "check_inputs", exitCode: result.exitCode, launcherError: result.error ?? undefined, cleanupUnconfirmed: result.cleanupUnconfirmed, missing: artifacts.missing, mutations: mutationPaths, invalidRunner: Boolean(group.runnerEvidence && !runnerEvidence) });
         if (result.failure)
             physicalFailures.push(result.failure);
@@ -680,6 +681,9 @@ async function runCodeChecksOwned(context, input, workspaceGateId, generation, s
         if (group.runnerEvidence) {
             receipt.runner_evidence_required = group.runnerEvidence;
             receipt.runner_evidence = runnerEvidence ?? null;
+            receipt.runner_evidence_diagnostics = runnerRead.diagnostics;
+            if (runnerRead?.diagnostics_truncated)
+                receipt.runner_evidence_diagnostics_truncated = true;
         }
         context.db.run("UPDATE check_receipts SET status = ?, exit_code = ?, after_fingerprint = ?, mutation_paths_json = ?, artifacts_json = ?, finished_at = ? WHERE id = ? AND project_id = ? AND status = 'running'", [receipt.status, receipt.exit_code, receipt.after_fingerprint, JSON.stringify(receipt.mutation_paths), JSON.stringify(receipt.artifacts), receipt.finished_at, id, input.projectId]);
         writeReceipt(receiptPath, receipt);
@@ -752,7 +756,8 @@ export function reconcileUnfinishedChecks(context, input) {
         const mutationPaths = workspaceUnchanged ? [] : scoped && completionSnapshot ? ["<declared check inputs differed at completion; exact delta unavailable>"]
             : scoped && beforeFiles ? changedPaths(beforeFiles, selectedInputFiles(input.workspaceRoot, after.files, receipt.inputs ?? [], input.runHome ? [input.runHome] : []))
                 : [scoped ? "<declared check inputs changed; exact manifest unavailable>" : "<workspace changed while detached check ran>"];
-        const runnerEvidence = receipt?.runner_evidence_required ? readRunnerEvidence(path.join(path.dirname(pendingReceipt.receipt_path), "artifacts"), receipt.runner_evidence_required, { invocation_id: receipt.id, check_id: receipt.id, command: receipt.command, input_hash: receipt.input_hash, verification_epoch: receipt.verification_epoch }) : undefined;
+        const runnerRead = receipt?.runner_evidence_required ? readRunnerEvidenceDetailed(path.join(path.dirname(pendingReceipt.receipt_path), "artifacts"), receipt.runner_evidence_required, { invocation_id: receipt.id, check_id: receipt.id, command: receipt.command, input_hash: receipt.input_hash, verification_epoch: receipt.verification_epoch }) : undefined;
+        const runnerEvidence = runnerRead?.evidence;
         const exitCode = completion?.exit_code ?? null;
         const finishedAt = completion?.finished_at ?? context.now();
         const physicalFailures = executionFailures({ fingerprintScope: scoped ? "check_inputs" : undefined, exitCode, missing: artifacts.missing.filter(file => file !== "engine-outcome.json"), mutations: mutationPaths, invalidRunner: Boolean(receipt?.runner_evidence_required && !runnerEvidence) });
@@ -786,7 +791,7 @@ export function reconcileUnfinishedChecks(context, input) {
         if (process)
             finishManagedProcess(context, { id: process.id, leaseToken: process.lease_token, state: status === "passed" ? "stopped" : "failed", reason: status === "passed" ? "reconciled_completion" : completion === null ? "completion_marker_missing" : "reconciled_check_failed" });
         if (receipt) {
-            const repaired = { ...receipt, ...(receipt.runner_evidence_required ? { runner_evidence: runnerEvidence ?? null } : {}), completion_path: receipt.completion_path || path.join(path.dirname(pendingReceipt.receipt_path), "completion.json"), required_artifacts: receipt.required_artifacts ?? [], ...(status === "aborted" ? { abort_reason: "completion_marker_missing" } : {}), status, exit_code: exitCode, after_fingerprint: afterFingerprint, mutation_paths: mutationPaths, artifacts: artifacts.items, finished_at: finishedAt };
+            const repaired = { ...receipt, ...(receipt.runner_evidence_required ? { runner_evidence: runnerEvidence ?? null, runner_evidence_diagnostics: runnerRead.diagnostics, ...(runnerRead?.diagnostics_truncated ? { runner_evidence_diagnostics_truncated: true } : {}) } : {}), completion_path: receipt.completion_path || path.join(path.dirname(pendingReceipt.receipt_path), "completion.json"), required_artifacts: receipt.required_artifacts ?? [], ...(status === "aborted" ? { abort_reason: "completion_marker_missing" } : {}), status, exit_code: exitCode, after_fingerprint: afterFingerprint, mutation_paths: mutationPaths, artifacts: artifacts.items, finished_at: finishedAt };
