@deksden-com/dd-flow-cli 0.9.0-beta.152 → 0.9.0-beta.156

package/dist/services/distill-stage-results.js

@@ -0,0 +1,105 @@
+import path from "node:path";
+import { Ajv2020 } from "ajv/dist/2020.js";
+import { AppError } from "../shared/errors.js";
+import { distillAspects } from "../domain/distill-flow.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { verifyDiagnosticCoverage, verifyDiagnosticSources } from "./diagnostic-evidence.js";
+function refuse(reason) {
+    throw new AppError("distill_stage_result_invalid", "Distillation stage result lacks its exact input, reviewed scope or publication proof", 2, { reason, effect: "no_effect", ...(reason === "invalid_schema" ? { phase: "prepare", recoverable: true } : {}) });
+}
+const portable = (value) => Boolean(value) && !path.posix.isAbsolute(value) && !path.win32.isAbsolute(value)
+    && !value.includes("\\") && !value.includes("\0") && value.split("/").every(part => Boolean(part) && ![".", "..", ".git", "node_modules"].includes(part));
+/** Shape/evidence checks do not establish independent Work or publication
+ * custody. The registered handler must prepare those bindings and fence them
+ * again in its settlement transaction. */
+export function validateDistillStageResult(bytes, schemaBytes, binding) {
+    if (!bytes.length || bytes.length > 1024 * 1024 || !schemaBytes.length || schemaBytes.length > 1024 * 1024)
+        refuse("result_exceeds_bound");
+    const validate = (() => {
+        try {
+            const schema = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(schemaBytes));
+            if (schema.$id !== "dd-flow/distill-stage-result@1")
+                refuse("frozen_schema_invalid");
+            return new Ajv2020({ strict: false, validateFormats: false }).compile(schema);
+        }
+        catch {
+            return refuse("frozen_schema_invalid");
+        }
+    })();
+    let result;
+    try {
+        result = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    catch {
+        return refuse("invalid_schema");
+    }
+    if (!validate(result))
+        refuse("invalid_schema");
+    if (result.flow_id !== "mb-distill" || result.run_id !== binding.runId || result.stage !== binding.stage
+        || result.input_sha256 !== binding.inputSha256 || result.snapshot_sha256 !== binding.snapshotSha256
+        || hybridDigest(result.predecessors) !== hybridDigest(binding.predecessors))
+        refuse("foreign_stage_binding");
+    const details = result.details;
+    verifyDiagnosticCoverage(binding.snapshotRoot, distillAspects.map(aspect => aspect.id), details.coverage);
+    const ids = new Set();
+    const baseline = (refs) => {
+        if (refs.some(ref => !binding.support.some(source => source.path === ref.path && source.sha256 === ref.sha256)))
+            refuse("foreign_baseline");
+    };
+    for (const candidate of details.candidates) {
+        if (ids.has(candidate.id) || !details.coverage.some(row => row.id === candidate.aspect_id && row.applicability === "applicable"))
+            refuse("candidate_outside_selection");
+        ids.add(candidate.id);
+        baseline(candidate.baseline_refs);
+        verifyDiagnosticSources(binding.snapshotRoot, [...candidate.source_refs, ...candidate.usage_refs]);
+    }
+    const decided = new Set();
+    for (const decision of details.decisions) {
+        if (!ids.has(decision.candidate_id) || decided.has(decision.candidate_id))
+            refuse("foreign_or_duplicate_decision");
+        decided.add(decision.candidate_id);
+        baseline(decision.baseline_refs);
+        verifyDiagnosticSources(binding.snapshotRoot, decision.source_refs);
+    }
+    if (!["preflight", "extract"].includes(binding.stage) && decided.size !== ids.size)
+        refuse("unresolved_candidate");
+    if (hybridDigest(details.write_scope) !== hybridDigest(binding.writeScope)
+        || hybridDigest(details.promotion_receipt) !== hybridDigest(binding.promotionReceipt))
+        refuse("unowned_publication_claim");
+    const scope = binding.writeScope;
+    if (!["verify", "finish"].includes(binding.stage) && details.verification.length)
+        refuse("verification_before_publication_review");
+    if (scope) {
+        if (!["promote", "verify", "finish"].includes(binding.stage) || !path.isAbsolute(scope.destination_root)
+            || path.resolve(scope.destination_root) !== scope.destination_root || scope.paths.some(value => !portable(value))
+            || scope.candidate_ids.some(id => !details.decisions.some(decision => decision.candidate_id === id && ["adopt", "adapt"].includes(decision.disposition))))
+            refuse("invalid_write_scope");
+        verifyDiagnosticSources(binding.runRoot, [scope.approval_source]);
+    }
+    if (binding.promotionReceipt)
+        verifyDiagnosticSources(binding.runRoot, [binding.promotionReceipt]);
+    if (binding.stage === "promote" && details.decisions.some(decision => ["adopt", "adapt"].includes(decision.disposition))
+        && (!scope || !binding.promotionReceipt))
+        refuse("promotion_requires_accepted_scope_and_receipt");
+    const verified = new Set();
+    for (const observation of details.verification) {
+        if (!scope?.candidate_ids.includes(observation.candidate_id) || verified.has(observation.candidate_id))
+            refuse("foreign_verification");
+        verified.add(observation.candidate_id);
+        for (const evidence of observation.evidence)
+            verifyDiagnosticSources(evidence.root === "run" ? binding.runRoot : scope.destination_root, [evidence]);
+    }
+    if (["verify", "finish"].includes(binding.stage) && details.decisions.some(decision => ["adopt", "adapt"].includes(decision.disposition))
+        && (!scope || !binding.promotionReceipt || scope.candidate_ids.some(id => !verified.has(id))
+            || details.verification.some(observation => observation.verdict !== "verified")))
+        refuse("unverified_promotion");
+    return result;
+}
+export function assertDistillStageScope(result, prior) {
+    if (hybridDigest(result.details.coverage) !== hybridDigest(prior.details.coverage)
+        || prior.details.limitations.some(value => !result.details.limitations.includes(value))
+        || (prior.stage !== "preflight" && hybridDigest(result.details.candidates) !== hybridDigest(prior.details.candidates))
+        || (!["preflight", "extract"].includes(prior.stage) && hybridDigest(result.details.decisions) !== hybridDigest(prior.details.decisions))
+        || (prior.details.write_scope && hybridDigest(result.details.write_scope) !== hybridDigest(prior.details.write_scope)))
+        refuse("accepted_scope_changed");
+}

