@deksden-com/dd-flow-cli 0.9.0-beta.151 → 0.9.0-beta.155

package/dist/services/descriptor-stage-settlement.js

@@ -17,6 +17,7 @@ import { appendAudit } from "./audit.js";
 import { prepareStagePacket, acceptStagePacket, publishStagePacket, readAcceptedStageData } from "./stage-report-renderer.js";
 import { assertStageSettlementAllowed } from "./run-recovery.js";
 import { refreshRunSessionProjection } from "./run-projection.js";
+import { currentAssignedLifecycle, assertAssignedSettlementCurrent, hasAssignedCoordinatorLaunch } from "./assigned-lifecycle.js";
 const event = "flow_run.descriptor_stage_settlement";
 const hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
 function refuse(reason) { throw new AppError("descriptor_stage_settlement_invalid", "Stage settlement lacks exact coordinator and result custody", 1, { reason, effect: "no_effect" }); }
@@ -26,10 +27,10 @@ function receipts(context, scope, kind) {
         refuse("ambiguous_receipt");
     return rows[0] ? JSON.parse(rows[0].payload_json) : null;
 }
-function owner(context, scope, bundle, finishKey, matchKeys) {
+function coordinatorOwner(context, scope, bundle, historicalRead = false) {
     const prior = receipts(context, scope, event);
     const input = readDescriptorStageInput(context, scope, bundle, true, prior !== null), root = readDescriptorRootWork(context, scope, bundle);
-    const closedTerminal = prior && root.status === "completed" && bundle.descriptor.descriptor.terminal_stages.includes(scope.stage)
+    const closedTerminal = prior && root.status === "completed" && (historicalRead || bundle.descriptor.descriptor.terminal_stages.includes(scope.stage))
         && context.db.get("SELECT 1 FROM runs WHERE project_id=? AND id=? AND status='done'", [scope.projectId, scope.runId]);
     if (root.status !== "running" && !closedTerminal || !stageWorkIds(context, scope.projectId, scope.runId, scope.stage).has(root.workId))
         refuse("root_not_active");
@@ -67,13 +68,50 @@ function owner(context, scope, bundle, finishKey, matchKeys) {
     const promptPath = path.join(input.runRoot, bundle.descriptor.stage(scope.stage).directory, "coordinator-prompt.md");
     if (link.prompt_path !== promptPath)
         refuse("prompt_link_changed");
-    const prompts = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type='flow_run.stage_packet' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.stage')=? AND json_extract(payload_json,'$.file')=? LIMIT 2", [scope.projectId, scope.runId, scope.stage, promptPath]);
-    if (prompts.length !== 1 || Buffer.byteLength(prompts[0].payload_json) > 6 * 1024 * 1024)
+    const prompts = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type='flow_run.stage_packet' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.stage')=? AND json_extract(payload_json,'$.file')=? AND json_extract(payload_json,'$.attempt')=? AND json_extract(payload_json,'$.sha256')=?", [scope.projectId, scope.runId, scope.stage, promptPath, input.attempt, association.binding.prompt_sha256]);
+    if (!prompts.length)
         refuse("prompt_custody_missing");
-    const prompt = JSON.parse(prompts[0].payload_json), promptBytes = Buffer.from(prompt.base64, "base64");
-    if (prompt.attempt !== input.attempt || prompt.sha256 !== association.binding.prompt_sha256 || hash(promptBytes) !== prompt.sha256 || promptBytes.toString("base64") !== prompt.base64)
-        refuse("prompt_custody_changed");
+    let promptBytes;
+    for (const row of prompts) {
+        const prompt = JSON.parse(row.payload_json), bytes = Buffer.from(prompt.base64, "base64");
+        if (hash(bytes) !== prompt.sha256 || bytes.toString("base64") !== prompt.base64 || promptBytes && !promptBytes.equals(bytes))
+            refuse("prompt_custody_changed");
+        promptBytes = bytes;
+    }
     const start = context.db.get("SELECT daemon_id,session_id,harness,provider_session_id FROM hook_events WHERE project_id=? AND event_key=? AND status='claimed' AND event_name='PreToolUse'", [scope.projectId, link.hook_event_id]);
+    if (start ? start.session_id !== link.session_id || start.harness !== session.harness || start.provider_session_id !== session.provider_session_id
+        : !hasAssignedCoordinatorLaunch(context, { ...scope, workSessionId: link.id, sessionId: link.session_id }))
+        refuse("start_owner_mismatch");
+    return { input, root, link, session, binding, association, promptPath, prior, start };
+}
+/** SQL-only current author identity. This proves the registered coordinator,
+ * exact prompt, physical binding and claimed or assigned start, not output approval,
+ * permission to publish, or Stage completion. No Session is allocated here. */
+export function readActiveDescriptorStageCoordinator(context, input, bundle) {
+    const scope = { projectId: input.projectId, runId: input.runId, stage: input.stage };
+    const selected = coordinatorOwner(context, scope, bundle);
+    if (selected.prior)
+        refuse("coordinator_already_settled");
+    if (!selected.session.harness || !selected.session.provider_session_id)
+        refuse("physical_owner_missing");
+    return { work_id: selected.root.workId, work_session_id: selected.link.id, session_id: selected.link.session_id,
+        harness: selected.session.harness, provider_session_id: selected.session.provider_session_id,
+        start_hook: selected.link.hook_event_id, association_sha256: hybridDigest(selected.association),
+        physical_binding_sha256: hybridDigest(selected.binding), prompt_path: selected.promptPath };
+}
+function owner(context, scope, bundle, finishKey, matchKeys, historicalRead = false) {
+    const { input, root, link, session, binding, association, promptPath, prior, start } = coordinatorOwner(context, scope, bundle, historicalRead);
+    const assignedId = prior?.binding?.assignedInvocationId;
+    const saved = assignedId && context.db.get("SELECT admission_json,status FROM lifecycle_invocations WHERE id=?", [assignedId]);
+    const assigned = prior
+        ? saved && saved.status === "settled" && saved.admission_json ? JSON.parse(saved.admission_json) : null
+        : currentAssignedLifecycle(context);
+    if (assigned && assigned.work_session_id === link.id && assigned.operation === "stage_finish" && assigned.scope.runId === scope.runId && assigned.stage === scope.stage) {
+        return { input, workId: root.workId, workSessionId: link.id, sessionId: link.session_id,
+            startHook: link.hook_event_id, finishKey: null, finishId: null, finishDaemon: assigned.scope.daemonId,
