@deksden-com/dd-flow-cli 0.9.0-beta.15 → 0.9.0-beta.150

package/dist/services/codex-hook-delivery.js

@@ -0,0 +1,32 @@
+import path from "node:path";
+import { callDaemon } from "../harness-runtime/lib/dd-codex-daemon.mjs";
+import { AppError } from "../shared/errors.js";
+import { commandOption, lifecycleCommandFromPayload, parseLifecycleCommand, continuationCommand } from "./lifecycle-command.js";
+/** The hook asks the existing daemon about native evidence; it cannot mint it. */
+export async function verifyCodexHookDelivery(env, payload) {
+    const command = lifecycleCommandFromPayload(payload);
+    const parsed = command ? parseLifecycleCommand(command) : { kind: "none", participation: "none" };
+    if (parsed.kind === "none" && !["lifecycle", "auxiliary"].includes(parsed.participation) && !(command && continuationCommand(command)))
+        return undefined;
+    const managed = (parsed.kind !== "none" && commandOption(parsed.invocation, "invocation-id")) || env.DD_FLOW_DAEMON_ID;
+    if (!managed)
+        return undefined; // Explicit legacy/unmanaged transport.
+    if (!env.DD_FLOW_CODEX_STATE_DIR || !env.DD_FLOW_DAEMON_ID)
+        throw new AppError("native_hook_unproven", "Managed hook has no owning native daemon", 1, { effect: "no_effect" });
+    const deadline = Number(env.DD_FLOW_HOOK_DEADLINE_AT);
+    const remaining = Number.isFinite(deadline) && deadline > 0 ? deadline - Date.now() : 5000;
+    if (remaining <= 0)
+        throw new AppError("native_hook_timeout", "Native hook deadline expired before delivery verification", 1, { phase: "verification", effect: "no_effect", recoverable: false });
+    const proof = await callDaemon(env.DD_FLOW_CODEX_STATE_DIR, "hook.verify", {
+        daemonId: env.DD_FLOW_DAEMON_ID, rootSessionId: payload.session_id,
+        sessionId: payload.agent_id ?? payload.session_id, toolCallId: payload.tool_use_id, turnId: payload.turn_id
+    }, Math.min(5000, remaining));
+    if (typeof proof.projectRoot !== "string"
+        || typeof proof.ddFlowHome !== "string" || !env.DD_FLOW_HOME || path.resolve(env.DD_FLOW_HOME) !== path.resolve(proof.ddFlowHome)
+        || proof.daemonId !== env.DD_FLOW_DAEMON_ID || typeof proof.rootSessionId !== "string" || typeof proof.sessionId !== "string"
+        || typeof proof.toolCallId !== "string" || !(proof.parentSessionId === null || typeof proof.parentSessionId === "string")) {
+        throw new AppError("native_hook_unproven", "Native hook proof differs from the requested project/runtime", 1, { effect: "no_effect" });
+    }
+    return { daemonId: proof.daemonId, rootSessionId: proof.rootSessionId, sessionId: proof.sessionId,
+        parentSessionId: proof.parentSessionId, toolCallId: proof.toolCallId, projectRoot: proof.projectRoot, command: command };
+}

