@deksden-com/dd-flow-cli 0.9.0-beta.152 → 0.9.0-beta.155

package/dist/services/interactive-work-start.js

@@ -0,0 +1,155 @@
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { readFlowRunExecutionBundle, assertPreparedRunBundleSqlAuthority } from "./runs.js";
+import { readRegisteredInteractiveWork } from "./interactive-work-registration.js";
+import { PreparedInteractiveWorkspaceChanges } from "./interactive-mutation-scope.js";
+import { PreparedInteractiveGitBaseline } from "./interactive-git-baseline.js";
+import { readDescriptorStageInput } from "./descriptor-stage-coordinator.js";
+import { stageGraphScope } from "./stage-work-graph.js";
+import { assertRunMutationAllowed } from "./run-recovery-guard.js";
+import { readBoundedReleaseFile } from "./release-source.js";
+const event = "interactive.work_start";
+const hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
+function refuse(reason) {
+    throw new AppError("interactive_work_start_invalid", "Interactive Work requires its issued input and actual physical start", 2, { reason, effect: "no_effect" });
+}
+export function readInteractiveWorkGit(bundle) {
+    const git = JSON.parse(bundle.blob("runtime/git-policy.json").toString("utf8"));
+    if (!git || typeof git.git_executable !== "string" || !/^[a-f0-9]{64}$/.test(git.git_sha256)
+        || hash(readBoundedReleaseFile(git.git_executable, 64 * 1024 * 1024)) !== git.git_sha256)
+        refuse("selected_git_changed");
+    return { git_executable: git.git_executable, git_sha256: git.git_sha256 };
+}
+/** Historical SQL-only start custody. Never recapture already edited sources. */
+export function readInteractiveWorkStart(context, scope, bundle, workSessionId) {
+    const assignment = readRegisteredInteractiveWork(context, scope, bundle, scope.workId);
+    const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type=? AND json_extract(payload_json,'$.work_session_id')=? LIMIT 2", [scope.projectId, event, workSessionId]);
+    if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 33 * 1024 * 1024)
+        refuse("start_custody_missing");
+    const receipt = JSON.parse(rows[0].payload_json);
+    if (!receipt || Object.keys(receipt).sort().join() !== "actor,attempt,bundle_sha256,hook_event_id,hook_event_key,packet_sha256,run_id,schema_id,snapshot,snapshot_sha256,stage,work_id,work_session_id"
+        || receipt.schema_id !== "dd-flow/interactive-work-start@1" || receipt.run_id !== scope.runId || receipt.work_id !== scope.workId
+        || receipt.work_session_id !== workSessionId || receipt.stage !== assignment.packet.stage || receipt.attempt !== assignment.receipt.attempt
+        || receipt.packet_sha256 !== assignment.packet.packet_sha256 || receipt.bundle_sha256 !== bundle.sha256
+        || !receipt.actor || Object.keys(receipt.actor).sort().join() !== "harness,provider_session_id,session_id")
+        refuse("start_binding_changed");
+    const actor = receipt.actor;
+    if (!context.db.get("SELECT 1 FROM work_sessions ws JOIN works w ON w.work_id=ws.work_id JOIN hook_events h ON h.project_id=w.project_id AND h.event_key=ws.hook_event_id WHERE w.project_id=? AND w.run_id=? AND w.work_id=? AND ws.id=? AND ws.session_id=? AND ws.hook_event_id=? AND h.id=? AND h.status='claimed' AND h.session_id=ws.session_id AND h.harness=? AND h.provider_session_id=?", [scope.projectId, scope.runId, scope.workId, workSessionId, actor.session_id, receipt.hook_event_key, receipt.hook_event_id, actor.harness, actor.provider_session_id]))
+        refuse("physical_start_custody_changed");
+    const baseline = PreparedInteractiveGitBaseline.restore(Buffer.from(JSON.stringify(receipt.snapshot)), receipt.snapshot_sha256);
+    const start = context.db.get("SELECT start_receipt_json FROM work_sessions WHERE id=? AND work_id=?", [workSessionId, scope.workId]);
+    if (!start?.start_receipt_json || Buffer.byteLength(start.start_receipt_json) > 33 * 1024 * 1024)
+        refuse("start_packet_custody_missing");
+    const packetReceipt = JSON.parse(start.start_receipt_json);
+    if (typeof packetReceipt.context !== "string" || hash(Buffer.from(packetReceipt.context)) !== packetReceipt.context_sha256)
+        refuse("start_packet_changed");
+    const startContext = JSON.parse(packetReceipt.context);
+    if (startContext.run_id !== scope.runId || startContext.work_id !== scope.workId
+        || hybridDigest(startContext.interactive_start) !== hybridDigest({ schema_id: "dd-flow/interactive-work-start-binding@1",
+            packet_sha256: assignment.packet.packet_sha256, snapshot_sha256: baseline.sha256 }))
+        refuse("start_snapshot_binding_changed");
+    const frozen = bundle.execution.snapshot().scope;
+    if (baseline.snapshot().project_root !== frozen.projectRoot || baseline.snapshot().workspace !== frozen.workspace)
+        refuse("physical_start_scope_changed");
+    return { receipt, baseline, assignment };
+}
+/** Physical preparation precedes the ordinary hook/Session claim writer.