+            assignedInvocationId: assigned.invocation_id, associationSha256: hybridDigest(association), physicalBindingSha256: hybridDigest(binding),
+            promptPath, prior, linkResultPath: link.result_path };
+    }
     const finish = context.db.get("SELECT id,daemon_id,session_id,harness,provider_session_id,match_key,status FROM hook_events WHERE project_id=? AND event_key=? AND event_name='PreToolUse'", [scope.projectId, finishKey]);
     if (!start || !finish || finish.status !== (prior ? "claimed" : "observed")
         || start.session_id !== link.session_id || finish.session_id !== link.session_id
@@ -83,13 +121,14 @@ function owner(context, scope, bundle, finishKey, matchKeys) {
         refuse("finish_owner_mismatch");
     return { input, workId: root.workId, workSessionId: link.id, sessionId: link.session_id,
         startHook: link.hook_event_id, finishKey, finishId: finish.id, finishDaemon: finish.daemon_id,
-        associationSha256: hybridDigest(association), physicalBindingSha256: hybridDigest(binding),
+        assignedInvocationId: undefined, associationSha256: hybridDigest(association), physicalBindingSha256: hybridDigest(binding),
         promptPath, prior, linkResultPath: link.result_path };
 }
 function stableOwner(value) {
     return { input: value.input, workId: value.workId, workSessionId: value.workSessionId, sessionId: value.sessionId,
         startHook: value.startHook, finishKey: value.finishKey, finishId: value.finishId, finishDaemon: value.finishDaemon,
-        associationSha256: value.associationSha256, physicalBindingSha256: value.physicalBindingSha256, promptPath: value.promptPath };
+        associationSha256: value.associationSha256, physicalBindingSha256: value.physicalBindingSha256, promptPath: value.promptPath,
+        ...(value.assignedInvocationId ? { assignedInvocationId: value.assignedInvocationId } : {}) };
 }
 /** SQL-only accepted terminal custody reader, also after root closure. Match
  * keys must be prepared outside the writer because lifecycle key preparation
@@ -100,16 +139,17 @@ export function readAcceptedDescriptorStageSettlement(context, input, bundle, ma
     // the retained coordinator binding; source/policy owners are not scope keys.
     const scope = { projectId: input.projectId, runId: input.runId, stage: input.stage };
     const receipt = receipts(context, scope, event);
-    if (!receipt || typeof receipt.binding?.finishKey !== "string")
+    if (!receipt || typeof receipt.binding?.finishKey !== "string" && typeof receipt.binding?.assignedInvocationId !== "string")
         refuse("settlement_receipt_missing");
-    const selected = owner(context, scope, bundle, receipt.binding.finishKey, matchKeys);
+    const selected = owner(context, scope, bundle, receipt.binding.finishKey, matchKeys, true);
     const data = readAcceptedStageData(context, scope);
     const expected = { run_id: scope.runId, stage: scope.stage, work_id: selected.workId, work_session_id: selected.workSessionId, binding: {
             workId: selected.workId, workSessionId: selected.workSessionId, sessionId: selected.sessionId, startHook: selected.startHook,
             finishKey: selected.finishKey, finishId: selected.finishId, finishDaemon: selected.finishDaemon,
             associationSha256: selected.associationSha256, physicalBindingSha256: selected.physicalBindingSha256, promptPath: selected.promptPath,
             scope, attempt: selected.input.attempt, input_sha256: selected.input.inputSha256, bundle_sha256: bundle.sha256,
-            result_sha256: data.result.sha256, result_path: selected.linkResultPath, data_schema_id: data.data_schema_id
+            result_sha256: data.result.sha256, result_path: selected.linkResultPath, data_schema_id: data.data_schema_id,
+            ...(selected.assignedInvocationId ? { assignedInvocationId: selected.assignedInvocationId } : {})
         } };
     if (hybridDigest(expected) !== hybridDigest(receipt) || data.input_sha256 !== selected.input.inputSha256)
         refuse("settlement_changed");
@@ -168,8 +208,12 @@ export class PreparedDescriptorStageSettlement {
             finishKey: value.finishKey, finishId: value.finishId, finishDaemon: value.finishDaemon,
             associationSha256: value.associationSha256, physicalBindingSha256: value.physicalBindingSha256, promptPath: value.promptPath,
             scope: this.#scope, attempt: value.input.attempt, input_sha256: value.input.inputSha256, bundle_sha256: this.#bundle.sha256,
-            result_sha256: this.#packet.sha256, result_path: this.#packet.file, data_schema_id: this.#schemaId };
+            result_sha256: this.#packet.sha256, result_path: this.#packet.file, data_schema_id: this.#schemaId,
+            ...(value.assignedInvocationId ? { assignedInvocationId: value.assignedInvocationId } : {}) };
     }
+    /** Identity already admitted against physical hook/coordinator custody.
+     * A family may compare it with a prior writer; this grants no settlement. */
+    coordinatorSessionId() { return this.#owner.sessionId; }
     /** The optional handler fence must be SQL-only, prepared before this call.
      * It keeps bootstrap/check/reviewer custody in the same acceptance writer.
      */
@@ -197,7 +241,8 @@ export class PreparedDescriptorStageSettlement {
             const activeChildren = [...stageWorkIds(context, this.#scope.projectId, this.#scope.runId, this.#scope.stage)].filter(id => id !== this.#owner.workId && context.db.get("SELECT 1 FROM works WHERE work_id=? AND status IN ('created','running','paused')", [id]));
             if (activeChildren.length)
                 refuse("stage_children_active");
-            if (context.db.run("UPDATE hook_events SET status='claimed',claimed_at=? WHERE id=? AND status='observed'", [context.now(), this.#owner.finishId]).changes !== 1)
+            assertAssignedSettlementCurrent(context, this.#owner.workSessionId);
+            if (this.#owner.finishId !== null && context.db.run("UPDATE hook_events SET status='claimed',claimed_at=? WHERE id=? AND status='observed'", [context.now(), this.#owner.finishId]).changes !== 1)
                 refuse("finish_claim_changed");
             acceptStagePacket(context, { ...this.#scope, prepared: this.#packet });
             completeFlowRunStage(context, { projectRoot: this.#completion.run.project_root, runId: this.#scope.runId, stage: this.#scope.stage, status: "done", data: "result.json", dataSchemaId: this.#schemaId, dataSha256: this.#packet.sha256 }, this.#completion);