             repaired.candidate_root = input.workspaceRoot;
             repaired.candidate_files = candidateFiles;
             repaired.candidate_absences = candidateAbsences;
@@ -976,11 +981,19 @@ function resolvedReceiptArtifacts(receiptPath, artifacts, binding) {
         return !path.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path.sep}`) ? path.join(currentRoot, relative) : file;
     };
     let evidence = null;
+    let diagnostics = [];
+    let diagnosticsTruncated = false;
     if (original.runner_evidence_required && original.id && original.command && original.input_hash && original.verification_epoch) {
         const root = path.join(currentRoot, "artifacts");
         const retained = collectCheckArtifacts(root, [original.runner_evidence_required.path]);
-        if (retained.complete && retained.items.every(item => artifacts.some(artifact => relocate(artifact.path) === item.path && artifact.sha256 === item.sha256)))
-            evidence = readRunnerEvidence(root, original.runner_evidence_required, { invocation_id: binding.id, check_id: binding.id, command: binding.command, input_hash: binding.input_hash, verification_epoch: binding.verification_epoch });
+        if (retained.complete && retained.items.every(item => artifacts.some(artifact => relocate(artifact.path) === item.path && artifact.sha256 === item.sha256))) {
+            const read = readRunnerEvidenceDetailed(root, original.runner_evidence_required, { invocation_id: binding.id, check_id: binding.id, command: binding.command, input_hash: binding.input_hash, verification_epoch: binding.verification_epoch });
+            evidence = read.evidence;
+            diagnostics = read.diagnostics;
+            diagnosticsTruncated = Boolean(read.diagnostics_truncated);
+        }
+        else
+            diagnostics = [{ reason: retained.complete ? "artifact_mismatch" : "missing", report: original.runner_evidence_required.path }];
     }
     let outcome = {};
     const outcomePath = path.join(currentRoot, "artifacts", "engine-outcome.json");
@@ -993,7 +1006,7 @@ function resolvedReceiptArtifacts(receiptPath, artifacts, binding) {
         }
         catch { /* Missing physical proof cannot grant attribution. */ }
     }
-    return { completion_path: path.join(currentRoot, "completion.json"), required_artifacts: original.required_artifacts ?? [], inputs: original.inputs ?? [], artifacts: artifacts.map((artifact) => ({ ...artifact, path: relocate(artifact.path) })), ...(original.runner_evidence_required ? { runner_evidence_required: original.runner_evidence_required, runner_evidence: evidence } : {}), execution_failures: outcome.execution_failures ?? [], ...(outcome.candidate_root ? { candidate_root: outcome.candidate_root } : {}), ...(outcome.candidate_files ? { candidate_files: outcome.candidate_files } : {}), ...(outcome.candidate_absences ? { candidate_absences: outcome.candidate_absences } : {}) };
+    return { completion_path: path.join(currentRoot, "completion.json"), required_artifacts: original.required_artifacts ?? [], inputs: original.inputs ?? [], artifacts: artifacts.map((artifact) => ({ ...artifact, path: relocate(artifact.path) })), ...(original.runner_evidence_required ? { runner_evidence_required: original.runner_evidence_required, runner_evidence: evidence, runner_evidence_diagnostics: diagnostics, ...(diagnosticsTruncated ? { runner_evidence_diagnostics_truncated: true } : {}) } : {}), execution_failures: outcome.execution_failures ?? [], ...(outcome.candidate_root ? { candidate_root: outcome.candidate_root } : {}), ...(outcome.candidate_files ? { candidate_files: outcome.candidate_files } : {}), ...(outcome.candidate_absences ? { candidate_absences: outcome.candidate_absences } : {}) };
 }
 function executionFailures(input) {
     const failures = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.149",
+  "version": "0.9.0-beta.150",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "packageManager": "pnpm@10.23.0",