package/dist/services/distill-user-inputs.js

@@ -0,0 +1,4 @@
+import { readMemoryFlowUserInputs } from "./memory-flow-user-inputs.js";
+export function readDistillUserInputs(context, input, retainedBundle) {
+    return readMemoryFlowUserInputs(context, input, "mb-distill", retainedBundle);
+}

package/dist/services/distill-work-batch.js

@@ -0,0 +1,42 @@
+import { distillAspects } from "../domain/distill-flow.js";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+function refuse(reason) {
+    throw new AppError("distill_work_batch_invalid", "Distillation requires its accepted complete aspect selection", 2, { reason, effect: "no_effect" });
+}
+/** One selected aspect is one independent semantic unit. Capacity changes
+ * scheduling in the existing Work runtime, never selection or dependencies. */
+export function distillWorkBatch(input) {
+    const ids = input.coverage.map(row => row.id);
+    if (input.flow_id !== "mb-distill" || !["extract", "review"].includes(input.stage)
+        || ids.length !== distillAspects.length || new Set(ids).size !== ids.length
+        || distillAspects.some(aspect => !ids.includes(aspect.id))
+        || input.coverage.some(row => !row.reason.trim() || !["applicable", "not_applicable", "blocked", "out_of_scope"].includes(row.applicability)))
+        refuse("invalid_coverage");
+    const selected = distillAspects.filter(aspect => input.coverage.some(row => row.id === aspect.id && row.applicability === "applicable"));
+    if (input.stage === "extract" && input.candidates.length)
+        refuse("extract_cannot_accept_candidates");
+    if (new Set(input.candidates.map(candidate => candidate.id)).size !== input.candidates.length
+        || input.candidates.some(candidate => !selected.some(aspect => aspect.id === candidate.aspect_id)))
+        refuse("candidate_outside_selection");
+    for (const aspect of selected)
+        if (!input.support.some(ref => ref.path === aspect.criterion))
+            refuse("missing_selected_criterion");
+    const review = input.stage === "review";
+    const assignments = review
+        ? [{ id: "novelty", criterion: null, role: "critic" }, { id: "portability", criterion: null, role: "critic" }]
+        : selected.map(aspect => ({ id: aspect.id, criterion: aspect.criterion, role: "aspect" }));
+    return { works: assignments.map((assignment, index) => {
+            const key = `${assignment.role}-${String(index + 1).padStart(3, "0")}`;
+            const packet = { schema_id: "dd-flow/distill-work-input@1", ...structuredClone(input), key,
+                aspect_id: assignment.id, role: assignment.role, criterion: assignment.criterion };
+            return { key, depends_on: [], launch_policy: "fresh_agent_required",
+                result_schema: "dd-flow/distill-work-result@1",
+                task: (review
+                    ? `Independently review every candidate through the ${assignment.id} lens. Compare exact project usage and frozen canon baseline. Preserve observe/duplicate/reject decisions and disagreements. Adopt/adapt requires transferable applicability and sufficient evidence, not popularity or missing project compliance. Return one decision per candidate. Do not replace candidates, promote documents, change scope, allocate Work or claim another critic's review.`
+                    : `Extract transferable practices only for ${assignment.id}. Read its frozen criterion and canon baseline, then actual assigned project sources. Do not audit project compliance. Explain novelty, usage, applicability, cost and complexity; distinguish established practice from plans. Keep domain and process lenses separate. Return an explicit checked/no-candidate explanation when nothing substantial is found. Decide whether external research can change the assessment and disclose use and sources. Do not mutate project/canon, promote documents, allocate Work or self-accept candidates.`)
+                    + " Read support references relative to run_home/execution-bundle; preserve their supplied support paths and hashes in baseline_refs. Project source_refs/usage_refs are relative to the assigned snapshot workspace with exact snapshot-file hashes, never canon, intake or RUN files. Old manual lifecycle/dispatch snippets in criteria are reference data, not execution authority.",
+                payload: { kind: review ? "distill-critic" : "distill-aspect", read_only: true,
+                    distill: { ...packet, packet_sha256: hybridDigest(packet) } } };
+        }) };
+}