package/dist/services/diagnostic-repair-intake.js

@@ -0,0 +1,123 @@
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+import { resolveProjectRoot } from "../storage/paths.js";
+import { requireProjectByRoot } from "./projects.js";
+import { readFlowRunExecutionBundle, resolveRun } from "./runs.js";
+import { readAcceptedStageData, resolveStagePublicationPath } from "./stage-report-renderer.js";
+import { selectDiagnosticFindings } from "./diagnostic-report.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { assertMemoryRepairWritePaths } from "./memory-review-correction-plan.js";
+import { readMemoryFlowUserInputs } from "./memory-flow-user-inputs.js";
+function refuse(reason) {
+    throw new AppError("repair_source_invalid", "Repair intake requires a completed diagnostic RUN and its accepted report", 2, { reason, effect: "no_effect" });
+}
+export function readDiagnosticRepairIntake(context, input) {
+    return context.db.readSnapshot(() => {
+        try {
+            return readIntake(context, input);
+        }
+        catch (error) {
+            if (error instanceof SyntaxError || error instanceof TypeError)
+                refuse("malformed_source_custody");
+            throw error;
+        }
+    });
+}
+export function readMemoryFixUserInputs(context, input, retainedBundle) {
+    return readMemoryFlowUserInputs(context, input, "mb-fix", retainedBundle);
+}
+/** Semantic intake proposal only: no write, closure, migration or SDLC launch
+ * authority. The registered flow must separately bind actual user approval,
+ * observe current source drift and admit its writer/independent verifier.
+ * Never classify prose by keywords or infer selection from severity. */
+export function prepareMemoryFixIntake(context, input) {
+    const source = readDiagnosticRepairIntake(context, input);
+    const routing = validateMemoryFixRouting(source.selected_findings.map(finding => finding.id), input.decisions);
+    return { schema_id: "dd-flow/mb-fix-intake@1", ...source, routing,
+        repair_finding_ids: routing.filter(decision => decision.route === "memory_repair").map(decision => decision.finding_id) };
+}
+/** Shared semantic routing checks; this does not admit a source RUN or user approval. */
+export function validateMemoryFixRouting(findingIds, decisions) {
+    const invalid = (reason) => {
+        throw new AppError("memory_fix_intake_invalid", "Memory repair intake requires one bounded routing decision per selected finding", 2, { reason, effect: "no_effect" });
+    };
+    if (!Array.isArray(findingIds) || !findingIds.length || findingIds.length > 4096
+        || findingIds.some(id => typeof id !== "string" || !id.trim()) || new Set(findingIds).size !== findingIds.length
+        || !Array.isArray(decisions) || decisions.length !== findingIds.length)
+        invalid("complete_routing_required");
+    const selected = new Set(findingIds);
+    const byId = new Map();
+    for (const value of decisions) {
+        if (!value || typeof value !== "object" || Array.isArray(value)
+            || Object.keys(value).sort().join() !== "finding_id,reason,route,write_paths")
+            invalid("invalid_routing_decision");
+        const decision = value;
+        if (typeof decision.finding_id !== "string" || !selected.has(decision.finding_id) || byId.has(decision.finding_id))
+            invalid("foreign_or_duplicate_finding");
+        if (!["memory_repair", "review_fix", "upgrade", "defer"].includes(decision.route)
+            || typeof decision.reason !== "string" || !decision.reason.trim() || decision.reason.includes("\0")
+            || Buffer.byteLength(decision.reason) > 16 * 1024 || !Array.isArray(decision.write_paths))
+            invalid("invalid_routing_decision");
+        if (decision.route === "memory_repair")
+            assertMemoryRepairWritePaths(decision.write_paths);
+        else if (decision.write_paths.length)
+            invalid("non_memory_write_scope");
+        byId.set(decision.finding_id, structuredClone(decision));
+    }
+    return findingIds.map(id => byId.get(id));
+}
+function readIntake(context, input) {
+    const projectRoot = resolveProjectRoot(input.projectRoot), project = requireProjectByRoot(context, projectRoot);