+ * The original Work snapshot is retained with that claim, never after edits. */
+export class PreparedInteractiveWorkStart {
+    #scope;
+    #bundle;
+    #assignment;
+    #changes;
+    #baseline;
+    #git;
+    constructor(scope, bundle, assignment, changes, git) {
+        this.#scope = { ...scope };
+        this.#bundle = bundle;
+        this.#assignment = assignment;
+        this.#changes = changes;
+        const bytes = Buffer.from(JSON.stringify(changes.currentSnapshot()));
+        this.#baseline = PreparedInteractiveGitBaseline.restore(bytes, hash(bytes));
+        this.#git = { ...git };
+        Object.freeze(this);
+    }
+    static prepare(context, input) {
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        const bundle = readFlowRunExecutionBundle(context, input);
+        if (!bundle)
+            refuse("bundle_required");
+        const assignment = readRegisteredInteractiveWork(context, input, bundle, input.workId), frozen = bundle.execution.snapshot().scope;
+        const git = readInteractiveWorkGit(bundle);
+        const changes = PreparedInteractiveWorkspaceChanges.prepare(context, input, bundle, { projectRoot: frozen.projectRoot,
+            workspace: frozen.workspace, gitExecutable: git.git_executable, env: context.env });
+        const prepared = new PreparedInteractiveWorkStart(input, bundle, assignment, changes, git);
+        const patch = changes.snapshot(), packet = assignment.packet;
+        if (hybridDigest(patch.delta.changes) !== packet.file_changes_sha256 || patch.scope_revision !== packet.scope_revision
+            || patch.user_inputs_sha256 !== packet.user_inputs_sha256)
+            refuse("issued_context_changed_before_start");
+        // Unchanged files are also selected reviewer/writer inputs, not just patch paths.
+        const files = new Map(changes.currentSnapshot().entries.filter(item => item.kind === "file").map(item => [item.path, item.sha256]));
+        if (packet.read_inputs.some(ref => ref.root === "workspace" && files.get(ref.path) !== ref.sha256))
+            refuse("issued_source_changed_before_start");
+        context.db.readSnapshot(() => prepared.assertSelection(context));
+        prepared.revalidate();
+        return prepared;
+    }
+    revalidate() {
+        if (hash(readBoundedReleaseFile(this.#git.git_executable, 64 * 1024 * 1024)) !== this.#git.git_sha256)
+            refuse("selected_git_changed");
+        this.#changes.revalidate();
+    }
+    binding() {
+        return { schema_id: "dd-flow/interactive-work-start-binding@1", packet_sha256: this.#assignment.packet.packet_sha256, snapshot_sha256: this.#baseline.sha256 };
+    }
+    assertSelection(context) {
+        const { projectId, runId, workId } = this.#scope, packet = this.#assignment.packet;
+        const current = readRegisteredInteractiveWork(context, this.#scope, this.#bundle, workId);
+        if (hybridDigest(current.receipt) !== hybridDigest(this.#assignment.receipt)
+            || hybridDigest(current.custody) !== hybridDigest(this.#assignment.custody)
+            || current.packet.packet_sha256 !== this.#assignment.packet.packet_sha256)
+            refuse("assignment_changed_before_start");
+        const run = assertPreparedRunBundleSqlAuthority(context, this.#scope, this.#bundle), index = JSON.parse(run.index_json);
+        const graph = stageGraphScope(context, projectId, runId, packet.owner_stage), stage = readDescriptorStageInput(context, { ...this.#scope, stage: packet.owner_stage }, this.#bundle);
+        if (run.status !== "running" || index.current_stage !== packet.owner_stage
+            || !index.stage_runs?.some((item) => item.stage === packet.owner_stage && item.status === "running" && item.attempt === graph.attempt)
+            || graph.attempt !== current.custody.scope.attempt || graph.cycle !== current.custody.scope.cycle
+            || stage.attempt !== graph.attempt || stage.inputSha256 !== packet.input_sha256)
+            refuse("active_assignment_required");
+        assertRunMutationAllowed(context, projectId, runId);
+    }
+    assertCustody(context) {
+        if (!context.db.isOwnedWriteTransaction?.())
+            refuse("owned_writer_required");
+        this.assertSelection(context);
+        this.#changes.assertCustody(context);
+    }
+    recordStart(context, workSessionId, hookEventKey, identity) {
+        this.assertCustody(context);
+        const { projectId, runId, workId } = this.#scope;
+        const link = context.db.get("SELECT 1 FROM work_sessions ws JOIN works w ON w.work_id=ws.work_id JOIN sessions s ON s.project_id=w.project_id AND s.session_id=ws.session_id JOIN hook_events h ON h.project_id=w.project_id AND h.event_key=ws.hook_event_id WHERE w.project_id=? AND w.run_id=? AND w.work_id=? AND w.status='running' AND ws.id=? AND ws.status='running' AND ws.session_id=? AND ws.hook_event_id=? AND h.status='claimed' AND h.id=? AND h.session_id=ws.session_id AND s.harness=? AND s.provider_session_id=? AND h.harness=s.harness AND h.provider_session_id=s.provider_session_id", [projectId, runId, workId, workSessionId, identity.sessionId, hookEventKey, identity.hookEventId, identity.harness, identity.providerSessionId]);
+        if (!link)
+            refuse("claimed_work_session_required");
+        if (this.#assignment.retained.body.work_history.works.some(prior => prior.actor?.harness === identity.harness
+            && prior.actor.provider_session_id === identity.providerSessionId))
+            refuse("independent_physical_session_required");
+        if (context.db.get("SELECT 1 FROM work_sessions ws JOIN works w ON w.work_id=ws.work_id JOIN sessions s ON s.project_id=w.project_id AND s.session_id=ws.session_id WHERE w.project_id=? AND w.run_id=? AND ws.id<>? AND s.harness=? AND s.provider_session_id=? LIMIT 1", [projectId, runId, workSessionId, identity.harness, identity.providerSessionId]))
+            refuse("independent_physical_session_required");
+        if (context.db.get("SELECT 1 FROM audit_events WHERE project_id=? AND event_type=? AND json_extract(payload_json,'$.work_session_id')=?", [projectId, event, workSessionId]))
+            refuse("start_already_retained");
+        const packet = this.#assignment.packet;
+        const receipt = { schema_id: "dd-flow/interactive-work-start@1", run_id: runId, work_id: workId, work_session_id: workSessionId,
+            hook_event_key: hookEventKey, hook_event_id: identity.hookEventId, stage: packet.stage, attempt: this.#assignment.receipt.attempt,
+            packet_sha256: packet.packet_sha256, bundle_sha256: this.#bundle.sha256,
+            actor: { session_id: identity.sessionId, harness: identity.harness, provider_session_id: identity.providerSessionId },
+            snapshot_sha256: this.#baseline.sha256, snapshot: this.#baseline.snapshot() };
+        // Same bounded snapshot as the RUN baseline; SQL custody is not worker transport.