package/dist/services/distill-work-collection.js

@@ -0,0 +1,74 @@
+import { AppError } from "../shared/errors.js";
+import { readFlowRunExecutionBundle, assertPreparedRunBundleSqlAuthority } from "./runs.js";
+import { requireProjectByRoot } from "./projects.js";
+import { resolveProjectRoot } from "../storage/paths.js";
+import { readDescriptorRootWork } from "./descriptor-root-work.js";
+import { diagnosticSnapshotPaths, readDiagnosticSnapshot, readDiagnosticSnapshotCustody } from "./diagnostic-snapshot.js";
+import { readRegisteredDistillGraph } from "./distill-work-registration.js";
+import { distillWorkBatch } from "./distill-work-batch.js";
+import { validateDistillWorkResult } from "./distill-work-results.js";
+import { assertDiagnosticSessionIndependence, readCompletedResearchWork } from "./diagnostic-work-collection.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+function refuse(reason) {
+    throw new AppError("distill_work_collection_invalid", "Distillation requires the complete independently settled registered graph", 2, { reason, effect: "no_effect" });
+}
+function collectSql(context, scope, rootId) {
+    const graph = readRegisteredDistillGraph(context, scope);
+    if (!graph || graph.parent_work_id !== rootId)
+        refuse("registration_required");
+    const batch = distillWorkBatch(graph.input);
+    const works = batch.works.map(item => readCompletedResearchWork(context, scope, graph.work_ids[item.key]));
+    const coordinators = context.db.all("SELECT s.harness,s.provider_session_id FROM work_sessions ws JOIN sessions s ON s.project_id=? AND s.run_id=? AND s.session_id=ws.session_id WHERE ws.work_id=?", [scope.projectId, scope.runId, rootId]);
+    const authorGraph = scope.stage === "review" ? readRegisteredDistillGraph(context, { ...scope, stage: "extract" }) : null;
+    if (scope.stage === "review" && !authorGraph)
+        refuse("author_graph_missing");
+    const authors = authorGraph ? Object.values(authorGraph.work_ids).map(id => readCompletedResearchWork(context, scope, id)) : [];
+    assertDiagnosticSessionIndependence(works.map(work => work.session), [...coordinators, ...authors.map(work => work.session)]);
+    return { graph, works, authors, coordinators };
+}
+export class PreparedDistillWorkCollection {
+    #scope;
+    #rootId;
+    #sql;
+    #snapshot;
+    #results;
+    constructor(scope, rootId, sql, snapshot, results) {
+        this.#scope = scope;
+        this.#rootId = rootId;
+        this.#sql = sql;
+        this.#snapshot = snapshot;
+        this.#results = results;
+        Object.freeze(this);
+    }
+    static prepare(context, input) {
+        const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot)), bundle = readFlowRunExecutionBundle(context, input);
+        if (!bundle || bundle.manifest.flow_id !== "mb-distill")
+            refuse("distill_bundle_required");
+        const scope = { projectId: project.id, runId: input.runId, stage: input.stage }, frozen = bundle.execution.snapshot().scope;
+        const snapshot = readDiagnosticSnapshot(context, { projectId: project.id, projectRoot: frozen.projectRoot,
+            sourceRoot: frozen.projectRoot, requestId: frozen.requestId, flowId: "mb-distill" }, input.runId);
+        if (!snapshot || snapshot.root !== frozen.workspace)
+            refuse("snapshot_required");
+        const root = readDescriptorRootWork(context, scope, bundle);
+        const sql = context.db.readSnapshot(() => {
+            assertPreparedRunBundleSqlAuthority(context, scope, bundle);
+            return collectSql(context, scope, root.workId);
+        });
+        if (sql.graph.bundle_sha256 !== bundle.sha256 || sql.graph.input.snapshot_sha256 !== snapshot.source_sha256)
+            refuse("foreign_graph");
+        const batch = distillWorkBatch(sql.graph.input), schema = bundle.blob("schemas/distill-work-result.schema.json");
+        const results = sql.works.map((work, index) => ({ workId: work.workId,
+            result: validateDistillWorkResult(Buffer.from(work.result), schema, diagnosticSnapshotPaths(context, snapshot, input.runId).root, sql.graph.input, {
+                workId: work.workId, aspectId: batch.works[index].payload.distill.aspect_id, role: batch.works[index].payload.distill.role
+            }) }));
+        return new PreparedDistillWorkCollection(scope, root.workId, sql, snapshot, results);
+    }
+    results() { return structuredClone(this.#results); }
+    assertCustody(context) {
+        const s = this.#snapshot;
+        if (hybridDigest(collectSql(context, this.#scope, this.#rootId)) !== hybridDigest(this.#sql)
+            || hybridDigest(readDiagnosticSnapshotCustody(context, { projectId: s.projectId, projectRoot: s.projectRoot,
+                sourceRoot: s.sourceRoot, requestId: s.requestId, flowId: s.flowId }, this.#scope.runId)) !== hybridDigest(s))
+            refuse("collection_changed");
+    }
+}