+    const run = resolveRun(context, project.id, input.sourceRunId);
+    if (run.status !== "done" || !isDiagnosticFlow(run.flow_kind))
+        refuse("completed_diagnostic_required");
+    const bundle = readFlowRunExecutionBundle(context, { projectRoot, runId: run.id });
+    if (!bundle || bundle.manifest.flow_id !== run.flow_kind)
+        refuse("diagnostic_bundle_required");
+    const scope = { projectId: project.id, runId: run.id, stage: "report" };
+    const accepted = readAcceptedStageData(context, scope);
+    if (accepted.data_schema_id !== "dd-flow/diagnostic-stage-result@1")
+        refuse("unsupported_source_result");
+    const result = JSON.parse(accepted.bytes.toString("utf8"));
+    if (result.schema_id !== accepted.data_schema_id || result.run_id !== run.id || result.flow_id !== run.flow_kind
+        || result.stage !== "report" || result.input_sha256 !== accepted.input_sha256)
+        refuse("foreign_source_result");
+    const stage = JSON.parse(run.index_json).stage_runs.find((item) => item.stage === "report");
+    const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type='diagnostic.report' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.attempt')=? LIMIT 2", [project.id, run.id, stage.attempt]);
+    if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 16 * 1024)
+        refuse("report_publication_missing");
+    const publication = JSON.parse(rows[0].payload_json);
+    const reportPath = `${stage.dir}/diagnostic-report.json`;
+    if (publication.schema_id !== "dd-flow/diagnostic-report-publication@1" || publication.input_sha256 !== accepted.input_sha256
+        || !Array.isArray(publication.artifacts))
+        refuse("foreign_report_publication");
+    const artifacts = publication.artifacts.filter((item) => item.path === reportPath);
+    if (artifacts.length !== 1 || !/^[a-f0-9]{64}$/.test(artifacts[0].sha256))
+        refuse("report_artifact_missing");
+    const packets = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type='flow_run.stage_packet' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.stage')='report' AND json_extract(payload_json,'$.attempt')=? AND json_extract(payload_json,'$.sha256')=? LIMIT 2", [project.id, run.id, stage.attempt, artifacts[0].sha256]);
+    if (packets.length !== 1 || Buffer.byteLength(packets[0].payload_json) > 6 * 1024 * 1024)
+        refuse("report_packet_missing");
+    const packet = JSON.parse(packets[0].payload_json);
+    const destination = path.resolve(run.run_root ?? run.run_dir, reportPath);
+    if (typeof packet.file !== "string" || resolveStagePublicationPath(context, project.id, run.id, packet.file) !== destination
+        || typeof packet.base64 !== "string")
+        refuse("foreign_report_packet");
+    const bytes = Buffer.from(packet.base64, "base64");
+    if (!bytes.length || bytes.length > 4 * 1024 * 1024 || bytes.toString("base64") !== packet.base64
+        || createHash("sha256").update(bytes).digest("hex") !== artifacts[0].sha256)
+        refuse("report_packet_changed");
+    const report = JSON.parse(bytes.toString("utf8"));
+    if (report.schema_id !== "dd-flow/diagnostic-report@1" || report.run.id !== run.id || report.run.flow_id !== run.flow_kind
+        || report.run.snapshot_sha256 !== result.snapshot_sha256 || report.summary !== result.summary
+        || hybridDigest(report.review_focus) !== hybridDigest(result.details.focus)
+        || hybridDigest(report.aspect_coverage) !== hybridDigest(result.details.coverage)
+        || hybridDigest(report.limitations) !== hybridDigest(result.details.limitations)
+        || !Array.isArray(report.findings_register)
+        || hybridDigest(report.findings_register.map(({ origin: _origin, resolution: _resolution, critic_decisions: _critics, ...finding }) => finding)) !== hybridDigest(result.details.findings)
+        || hybridDigest(report.findings_register.map(finding => finding.resolution)) !== hybridDigest(result.details.decisions))
+        refuse("report_result_changed");
+    return { ...selectDiagnosticFindings(report, input.findingIds),
+        source_stage: { ...accepted.result, authority_sha256: accepted.authority_sha256 } };
+}