+        const json = JSON.stringify(receipt);
+        if (Buffer.byteLength(json) > 33 * 1024 * 1024)
+            refuse("unbounded_start_receipt");
+        context.db.run("INSERT INTO audit_events(project_id,event_type,payload_json,created_at) VALUES(?,?,?,?)", [projectId, event, json, context.now()]);
+        readInteractiveWorkStart(context, this.#scope, this.#bundle, workSessionId);
+    }
+}

package/dist/services/lifecycle-invocations.js

@@ -1,5 +1,5 @@
 import crypto from "node:crypto";
-import { checkRepairDisposition } from "./check-runner-evidence.js";
+import { checkDiagnosisDisposition } from "./check-runner-evidence.js";
 import path from "node:path";
 import fs from "node:fs";
 import { quote } from "shell-quote";
@@ -21,6 +21,12 @@ import { stageAttempt } from "./stage-work-graph.js";
 import { contextualPathOptionsForLifecycle } from "../cli/command-inputs.js";
 import { canonicalPath } from "../storage/paths.js";
 import { runtimeCommand, shellArgument } from "./runtime-command.js";
+import { assignedLifecycleBinding, claimAssignedLifecycle, currentAssignedLifecycle, bindAssignedCoordinatorPacket, inheritAssignedPackets, retainControllerStageAssignment, admitAssignedAuxiliary, bindAssignedStageResume, readAcceptedAssignedWork, assertTerminalSettlementUnreserved } from "./assigned-lifecycle.js";
+import { appendAudit } from "./audit.js";
+import { recordTechnicalNote } from "./technical-notes.js";
+import { ObservationClock } from "../harness-runtime/lib/observation-clock.mjs";
+export { currentAssignedLifecycle, assignedSessionIdentity, assertAssignedSettlementCurrent } from "./assigned-lifecycle.js";
+export const bindControllerStageAssignment = retainControllerStageAssignment;
 // Process-local custody: an executing SQL row or ambient variable alone cannot
 // recreate admission after a CLI restart, or in another resource database.
 const currentAdmissions = new WeakMap();
@@ -48,6 +54,11 @@ export function assertAuxiliaryCommandScope(context, command, projectRoot) {
     const daemonId = context.env.DD_FLOW_DAEMON_ID;
     if (!auxiliary || !daemonId)
         return;
+    const assignedScope = cliManagedInvocationScope(context);
+    if (assignedScope && admitAssignedAuxiliary(context, command, assignedScope, projectRoot)) {
+        assertRunMutationAllowed(context, requireProjectByRoot(context, assignedScope.projectRoot).id, assignedScope.runId, assignedScope.generation);
+        return;
+    }
     const event = observedLifecycleNativeEvent(context, command, daemonId);
     if (!event)
         throw new AppError("invocation_receipt_missing", "Auxiliary command has no exact native receipt", 1, { phase: "prepare", effect: "no_effect" });
@@ -96,7 +107,7 @@ export function isRetryableLifecycleRejection(code, details = {}) {
     if (["invocation_command_mismatch", "invocation_argument_mismatch"].includes(code))
         return details.recoverable !== false;
     if (["work_checks_failed", "code_gate_failed", "code_review_gate_failed", "merge_gate_failed"].includes(code))
-        return Array.isArray(details.failures) && details.failures.length > 0 && details.failures.every(receipt => checkRepairDisposition(receipt) === "source_repair");
+        return Array.isArray(details.failures) && details.failures.length > 0 && details.failures.every(receipt => checkDiagnosisDisposition(receipt) === "diagnosis_required");
     return details.recoverable === true || ["review_repair_incomplete", "plan_review_incomplete", "semantic_result_invalid",
         "review_evidence_invalid", "evidence_obligation_unknown", "invalid_evidence_ref",
         "evidence_ref_missing", "evidence_line_out_of_range", "document_update_missing",
@@ -289,6 +300,7 @@ export function bindLifecyclePublishedPacket(context, prompt) {
     const issued = context.db.all("SELECT * FROM lifecycle_invocations WHERE scope_json = ? AND status = 'issued' ORDER BY rowid", [scope]);
     const ids = issued.filter(row => prompt.includes(publicInvocationCommand(context, row, retainedCommandWithoutInvocationId(row)))).map(row => row.id);
     bindLifecyclePacketAssignments(context, prompt, ids);
+    bindAssignedCoordinatorPacket(context, prompt);
 }
 function retainedCommandWithoutInvocationId(row) {
     const marker = ` --invocation-id ${row.id}`;
@@ -391,6 +403,24 @@ export function assertLifecycleOutcomes(context, scope) {
 /** Hooks already own native identity. Retain command outcomes there, with an
  * atomic controller notification; missing notifications reconcile from the row. */
 export function observeLifecycleCommand(context, command, nativeEvent) {
+    const assigned = currentAssignedLifecycle(context);
+    if (assigned)
+        return outcome => {
+            try {
+                const project = requireProjectByRoot(context, assigned.scope.projectRoot);
+                try {
+                    appendAudit(context, { projectId: project.id, eventType: "lifecycle.assigned_outcome", payload: { run_id: assigned.scope.runId,
+                            generation: assigned.scope.generation, invocation_id: assigned.invocation_id, operation: assigned.operation,
+                            work_id: assigned.work_id, ...(outcome.error ? { error: { code: outcome.error.code, message: outcome.error.message } } : { accepted: true }) } });
+                }
+                catch {