package/dist/services/distill-work-registration.js

@@ -0,0 +1,93 @@
+import { AppError } from "../shared/errors.js";
+import { readFlowRunExecutionBundle, assertPreparedRunBundleSqlAuthority } from "./runs.js";
+import { requireProjectByRoot } from "./projects.js";
+import { resolveProjectRoot } from "../storage/paths.js";
+import { readDescriptorStageInput } from "./descriptor-stage-coordinator.js";
+import { readDescriptorRootWork } from "./descriptor-root-work.js";
+import { readAcceptedStageData } from "./stage-report-renderer.js";
+import { diagnosticSnapshotPaths, readDiagnosticSnapshot, readDiagnosticSnapshotCustody } from "./diagnostic-snapshot.js";
+import { validateDistillStageResult } from "./distill-stage-results.js";
+import { distillWorkBatch } from "./distill-work-batch.js";
+import { prepareWorkBatch, addWorkBatch, readWorkBatchCustody } from "./work-registry.js";
+import { stageGraphScope } from "./stage-work-graph.js";
+import { appendAudit } from "./audit.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+const event = "distill.work_registration";
+function refuse(reason) {
+    throw new AppError("distill_work_registration_invalid", "Distillation graph requires its accepted predecessor and frozen stage", 2, { reason, effect: "no_effect" });
+}
+export function readRegisteredDistillGraph(context, scope) {
+    const graph = stageGraphScope(context, scope.projectId, scope.runId, scope.stage);
+    const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type=? AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.stage')=? AND json_extract(payload_json,'$.attempt')=? LIMIT 2", [scope.projectId, event, scope.runId, scope.stage, graph.attempt]);
+    if (!rows.length)
+        return null;
+    if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 2 * 1024 * 1024)
+        refuse("ambiguous_registration");
+    const receipt = JSON.parse(rows[0].payload_json);
+    if (receipt.schema_id !== "dd-flow/distill-work-registration@1" || receipt.run_id !== scope.runId || receipt.stage !== scope.stage
+        || receipt.attempt !== graph.attempt || !receipt.work_ids || receipt.input.run_id !== scope.runId
+        || receipt.input.stage !== scope.stage || receipt.input.input_sha256 !== receipt.input_sha256)
+        refuse("foreign_registration");
+    const batch = distillWorkBatch(receipt.input);
+    if (receipt.batch_sha256 !== hybridDigest(batch.works) || batch.works.length !== Object.keys(receipt.work_ids).length
+        || new Set(Object.values(receipt.work_ids)).size !== batch.works.length)
+        refuse("changed_batch");
+    for (const item of batch.works) {
+        const id = receipt.work_ids[item.key];
+        if (!id)
+            refuse("missing_work");
+        const custody = readWorkBatchCustody(context, id);
+        if (custody.item_key !== item.key || custody.batch_sha256 !== receipt.batch_sha256
+            || hybridDigest(custody.work_ids) !== hybridDigest(receipt.work_ids)
+            || hybridDigest(custody.scope) !== hybridDigest({ ...graph, stage: scope.stage, parent_work_id: receipt.parent_work_id, request_key: "distill-graph" }))
+            refuse("changed_work_custody");
+    }
+    return receipt;
+}
+export function registerDistillStageGraph(context, input) {
+    const bundle = readFlowRunExecutionBundle(context, input), project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    if (!bundle || bundle.manifest.flow_id !== "mb-distill" || !["extract", "review"].includes(input.stage))
+        refuse("distill_stage_required");
+    const frozen = bundle.execution.snapshot().scope, scope = { projectId: project.id, runId: input.runId, stage: input.stage };
+    const selection = readDescriptorStageInput(context, scope, bundle), root = readDescriptorRootWork(context, scope, bundle);
+    const snapshotScope = { projectId: project.id, projectRoot: frozen.projectRoot, sourceRoot: frozen.projectRoot, requestId: frozen.requestId, flowId: "mb-distill" };
+    const snapshot = readDiagnosticSnapshot(context, snapshotScope, input.runId);
+    if (!snapshot || snapshot.root !== frozen.workspace)
+        refuse("snapshot_required");
+    const previousStage = input.stage === "extract" ? "preflight" : "extract";
+    if (selection.input.predecessor?.stage !== previousStage)
+        refuse("predecessor_required");
+    const previousScope = { ...scope, stage: previousStage }, accepted = readAcceptedStageData(context, previousScope);
+    const priorInput = readDescriptorStageInput(context, previousScope, bundle, true, true);
+    const support = bundle.manifest.inventory.filter(ref => ref.path.startsWith("support/"));
+    const previous = validateDistillStageResult(accepted.bytes, bundle.descriptor.stageBlob(previousStage, "result_schema"), {
+        runId: input.runId, stage: previousStage, inputSha256: priorInput.inputSha256, snapshotSha256: snapshot.source_sha256,
+        snapshotRoot: diagnosticSnapshotPaths(context, snapshot, input.runId).root, runRoot: selection.runRoot, support, writeScope: null, promotionReceipt: null,
+        predecessors: priorInput.input.predecessor ? [{ stage: priorInput.input.predecessor.stage, ...priorInput.input.predecessor.result }] : []
+    });
+    const workInput = { flow_id: "mb-distill", run_id: input.runId, stage: input.stage,
+        input_sha256: selection.inputSha256, snapshot_sha256: snapshot.source_sha256, instruction: bundle.descriptor.stageBlob(input.stage, "instruction").toString("utf8"),
+        coverage: previous.details.coverage, candidates: input.stage === "review" ? previous.details.candidates : [], support };
+    const batch = distillWorkBatch(workInput), batchInput = { parentWorkId: root.workId, stage: input.stage, requestKey: "distill-graph", value: batch };
+    const prepared = batch.works.length ? prepareWorkBatch(context, batchInput) : [];
+    return context.db.writeTransaction(() => {
+        assertPreparedRunBundleSqlAuthority(context, scope, bundle);
+        if (hybridDigest(readDiagnosticSnapshotCustody(context, snapshotScope, input.runId)) !== hybridDigest(snapshot)
+            || hybridDigest(readDescriptorStageInput(context, scope, bundle)) !== hybridDigest(selection)
+            || hybridDigest(readAcceptedStageData(context, previousScope)) !== hybridDigest(accepted)
+            || readDescriptorRootWork(context, scope, bundle).workId !== root.workId)
+            refuse("stage_authority_changed");
+        const expected = { schema_id: "dd-flow/distill-work-registration@1", run_id: input.runId, stage: input.stage, attempt: selection.attempt,
+            parent_work_id: root.workId, bundle_sha256: bundle.sha256, input_sha256: selection.inputSha256, input: workInput, batch_sha256: hybridDigest(batch.works) };
+        const prior = readRegisteredDistillGraph(context, scope);
+        if (prior) {
+            if (hybridDigest({ ...prior, work_ids: undefined }) !== hybridDigest(expected))
+                refuse("registration_changed");
+            return prior;
+        }
+        const workIds = batch.works.length ? addWorkBatch(context, { ...batchInput, prepared }).work_ids : {};
+        const receipt = { ...expected, work_ids: workIds };
+        appendAudit(context, { projectId: project.id, eventType: event, payload: receipt });
+        return readRegisteredDistillGraph(context, scope);
+    });
+}