package/dist/services/diagnostic-repair-source-intake.js

@@ -0,0 +1,102 @@
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+import { readDiagnosticRepairIntake } from "./diagnostic-repair-intake.js";
+import { readFlowRunExecutionBundle, assertPreparedRunBundleSqlAuthority } from "./runs.js";
+import { requireProjectByRoot } from "./projects.js";
+import { resolveProjectRoot } from "../storage/paths.js";
+const logical = "runtime/repair-intake.json", limit = 4 * 1024 * 1024;
+const hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const digest = (value) => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+const targets = {
+    "mb-fix": { schema: "dd-flow/mb-fix-source-intake@1", error: "memory_fix_intake_custody_invalid", message: "Memory repair requires its own frozen selected source intake", bundle: "memory_fix_bundle_required" },
+    "review-fix": { schema: "dd-flow/review-fix-source-intake@1", error: "review_fix_intake_custody_invalid", message: "Review-fix requires its own frozen selected source intake", bundle: "review_fix_bundle_required" }
+};
+function refuse(flowId, reason) {
+    const owner = Object.hasOwn(targets, flowId) ? targets[flowId] : targets["mb-fix"];
+    throw new AppError(owner.error, owner.message, 2, { reason, effect: "no_effect" });
+}
+/** SQL/in-memory fence for generic Stage writers; performs no filesystem lookup. */
+export function assertDiagnosticRepairSourceIntakeCustody(context, scope, bundle, expectedSha256, flowId) {
+    if (!Object.hasOwn(targets, flowId))
+        refuse(flowId, "unsupported_flow");
+    if (bundle.manifest.flow_id !== flowId || bundle.manifest.run_id !== scope.runId)
+        refuse(flowId, targets[flowId].bundle);
+    assertPreparedRunBundleSqlAuthority(context, scope, bundle);
+    const references = bundle.manifest.inventory.filter(ref => ref.path === logical);
+    if (references.length !== 1 || references[0].sha256 !== expectedSha256 || hash(bundle.blob(logical)) !== expectedSha256)
+        refuse(flowId, "source_intake_changed");
+}
+/** Initial selection comes from the completed diagnostic's SQL custody, never
+ * an agent-authored report. The RUN bundle factory must retain these exact bytes.
+ * No RUN allocation, write approval or mutation happens here.
+ */
+export function prepareDiagnosticRepairSourceIntake(context, input, flowId) {
+    if (!Object.hasOwn(targets, flowId))
+        refuse(flowId, "unsupported_flow");
+    const intake = readDiagnosticRepairIntake(context, input);
+    const bytes = Buffer.from(JSON.stringify({ schema_id: targets[flowId].schema, intake }));
+    if (bytes.length > limit)
+        refuse(flowId, "intake_exceeds_bound");
+    return { path: logical, sha256: hash(bytes), bytes };
+}
+/** Existing RUNs read their own retained input, not neighboring audit storage.
+ * Original source-stage paths are provenance only, never paths in this RUN.
+ * Frozen-bundle SQL authority still belongs to the existing generic runtime.
+ */
+export function readDiagnosticRepairSourceIntake(context, input, flowId, retainedBundle) {
+    if (!Object.hasOwn(targets, flowId))
+        refuse(flowId, "unsupported_flow");
+    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    const bundle = retainedBundle ?? readFlowRunExecutionBundle(context, input);
+    if (!bundle || bundle.manifest.flow_id !== flowId || bundle.manifest.run_id !== input.runId)
+        refuse(flowId, targets[flowId].bundle);
+    return context.db.readSnapshot(() => {
+        assertPreparedRunBundleSqlAuthority(context, { projectId: project.id, runId: input.runId }, bundle);
+        const references = bundle.manifest.inventory.filter(ref => ref.path === logical);
+        if (references.length !== 1)
+            refuse(flowId, "source_intake_reference_missing");
+        const bytes = bundle.blob(logical);
+        if (!bytes.length || bytes.length > limit || hash(bytes) !== references[0].sha256)
+            refuse(flowId, "source_intake_changed");
+        let value;
+        try {
+            value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+        }
+        catch {
+            return refuse(flowId, "invalid_source_intake");
+        }
+        try {
+            const intake = value.intake;
+            if (value.schema_id !== targets[flowId].schema || Object.keys(value).sort().join() !== "intake,schema_id"
+                || intake.authorization !== "not_granted" || !/^RUN-[0-9]+-[a-z0-9-]+$/.test(intake.source.id)
+                || !isDiagnosticFlow(intake.source.flow_id) || !digest(intake.source.snapshot_sha256) || !digest(intake.source.report_sha256)
+                || !digest(intake.source_stage.sha256) || !digest(intake.source_stage.authority_sha256)
+                || typeof intake.source_stage.path !== "string" || !intake.source_stage.path
+                || !Array.isArray(intake.selected_findings) || !intake.selected_findings.length || intake.selected_findings.length > 4096
+                || !Array.isArray(intake.unselected_ids) || intake.unselected_ids.length > 4096
+                || !Array.isArray(intake.limitations) || intake.limitations.some(item => typeof item !== "string"))
+                refuse(flowId, "invalid_source_intake");
+            const ids = intake.selected_findings.map(finding => finding.id);
+            if (ids.some(id => typeof id !== "string" || !id.trim()) || new Set(ids).size !== ids.length
+                || new Set(intake.unselected_ids).size !== intake.unselected_ids.length
+                || intake.unselected_ids.some(id => typeof id !== "string" || !id.trim() || ids.includes(id)))
+                refuse(flowId, "invalid_source_selection");
+            for (const finding of intake.selected_findings) {
+                if (finding.origin.id !== finding.id || typeof finding.origin.work_id !== "string"
+                    || finding.resolution.finding_id !== finding.id
+                    || !["accepted", "downgraded", "def_candidate", "review_fix_candidate"].includes(finding.resolution.disposition)
+                    || !Array.isArray(finding.evidence) || !Array.isArray(finding.resolution.evidence) || !Array.isArray(finding.critic_decisions)
+                    || finding.critic_decisions.some(critic => critic.decision.finding_id !== finding.id || !Array.isArray(critic.decision.evidence)))
+                    refuse(flowId, "invalid_source_selection");
+            }
+        }
+        catch (error) {
+            if (error instanceof AppError)
+                throw error;
+            return refuse(flowId, "invalid_source_intake");
+        }
+        return { sha256: references[0].sha256, reference: { root: "run", path: `execution-bundle/${logical}`, sha256: references[0].sha256 },
+            intake: structuredClone(value.intake) };
+    });
+}