+                    recordTechnicalNote(context, project.id, assigned.scope.runId, { code: "assigned_outcome_audit_unavailable", message: "Optional assigned-operation audit could not be written; invocation outcome remains authoritative", phase: "settlement", generation: assigned.scope.generation, source_operation_id: assigned.invocation_id, consequence: "none" });
+                }
+            }
+            catch {
+                process.stderr.write(`${JSON.stringify({ event: "assigned_outcome_audit_unavailable", invocation_id: assigned.invocation_id })}\n`);
+            }
+        };
     const parsed = parseLifecycleCommand(command);
     const auxiliary = continuationCommand(command);
     if (parsed.kind !== "standalone" && !auxiliary)
@@ -677,9 +707,41 @@ export function lifecycleRetryCommands(context, stage) {
             }
         }))];
 }
-function currentIssuedCommand(context, scope, command) {
+/** A resumed coordinator retains intent, not the old route's mutation authority. */
+export function rebindAssignedCoordinatorCommands(context) {
+    const assigned = currentAssignedLifecycle(context);
+    if (assigned?.operation !== "stage_resume" || !assigned.work_session_id)
+        return [];
+    const rows = context.db.all(`SELECT DISTINCT li.* FROM lifecycle_invocations li JOIN lifecycle_packet_assignments pa ON pa.invocation_id=li.id
+    WHERE li.status='issued' AND (pa.packet_sha256=(SELECT json_extract(start_receipt_json,'$.prompt_sha256') FROM work_sessions WHERE id=?)
+      OR EXISTS (SELECT 1 FROM audit_events a WHERE a.event_type='lifecycle.coordinator_packet'
+        AND json_extract(a.payload_json,'$.work_session_id')=? AND json_extract(a.payload_json,'$.packet_sha256')=pa.packet_sha256))`, [assigned.work_session_id, assigned.work_session_id]);
+    const commands = [];
+    context.db.writeTransaction(() => {
+        for (const row of rows) {
+            const parsed = invocation(row.command), scope = JSON.parse(row.scope_json);
+            if (!["stage_finish", "stage_pause"].includes(parsed.operation) || commandOption(parsed, "stage") !== assigned.stage
+                || scope.projectRoot !== assigned.scope.projectRoot || scope.runId !== assigned.scope.runId || scope.generation > assigned.scope.generation)
+                continue;
+            if (row.scope_json === JSON.stringify(assigned.scope)) {
+                commands.push(publicInvocationCommand(context, row, row.command));
+                continue;
+            }
+            const command = canonicalManagedCommand(context, retainedCommandWithoutInvocationId(row), assigned.scope);
+            const next = managedLifecycleCommand(context, command);
+            const successor = currentIssuedCommand(context, JSON.stringify(assigned.scope), next);
+            if (!successor)
+                throw new AppError("invocation_assignment_unproven", "Resume has no exact current coordinator successor", 1, { effect: "no_effect", reconciliation_required: true });
+            inheritAssignedPackets(context, row.id, successor.id);
+            context.db.run("UPDATE lifecycle_invocations SET status='expired',updated_at=? WHERE id=? AND status='issued'", [context.now(), row.id]);
+            commands.push(next);
+        }
+    });
+    return [...new Set(commands)];
+}
+function currentIssuedCommand(context, scope, command, excludeId) {
     const rows = context.db.all("SELECT * FROM lifecycle_invocations WHERE scope_json = ? AND fingerprint = ? AND status = 'issued'", [scope, scopedCommandFingerprint(context, scope, command)])
-        .filter(row => row.deadline === null || row.deadline > Date.now());
+        .filter(row => row.id !== excludeId && (row.deadline === null || row.deadline > Date.now()));
     if (rows.length > 1)
         throw new AppError("invocation_ambiguous", "Multiple current lifecycle successors match this command", 1);
     return rows[0] ?? null;
@@ -805,6 +867,7 @@ export function managedLifecycleCommand(context, command, options = {}) {
         if (context.env.DD_FLOW_INVOCATION_READONLY === "1")
             throw new AppError("invocation_command_unprepared", "No prepared lifecycle command is available; read-only inspection cannot issue one", 1);
         const issued = issueLifecycleInvocation(context, command, scope);
+        bindAssignedStageResume(context, load(context, issued.id));
         return publicInvocationCommand(context, load(context, issued.id), command);
     });
 }
@@ -841,9 +904,13 @@ function successorLifecycleInvocationCommand(context, prior, checkReceiptId) {
                 throw new AppError("invocation_command_invalid", "Retained retry option cannot be rewritten unambiguously", 1);
             retained = retained.replace(fragments[0], "");
         }
-        command = retained.replace(` --invocation-id ${prior.id}`, ` --retry-check ${shellArgument(checkReceiptId)} --reason ${shellArgument("Recheck after candidate-source correction")}`);
+        command = retained.replace(` --invocation-id ${prior.id}`, ` --retry-check ${shellArgument(checkReceiptId)} --reason ${shellArgument("Recheck after diagnosis and correction of the failed check")}`);
     }
-    return managedLifecycleCommand({ ...context, env: { ...context.env, DD_FLOW_INVOCATION_SCOPE: prior.scope_json, DD_FLOW_CURRENT_INVOCATION: prior.id } }, command);
