@deksden-com/dd-flow-cli 0.9.0-beta.15 → 0.9.0-beta.151

package/dist/verification-components.json

@@ -0,0 +1,299 @@
+{
+  "schema_id": "dd-flow/verification-components@1",
+  "scope": "technical-matrix-publication-not-native-execution",
+  "matrix": {
+    "roots": [
+      "services/verification-matrix.js",
+      "services/stage-report-renderer.js",
+      "services/accepted-intent.js",
+      "services/check-runner-evidence.js",
+      "services/check-runner-proof.js"
+    ],
+    "runner_proof_contract": "dd-flow/check-runner-proof@1",
+    "files": [
+      "cli/command-inputs.js",
+      "cli/command-metadata.js",
+      "cli/command-option-descriptions.js",
+      "cli/help.js",
+      "cli/input-preparation.js",
+      "cli/native-hook-preparation.js",
+      "domain/contracts.js",
+      "domain/diagnostic-aspects.js",
+      "domain/diagnostic-flows.js",
+      "domain/entity-ids.js",
+      "domain/flow-contract.js",
+      "domain/session-coverage.js",
+      "domain/stage-catalog.js",
+      "domain/stage-handler-identities.js",
+      "domain/validation.js",
+      "protocol/local-files.js",
+      "runtime/context.js",
+      "schemas/merge-result.schema.json",
+      "schemas/merge-stage-report-legacy-0.4.2.schema.json",
+      "schemas/merge-stage-report.schema.json",
+      "schemas/plan-aspect-map.schema.json",
+      "schemas/plan-review-decision.schema.json",
+      "schemas/plan-review-result.schema.json",
+      "schemas/plan-stage-report.schema.json",
+      "schemas/protocol-dashboard-data.schema.json",
+      "schemas/protocol-plan.schema.json",
+      "schemas/run-control-receipt.schema.json",
+      "schemas/run-control-request.schema.json",
+      "schemas/run-engine-binding.schema.json",
+      "schemas/stage-finish-input.schema.json",
+      "schemas/stage-prompt.schema.json",
+      "schemas/stage-report.schema.json",
+      "schemas/stage-start-response.schema.json",
+      "services/accepted-intent.js",
+      "services/audit.js",
+      "services/branch-context.js",
+      "services/build-info.js",
+      "services/canon.js",
+      "services/check-environment.js",
+      "services/check-runner-evidence.js",
+      "services/check-runner-proof.js",
+      "services/cli-operation-classifier.js",
+      "services/cli-upgrade-allowlist.js",
+      "services/code-checks.js",
+      "services/command-context.js",
+      "services/config.js",
+      "services/descriptor-coordinator-session.js",
+      "services/descriptor-root-work.js",
+      "services/descriptor-run-settlement.js",
+      "services/descriptor-run-start.js",
+      "services/descriptor-stage-coordinator.js",
+      "services/descriptor-stage-settlement.js",
+      "services/descriptor-stage-start.js",
+      "services/diagnostic-evidence.js",
+      "services/diagnostic-report-publication.js",
+      "services/diagnostic-report.js",
+      "services/diagnostic-snapshot.js",
+      "services/diagnostic-stage-handlers.js",
+      "services/diagnostic-stage-results.js",
+      "services/diagnostic-work-batch.js",
+      "services/diagnostic-work-collection.js",
+      "services/diagnostic-work-registration.js",
+      "services/diagnostic-work-results.js",
+      "services/engines.js",
+      "services/eval-snapshots.js",
+      "services/execution-bundles.js",
+      "services/execution-policy.js",
+      "services/executor-onboarding.js",
+      "services/external-work-launch.js",
+      "services/flow-descriptors.js",
+      "services/flow-guidance.js",
+      "services/frozen-engine.js",
+      "services/generic-execution.js",
+      "services/hook-memory-routing.js",
+      "services/hook-recovery-guard.js",
+      "services/hook-session-observation.js",
+      "services/hooks.js",
+      "services/hybrid-contracts.js",
+      "services/hybrid-digest.js",
+      "services/ids.js",
+      "services/installation-lock.js",