package/dist/services/diagnostic-report.js

@@ -55,6 +55,36 @@ export function prepareDiagnosticReport(result, analysis, critics) {
         dashboard_links: critics.map(work => ({ work_id: work.workId, result: `run://${result.run_id}/works/${work.workId}/result.json` }))
     };
 }
+/** Pure repair-intake selection, not acceptance or mutation authority. The
+ * caller must obtain report bytes from the completed RUN's committed custody,
+ * then separately bind the user's approved write scope. Never infer selection
+ * from severity, recommendations or a non-empty findings register. */
+export function selectDiagnosticFindings(report, findingIds) {
+    const invalid = (reason) => {
+        throw new AppError("repair_selection_invalid", "Select exact reviewed finding IDs before preparing repair scope", 2, { reason, effect: "no_effect" });
+    };
+    if (!Array.isArray(findingIds) || !findingIds.length || findingIds.length > 4096
+        || findingIds.some(id => typeof id !== "string" || !id.trim()) || new Set(findingIds).size !== findingIds.length)
+        invalid("explicit_unique_selection_required");
+    const register = new Map(report.findings_register.map(finding => [finding.id, finding]));
+    if (register.size !== report.findings_register.length)
+        invalid("ambiguous_finding_register");
+    const selected = findingIds.map(id => {
+        const finding = register.get(id);
+        if (!finding)
+            return invalid("unknown_finding");
+        if (!["accepted", "downgraded", "def_candidate", "review_fix_candidate"].includes(finding.resolution.disposition))
+            invalid("finding_not_accepted");
+        return structuredClone(finding);
+    });
+    return {
+        source: { ...structuredClone(report.run), report_sha256: hybridDigest(report) },
+        selected_findings: selected,
+        unselected_ids: report.findings_register.filter(finding => !findingIds.includes(finding.id)).map(finding => finding.id),
+        limitations: [...report.limitations],
+        authorization: "not_granted"
+    };
+}
 /** HTML embeds exactly the authoritative JSON value; untrusted prose is text,
  * never HTML or executable script. Markdown remains a compact companion. */
 export function renderDiagnosticReport(report) {