+    const successor = managedLifecycleCommand({ ...context, env: { ...context.env, DD_FLOW_INVOCATION_SCOPE: prior.scope_json, DD_FLOW_CURRENT_INVOCATION: prior.id } }, command);
+    const next = stagedContinuations.get(context.db)?.get(prior.id) ?? currentIssuedCommand(context, prior.scope_json, successor, prior.id);
+    if (next && context.db.get("SELECT 1 FROM lifecycle_invocations WHERE id=?", [next.id]))
+        inheritAssignedPackets(context, prior.id, next.id);
+    return successor;
 }
 // Caller holds the write transaction and has checked authority. Issued (or
 // legacy expired) attempts have never admitted an effect; observed/executing
@@ -862,6 +929,16 @@ const receiptTimeout = (id) => ({ code: "invocation_receipt_timeout", message: "
  * A crash must leave either the old attempt executing, or both the settled
  * outcome and its successor; never a usable successor beside an unknown effect. */
 export function settleLifecycleRejection(context, id, error) {
+    const accepted = readAcceptedAssignedWork(context, id);
+    if (accepted) {
+        const row = load(context, id), scope = JSON.parse(row.scope_json);
+        settleLifecycleInvocation(context, id, { result: accepted });
+        Object.assign(error.details, { effect: "committed", recoverable: false, work_result_accepted: true, reconciliation_required: true });
+        const project = requireProjectByRoot(context, scope.projectRoot);
+        recordTechnicalNote(context, project.id, scope.runId, { code: "work_post_commit_pending", message: "Work result was accepted; derivative publication or projection needs reconciliation", phase: "publication", generation: scope.generation,
+            source_operation_id: id, work_id: String(accepted.work_id), consequence: "dependency_blocked" });
+        return;
+    }
     storage(context);
     // Only this settlement may publish a successor; inherited help is not authority.
     delete error.details.retry_command;
@@ -935,24 +1012,33 @@ export function hasLifecyclePacketAssignments(context, originalPrompt) {
 }
 export function recoverLifecycleCommands(context, originalPrompt, scope) {
     const digest = crypto.createHash("sha256").update(originalPrompt).digest("hex");
-    const ids = context.db.all("SELECT invocation_id FROM lifecycle_packet_assignments WHERE packet_sha256 = ? ORDER BY rowid", [digest]).map(row => row.invocation_id);
-    if (!ids.length)
+    const packet = context.db.all("SELECT li.* FROM lifecycle_packet_assignments pa JOIN lifecycle_invocations li ON li.id=pa.invocation_id WHERE pa.packet_sha256 = ? ORDER BY pa.rowid", [digest]);
+    if (!packet.length)
         throw new AppError("invocation_recovery_unbound", "Original packet has no verified lifecycle assignment binding; reconcile it before continuing", 1);
+    const origins = new Map();
+    for (const row of packet) {
+        const priorScope = JSON.parse(row.scope_json);
+        if (priorScope.projectRoot !== scope.projectRoot || priorScope.runId !== scope.runId || priorScope.rootSessionId !== scope.rootSessionId
+            || priorScope.generation > scope.generation || priorScope.generation === scope.generation && row.scope_json !== JSON.stringify(scope))
+            throw new AppError("invocation_recovery_scope_mismatch", "Retained command does not belong to the recovered root and an earlier generation", 1, { invocation_id: row.id });
+        // Recovery inherits the immutable packet binding. Those new rows are
+        // successors of its original commands, not additional commands to recover.
+        if (priorScope.generation < scope.generation && !origins.has(row.fingerprint))
+            origins.set(row.fingerprint, row);
+    }
+    if (!origins.size)
+        throw new AppError("invocation_recovery_scope_mismatch", "Recovery requires an earlier packet generation", 1);
     const recovered = [];
-    for (const id of ids) {
-        let prior = load(context, id);
-        const oldScope = JSON.parse(prior.scope_json);
-        if (oldScope.projectRoot !== scope.projectRoot || oldScope.runId !== scope.runId
-            || oldScope.rootSessionId !== scope.rootSessionId || oldScope.generation >= scope.generation) {
-            throw new AppError("invocation_recovery_scope_mismatch", "Retained command does not belong to the recovered root and an earlier generation", 1, { invocation_id: id });
-        }
+    for (const origin of origins.values()) {
+        const id = origin.id;
         // The immutable prompt can predate several recoveries. Follow the newest
         // retained attempt, including an unknown successor, rather than reviving
         // an older unexecuted command after the successor already produced effects.
-        prior = context.db.get(`SELECT * FROM lifecycle_invocations WHERE fingerprint = ?
-      AND json_extract(scope_json, '$.projectRoot') = ? AND json_extract(scope_json, '$.runId') IS ?
-      AND json_extract(scope_json, '$.rootSessionId') = ? AND json_extract(scope_json, '$.generation') < ?
-      ORDER BY json_extract(scope_json, '$.generation') DESC, rowid DESC LIMIT 1`, [prior.fingerprint, scope.projectRoot, scope.runId, scope.rootSessionId, scope.generation]);
+        const prior = context.db.get(`SELECT li.* FROM lifecycle_invocations li JOIN lifecycle_packet_assignments pa ON pa.invocation_id=li.id
+      WHERE pa.packet_sha256=? AND li.fingerprint = ?