+      "services/installed-flow-source.js",
+      "services/lanes.js",
+      "services/lifecycle-command.js",
+      "services/lifecycle-contract.js",
+      "services/lifecycle-invocations.js",
+      "services/managed-daemon-binding.js",
+      "services/managed-processes.js",
+      "services/memory-accepted-composition.js",
+      "services/memory-baseline-preservation.js",
+      "services/memory-completed-correction-wave.js",
+      "services/memory-compose-handler.js",
+      "services/memory-composition-acceptance.js",
+      "services/memory-composition-graph.js",
+      "services/memory-composition-registration.js",
+      "services/memory-composition-work-custody.js",
+      "services/memory-composition-work-results.js",
+      "services/memory-corrected-review-acceptance.js",
+      "services/memory-corrected-review-batch.js",
+      "services/memory-corrected-review-findings.js",
+      "services/memory-corrected-review-inputs.js",
+      "services/memory-corrected-review-projection.js",
+      "services/memory-corrected-review-receipt.js",
+      "services/memory-corrected-review-registration.js",
+      "services/memory-correction-check-receipt.js",
+      "services/memory-correction-input-owner.js",
+      "services/memory-custody-snapshot.js",
+      "services/memory-discover-handler.js",
+      "services/memory-finish-evidence.js",
+      "services/memory-finish-handler.js",
+      "services/memory-finish-integration.js",
+      "services/memory-finish-readiness.js",
+      "services/memory-git-integration.js",
+      "services/memory-historical-corrected-review.js",
+      "services/memory-historical-original-review.js",
+      "services/memory-historical-repair-registration.js",
+      "services/memory-historical-second-review.js",
+      "services/memory-init-bootstrap-readiness.js",
+      "services/memory-init-engine-release.js",
+      "services/memory-init-git-policy.js",
+      "services/memory-init-lint-capability.js",
+      "services/memory-init-preflight.js",
+      "services/memory-init-project-bootstrap.js",
+      "services/memory-init-request-candidate.js",
+      "services/memory-init-request-input.js",
+      "services/memory-init-resource-storage.js",
+      "services/memory-init-run-allocation.js",
+      "services/memory-init-startup-custody.js",
+      "services/memory-init-storage.js",
+      "services/memory-init-worktrunk-capability.js",
+      "services/memory-layer-publication.js",
+      "services/memory-layer.js",
+      "services/memory-lint-config.js",
+      "services/memory-native-review-copy.js",
+      "services/memory-normal-flow-entry.js",
+      "services/memory-ordinary-defaults.js",
+      "services/memory-permissions.js",
+      "services/memory-preflight-bootstrap-custody.js",
+      "services/memory-preflight-handler.js",
+      "services/memory-repair-current-view.js",
+      "services/memory-repair-document-delta.js",
+      "services/memory-repair-history.js",
+      "services/memory-repair-physical-binding.js",
+      "services/memory-repair-publication-files.js",
+      "services/memory-repair-publication-intent.js",
+      "services/memory-repair-publication-plan.js",
+      "services/memory-repair-publication-source.js",
+      "services/memory-repair-publication.js",
+      "services/memory-repair-registration.js",
+      "services/memory-repair-work-baseline.js",
+      "services/memory-repair-work-completion.js",
+      "services/memory-repair-work-custody.js",
+      "services/memory-repair-work-results.js",
+      "services/memory-repair-workspace.js",
+      "services/memory-repair-writer-copy.js",
+      "services/memory-result-binding.js",
+      "services/memory-retained-review-authority.js",
+      "services/memory-retained-review-results.js",
+      "services/memory-retained-second-baseline.js",
+      "services/memory-retained-second-repairs.js",