package/dist/services/diagnostic-run-bundle.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { AppError } from "../shared/errors.js";
-import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+import { isSourceSnapshotFlow } from "../domain/source-snapshot-flows.js";
+import { isDeliveryFlow } from "../domain/delivery-flows.js";
 import { PreparedInstalledFlowSource } from "./installed-flow-source.js";
 import { FrozenGenericExecution } from "./generic-execution.js";
 import { AdmittedFrozenEngine } from "./frozen-engine.js";
@@ -10,34 +11,65 @@ import { requireProjectByRoot } from "./projects.js";
 import { nextDescriptorRunId } from "./descriptor-run-start.js";
 import { bundledHandlerContext } from "./stage-handlers.js";
 import { hybridDigest } from "./hybrid-contracts.js";
+import { readDiagnosticRequest } from "./diagnostic-start.js";
 const bytes = (value) => Buffer.from(JSON.stringify(value));
 const hash = (value) => createHash("sha256").update(value).digest("hex");
 function refuse(reason) { throw new AppError("diagnostic_run_bundle_invalid", "Diagnostic bundle requires its frozen source, execution and snapshot", 2, { reason, effect: "no_effect" }); }
 /** Initial construction only. Retry after allocation restores the retained RUN
  * bundle, never current operator settings/canon. boundAt belongs to the request. */
 export function prepareDiagnosticRunBundle(context, input) {
+    return prepareRequestRunBundle(context, input, "source_snapshot");
+}
+/** Delivery shares immutable request/engine/profile retention, not diagnosis's
+ * read-only cloned workspace or its permission model. No effect is admitted. */
+export function prepareDeliveryRunBundle(context, input) {
+    return prepareRequestRunBundle(context, input, "delivery");
+}
+function prepareRequestRunBundle(context, input, mode) {
     if (!(input.source instanceof PreparedInstalledFlowSource) || !(input.execution instanceof FrozenGenericExecution)
         || !(input.engine instanceof AdmittedFrozenEngine) || !Number.isFinite(Date.parse(input.boundAt)))
         refuse("unprepared_selection");
     const frozen = input.execution.snapshot(), flowId = frozen.settings.flow_id;
-    if (!isDiagnosticFlow(flowId))
-        refuse("diagnostic_flow_required");
+    if (mode === "delivery" ? !isDeliveryFlow(flowId) : !isSourceSnapshotFlow(flowId))
+        refuse("registered_request_flow_required");
+    if (mode === "delivery" && frozen.settings.stage_session_mode === "same_session")
+        refuse("independent_delivery_verifier_session_required");
+    if (flowId === "review-fix" && frozen.settings.stage_session_mode === "same_session")
+        refuse("independent_scope_review_session_required");
+    if ((mode === "delivery" || flowId === "mb-distill" || flowId === "review-fix") && (typeof input.requestText !== "string" || !input.requestText.trim()
+        || Buffer.byteLength(input.requestText) > 64 * 1024))
+        refuse(mode === "delivery" ? "original_delivery_request_required" : flowId === "mb-distill" ? "original_distill_request_required" : "original_review_fix_request_required");
+    const request = flowId === "review-fix" ? readDiagnosticRequest(context, { projectRoot: frozen.scope.projectRoot,
+        requestId: frozen.scope.requestId, flowId }) : null;
+    if (flowId === "review-fix" && (!request?.repair_source || request.created_at !== input.boundAt
+        || request.objective !== input.requestText || request.source_sha256 !== input.source.sha256
+        || request.execution_sha256 !== input.execution.sha256))
+        refuse("original_repair_request_required");
     const project = requireProjectByRoot(context, frozen.scope.projectRoot);
-    const snapshot = readDiagnosticSnapshot(context, { projectId: project.id, projectRoot: frozen.scope.projectRoot,
-        sourceRoot: frozen.scope.projectRoot, requestId: frozen.scope.requestId, flowId });
-    if (!snapshot || snapshot.root !== frozen.scope.workspace)
+    const snapshot = isSourceSnapshotFlow(flowId) ? readDiagnosticSnapshot(context, { projectId: project.id, projectRoot: frozen.scope.projectRoot,
+        sourceRoot: frozen.scope.projectRoot, requestId: frozen.scope.requestId, flowId }) : null;
+    if (mode === "source_snapshot" && (!snapshot || snapshot.root !== frozen.scope.workspace))
         refuse("snapshot_selection_changed");
     input.source.revalidate();
     const flow = input.source.resolveRegisteredFlow();
     if (flow.descriptor.id !== flowId || flow.sha256 !== frozen.settings.descriptor_sha256)
         refuse("flow_selection_changed");
-    input.engine.admitDiagnosticFlow(input.source, flowId);
+    if (isDeliveryFlow(flowId))
+        input.engine.admitDeliveryFlow(input.source, flowId);
+    else if (flowId === "review-fix")
+        input.engine.admitReviewFixFlow(input.source);
+    else if (flowId === "mb-distill")
+        input.engine.admitDistillFlow(input.source);
+    else if (flowId === "mb-audit" || flowId === "project-review")
+        input.engine.admitDiagnosticFlow(input.source, flowId);
+    else
+        refuse("registered_request_flow_required");
     const manifest = input.engine.manifest(), checksum = manifest.integrity.checksum;
     if (typeof checksum !== "string")
         refuse("engine_identity_missing");
     const runId = nextDescriptorRunId(context, { projectRoot: frozen.scope.projectRoot, requestId: frozen.scope.requestId, slug: flowId });
     const binding = { schema_id: "dd-flow/run-engine-binding@1", run_id: runId,
-        project_root: frozen.scope.projectRoot, bound_at: input.boundAt, source: "run_creation", reason: "Request-bound read-only diagnostic",
+        project_root: frozen.scope.projectRoot, bound_at: input.boundAt, source: "run_creation", reason: isDeliveryFlow(flowId) ? "Request-bound delivery; startup grants no productive mutation approval" : flowId === "review-fix" ? "Request-bound selected finding scope and explicit formalization handoff" : flowId === "mb-distill" ? "Request-bound practice distillation with separate destination authority" : "Request-bound read-only diagnostic",
         engine: { package_name: manifest.package_name, package_version: manifest.package_version, engine_version: manifest.engine_version,
             integrity_checksum: checksum, snapshot_root: manifest.snapshot_root }, probe: { status: "not_required", command: null } };
     const blobs = input.source.blobs();
@@ -47,6 +79,12 @@ export function prepareDiagnosticRunBundle(context, input) {
         blobs.set(logical, content);
         return { path: logical, sha256: hash(content) };
     };
+    // Use the retained request verbatim, not the coordinator's interpretation or
+    // a later mutable intake file. It is task data, never implicit write scope.
+    if (mode === "delivery" || flowId === "mb-distill" || flowId === "review-fix")
+        put("runtime/source-request.md", Buffer.from(input.requestText));
+    if (request?.repair_source)
+        put(request.repair_source.path, Buffer.from(request.repair_source.base64, "base64"));
     for (const ref of [frozen.settings.attached_session_receipt, frozen.settings.delegation.native_capacity_receipt]) {
         if (!ref)
             continue;
@@ -60,7 +98,8 @@ export function prepareDiagnosticRunBundle(context, input) {
     const execution = put("runtime/execution.json", bytes(frozen.settings));
     const engineBinding = put("runtime/engine-binding.json", bytes(binding));
     const engineManifest = put("runtime/engine-manifest.json", input.engine.manifestBytes());
-    put("runtime/diagnostic-snapshot.json", bytes(snapshot));
+    if (snapshot)
+        put("runtime/diagnostic-snapshot.json", bytes(snapshot));
     const provenance = { canon: input.source.canonProvenance(), project_pack: null };
     const bundle = { schema_id: "dd-flow/execution-bundle@1", run_id: runId, flow_id: flowId,
         descriptor: input.source.descriptorReference(), execution_settings: execution, profile_settings: profile,