package/dist/services/command-context.js

@@ -0,0 +1,80 @@
+import path from "node:path";
+import { commandInputs, physicalPathOptions } from "../cli/command-inputs.js";
+import { parseCommandArgs } from "./lifecycle-command.js";
+import { assertPathWithin, canonicalPath } from "../storage/paths.js";
+import { AppError } from "../shared/errors.js";
+import { resolveWorkReference } from "../storage/work-references.js";
+export function normalizedPathAlias(value) {
+    return value.replace(/^\\+(?=@(?:project|workspace|run)(?:\/|$))/, "");
+}
+export function resolveContextualPaths(args, options, roots) {
+    const resolve = (option, original) => {
+        if (!options.has(option))
+            return original;
+        const value = normalizedPathAlias(original);
+        if (!value.startsWith("@"))
+            return value;
+        const match = /^@(project|workspace|run)(?:\/(.*))?$/.exec(value);
+        if (!match || !roots[match[1]])
+            throw new AppError("usage", `Unknown or unavailable path alias: ${value}`, 2, { phase: "prepare", effect: "no_effect", recoverable: true, parameter: option });
+        const root = roots[match[1]];
+        return assertPathWithin(root, path.join(root, match[2] ?? ""), `${match[1]}_alias`);
+    };
+    return args.map((value, index) => {
+        const equal = /^--([^=]+)=(.*)$/s.exec(value);
+        if (equal)
+            return `--${equal[1]}=${resolve(equal[1], equal[2])}`;
+        const option = args[index - 1]?.match(/^--([^=]+)$/)?.[1];
+        return option ? resolve(option, value) : value;
+    });
+}
+/** Contextual paths are route semantics, not lifecycle invocation authority. */
+export function resolveCommandProjectRoot(context, args, explicit) {
+    if (explicit && !normalizedPathAlias(explicit).startsWith("@"))
+        return canonicalPath(explicit, false);
+    if (!context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'runs'"))
+        return null;
+    const parsed = parseCommandArgs(args);
+    const key = Object.keys(commandInputs).filter(key => key.split(" ").every((part, i) => parsed.positional[i] === part)).sort((a, b) => b.length - a.length)[0];
+    const reference = parsed.options.get("run")?.[0] ?? (key?.startsWith("stage ") ? parsed.positional[key.split(" ").length] : undefined);
+    if (reference) {
+        const rows = context.db.all("SELECT project_root FROM runs WHERE id = ? OR short_id = ?", [reference, reference]);
+        if (rows.length === 1)
+            return rows[0].project_root;
+        if (rows.length > 1)
+            throw new AppError("usage", "RUN reference requires an explicit project scope", 2, { phase: "prepare", effect: "no_effect" });
+    }
+    const work = parsed.options.get("parent")?.[0] ?? (key?.startsWith("work ") && !key.startsWith("work repair") ? parsed.positional[key.split(" ").length] : undefined);
+    if (work) {
+        const resolved = resolveWorkReference(context, work);
+        return context.db.get("SELECT root FROM projects WHERE id = ?", [resolved.project_id])?.root ?? null;
+    }
+    return null;
+}
+export function resolveCommandPaths(context, args, projectRoot) {
+    const parsed = parseCommandArgs(args);
+    const key = Object.keys(commandInputs).filter(key => key.split(" ").every((part, i) => parsed.positional[i] === part)).sort((a, b) => b.length - a.length)[0];
+    const options = new Set(key ? commandInputs[key]?.contextualPaths ?? [] : []);
+    if (!args.some(value => /(?:^|=)\\*@/.test(value)))
+        return args;
+    for (const [option, values] of parsed.options) {
+        if (physicalPathOptions.has(option) && !options.has(option) && values.some(value => normalizedPathAlias(value).startsWith("@")))
+            throw new AppError("usage", `--${option} requires a physical path on this route`, 2, { phase: "prepare", effect: "no_effect", recoverable: true, parameter: option });
+    }
+    const project = projectRoot ? context.db.get("SELECT id FROM projects WHERE root = ?", [projectRoot]) : undefined;
+    const reference = parsed.options.get("run")?.[0] ?? (key?.startsWith("stage ") ? parsed.positional[key.split(" ").length] : undefined);
+    let run;
+    if (reference && project) {
+        const rows = context.db.all("SELECT id, workspace_root, run_root FROM runs WHERE project_id = ? AND (id = ? OR short_id = ?)", [project.id, reference, reference]);
+        if (rows.length !== 1)
+            throw new AppError("usage", "Path aliases require one RUN in the selected project", 2, { phase: "prepare", effect: "no_effect" });
+        run = rows[0];
+    }
+    const work = parsed.options.get("parent")?.[0] ?? (key?.startsWith("work ") && !key.startsWith("work repair") ? parsed.positional[key.split(" ").length] : undefined);
+    if (work && project) {
+        const resolved = resolveWorkReference(context, work, { projectId: project.id, ...(run ? { runId: run.id } : {}) });
+        if (!run)
+            run = context.db.get("SELECT id, workspace_root, run_root FROM runs WHERE project_id = ? AND id = ?", [project.id, resolved.run_id]);
+    }
+    return resolveContextualPaths(args, options, { project: projectRoot, workspace: run?.workspace_root, run: run?.run_root });
+}