+      "services/memory-review-acceptance.js",
+      "services/memory-review-correction-plan.js",
+      "services/memory-review-handler.js",
+      "services/memory-review-inputs.js",
+      "services/memory-review-limits.js",
+      "services/memory-review-receipt.js",
+      "services/memory-review-registration.js",
+      "services/memory-review-work-custody.js",
+      "services/memory-review-work-input.js",
+      "services/memory-review-work-results.js",
+      "services/memory-second-corrected-review-inputs.js",
+      "services/memory-second-correction-plan.js",
+      "services/memory-second-repair-baseline.js",
+      "services/memory-second-repair-launch.js",
+      "services/memory-second-repair-registration.js",
+      "services/memory-second-repair-source.js",
+      "services/memory-second-review-acceptance.js",
+      "services/memory-source-observations.js",
+      "services/memory-stage-dispatch.js",
+      "services/memory-stage-results.js",
+      "services/memory-tool-probe.js",
+      "services/memory-upgrade-analysis-handler.js",
+      "services/memory-upgrade-bootstrap-readiness.js",
+      "services/memory-upgrade-evidence.js",
+      "services/memory-upgrade-inventory.js",
+      "services/memory-upgrade-publication-custody.js",
+      "services/memory-upgrade-publication.js",
+      "services/memory-upgrade-selection.js",
+      "services/memory-upgrade-storage-readiness.js",
+      "services/memory-verification-acceptance.js",
+      "services/memory-verification-checks.js",
+      "services/memory-verification-receipt.js",
+      "services/memory-verify-handler.js",
+      "services/memory-work-result-json.js",
+      "services/memory-work-result-preparation.js",
+      "services/merge-queue.js",
+      "services/migrations.js",
+      "services/native-session-control.js",
+      "services/operator-profiles.js",
+      "services/plan-runtime.js",
+      "services/portable-refs.js",
+      "services/project-registry.js",
+      "services/project-summary.js",
+      "services/projects.js",
+      "services/prompt-delivery.js",
+      "services/protocol-lifecycle.js",
+      "services/protocols.js",
+      "services/provider-capacity.js",
+      "services/recovery-snapshot-database.js",
+      "services/release-archive.js",
+      "services/release-cache.js",
+      "services/release-download.js",
+      "services/release-envelope.js",
+      "services/release-manifest.js",
+      "services/release-payload.js",
+      "services/release-source.js",
+      "services/repair-intents.js",
+      "services/repair-receipt.js",
+      "services/review-copy.js",
+      "services/review-deferral.js",
+      "services/run-control-receipt.js",
+      "services/run-control.js",
+      "services/run-controller-state.js",
+      "services/run-engine-bindings.js",
+      "services/run-observations.js",
+      "services/run-projection.js",
+      "services/run-recovery-guard.js",
+      "services/run-recovery.js",
+      "services/run-start-custody.js",
+      "services/runs.js",
+      "services/runtime-budget.js",
+      "services/runtime-command.js",
+      "services/schema-validation.js",
+      "services/scope-writer-cleanup.js",
+      "services/session-identity.js",
+      "services/sessions.js",
+      "services/setup.js",
+      "services/stage-context.js",
+      "services/stage-handlers.js",
+      "services/stage-lifecycle.js",
+      "services/stage-pause.js",
+      "services/stage-report-renderer.js",
+      "services/stage-work-graph.js",
+      "services/tooling.js",
+      "services/usage.js",
+      "services/verification-matrix.js",
+      "services/version-status.js",
+      "services/vnext-code-review.js",
+      "services/vnext-code.js",
+      "services/vnext-contracts.js",
+      "services/vnext-execution-profile.js",
+      "services/vnext-fanout.js",