+      AND json_extract(li.scope_json, '$.projectRoot') = ? AND json_extract(li.scope_json, '$.runId') IS ?
+      AND json_extract(li.scope_json, '$.rootSessionId') = ? AND (json_extract(li.scope_json, '$.generation') < ? OR li.scope_json = ?)
+      ORDER BY json_extract(li.scope_json, '$.generation') DESC, li.rowid DESC LIMIT 1`, [digest, origin.fingerprint, scope.projectRoot, scope.runId, scope.rootSessionId, scope.generation, JSON.stringify(scope)]);
         if (prior.status === "executing" || prior.status === "settled") {
             const outcome = prior.outcome_json ? JSON.parse(prior.outcome_json) : null;
             recovered.push({ invocation_id: id, status: prior.status, outcome,
@@ -968,6 +1054,9 @@ export function recoverLifecycleCommands(context, originalPrompt, scope) {
         const env = { ...parsed.env, DD_FLOW_INVOCATION_SCOPE: JSON.stringify(scope) };
         const command = `${Object.entries(env).map(([key, value]) => `${key}=${quote([value])}`).join(" ")} ${launchExpression(parsed)} ${quote(argv)} ${prior.command.slice(shellSuffixOffset(prior.command))}`.trim();
         const prepared = managedLifecycleCommand({ ...context, env: { ...context.env, DD_FLOW_INVOCATION_SCOPE: JSON.stringify(scope), DD_FLOW_CURRENT_INVOCATION: undefined } }, command);
+        const successor = currentIssuedCommand(context, JSON.stringify(scope), prepared);
+        if (successor)
+            inheritAssignedPackets(context, prior.id, successor.id);
         recovered.push({ invocation_id: id, status: "replaced_unexecuted", command: prepared });
     }
     return recovered;
@@ -1029,6 +1118,28 @@ function checkCommand(row, command) {
         throw new AppError("invocation_command_mismatch", "Lifecycle attempt belongs to another command or project", 1, { invocation_id: row.id });
     }
 }
+/** Match a daemon-attested native tool against its exact issued command.
+ * This is only a correlation check: claim/owner/generation are verified again
+ * by the normal invocation path before the command can mutate anything. */
+export function matchesIssuedNativeCommand(context, id, command) {
+    const row = load(context, id);
+    const analysis = parseLifecycleCommand(command);
+    if (analysis.kind === "none" || analysis.supported === false)
+        return false;
+    try {
+        const scope = JSON.parse(row.scope_json);
+        const parsed = invocation(canonicalManagedCommand(context, analysis.invocation.command, scope));
+        assertSuppliedLifecycleTarget(row, parsed);
+        // Public Work packets deliberately omit the internal UUID. The caller
+        // has already selected the unique issued assignment in its managed scope;
+        // this comparison supplies no authority and must still pass native proof/CAS.
+        const supplied = commandOption(parsed, "invocation-id");
+        return (supplied === id || supplied === undefined && parsed.operation === "work_start") && fingerprint(parsed) === row.fingerprint;
+    }
+    catch {
+        return false;
+    }
+}
 /** Public commands may omit the coordinator RUN. A supplied target remains
  * input to validate, not text to silently overwrite with retained authority. */
 function assertSuppliedLifecycleTarget(row, actual) {
@@ -1480,6 +1591,32 @@ export function observeLifecycleInvocation(context, input) {
 }
 function observeLifecycleInvocationReceipt(context, input) {
     storage(context);
+    const delivered = parseLifecycleCommand(input.command);
+    if (delivered.kind === "standalone") {
+        const id = commandOption(delivered.invocation, "invocation-id");
+        const direct = context.db.all("SELECT * FROM lifecycle_invocations WHERE admission_json IS NOT NULL AND status IN ('executing','settled')")
+            .filter(row => {
+            const scope = JSON.parse(row.scope_json);
+            if (id && row.id !== id || scope.daemonId !== input.identity.daemonId || scope.rootSessionId !== input.identity.rootSessionId)
+                return false;
+            // A fresh native call must bind the explicitly committed successor,
+            // not short-circuit to its predecessor's successful repair response.
+            // Exact delivery/explicit-ID replay remains historical read-only.
+            const successor = row.status === "settled" && row.outcome_json ? committedSuccessor(context, row, JSON.parse(row.outcome_json)) : null;
+            if (!id && row.identity_json && successor && ["issued", "observed"].includes(successor.status)
+                && !sameNativeCall(row.identity_json, JSON.stringify([input.identity.daemonId, input.identity.rootSessionId, input.identity.sessionId, input.identity.parentSessionId, input.identity.toolCallId])))
+                return false;
+            try {
+                return fingerprint(invocation(canonicalManagedCommand(context, delivered.invocation.command, scope))) === row.fingerprint;
+            }
+            catch {
+                return false;
+            }
+        });
+        if (direct.length === 1)
+            return { eventKey: direct[0].event_key, duplicate: true,
+                disposition: direct[0].status === "settled" ? "settled_read" : "in_flight", invocationId: direct[0].id };
+    }
     const projectRoot = input.projectId ? context.db.get("SELECT root FROM projects WHERE id = ?", [input.projectId])?.root : undefined;
     const provenScope = projectRoot && input.harness ? managedNativeInvocationScope(context, projectRoot, input.identity, input.harness) : null;
     const owner = provenScope && input.harness && input.projectId ? managedNativeOwner(context, input.identity, input.harness, input.projectId) : null;
@@ -1587,6 +1724,10 @@ function observeLifecycleInvocationReceipt(context, input) {
     // public ID is corrected only by an exact operation/target match inside the
     // trusted native root. Never fuzzy-match UUID text or select a global latest.
     const initial = supplied ?? (candidates.length === 1 ? candidates[0] : undefined);
+    // A live observation arriving after direct admission is optional correlation,
+    // never a second authority or an executing -> observed transition.