package/dist/services/distill-work-results.js

@@ -0,0 +1,98 @@
+import { Ajv2020 } from "ajv/dist/2020.js";
+import { AppError } from "../shared/errors.js";
+import { verifyDiagnosticSources } from "./diagnostic-evidence.js";
+function refuse(reason) {
+    throw new AppError("distill_work_result_invalid", "Distillation result does not match its assigned aspect, evidence and baseline", 2, { reason, effect: "no_effect", ...(reason === "invalid_schema" ? { phase: "prepare", recoverable: true } : {}) });
+}
+/** Semantic judgments remain agent-owned. Mechanically verify the assigned
+ * unit, exact project evidence and frozen canon baseline before Work admission. */
+export function validateDistillWorkResult(bytes, schemaBytes, snapshotRoot, input, assignment) {
+    if (!bytes.length || bytes.length > 1024 * 1024 || !schemaBytes.length || schemaBytes.length > 1024 * 1024)
+        refuse("result_exceeds_bound");
+    const validate = (() => {
+        try {
+            const schema = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(schemaBytes));
+            if (schema.$id !== "dd-flow/distill-work-result@1")
+                refuse("frozen_schema_invalid");
+            return new Ajv2020({ strict: false, validateFormats: false }).compile(schema);
+        }
+        catch {
+            return refuse("frozen_schema_invalid");
+        }
+    })();
+    let result;
+    try {
+        result = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    catch {
+        return refuse("invalid_schema");
+    }
+    if (!validate(result))
+        refuse("invalid_schema");
+    if (result.flow_id !== input.flow_id || result.run_id !== input.run_id || result.stage !== input.stage
+        || result.work_id !== assignment.workId || result.aspect_id !== assignment.aspectId)
+        refuse("foreign_assignment");
+    const baseline = (refs) => {
+        if (new Set(refs.map(ref => ref.path)).size !== refs.length
+            || refs.some(ref => !input.support.some(source => source.path === ref.path && source.sha256 === ref.sha256)))
+            refuse("foreign_baseline");
+    };
+    const external = result.external_research;
+    if (!external.used && (external.sources.length || external.questions.length || external.signal !== "none" || external.effect !== "neutral"))
+        refuse("unperformed_research_claim");
+    if (external.signal !== "none" && !external.sources.length)
+        refuse("external_signal_without_sources");
+    for (const source of external.sources) {
+        try {
+            const url = new URL(source.url);
+            if (!["http:", "https:"].includes(url.protocol) || url.username || url.password)
+                refuse("invalid_external_source");
+        }
+        catch {
+            refuse("invalid_external_source");
+        }
+    }
+    if (assignment.role === "critic") {
+        const decisions = result.decisions.map(decision => decision.candidate_id);
+        if (input.stage !== "review" || result.candidates.length || new Set(decisions).size !== decisions.length
+            || decisions.length !== input.candidates.length || input.candidates.some(candidate => !decisions.includes(candidate.id)))
+            refuse("incomplete_critic_coverage");
+        for (const decision of result.decisions) {
+            if (!decision.source_refs.length && !decision.baseline_refs.length)
+                refuse("decision_without_evidence");
+            verifyDiagnosticSources(snapshotRoot, decision.source_refs);
+            baseline(decision.baseline_refs);
+        }
+    }
+    else {
+        if (input.stage !== "extract" || result.decisions.length
+            || !input.coverage.some(row => row.id === assignment.aspectId && row.applicability === "applicable"))
+            refuse("foreign_aspect");
+        const ids = new Set();
+        for (const candidate of result.candidates) {
+            if (candidate.aspect_id !== assignment.aspectId || ids.has(candidate.id))
+                refuse("foreign_or_duplicate_candidate");
+            ids.add(candidate.id);
+            verifyDiagnosticSources(snapshotRoot, candidate.source_refs);
+            verifyDiagnosticSources(snapshotRoot, candidate.usage_refs);
+            baseline(candidate.baseline_refs);
+        }
+    }
+    return result;
+}
+/** Collect admitted Work only; keep local IDs and all rejected/observed data. */
+export function collectDistillCandidates(results) {
+    const candidates = [], origins = [];
+    const owners = new Set();
+    for (const [workIndex, work] of results.entries()) {
+        if (owners.has(work.workId) || work.workId !== work.result.work_id || work.result.stage !== "extract")
+            refuse("foreign_or_duplicate_work");
+        owners.add(work.workId);
+        for (const [index, candidate] of work.result.candidates.entries()) {
+            const id = `DST-${String(workIndex + 1).padStart(3, "0")}-${String(index + 1).padStart(3, "0")}`;
+            candidates.push({ ...structuredClone(candidate), id });
+            origins.push({ id, work_id: work.workId, original_id: candidate.id });
+        }
+    }
+    return { candidates, origins };
+}