+      "services/vnext-merge.js",
+      "services/vnext-plan-review.js",
+      "services/vnext-plan.js",
+      "services/vnext-protocolize.js",
+      "services/vnext-specify.js",
+      "services/vnext-workspace-policy.js",
+      "services/work-registry.js",
+      "services/workspace-bootstrap.js",
+      "services/workspace-files.js",
+      "services/worktrees.js",
+      "shared/entity-references.js",
+      "shared/errors.js",
+      "shared/json.js",
+      "storage/agent-output.js",
+      "storage/database.js",
+      "storage/foreign-key-transaction.js",
+      "storage/immutable-input.js",
+      "storage/import-guard.js",
+      "storage/native-cleanup.js",
+      "storage/paths.js",
+      "storage/projection-lock.js",
+      "storage/work-references.js",
+      "storage/writer-contract.js"
+    ],
+    "dependencies": [
+      "ajv/dist/2020.js",
+      "ajv/dist/ajv.js",
+      "semver",
+      "shell-quote",
+      "smol-toml",
+      "yaml"
+    ]
+  }
+}

package/package.json

@@ -1,10 +1,17 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.15",
+  "version": "0.9.0-beta.151",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
+  "packageManager": "pnpm@10.23.0",
   "bin": {
-    "dd-flow": "./dist/cli.js"
+    "dd-flow": "dist/cli.js",
+    "dd-codex": "dist/harness-runtime/bin/dd-codex.mjs",
+    "dd-zcode": "dist/harness-runtime/bin/dd-zcode.mjs",
+    "dd-grok": "dist/harness-runtime/bin/dd-grok.mjs",
+    "dd-opencode": "dist/harness-runtime/bin/dd-opencode.mjs",
+    "dd-agy": "dist/harness-runtime/bin/dd-agy.mjs",
+    "dd-droid": "dist/harness-runtime/bin/dd-droid.mjs"
   },
   "files": [
     "dist",
@@ -16,32 +23,63 @@
     "node": ">=26.0.0",
     "pnpm": ">=10.0.0"
   },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && node scripts/generate-build-info.mjs && node scripts/copy-assets.mjs && node scripts/generate-verification-components.mjs",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint . --max-warnings=0",
+    "test": "node scripts/verification.mjs run",
+    "gate:merge": "node scripts/verification.mjs run",
+    "verify:plan": "node scripts/verification.mjs plan",
+    "test:verification": "node --test --test-concurrency=1 scripts/verification-policy.test.mjs scripts/generate-verification-components.test.mjs",
+    "test:hybrid": "node --import ./scripts/source-test-loader.mjs --test --test-concurrency=1 scripts/hybrid-contracts.test.mjs",
+    "test:hybrid:canon": "node --import ./scripts/source-test-loader.mjs --test --test-concurrency=1 scripts/hybrid-canon.test.mjs scripts/hybrid-inventory.test.mjs scripts/hybrid-consumers.test.mjs scripts/hybrid-schema-copies.test.mjs scripts/verify-e3-canon.test.mjs",
+    "test:e2": "node --import ./scripts/source-test-loader.mjs --test --test-concurrency=1 scripts/e2-*.test.mjs",
+    "test:e2:installed": "node --test scripts/verify-e2-built-cli.test.mjs scripts/verify-e2-installed-cli.test.mjs",
+    "test:e3": "node --import ./scripts/source-test-loader.mjs --test --test-concurrency=1 scripts/e3-*.test.mjs",
+    "test:e4": "node --import ./scripts/source-test-loader.mjs --test --test-concurrency=1 scripts/e4-*.test.mjs",
+    "test:e3:canon": "node --import ./scripts/source-test-loader.mjs --test scripts/verify-e3-canon.test.mjs",
+    "test:release": "node --test scripts/verify-release-build.test.mjs && vitest run --project=release",
+    "test:release:build": "node --test --test-concurrency=1 scripts/verify-release-build.test.mjs scripts/verify-e2-built-cli.test.mjs scripts/verify-e2-installed-cli.test.mjs",
+    "test:integration": "vitest run --project='integration-*'",
+    "test:fast": "vitest run --project=integration-fast",
+    "test:core": "vitest run --project='integration-core-*'",
+    "test:flow": "vitest run --project=integration-flow",
+    "test:runtime-sensitive": "vitest run --project=runtime-sensitive",