package/dist/services/compatibility-preflight.js

@@ -1,17 +1,30 @@
 import { AppError } from "../shared/errors.js";
 import { getCliBuildInfo } from "./build-info.js";
 import { classifyCliOperation } from "./cli-operation-classifier.js";
-import { resolveOperationProjectRoot, selectEngine } from "./engines.js";
-export function preflightCliCompatibility(context, args, env = process.env, resolvedProjectRoot) {
+import { parseCommandArgs } from "./lifecycle-command.js";
+export async function preflightCliCompatibility(context, args, env = process.env, resolvedProjectRoot) {
     const classification = classifyCliOperation(args, env);
     if (classification.mode === "router_native") {
         return { ok: true, classification, compatibility: null };
     }
+    // Internal scope-free ownership maintenance has no project compatibility
+    // work. Keep the engine/protocol/canon graph out of that cold path.
+    const parsed = parseCommandArgs(args);
+    if (resolvedProjectRoot === null && parsed.positional[0] === "runtime" && parsed.positional[1] === "process"
+        && !parsed.options.has("project-root") && !parsed.options.has("root"))
+        return { ok: true, classification, compatibility: null };
+    const { resolveOperationProjectRoot, selectEngine, selectBoundExecutingEngine } = await import("./engines.js");
     const projectRoot = resolvedProjectRoot ?? resolveOperationProjectRoot(context, args);
     if (!projectRoot) {
         return { ok: true, classification, compatibility: null };
     }
-    const selection = selectEngine(context, { projectRoot, env }, { allowCurrentInProcess: true }, classification);
+    // Compatibility checks the executing build/manifest identity. Routing and
+    // binding validate snapshot bytes before dispatch; maintenance must not
+    // rehash the dependency closure or spawn health probes on every lease ACK.
+    // Read-only probes may intentionally inspect a copied RUN before its new
+    // executor is bound. Writer authority is neither required nor granted here.
+    const selection = (classification.mode === "read_only_diagnostics" ? null : selectBoundExecutingEngine(context, args, projectRoot, env))
+        ?? selectEngine(context, { projectRoot, env }, { allowCurrentInProcess: true, verifyCurrentContent: false }, classification);
     const compatibility = compatibilityReport(selection, classification);
     if (classification.mode === "read_only_diagnostics" || classification.mode === "mb_upgrade") {
         return { ok: true, classification, compatibility };

package/dist/services/config.js

@@ -28,7 +28,8 @@ export function getProjectConfigStatus(context, project) {
     };
 }
 export function setProjectConfigValue(context, project, input) {
-    const value = parseConfigValue(input.key, input.value);
+    const value = prepareProjectConfigValue(input.key, input.value);
+    migrateLegacyConfig(context, project.id);
     const now = context.now();
     context.db.run(`INSERT INTO project_config (project_id, key, value_json, created_at, updated_at)
      VALUES (?, ?, ?, ?, ?)
@@ -38,13 +39,15 @@ export function setProjectConfigValue(context, project, input) {
     return getProjectConfigStatus(context, project);
 }
 export function readProjectConfig(context, projectId) {
-    // Status and dashboard reads intentionally open SQLite read-only. Legacy
-    // cleanup is a write-side concern and must not make those commands fail.
-    if (context.db.writable)
-        migrateLegacyConfig(context, projectId);
+    // Project legacy values without changing storage. Explicit writes migrate
+    // them; a canonical override always wins over its legacy alias.
+    const rows = configOverrides(context, projectId), keys = new Set(rows.map(row => row.key));
     const config = structuredClone(defaultProjectConfig);
-    for (const row of configOverrides(context, projectId)) {
-        applyConfigValue(config, row.key, JSON.parse(row.value_json));
+    for (const row of rows) {
+        const key = legacyConfigKey(row.key);
+        if (key !== row.key && keys.has(key))
+            continue;
+        applyConfigValue(config, key, JSON.parse(row.value_json));
     }
     return config;
 }
@@ -89,7 +92,7 @@ export function globalDashboardHtmlPath(context) {
 function configOverrides(context, projectId) {
     return context.db.all("SELECT key, value_json, updated_at FROM project_config WHERE project_id = ? ORDER BY key ASC", [projectId]);
 }
-function parseConfigValue(key, value) {
+export function prepareProjectConfigValue(key, value) {
     if (key === "integrations.cmux.mode") {
         if (!cmuxModes.includes(value)) {
             throw new AppError("validation", "--value for integrations.cmux.mode must be off, auto, or required", 2);