package/dist/services/eval-snapshots.js

@@ -22,15 +22,25 @@ import { prepareOutputFile } from "../cli/input-preparation.js";
 import { localEnvironmentAllowed, projectServicePathFilter } from "./workspace-files.js";
 import { cleanupScopeWriters } from "./scope-writer-cleanup.js";
 import { PreparedInstalledFlowSource } from "./installed-flow-source.js";
+import { PreparedProjectFlowSource } from "./project-flow-source.js";
 import { readSetupStatus } from "./setup.js";
-import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+import { isSourceSnapshotFlow } from "../domain/source-snapshot-flows.js";
+import { isDeliveryFlow } from "../domain/delivery-flows.js";
 import { isObservationOperation, nativeInventoryVersion, retainedDaemonOperations } from "./run-control.js";
 /** Capture the only flow boundary which exists before `stage start --bootstrap` creates a RUN. */
 export function prepareEvalBootstrapSnapshot(context, input) {
     let source;
-    if (input.flow !== undefined && input.flow !== "sdlc") {
-        if (input.flow !== "mb-init" && input.flow !== "mb-upgrade" && !isDiagnosticFlow(input.flow))
+    if (input.flow === "interactive") {
+        const projectRoot = resolveProjectRoot(input.projectRoot);
+        source = PreparedProjectFlowSource.fromProject({ projectRoot, workspace: projectRoot, flowId: "interactive" });
+        if (source.resolveRegisteredFlow().descriptor.stages[0]?.id !== "preflight")
+            throw new AppError("snapshot_flow_unsupported", "Interactive bootstrap requires its preflight entry", 2, { phase: "prepare", effect: "no_effect" });
+    }
+    else if (input.flow !== undefined && input.flow !== "sdlc") {
+        if (input.flow !== "mb-init" && input.flow !== "mb-upgrade" && !isSourceSnapshotFlow(input.flow) && !isDeliveryFlow(input.flow))
             throw new AppError("snapshot_flow_unsupported", "Bootstrap snapshot flow is not registered", 2, { phase: "prepare", effect: "no_effect" });
+        if (input.flow === "review-fix")
+            throw new AppError("snapshot_flow_unsupported", "Review-fix starts at intake, not the preflight bootstrap boundary", 2, { phase: "prepare", effect: "no_effect" });
         const home = context.env.DD_FLOW_CONFIG_HOME ?? context.ddFlowHome;
         const selected = readSetupStatus(home);
         if (!selected.installation)
@@ -223,7 +233,7 @@ export function prepareEvalRunSnapshotCreation(context, input) {
         throw new AppError("snapshot_output_inside_project", "Snapshot output must be outside the project and RUN workspace trees", 1, { output });
     prepareOutputFile(output);
     prepareSnapshotProjectGit(projectRoot, recovery && status.run.flow_kind === "mb-init");
-    prepareSnapshotWorkspace(workspaceRoot, projectRoot, isDiagnosticFlow(status.run.flow_kind));
+    prepareSnapshotWorkspace(workspaceRoot, projectRoot, isSourceSnapshotFlow(status.run.flow_kind));
     return { projectRoot, project, status, recovery, output, workspaceRoot, activeChildren };
 }
 function captureEvalRunSnapshot(context, input) {
@@ -241,7 +251,7 @@ function captureEvalRunSnapshot(context, input) {
         }
     }
     else
-        copyRuntimeTree(context.ddFlowHome, path.join(output, "runtime"), false, [...databaseFiles, ...codexExclusions, ...(isDiagnosticFlow(status.run.flow_kind) ? [workspaceRoot] : [])], grokProviderHomes(context.ddFlowHome), input.observationCuts);
+        copyRuntimeTree(context.ddFlowHome, path.join(output, "runtime"), false, [...databaseFiles, ...codexExclusions, ...(isSourceSnapshotFlow(status.run.flow_kind) ? [workspaceRoot] : [])], grokProviderHomes(context.ddFlowHome), input.observationCuts);
     for (const [file, cut] of input.journalCuts ?? []) {
         const target = path.join(output, "runtime", path.relative(context.ddFlowHome, file));
         fs.mkdirSync(path.dirname(target), { recursive: true });
@@ -281,7 +291,7 @@ function captureEvalRunSnapshot(context, input) {
         filter: projectPayloadFilter(projectRoot)
     });
     const projectGit = snapshotProjectGit(projectRoot, output, recovery && status.run.flow_kind === "mb-init");
-    const workspace = snapshotWorkspace(workspaceRoot, projectRoot, output, isDiagnosticFlow(status.run.flow_kind));
+    const workspace = snapshotWorkspace(workspaceRoot, projectRoot, output, isSourceSnapshotFlow(status.run.flow_kind));
     // Accepted Work results are captured in SQLite. Their file representations
     // are retained evidence, not a second authority or a checkpoint gate.
     if (recovery) {
@@ -1546,7 +1556,7 @@ function readBootstrapManifest(snapshot) {
         throw new AppError("snapshot_missing", "Bootstrap snapshot manifest is missing", 1, { snapshot });
     const value = JSON.parse(fs.readFileSync(file, "utf8"));
     const validBoundary = value.schema_id === "dd-eval/bootstrap-snapshot@1" ? value.stage === "specify" && value.flow === undefined
-        : value.schema_id === "dd-eval/bootstrap-snapshot@2" && (value.flow?.id === "mb-init" || value.flow?.id === "mb-upgrade" || isDiagnosticFlow(value.flow?.id)) && value.stage === "preflight"
+        : value.schema_id === "dd-eval/bootstrap-snapshot@2" && (value.flow?.id === "mb-init" || value.flow?.id === "mb-upgrade" || value.flow?.id === "interactive" || isSourceSnapshotFlow(value.flow?.id) || isDeliveryFlow(value.flow?.id)) && value.stage === "preflight"
             && Object.keys(value.flow).sort().join() === "descriptor_sha256,id,source_sha256"
             && /^[a-f0-9]{64}$/.test(value.flow.source_sha256) && /^[a-f0-9]{64}$/.test(value.flow.descriptor_sha256);
     if (!validBoundary || !value.project_root || !value.project_sha256 || !value.project_git?.branch || !value.project_git.head || !value.project_git.bundle_sha256)