+    if (initial?.admission_json && ["executing", "settled"].includes(initial.status))
+        return { eventKey: initial.event_key, duplicate: true, disposition: initial.status === "settled" ? "settled_read" : "in_flight", invocationId: initial.id };
     if (!supplied && candidates.length > 1) {
         input.recordReceipt();
         throw new AppError("invocation_ambiguous", "More than one issued lifecycle attempt matches this native command", 1, { effect: "no_effect", matches: candidates.map(row => row.id), ...(provenScope ? { lifecycle_assignment: { issuer: "dd-flow", scope: provenScope } } : {}) });
@@ -2024,13 +2165,50 @@ export async function awaitLifecycleInvocation(context, input) {
     if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 60000)
         throw new AppError("invocation_timeout_invalid", "Receipt timeout must be within 1..60000 ms", 1);
     context.db.run("UPDATE lifecycle_invocations SET deadline = COALESCE(deadline, ?), updated_at = ? WHERE id = ? AND status = 'issued'", [Date.now() + timeoutMs, context.now(), input.id]);
+    const initialClock = new ObservationClock({ timeoutMs }), seenProgress = new Set();
+    const receiptClock = new ObservationClock({ timeoutMs, snapshotIsLive: true, saved: { ...initialClock.state(),
+            elapsed_ms: Math.max(0, timeoutMs - Math.max(0, (load(context, input.id).deadline ?? Date.now()) - Date.now())) } });
     for (;;) {
-        const row = load(context, input.id);
+        let row = load(context, input.id);
+        if (row.status === "issued" && invocation(row.command).operation === "work_start" && input.reconcileNativeObservation) {
+            const scope = JSON.parse(row.scope_json);
+            input.assertCurrent(scope);
+            await input.reconcileNativeObservation(scope, progress => {
+                input.assertCurrent(scope);
+                if (seenProgress.has(progress.cursor))
+                    return;
+                const current = load(context, input.id);
+                if (current.status !== 'issued' || current.scope_json !== row.scope_json || current.deadline === null
+                    || !Number.isFinite(progress.observed_at) || progress.observed_at >= current.deadline || progress.observed_at > Date.now())
+                    return;
+                const expired = receiptClock.sample(progress);
+                const state = receiptClock.state();
+                if (expired || state.cursor !== progress.cursor)
+                    return;
+                seenProgress.add(progress.cursor);
+                context.db.run("UPDATE lifecycle_invocations SET deadline = ?, updated_at = ? WHERE id = ? AND status = 'issued' AND scope_json = ?", [Date.now() + Math.max(1, timeoutMs - state.elapsed_ms), context.now(), input.id, row.scope_json]);
+                input.progress?.("native_verification_progress");
+            });
+            // A native receipt can arrive while it is being read. Reload it before
+            // deciding whether this exact invocation is eligible for admission.
+            row = load(context, input.id);
+            if (row.status !== "issued")
+                continue;
+        }
         if (row.status === "settled")
             return { outcome: JSON.parse(row.outcome_json), replay: true };
         if (row.status === "executing") {
             const scope = JSON.parse(row.scope_json);
             const parsed = invocation(row.command);
+            if (row.admission_json && ["work_finish", "work_fail"].includes(parsed.operation)) {
+                const { recoverCommittedAssignedWork } = await import("./work-registry.js");
+                const result = recoverCommittedAssignedWork(context, row.id);
+                if (result) {
+                    const outcome = { result };
+                    settleLifecycleInvocation(context, row.id, outcome);
+                    return { outcome, replay: true };
+                }
+            }
             if (parsed.operation === "stage_resume" && scope.runId) {
                 input.assertCurrent(scope);
                 const { recoverCommittedStageResume } = await import("./stage-pause.js");
@@ -2073,6 +2251,14 @@ export async function awaitLifecycleInvocation(context, input) {
             throw new AppError("invocation_outcome_pending", "This attempt already started; inspect its retained operation outcome before retrying", 1, { invocation_id: input.id, effect: "unknown" });
         }
         input.assertCurrent(JSON.parse(row.scope_json));
+        if (["issued", "observed"].includes(row.status) && assignedLifecycleBinding(context, row)) {
+            if (claimAssignedLifecycle(context, row))
+                return { kind: "managed_assignment", replay: false };
+            continue;
+        }
+        if (row.status === "issued" && context.env.DD_FLOW_DAEMON_ID && ["work_finish", "work_fail", "stage_finish", "stage_pause", "stage_resume", "stage_start"].includes(invocation(row.command).operation)) {
+            throw new AppError("invocation_assignment_unproven", "Current managed assignment is unavailable; reconcile this operation without repeating Work", 1, { invocation_id: row.id, effect: "no_effect", recoverable: true, reconciliation_required: true });
+        }
         if (row.status === "observed") {
             if (row.identity_json) {
                 // Receipt display text is bounded/redacted and may not be valid JSON.
@@ -2086,11 +2272,13 @@ export async function awaitLifecycleInvocation(context, input) {
             }
             // Another native observation can replace an unclaimed receipt. Claim
             // exactly the identity/route checked above, or reload and validate it.