package/dist/services/continuation-outcome.js

@@ -0,0 +1,20 @@
+import { AppError } from "../shared/errors.js";
+import { isRegisteredRepair } from "./repair-intents.js";
+import { stageAttempt } from "./stage-work-graph.js";
+/** Only the settled coordinator turn can explain a repeated continuation.
+ * A stale error from another stage/turn or an error followed by success is not
+ * authority. Never inspect the assistant's prose for this decision. */
+export function assertNoCorrelatedRejection(context, scope) {
+    const rows = context.db.all(`SELECT outcome_json FROM hook_events
+    WHERE project_id = ? AND json_extract(outcome_json, '$.run_id') = ?
+    AND json_extract(outcome_json, '$.generation') = ? AND json_extract(outcome_json, '$.stage') = ?
+    AND json_extract(outcome_json, '$.controller_turn') = ? AND json_extract(outcome_json, '$.attempt') = ? ORDER BY id`, [scope.projectId, scope.runId, scope.generation, scope.stage, scope.turn, stageAttempt(context, scope.projectId, scope.runId, scope.stage)]);
+    const latest = new Map();
+    for (const row of rows) {
+        const value = JSON.parse(row.outcome_json);
+        latest.set(JSON.stringify([value.operation, value.session_id ?? null, value.correlation_key ?? value.fingerprint ?? value.work_id ?? null, value.attempt ?? null]), value);
+    }
+    for (const value of latest.values())
+        if (value.error && !isRegisteredRepair(context, value.error.details.continuation, scope))
+            throw new AppError(value.error.code, value.error.message, 1, { ...value.error.details, operation: value.operation, hook_event_id: value.hook_event_id, continuation_scope: scope });
+}

package/dist/services/controller-child-capacity.js

@@ -0,0 +1,13 @@
+/** Only a proven new successful terminal Turn closes a child's retry episode. */
+export function closeSuccessfulChildCapacity(state, children, parentId) {
+    const closed = [];
+    for (const child of children) {
+        const retained = state.child_capacity?.[child.session_id];
+        if (!retained || child.parent_session_id !== parentId || child.provenance === "parent_mismatch"
+            || child.status !== "completed" || !child.terminal_turn_id || child.terminal_turn_id === retained.turn_id)
+            continue;
+        delete state.child_capacity[child.session_id];
+        closed.push(child.session_id);
+    }
+    return closed;
+}