package/dist/services/external-work-launch.js

@@ -22,6 +22,7 @@ import { readFlowRunExecutionBundle } from "./runs.js";
 import { stageWorkIds } from "./stage-work-graph.js";
 import { hybridDigest } from "./hybrid-contracts.js";
 import { prepareMemoryRepairDispatchFromStage, prepareMemorySecondRepairDispatchFromStage, prepareExternalMemoryRepairCopyFromStage, prepareMemorySecondRepairLaunchFromStage } from "./memory-review-handler.js";
+import { readRegisteredInteractiveWork } from "./interactive-work-registration.js";
 /**
  * Creates an external provider root for one already-created Work.  The launch
  * is not a Work claim: only the worker's trusted `work start` hook binds it.
@@ -60,7 +61,12 @@ export async function launchExternalWork(context, input) {
         }
         if (override?.delegation !== undefined)
             throw new AppError("generic_execution_invalid", "Work cannot replace the RUN's frozen delegation", 2);
-        const route = bundle.execution.work(stage, override?.agent_profile_id);
+        const interactive = bundle.manifest.flow_id === "interactive"
+            ? readRegisteredInteractiveWork(context, { projectId: work.project_id, runId: work.run_id }, bundle, work.work_id).packet : null;
+        if (interactive && interactive.owner_stage !== stage)
+            throw new AppError("execution_stage_mismatch", "Interactive role differs from its owning Stage", 2);
+        const route = interactive ? bundle.execution.work(stage, override?.agent_profile_id, interactive.stage)
+            : bundle.execution.work(stage, override?.agent_profile_id);
         const selected = { coordinator: route.coordinator, worker: route.worker,
             delegation: { mode: route.delegation.mode, max_parallel: route.delegation.mode === "external" ? route.delegation.max_parallel : null } };
         resolved = { ...selected, profile_hash: crypto.createHash("sha256").update(JSON.stringify(selected)).digest("hex") };
@@ -182,7 +188,7 @@ export async function launchExternalWork(context, input) {
         if (reviewCopy && reviewSourceHash(run.workspace_root, reviewInputs, reviewBase) !== reviewCopy.source_sha256)
             throw new AppError("read_only_input_changed", "Authoritative review workspace changed after the execution copy was made", 2, { work_id: work.work_id });
         const promptFile = path.join(root, "launch.md");
-        fs.writeFileSync(promptFile, `Start the assigned Work now. Your first tool call must be this exact standalone command:\n\n${workStartCommand(runtimeContext, work)}\n\nUse the packet returned by that command. Do not claim another Work or run this command more than once.\n\n${lifecycleRetryInstruction}${isolatedWorkspace ? `\n\nThe review copy has no .git. Read the captured status/diff or gitless note in ${path.join(isolatedWorkspace, ".dd-flow", "review-evidence")}; do not run Git inside the copy.\n` : "\n"}`);
+        fs.writeFileSync(promptFile, `Start the assigned Work now. Your first tool call must be this exact standalone command:\n\n${workStartCommand(runtimeContext, work)}\n\nUse the packet returned by that command. Do not claim another Work or run this command more than once.\n\nAfter the issued Work finish succeeds, end this Turn immediately. The coordinator, not you, continues the Stage. Do not then read or follow other runtime/coordinator prompts, run Stage checks, write Stage proposals, or invoke stage start/finish/resume.\n\n${lifecycleRetryInstruction}${isolatedWorkspace ? `\n\nThe review copy has no .git. Read the captured status/diff or gitless note in ${path.join(isolatedWorkspace, ".dd-flow", "review-evidence")}; do not run Git inside the copy.\n` : "\n"}`);
         const promptOperationId = `${operationId}:session.prompt`;
         context.db.run("UPDATE work_launches SET adapter_receipt_json = ?, updated_at = ? WHERE operation_id = ? AND status = 'launching'", [JSON.stringify({ create: created, progress_policy: "native-inactivity@1" }), context.now(), operationId]);
         let prompted;

package/dist/services/flow-catalog.js

@@ -2,6 +2,11 @@ import { vnextStages } from "../domain/stage-catalog.js";
 import { sdlcHandlerIdentities, memoryInitHandlerIdentities, memoryUpgradeHandlerIdentities } from "../domain/stage-handler-identities.js";
 import { AppError } from "../shared/errors.js";
 import { diagnosticFlowStages } from "../domain/diagnostic-flows.js";
+import { distillStages } from "../domain/distill-flow.js";
+import { memoryFixStages } from "../domain/memory-fix-flow.js";
+import { reviewFixStages } from "../domain/review-fix-flow.js";
+import { interactiveStages } from "../domain/interactive-flow.js";
+import { deliveryFlowStages } from "../domain/delivery-flows.js";
 /** Engine-owned catalog, not descriptor discovery or permission to execute a RUN. */
 export function listBundledFlows() {
     return [
@@ -16,6 +21,25 @@ export function listBundledFlows() {
                 edges: stages.slice(0, -1).flatMap((handler, index) => [{ from: handler.stage, to: stages[index + 1].stage, on: "accepted" },
                     ...(handler.stage === "verify" ? [{ from: handler.stage, to: "review", on: "needs_repair" }] : [])]) };
         }),
+        { id: "mb-distill", handler_status: "registered", entry_stage: "preflight", terminal_stages: ["finish"],
+            stages: distillStages.map((id, index) => ({ id, directory: `${String(index + 1).padStart(2, "0")}-${id}`, entry_handler: "distill-stage-entry", finish_handler: "distill-stage-finish" })),
+            edges: distillStages.slice(0, -1).map((from, index) => ({ from, to: distillStages[index + 1], on: "accepted" })) },
+        { id: "mb-fix", handler_status: "registered", entry_stage: "intake", terminal_stages: ["finish"],
+            stages: memoryFixStages.map((id, index) => ({ id, directory: `${String(index + 1).padStart(2, "0")}-${id}`,
+                entry_handler: "memory-fix-stage-entry", finish_handler: "memory-fix-stage-finish" })),
+            edges: memoryFixStages.slice(0, -1).map((from, index) => ({ from, to: memoryFixStages[index + 1], on: "accepted" })) },
+        { id: "review-fix", handler_status: "registered", entry_stage: "intake", terminal_stages: ["handoff"],
+            stages: reviewFixStages.map((id, index) => ({ id, directory: `${String(index + 1).padStart(2, "0")}-${id}`,
+                entry_handler: "review-fix-stage-entry", finish_handler: "review-fix-stage-finish" })),
+            edges: reviewFixStages.slice(0, -1).map((from, index) => ({ from, to: reviewFixStages[index + 1], on: "accepted" })) },
+        { id: "interactive", handler_status: "registered", entry_stage: "preflight", terminal_stages: ["integration"],
+            stages: interactiveStages.map((id, index) => ({ id, directory: `${String(index + 1).padStart(2, "0")}-${id}`,
+                entry_handler: "interactive-stage-entry", finish_handler: "interactive-stage-finish" })),
+            edges: interactiveStages.slice(0, -1).map((from, index) => ({ from, to: interactiveStages[index + 1], on: "accepted" })) },
+        ...Object.entries(deliveryFlowStages).map(([id, stages]) => ({ id, handler_status: "registered", entry_stage: "preflight", terminal_stages: ["finish"],
+            stages: stages.map((stage, index) => ({ id: stage, directory: `${String(index + 1).padStart(2, "0")}-${stage}`,
+                entry_handler: "delivery-stage-entry", finish_handler: "delivery-stage-finish" })),
+            edges: stages.slice(0, -1).map((from, index) => ({ from, to: stages[index + 1], on: "accepted" })) })),
         ...Object.entries(diagnosticFlowStages).map(([id, stages]) => ({ id, handler_status: "registered", entry_stage: "preflight", terminal_stages: ["report"],
             stages: stages.map((stage, index) => ({ id: stage, directory: `${String(index + 1).padStart(2, "0")}-${stage}`,
                 entry_handler: "diagnostic-stage-entry", finish_handler: "diagnostic-stage-finish" })),