+    "changeset": "changeset",
+    "version-packages": "changeset version",
+    "release:candidate:pack": "node scripts/release-candidate.mjs pack",
+    "release:candidate:accept": "node scripts/release-candidate.mjs accept",
+    "release:publish": "node scripts/publish-release.mjs",
+    "release:hybrid:produce": "node tools/produce-hybrid-release.mjs",
+    "release:canon:archive": "node tools/create-canon-release.mjs"
+  },
   "devDependencies": {
+    "@bufbuild/protoc-gen-es": "2.16.0",
     "@changesets/cli": "^2.31.0",
     "@eslint/js": "^9.39.1",
+    "@opencode/client": "2.0.28",
+    "@opencode/plugin": "2.0.28",
     "@types/node": "^24.10.1",
+    "@types/semver": "7.8.0",
     "eslint": "^9.39.1",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.47.0",
     "vitest": "^4.0.13"
   },
   "dependencies": {
+    "@bufbuild/protobuf": "2.16.0",
+    "@grpc/grpc-js": "1.14.6",
     "ajv": "^8.20.0",
+    "jsonc-parser": "3.3.1",
+    "semver": "7.8.1",
     "shell-quote": "^1.10.0",
     "smol-toml": "^1.6.1",
+    "tree-sitter": "0.25.1",
+    "tree-sitter-bash": "0.25.1",
     "yaml": "^2.9.0"
   },
   "publishConfig": {
     "access": "public"
   },
-  "license": "MIT",
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json && node scripts/generate-build-info.mjs && node scripts/copy-assets.mjs",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint . --max-warnings=0",
-    "test": "vitest run",
-    "changeset": "changeset",
-    "version-packages": "changeset version",
-    "release": "pnpm run build && changeset publish"
-  }
-}
+  "license": "MIT"
+}

package/tools/create-canon-release.mjs

@@ -0,0 +1,33 @@
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { createHash, randomUUID } from "node:crypto";
+import { produceCanonArchive } from "../dist/services/release-provenance.js";
+
+const args = process.argv.slice(2), names = ["canon-root", "commit", "output"];
+if (args.includes("--help") || args.includes("-h")) {
+  process.stdout.write("Usage: node tools/create-canon-release.mjs --canon-root <checkout> --commit <40-hex-commit> --output <new-archive.tgz>\nCreates an immutable Git-object archive with reviewed aliases materialized. Does not publish or qualify a release.\n");
+} else {
+  let temporary;
+  let ownsTemporary = false;
+  try {
+    const options = new Map();
+    for (let index = 0; index < args.length; index += 2) {
+      const name = args[index]?.slice(2), value = args[index + 1];
+      if (!args[index]?.startsWith("--") || !names.includes(name) || options.has(name) || !value || value.startsWith("--")) throw new Error("invalid arguments");
+      options.set(name, value);
+    }
+    if (names.some(name => !options.has(name))) throw new Error("missing arguments");
+    const bytes = produceCanonArchive(options.get("canon-root"), options.get("commit"));
+    const output = path.resolve(options.get("output"));
+    temporary = path.join(path.dirname(output), `.canon-archive-${randomUUID()}.tmp`);
+    const fd = fs.openSync(temporary, "wx", 0o600);
+    ownsTemporary = true;
+    try { fs.writeFileSync(fd, bytes); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
+    fs.linkSync(temporary, output); // Atomic no-replace publication, including dangling symlink targets.
+    process.stdout.write(`${JSON.stringify({ ok: true, commit: options.get("commit"), output, bytes: bytes.length, sha256: createHash("sha256").update(bytes).digest("hex") })}\n`);
+  } catch {
+    process.stderr.write("Canonical archive production refused; check committed source and a new output path.\n");
+    process.exitCode = 1;
+  } finally { if (temporary && ownsTemporary) fs.rmSync(temporary, { force: true }); }
+}

package/tools/probe-codex-history.mjs

@@ -0,0 +1,37 @@
+/* global console */
+// Explicit non-generative contract probe. Never uses the operator's Codex home.