package/dist/services/controller-child-observer.js

@@ -0,0 +1,115 @@
+import fs from "node:fs";
+import { normalizeNativeChildren, safeNativeFailure } from "../harness-runtime/lib/native-children.mjs";
+/** A durable observation is a dispatch fence, not authority to complete Work. */
+export function retainedChildObserver(input) {
+    let active = true, pending;
+    let gap = null;
+    const retained = new Map();
+    const sameScope = (scope) => scope?.controller_id === input.scope.controller_id && scope.generation === input.scope.generation && scope.stage === input.scope.stage && scope.root_session_id === input.scope.root_session_id;
+    const normalized = (child) => {
+        if (!child || child.parent_session_id !== input.scope.root_session_id || child.status !== "failed" || typeof child.terminal_turn_id !== "string" || ![child.session_id, child.terminal_turn_id, child.source].every(value => typeof value === "string" && value.length > 0 && value.length <= 256))
+            throw new Error("native_child_observation_invalid");
+        const provider_error = safeNativeFailure(child.provider_error);
+        return { session_id: child.session_id, parent_session_id: child.parent_session_id, status: "failed", source: child.source, terminal_turn_id: child.terminal_turn_id,
+            ...(typeof child.terminal_observed_at === "string" && Number.isFinite(Date.parse(child.terminal_observed_at)) ? { terminal_observed_at: child.terminal_observed_at } : {}),
+            ...(child.native_source ? { native_source: child.native_source } : {}),
+            ...(child.native_turn_items ? { native_turn_items: {
+                    ...(typeof child.native_turn_items.observed === "boolean" ? { observed: child.native_turn_items.observed } : {}),
+                    ...(typeof child.native_turn_items.possible_effects === "boolean" ? { possible_effects: child.native_turn_items.possible_effects } : {}),
+                    ...(typeof child.native_turn_items.pending === "boolean" ? { pending: child.native_turn_items.pending } : {})
+                } } : {}),
+            ...(provider_error ? { provider_error } : {}) };
+    };
+    const accept = (children) => {
+        for (const raw of children) {
+            const child = normalized(raw);
+            retained.set(`${child.session_id}:${child.terminal_turn_id}`, child);
+        }
+    };
+    if (fs.existsSync(input.file))
+        for (const line of fs.readFileSync(input.file, "utf8").split("\n").filter(Boolean)) {
+            const observation = JSON.parse(line);
+            if (sameScope(observation.scope)) {
+                if (Array.isArray(observation.children))
+                    accept(observation.children);
+                for (const key of observation.resolved ?? [])
+                    retained.delete(key);
+                if (Object.hasOwn(observation, "gap"))
+                    gap = observation.gap ?? null;
+            }
+        }
+    const complete = (children) => {
+        if (!active)
+            return;
+        input.assertOwner();
+        const failed = children.filter(child => child.parent_session_id === input.scope.root_session_id && child.status === "failed" && child.terminal_turn_id && !retained.has(`${child.session_id}:${child.terminal_turn_id}`)).map(normalized);
+        // This is an authoritative current native snapshot. Older failed Turns
+        // remain in the journal/episode history, not in the current-outcome fence.
+        const resolved = [...retained].filter(([, old]) => children.some(child => child.parent_session_id === input.scope.root_session_id
+            && child.provenance !== "parent_mismatch" && child.session_id === old.session_id && ["completed", "failed"].includes(child.status)
+            && child.terminal_turn_id && child.terminal_turn_id !== old.terminal_turn_id)).map(([key]) => key);
+        if (!failed.length && !resolved.length && !gap)
+            return;
+        const fd = fs.openSync(input.file, "a", 0o600);
+        try {
+            fs.writeSync(fd, `${JSON.stringify({ scope: input.scope, children: failed, ...(resolved.length ? { resolved } : {}), gap: null })}\n`);
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        accept(failed);
+        for (const key of resolved)
+            retained.delete(key);
+        gap = null;
+    };
+    return {
+        failed: () => [...retained.values()],
+        gap: () => gap,
+        drain: () => pending ?? Promise.resolve(),
+        observeSettledChildren: complete,
+        completePostTurn(receipt) {
+            const evidence = receipt.evidence;
+            const tree = evidence?.subagents;
+            if (receipt.provider_session_id !== input.scope.root_session_id || receipt.observation_error || evidence?.observation_error || !evidence?.read?.projection || !evidence.read.session || !tree || tree.observation_error || !Array.isArray(tree.running))
+                return false;
+            if (tree.ended ? !Array.isArray(tree.ended.items) || tree.ended.total !== tree.ended.items.length || tree.ended.nextCursor : !Array.isArray(tree.completed))
+                return false;
+            const children = normalizeNativeChildren(receipt, input.scope.root_session_id);
+            if (children.some(child => child.status === "failed" && !child.terminal_turn_id))
+                return false;
+            complete(children);
+            return true;
+        },
+        tick() {
+            if (!active || pending)
+                return;
+            pending = (async () => {
+                const children = await input.read();
+                if (!active || children === null)
+                    return;
+                complete(children);
+            })().catch(error => {
+                if (!active)
+                    return;
+                try {
+                    input.assertOwner();
+                    const code = String(error?.code ?? "observation_unavailable");
+                    gap = /^[\w-]{1,128}$/.test(code) ? code : "observation_unavailable";
+                    const fd = fs.openSync(input.file, "a", 0o600);
+                    try {
+                        fs.writeSync(fd, `${JSON.stringify({ scope: input.scope, gap })}\n`);
+                        fs.fsyncSync(fd);
+                    }
+                    finally {
+                        fs.closeSync(fd);
+                    }
+                }
+                catch { /* Lost owner cannot publish; the gap remains an explicit caller error. */ }
+                input.gap(error);
+            }).finally(() => { pending = undefined; });
+        },
+        // The caller aborts its request; a late reply cannot publish after closure.
+        close() { active = false; return pending ?? Promise.resolve(); },
+    };
+}