package/dist/services/frozen-engine.js

@@ -12,6 +12,7 @@ import { isMemoryInitResourceStorageFacts } from "./memory-init-resource-storage
 import { memoryInitStartupInputSchemas } from "./memory-init-startup-custody.js";
 import { SETUP_STARTUP_MS } from "../harness-runtime/lib/setup-progress.mjs";
 import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+import { isDeliveryFlow } from "../domain/delivery-flows.js";
 function storageProbeRefuse(reason, probe) {
     const summary = probe ? ` (${probe.error_code ?? probe.signal ?? `exit ${probe.status}`})` : "";
     throw new AppError("frozen_engine_storage_incompatible", `Selected frozen engine cannot admit memory-flow storage${summary}`, 1, { reason, effect: "no_effect", ...(probe ? { probe } : {}) });
@@ -160,6 +161,22 @@ export class AdmittedFrozenEngine {
     admitDiagnosticFlow(source, flowId) {
         return this.#admitMemoryFlow(source, flowId);
     }
+    admitDistillFlow(source) {
+        return this.#admitMemoryFlow(source, "mb-distill");
+    }
+    admitMemoryFixFlow(source) {
+        return this.#admitMemoryFlow(source, "mb-fix");
+    }
+    admitReviewFixFlow(source) {
+        return this.#admitMemoryFlow(source, "review-fix");
+    }
+    admitInteractiveFlow(source) {
+        source.assertEngineCompatibility(this.#manifest);
+        return this.#admitMemoryFlow(source, "interactive");
+    }
+    admitDeliveryFlow(source, flowId) {
+        return this.#admitMemoryFlow(source, flowId);
+    }
     #admitMemoryFlow(source, flowId, startupInputSchema) {
         const fail = (reason, details = {}) => {
             throw new AppError("frozen_engine_flow_incompatible", `Selected frozen engine cannot admit ${flowId} handlers`, 1, { ...details, reason, phase: "prepare", effect: "no_effect" });
@@ -191,7 +208,7 @@ export class AdmittedFrozenEngine {
         const flow = source.resolveRegisteredFlow();
         if (flow.descriptor.id !== flowId)
             fail("foreign_flow_source");
-        const expected = { schema_id: isDiagnosticFlow(flowId) ? "dd-flow/diagnostic-engine-flow@1" : flowId === "mb-upgrade" ? "dd-flow/memory-upgrade-engine-flow@1"
+        const expected = { schema_id: isDeliveryFlow(flowId) ? "dd-flow/delivery-engine-flow@1" : flowId === "interactive" ? "dd-flow/interactive-engine-flow@1" : flowId === "review-fix" ? "dd-flow/review-fix-engine-flow@1" : flowId === "mb-fix" ? "dd-flow/memory-fix-engine-flow@1" : flowId === "mb-distill" ? "dd-flow/distill-engine-flow@1" : isDiagnosticFlow(flowId) ? "dd-flow/diagnostic-engine-flow@1" : flowId === "mb-upgrade" ? "dd-flow/memory-upgrade-engine-flow@1"
                 : startupInputSchema === undefined ? "dd-flow/memory-init-engine-flow@1" : "dd-flow/memory-init-engine-flow@2",
             ...(startupInputSchema === undefined ? {} : { startup_input_schema: startupInputSchema }),
             flow_id: flowId, source_sha256: source.sha256,
@@ -199,7 +216,7 @@ export class AdmittedFrozenEngine {
         revalidate();
         const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !["NODE_OPTIONS", "NODE_PATH"].includes(key) && !key.startsWith("DD_FLOW_")));
         const started = performance.now();
-        const result = spawnSync(this.nodeExecutable, [this.entrypoint, "runtime", "flow", "admit", "--operation", isDiagnosticFlow(flowId) ? flowId : flowId === "mb-init" ? "memory-init" : "memory-upgrade", "--json"], { input, cwd: this.#manifest.snapshot_root, env: { ...env, DD_FLOW_ENGINE_MODE: "1", DD_FLOW_ENGINE_HOME: this.#manifest.snapshot_root },
+        const result = spawnSync(this.nodeExecutable, [this.entrypoint, "runtime", "flow", "admit", "--operation", isDeliveryFlow(flowId) || isDiagnosticFlow(flowId) || flowId === "interactive" || flowId === "mb-distill" || flowId === "mb-fix" || flowId === "review-fix" ? flowId : flowId === "mb-init" ? "memory-init" : "memory-upgrade", "--json"], { input, cwd: this.#manifest.snapshot_root, env: { ...env, DD_FLOW_ENGINE_MODE: "1", DD_FLOW_ENGINE_HOME: this.#manifest.snapshot_root },
             // This is cold startup of a selected CLI, not an already-loaded handler.
             // Admission is bounded local validation; no provider operation is started.
             timeout: SETUP_STARTUP_MS, maxBuffer: 1024 * 1024, shell: false, windowsHide: true });