-            const workStart = invocation(row.command).operation === "work_start";
-            const birth = workStart ? processStartedAt(process.pid) : null, cwd = workStart ? process.cwd() : "";
+            const operation = invocation(row.command).operation;
+            const physicalAdmission = operation === "work_start" || operation.startsWith("delivery_");
+            const birth = physicalAdmission ? processStartedAt(process.pid) : null, cwd = physicalAdmission ? process.cwd() : "";
             input.assertCurrent(JSON.parse(row.scope_json));
             let admittedAt = "";
             const claimed = context.db.writeTransaction(() => {
+                assertTerminalSettlementUnreserved(context, row);
                 // Acquire the writer before taking the anchor; waiting for SQLite or
                 // physical birth observation must not make an old Hook appear fresh.
                 admittedAt = context.now();
@@ -2107,7 +2295,7 @@ export async function awaitLifecycleInvocation(context, input) {
                         owned.delete(owned.keys().next().value);
                     owned.set(input.id, { eventKey: row.event_key, identity: row.identity_json, scope: row.scope_json, command: row.command, cwd, pid: process.pid, birth, admittedAt });
                 }
-                return { eventKey: row.event_key, replay: false };
+                return { kind: "native_hook", eventKey: row.event_key, replay: false };
             }
             continue;
         }
@@ -2139,8 +2327,10 @@ export function settleLifecycleInvocation(context, id, outcome) {
         }
         if (row.status !== "executing")
             throw new AppError("invocation_settlement_conflict", "Attempt is no longer executing", 1, { invocation_id: id });
-        if (successor)
+        if (successor) {
             insertIssuedInvocation(context, successor);
+            inheritAssignedPackets(context, id, successor.id);
+        }
         if (context.db.run("UPDATE lifecycle_invocations SET status = 'settled', outcome_json = ?, updated_at = ? WHERE id = ? AND status = 'executing'", [encoded, context.now(), id]).changes !== 1)
             throw new AppError("invocation_settlement_conflict", "Lifecycle outcome changed before commit", 1, { invocation_id: id });
     });

package/dist/services/managed-daemon-binding.js

@@ -1,7 +1,31 @@
 import fs from "node:fs";
 import path from "node:path";
 import { AppError } from "../shared/errors.js";
-import { managedProcessRuntimeHome, managedProcessStatus } from "./managed-processes.js";
+import { managedProcessRuntimeHome, managedProcessStatus, processTreeIsAlive } from "./managed-processes.js";
+/** Native execution and AGY's potentially scheduled writers are separate facts. */
+export function managedExecutionReusable(state, harness) {
+    const shutdown = state.shutdown, result = shutdown?.result;
+    if (state.active_tree !== false || state.unclaimed_activity === true || shutdown?.phases?.execution !== true
+        || result?.native_settled !== true || result.settled !== true || result.native_settlement?.confirmed === false
+        || state.native_execution_revision !== undefined && state.native_execution_revision !== result.native_settlement?.revision)
+        return false;
+    // These adapters do not yet publish a revision for every possible late
+    // child/tool event. A completed native observation alone cannot exclude a
+    // newly scheduled writer; the caller can still use physical absence.
+    if (["zcode-acp", "droid-cli"].includes(harness))
+        return false;
+    if (harness !== "antigravity-cli")
+        return true;
+    const daemon = state.daemon_id ?? state.config?.daemonId, proof = shutdown.native_resource_reconciliation, resources = result.native_resources;
+    return Boolean(daemon && shutdown.phases.native_resources_reconciled === true && proof?.daemon_id === daemon
+        && proof.dispatch_generation === shutdown.generation && Number.isSafeInteger(proof.dispatch_generation)
+        && proof.native_revision === state.native_execution_revision && Number.isSafeInteger(proof.native_revision)
+        && resources?.schema_id === "native-resources@1" && resources.owner_daemon_id === daemon
+        && resources.revision === proof.native_revision && Number.isSafeInteger(resources.generation)
+        && result.native_settlement?.owner_daemon_id === daemon && result.native_settlement.generation === resources.generation
+        && Array.isArray(resources.entries)
+        && resources.entries.every(item => item.owner_daemon_id === daemon && item.generation === resources.generation && item.state === "stopped"));
+}
 export function readNativeDaemonState(stateDir) {
     if (!path.isAbsolute(stateDir))
         throw new AppError("daemon_owner_mismatch", "Native state directory must be absolute", 1);
@@ -36,3 +60,30 @@ export function requireManagedDaemonBinding(context, input) {
     }
     return { state, process: record };
 }
+/** A dead bridge is not enough: its provider may own a detached process group. */
+export function managedDaemonExecutionAbsent(context, input) {
+    const binding = requireManagedDaemonBinding(context, input);
+    const records = managedProcessStatus(context).filter(record => {
+        try {
+            return JSON.parse(record.metadata_json).state_dir === input.stateDir;
+        }
+        catch {
+            return false;
+        }
+    });
+    if (!records.length || records.some(record => {
+        const group = JSON.parse(record.metadata_json).process_group_id;
+        // A dead leader without its retained tree boundary cannot exclude surviving
+        // children. Fall back to strict native reconciliation, not assumed absence.
+        return record.project_id !== input.projectId || record.run_id !== input.runId
+            || managedProcessRuntimeHome(record, context) !== context.ddFlowHome || !record.pid || !record.pid_started_at
+            || !Number.isSafeInteger(group) || group <= 0 || processTreeIsAlive(record);
+    }))
+        return false;
+    if (binding.state.provider_process || binding.state.provider_pid) {
+        const provider = records.find(record => record.id === binding.state.provider_process?.id);
+        if (!provider || !managedProviderBelongsToDaemon(provider, binding.process, binding.state))
+            return false;
+    }
+    return true;
+}