+import { mkdtemp, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { CodexBridge, codexReadPhase, readCodexHistory, readCodexRpc } from "../dist/harness-runtime/lib/dd-codex.mjs";
+import { errorRecord } from "../dist/harness-runtime/lib/operation-errors.mjs";
+
+const bin = process.argv[2];
+if (!bin || !path.isAbsolute(bin)) throw new Error("Usage: node tools/probe-codex-history.mjs /absolute/native/codex");
+const home = await mkdtemp(path.join(os.tmpdir(), "dd-codex-history-"));
+await writeFile(path.join(home, "config.toml"), "[features]\nplugins = false\nremote_models = false\n");
+const bridge = new CodexBridge({ bin, cwd: home, journal: path.join(home, "native.jsonl"),
+  env: { ...Object.fromEntries(Object.keys(process.env).map(key => [key, undefined])),
+    PATH: process.env.PATH, HOME: home, CODEX_HOME: home, CODEX_SQLITE_HOME: home, CODEX_LOG_DIR: home } });
+const report = { home, non_generative: true, reads: [] };
+try {
+  await bridge.start();
+  const created = await bridge.request("thread/start", { cwd: home, ephemeral: false, approvalPolicy: "never", sandbox: "read-only" });
+  report.session_id = created.thread.id;
+  report.history_mode = created.thread.historyMode;
+  const phase = codexReadPhase(bridge);
+  const compact = await readCodexRpc(bridge, "thread/read", { threadId: report.session_id, includeTurns: false }, phase);
+  report.compact = { id: compact.thread.id, status: compact.thread.status };
+  for (const method of ["thread/turns/list", "thread/read"]) {
+    const read = await readCodexHistory(bridge, method, { threadId: report.session_id,
+      ...(method === "thread/read" ? { includeTurns: true } : { limit: 20, itemsView: "summary" }) }, phase);
+    report.reads.push({ method, available: read.available, ...(read.error ? { error: read.error } : {}) });
+  }
+} catch (error) { report.error = errorRecord(error); process.exitCode = 1; }
+finally {
+  try { await bridge.close(); }
+  catch (error) { report.cleanup_error = errorRecord(error); process.exitCode = 1; }
+  await writeFile(path.join(home, "result.json"), JSON.stringify(report, null, 2) + "\n");
+}
+console.log(JSON.stringify(report, null, 2));

package/tools/produce-hybrid-release.mjs

@@ -0,0 +1,41 @@
+import { createPrivateKey } from "node:crypto";
+import { Buffer } from "node:buffer";
+import process from "node:process";
+import { publishReleaseBundle } from "../dist/services/release-producer.js";
+import { readBoundedReleaseFile } from "../dist/services/release-source.js";
+import { createReleaseCompatibility, installedCatalogVersions } from "../dist/services/release-compatibility.js";
+import { getCliVersionReport } from "../dist/services/build-info.js";
+import { verifyProducerSource, verifyCanonArchiveSource } from "../dist/services/release-provenance.js";
+
+const names = ["payload-file", "canon-root", "canon-archive", "engine-archive", "key-file", "output", "channel"];
+const args = process.argv.slice(2);
+if (args.includes("--help") || args.includes("-h")) {
+  process.stdout.write(`Produce an immutable local signed release bundle from existing qualification evidence.\nUsage: node tools/produce-hybrid-release.mjs ${names.map(name => `--${name} <value>`).join(" ")}\nThis does not publish remotely or qualify a route. Private keys never enter the output.\n`);
+} else {
+  try {
+    const options = new Map();
+    for (let index = 0; index < args.length; index += 2) {
+      const name = args[index]?.slice(2), value = args[index + 1];
+      if (!args[index]?.startsWith("--") || !names.includes(name) || options.has(name) || !value || value.startsWith("--")) throw new Error("invalid arguments");
+      options.set(name, value);
+    }
+    if (names.some(name => !options.has(name))) throw new Error("missing arguments");
+    const compatibility = createReleaseCompatibility({ channel: options.get("channel"), catalogVersions: installedCatalogVersions, routerVersion: getCliVersionReport().cli.version });
+    const payload = JSON.parse(readBoundedReleaseFile(options.get("payload-file"), 16 * 1024 * 1024).toString("utf8"));
+    const manifest = JSON.parse(Buffer.from(payload.manifest_base64, "base64").toString("utf8"));
+    verifyProducerSource(options.get("canon-root"), payload.source, manifest.canon.version);
+    const canonArchive = readBoundedReleaseFile(options.get("canon-archive"), 256 * 1024 * 1024);
+    verifyCanonArchiveSource(options.get("canon-root"), payload.source.commit, manifest.canon.archive, canonArchive);
+    const result = publishReleaseBundle(options.get("output"), {
+      payload,
+      privateKey: createPrivateKey(readBoundedReleaseFile(options.get("key-file"), 64 * 1024)), compatibility,
+      canonArchive,
+      engineArchive: readBoundedReleaseFile(options.get("engine-archive"), 256 * 1024 * 1024)
+    });
+    process.stdout.write(`${JSON.stringify({ ok: true, ...result })}\n`);
+  } catch {
+    // Key/parser/network excerpts must never appear in producer diagnostics.