package/dist/services/diagnostic-snapshot.js

@@ -2,7 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
 import { AppError } from "../shared/errors.js";
-import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+import { isSourceSnapshotFlow } from "../domain/source-snapshot-flows.js";
 import { hybridDigest } from "./hybrid-contracts.js";
 import { appendAudit } from "./audit.js";
 import { reviewSourceHash, reviewSourceFilter, reviewExecutionCopyHash } from "./review-copy.js";
@@ -32,7 +32,7 @@ export function diagnosticSnapshotPaths(context, value, runId) {
 }
 function validate(context, input, runId) {
     const physical = physicalSnapshot(context, input, runId);
-    if (!isDiagnosticFlow(input.flowId) || !input.requestId?.trim() || input.requestId.length > 200
+    if (!isSourceSnapshotFlow(input.flowId) || !input.requestId?.trim() || input.requestId.length > 200
         || !path.isAbsolute(physical.projectRoot) || physical.projectRoot !== physical.sourceRoot
         || fs.realpathSync(physical.sourceRoot) !== physical.sourceRoot)
         refuse("invalid_selection");

package/dist/services/diagnostic-stage-handlers.js

@@ -8,7 +8,7 @@ import { PreparedDescriptorStageStart } from "./descriptor-stage-start.js";
 import { PreparedDescriptorStageCoordinator, readDescriptorStageInput } from "./descriptor-stage-coordinator.js";
 import { PreparedDescriptorStageSettlement } from "./descriptor-stage-settlement.js";
 import { PreparedDescriptorRunSettlement } from "./descriptor-run-settlement.js";
-import { assertDiagnosticCriticResolution, assertDiagnosticReportData, assertDiagnosticStageScope, sealDiagnosticStageLimitations, validateDiagnosticStageResult } from "./diagnostic-stage-results.js";
+import { assertDiagnosticCriticResolution, assertDiagnosticReportData, assertDiagnosticStageScope, materializeDiagnosticRetainedFields, sealDiagnosticStageLimitations, validateDiagnosticStageResult } from "./diagnostic-stage-results.js";
 import { readAcceptedStageData } from "./stage-report-renderer.js";
 import { registerDiagnosticStageGraph } from "./diagnostic-work-registration.js";
 import { PreparedDiagnosticWorkCollection } from "./diagnostic-work-collection.js";
@@ -53,7 +53,8 @@ export function finishDiagnosticStage(context, input) {
     const previous = previousStage ? readAcceptedStageData(context, { ...scope, stage: previousStage }) : null;
     const prior = previous ? JSON.parse(previous.bytes.toString("utf8")) : null;
     const collection = ["audit", "analyze", "review"].includes(input.stage) ? PreparedDiagnosticWorkCollection.prepare(context, input) : null;
-    const candidates = ["audit", "analyze"].includes(input.stage) ? sealDiagnosticCandidateIds(input.bytes, collection.results()) : input.bytes;
+    const proposal = materializeDiagnosticRetainedFields(input.bytes, prior, input.stage);
+    const candidates = ["audit", "analyze"].includes(input.stage) ? sealDiagnosticCandidateIds(proposal, collection.results()) : proposal;
     const bytes = sealDiagnosticStageLimitations(candidates, [
         ...(prior?.details.limitations ?? []), ...(collection?.results() ?? []).flatMap(work => work.result.limitations)
     ], prior?.details.missing_expected_sources ?? []);

package/dist/services/diagnostic-stage-results.js

@@ -7,6 +7,32 @@ import { verifyDiagnosticCoverage, verifyDiagnosticSources } from "./diagnostic-
 const refuse = (reason) => {
     throw new AppError("diagnostic_stage_result_invalid", "Diagnostic result does not match its frozen stage", 2, { reason, effect: "no_effect", ...(reason === "result_schema_invalid" ? { phase: "prepare", recoverable: true } : {}) });
 };
+/** Retained fields are CLI data, not a transcription task for the coordinator. */
+export function materializeDiagnosticRetainedFields(bytes, prior, stage) {
+    if (!prior || !bytes.length || bytes.length > 1024 * 1024)
+        return bytes;
+    let value;
+    try {
+        value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    catch {
+        return bytes;
+    }
+    if (!value || typeof value !== "object" || !value.details || typeof value.details !== "object" || Array.isArray(value.details))
+        return bytes;
+    const retained = stage === "report" ? Object.entries(prior.details).filter(([key]) => key !== "limitations")
+        : ["focus", "coverage"].map(key => [key, prior.details[key]]);
+    for (const [key, expected] of retained) {
+        if (Object.hasOwn(value.details, key) && hybridDigest(value.details[key]) !== hybridDigest(expected))
+            throw new AppError("diagnostic_stage_invalid", "A proposal cannot replace CLI-retained predecessor data", 2, { reason: `accepted_${key}_changed`, effect: "no_effect", phase: "prepare", recoverable: true });
+        value.details[key] = structuredClone(expected);
+    }
+    if (!Object.hasOwn(value.details, "limitations"))
+        value.details.limitations = [];
+    if (!Object.hasOwn(value.details, "missing_expected_sources"))
+        value.details.missing_expected_sources = structuredClone(prior.details.missing_expected_sources);
+    return Buffer.from(JSON.stringify(value));
+}
 /** Accepted limitations and missing-source observations belong to predecessor/Work custody, not a coordinator's
  * transcription. Keep its annotations too; validate the complete sealed result
  * with the frozen schema afterwards, without truncating overflowing data. */