package/dist/services/controller-execution.js

@@ -0,0 +1,94 @@
+import path from "node:path";
+import { AppError } from "../shared/errors.js";
+import { FrozenGenericExecution } from "./generic-execution.js";
+import { resolveExecutionPolicy, resolveStageTransition, stageExecutionCwd } from "./execution-policy.js";
+import { readFlowRunExecutionBundle } from "./runs.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+/** Adapt generic routing to shared fanout APIs, not to SDLC settings. No alias,
+ * operator file, merge policy or project default participates in this selection.
+ */
+export function genericControllerRouting(execution, workspaceRoot) {
+    if (!(execution instanceof FrozenGenericExecution) || execution.settings.execution !== "managed") {
+        throw new AppError("controller_execution_invalid", "Managed controller requires managed frozen execution", 1, { effect: "no_effect" });
+    }
+    const snapshot = execution.snapshot();
+    const profiles = Object.fromEntries(snapshot.profiles.map(value => [value.id, structuredClone(value.profile)]));
+    const delegation = { mode: execution.settings.delegation.mode,
+        ...(execution.settings.delegation.mode === "external" ? { max_parallel: execution.settings.delegation.max_parallel } : {}) };
+    const policy = { agent_profile_id: execution.settings.root_profile, delegation,
+        stage_overrides: Object.fromEntries(Object.entries(execution.settings.stage_profiles).map(([stage, id]) => [stage, { agent_profile_id: id }])) };
+    for (const profile of Object.values(profiles))
+        Object.freeze(profile);
+    Object.freeze(profiles);
+    for (const override of Object.values(policy.stage_overrides))
+        Object.freeze(override);
+    Object.freeze(policy.stage_overrides);
+    Object.freeze(delegation);
+    Object.freeze(policy);
+    return {
+        kind: "descriptor", policy, profiles, mergeMode: null,
+        transition(stage, fromStage, _currentRun) {
+            const selected = execution.stage(stage);
+            if (fromStage)
+                execution.stage(fromStage);
+            return { ...resolveExecutionPolicy({ ddFlowHome: "", policy, profiles, stage }), session_mode: selected.session_mode };
+        },
+        cwd(stage, _mergeTargetWorkspace, currentRun) {
+            execution.stage(stage);
+            return path.resolve(currentRun?.workspace_root ?? workspaceRoot ?? snapshot.scope.workspace);
+        }
+    };
+}
+/** Restore execution from RUN authority, never from a generic manifest copy.
+ * Legacy SDLC manifests retain their original settings and routing behavior.
+ */
+export function selectControllerExecution(context, run, manifest) {
+    if (manifest?.schema_id === "dd-flow/run-controller-manifest@2" || ["mb-init", "mb-upgrade"].includes(run.flow_kind) || isDiagnosticFlow(run.flow_kind)) {
+        const bundle = readFlowRunExecutionBundle(context, { projectRoot: run.project_root, runId: run.id });
+        if (!bundle || bundle.descriptor.descriptor.id !== run.flow_kind || bundle.descriptor.descriptor.id === "sdlc")
+            throw new AppError("controller_execution_invalid", "Generic controller requires its retained non-SDLC bundle", 1);
+        const binding = { bundle_sha256: bundle.sha256, descriptor_sha256: bundle.descriptor.sha256, execution_sha256: bundle.execution.sha256 };
+        if (manifest && (manifest.schema_id !== "dd-flow/run-controller-manifest@2" || manifest.execution_profile !== undefined