+    process.stderr.write("Release production refused; check explicit inputs and qualification evidence.\n");
+    process.exitCode = 1;
+  }
+}

package/tools/repair-paused-run-status.mjs

@@ -0,0 +1,84 @@
+#!/usr/bin/env node
+/* global process, console */
+// Explicit repair of legacy fenced RUN projections; no migrations or process control.
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { parseArgs } from 'node:util';
+import { createContext } from '../dist/runtime/context.js';
+import { appendFlowRunTimelineEvent, gitFacts, publishRunProjections } from '../dist/services/runs.js';
+import { appendAudit } from '../dist/services/audit.js';
+
+const { values } = parseArgs({ options: { home: { type: 'string' }, run: { type: 'string' }, project: { type: 'string' }, apply: { type: 'boolean', default: false }, 'cancel-abandoned': { type: 'boolean', default: false } } });
+if (!values.home || !values.run || !values.project) throw new Error('Usage: --home <runtime> --project <project-id> --run <run-id> [--apply]');
+const home = fs.realpathSync(values.home);
+const context = createContext({ ...process.env, DD_FLOW_HOME: home }, values.apply ? 'hook' : 'read_existing');
+const db = context.db;
+let runtimePath, original, backup, report;
+try {
+  const run = db.get('SELECT * FROM runs WHERE project_id=? AND id=?', [values.project, values.run]);
+  if (!run) throw new Error('RUN not found');
+  const guard = db.get('SELECT * FROM run_recovery_guards WHERE project_id=? AND run_id=? ORDER BY generation DESC LIMIT 1', [values.project, values.run]);
+  const cancel = values['cancel-abandoned'];
+  if (cancel) {
+    if (fs.existsSync(run.project_root)) throw new Error('Abandoned-fixture cancellation requires an absent project directory');
+    for (const table of ['works', 'sessions', 'run_controllers']) {
+      if (!db.get("SELECT 1 FROM sqlite_schema WHERE type='table' AND name=?", [table])) continue;
+      if (db.get(`SELECT 1 FROM ${table} WHERE project_id=? AND run_id=? LIMIT 1`, [values.project, values.run])) throw new Error('Abandoned-fixture cancellation requires no Work, Session or controller history');
+    }
+    if (guard) throw new Error('A recovery-owned RUN requires recovery reconciliation');
+  }
+  if (!cancel && !["draining", "sealed", "resuming"].includes(guard?.status)) throw new Error("Repair requires the current recovery to fence productive admission");
+  if (run.status !== 'running') {
+    report = { run_id: run.id, status: run.status, changed: false };
+  } else {
+    runtimePath = fs.realpathSync(run.runtime_path);
+    const relative = path.relative(home, runtimePath);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) throw new Error('Runtime file is outside the selected home');
+    original = fs.readFileSync(runtimePath);
+    if (JSON.parse(original).status !== 'running' || JSON.parse(run.index_json).status !== 'running') throw new Error('RUN projections disagree; manual review required');
+    if (values.apply) {
+      backup = `${runtimePath}.status-repair-${crypto.randomUUID()}.json`;
+      fs.writeFileSync(backup, JSON.stringify({ recovery_id: guard?.recovery_id ?? null, row: run, runtime: original.toString('utf8') }), { flag: 'wx', mode: 0o600 });
+      const git = cancel ? gitFacts(run.workspace_root) : null;
+      db.writeTransaction(() => {
+        const current = db.get('SELECT * FROM runs WHERE project_id=? AND id=?', [values.project, values.run]);
+        const currentGuard = db.get('SELECT * FROM run_recovery_guards WHERE project_id=? AND run_id=? ORDER BY generation DESC LIMIT 1', [values.project, values.run]);
+        if (!current || current.status !== 'running' || current.index_json !== run.index_json || current.runtime_path !== run.runtime_path) throw new Error('RUN changed after repair preparation');