+            || !manifest.execution_binding || Object.keys(manifest.execution_binding).length !== 3
+            || Object.entries(binding).some(([key, value]) => manifest.execution_binding[key] !== value)
+            || manifest.request?.project_root !== run.project_root || manifest.request?.run_id !== run.id)) {
+            throw new AppError("controller_execution_invalid", "Controller execution binding differs from retained RUN authority", 1);
+        }
+        // Bundle admission has already checked the current RUN workspace against
+        // its trusted relocation receipts; frozen scope remains historical input.
+        return { ...genericControllerRouting(bundle.execution, run.workspace_root), bundle, binding, legacy: undefined };
+    }
+    const index = JSON.parse(run.index_json);
+    const legacy = manifest ? manifest.execution_profile : index.execution_profile;
+    if (!legacy?.settings?.execution || !legacy.agent_profiles)
+        throw new AppError("execution_profile_not_frozen", "Managed launch requires the RUN's frozen execution profiles", 1);
+    const policy = legacy.settings.execution, profiles = legacy.agent_profiles;
+    const bundle = index.execution_bundle ? readFlowRunExecutionBundle(context, { projectRoot: run.project_root, runId: run.id }) : undefined;
+    if (index.execution_bundle && (!bundle || bundle.descriptor.descriptor.id !== "sdlc"))
+        throw new AppError("controller_execution_invalid", "SDLC controller lost its retained bundle authority", 1);
+    if (bundle) {
+        if (legacy.settings.stage_session_mode !== bundle.execution.settings.stage_session_mode)
+            throw new AppError("controller_execution_invalid", "SDLC session policy differs from its retained execution", 1);
+        for (const stage of bundle.descriptor.descriptor.stages) {
+            const selected = resolveExecutionPolicy({ ddFlowHome: context.ddFlowHome, policy, profiles, stage: stage.id });
+            const expected = bundle.execution.work(stage.id, selected.worker.id);
+            if (hybridDigest(selected.coordinator) !== hybridDigest(expected.coordinator) || hybridDigest(selected.worker) !== hybridDigest(expected.worker)
+                || selected.delegation.mode !== expected.delegation.mode
+                || selected.delegation.mode === "external" && selected.delegation.max_parallel !== expected.delegation.max_parallel) {
+                throw new AppError("controller_execution_invalid", "SDLC routing differs from its retained execution", 1, { stage: stage.id });
+            }
+        }
+    }
+    return {
+        kind: "sdlc", policy, profiles, bundle: bundle ?? undefined, binding: undefined, legacy,
+        mergeMode: legacy.settings.merge_mode,
+        transition(stage, fromStage, currentRun = run) {
+            return resolveStageTransition({ ddFlowHome: context.ddFlowHome, policy, profiles, ...(fromStage ? { fromStage } : {}), stage,
+                projectRoot: currentRun.project_root, workspaceRoot: currentRun.workspace_root, stageSessionMode: legacy.settings.stage_session_mode, mergeMode: legacy.settings.merge_mode });
+        },
+        cwd(stage, mergeTargetWorkspace, currentRun = run) {
+            return stageExecutionCwd({ stage, projectRoot: currentRun.project_root, workspaceRoot: currentRun.workspace_root, ...(mergeTargetWorkspace ? { mergeTargetWorkspace } : {}) });
+        }
+    };
+}