+        if (cancel) {
+          if (currentGuard) throw new Error('A recovery-owned RUN requires recovery reconciliation');
+          for (const table of ['works', 'sessions', 'run_controllers']) {
+            if (db.get("SELECT 1 FROM sqlite_schema WHERE type='table' AND name=?", [table]) && db.get(`SELECT 1 FROM ${table} WHERE project_id=? AND run_id=? LIMIT 1`, [values.project, values.run])) throw new Error('Abandoned-fixture cancellation requires no Work, Session or controller history');
+          }
+        } else if (!currentGuard || currentGuard.recovery_id !== guard.recovery_id || currentGuard.generation !== guard.generation || currentGuard.status !== guard.status) throw new Error('Recovery guard changed after repair preparation');
+        const index = JSON.parse(current.index_json), now = context.now();
+        if (index.status !== 'running') throw new Error('RUN index changed after repair preparation');
+        index.status = cancel ? 'cancelled' : 'paused';
+        index.updated_at = now;
+        index.runtime_revision = (index.runtime_revision ?? 0) + 1;
+        if (cancel) {
+          for (const stage of index.stage_runs) if (['running', 'pending', 'paused', 'blocked'].includes(stage.status)) {
+            stage.status = 'skipped'; stage.updated_at = now; stage.completed_at = now;
+            const elapsed = Date.parse(now) - Date.parse(stage.started_at ?? '');
+            stage.duration_ms = Number.isFinite(elapsed) && elapsed >= 0 ? elapsed : null;
+          }
+          if (!['vnext_specify', 'vnext_protocolize'].includes(index.flow_kind)) index.attempts = index.stage_runs.map(stage => ({ stage: stage.stage, attempt_number: Number((stage.attempt ?? 'try-001').replace('try-', '')) || 1, root: stage.dir, archive: null, status: stage.status, started_at: stage.started_at ?? now, finished_at: stage.completed_at ?? null }));
+          index.verdict = 'cancelled'; index.next_action = null; index.completed_at = now; index.finished_at = now;
+          const elapsed = Date.parse(now) - Date.parse(index.started_at ?? current.created_at);
+          index.duration_ms = Number.isFinite(elapsed) && elapsed >= 0 ? elapsed : null;
+          index.execution = { project_root: index.execution?.project_root ?? current.project_root, workspace_root: index.execution?.workspace_root ?? current.workspace_root, git };
+        }
+        const updated = db.run('UPDATE runs SET status=?, verdict=?, next_action=?, index_json=?, updated_at=?, completed_at=? WHERE project_id=? AND id=? AND status=? AND index_json=?', [index.status, index.verdict, index.next_action, JSON.stringify(index), now, index.completed_at ?? null, values.project, values.run, 'running', current.index_json]);
+        if (updated.changes !== 1) throw new Error('RUN changed before repair commit');
+        if (cancel) {
+          const reason = 'Operator requested cleanup of abandoned fixture: project removed; no Work, Session or controller history.';
+          appendAudit(context, { projectId: values.project, eventType: 'flow_run.manual_override', payload: { run_id: run.id, status: 'cancelled', verdict: 'cancelled', next_action: null, reason } });
+          appendFlowRunTimelineEvent(context, values.project, run.id, { at: now, type: 'run_manual_override', status: 'cancelled', reason });
+        }
+        if (!cancel) db.afterCommit(() => publishRunProjections(context, values.project, run.id));
+      }, 'repair-paused-run-status');
+    }
+    report = { run_id: run.id, from: 'running', to: cancel ? 'cancelled' : 'paused', recovery_id: guard?.recovery_id ?? null, applied: values.apply, backup };
+  }
+  console.log(JSON.stringify(report));
+} finally { db.close(); }