@deksden-com/dd-flow-cli 0.9.0-beta.16 → 0.9.0-beta.161

package/dist/services/diagnostic-start.js

@@ -0,0 +1,134 @@
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { isSourceSnapshotFlow } from "../domain/source-snapshot-flows.js";
+import { PreparedInstalledFlowSource } from "./installed-flow-source.js";
+import { FrozenGenericExecution } from "./generic-execution.js";
+import { AdmittedFrozenEngine } from "./frozen-engine.js";
+import { prepareDiagnosticSnapshot, diagnosticSnapshotRoot } from "./diagnostic-snapshot.js";
+import { prepareDiagnosticRunBundle } from "./diagnostic-run-bundle.js";
+import { PreparedDescriptorRunStart } from "./descriptor-run-start.js";
+import { readRunStartRequest } from "./run-start-custody.js";
+import { requireProjectByRoot } from "./projects.js";
+import { resolveProjectRoot } from "../storage/paths.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { appendAudit } from "./audit.js";
+import { prepareReviewFixSourceIntake } from "./review-fix-intake-custody.js";
+const event = "diagnostic.request";
+function refuse(reason) { throw new AppError("diagnostic_request_invalid", "Diagnostic request requires its original frozen selection", 2, { reason, effect: "no_effect" }); }
+export function readDiagnosticRequest(context, scope) {
+    const project = requireProjectByRoot(context, resolveProjectRoot(scope.projectRoot));
+    const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type=? AND json_extract(payload_json,'$.scope.requestId')=? LIMIT 2", [project.id, event, scope.requestId]);
+    if (!rows.length)
+        return null;
+    if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 48 * 1024 * 1024)
+        refuse("ambiguous_request");
+    const value = JSON.parse(rows[0].payload_json);
+    if (value.schema_id !== "dd-flow/diagnostic-request@1" || value.project_id !== project.id
+        || hybridDigest(value.scope) !== hybridDigest(scope) || !isSourceSnapshotFlow(value.scope.flowId))
+        refuse("request_scope_changed");
+    if (scope.flowId === "review-fix") {
+        try {
+            const source = value.repair_source;
+            if (!source || source.path !== "runtime/repair-intake.json" || typeof source.base64 !== "string"
+                || !/^[a-f0-9]{64}$/.test(source.sha256) || !Array.isArray(source.selection?.findingIds)
+                || !source.selection.findingIds.length || source.selection.findingIds.length > 4096)
+                refuse("repair_source_missing");
+            const bytes = Buffer.from(source.base64, "base64");
+            if (!bytes.length || bytes.length > 4 * 1024 * 1024 || bytes.toString("base64") !== source.base64
+                || createHash("sha256").update(bytes).digest("hex") !== source.sha256)
+                refuse("repair_source_changed");
+            const capsule = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+            if (capsule.schema_id !== "dd-flow/review-fix-source-intake@1" || capsule.intake.authorization !== "not_granted"
+                || capsule.intake.source.id !== source.selection.sourceRunId
+                || hybridDigest(capsule.intake.selected_findings.map((finding) => finding.id)) !== hybridDigest(source.selection.findingIds))
+                refuse("repair_selection_changed");
+        }
+        catch (error) {
+            if (error instanceof AppError)
+                throw error;
+            return refuse("repair_source_invalid");
+        }
+    }
+    else if (value.repair_source !== undefined)
+        refuse("foreign_repair_source");
+    return value;
+}
+/** Freeze all ambient choices before copying source or allocating a RUN. */
+export function retainDiagnosticRequest(context, input) {
+    const { scope, source, execution, engine } = input;
+    if (!(source instanceof PreparedInstalledFlowSource) || !(execution instanceof FrozenGenericExecution)
+        || !(engine instanceof AdmittedFrozenEngine) || !isSourceSnapshotFlow(scope.flowId) || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,95}$/.test(scope.requestId)
+        || !input.objective.trim() || Buffer.byteLength(input.objective) > 64 * 1024)
+        refuse("invalid_selection");
+    if ((scope.flowId === "review-fix") !== (input.repairSelection !== undefined))
+        refuse("repair_selection_required_only_for_review_fix");
+    const project = requireProjectByRoot(context, scope.projectRoot), frozen = execution.snapshot();
+    if (scope.flowId === "review-fix" && frozen.settings.stage_session_mode === "same_session")
+        refuse("independent_scope_review_session_required");
+    const workspace = diagnosticSnapshotRoot(context, { projectId: project.id, projectRoot: scope.projectRoot, sourceRoot: scope.projectRoot,
+        requestId: scope.requestId, flowId: scope.flowId });
+    if (frozen.scope.projectRoot !== scope.projectRoot || frozen.scope.requestId !== scope.requestId || frozen.scope.workspace !== workspace
+        || frozen.settings.flow_id !== scope.flowId || frozen.settings.descriptor_sha256 !== source.resolveRegisteredFlow().sha256
+        || frozen.settings.attached_session_receipt || frozen.settings.delegation.native_capacity_receipt)
+        refuse("execution_selection_changed");
+    source.revalidate();
+    if (scope.flowId === "review-fix")
+        engine.admitReviewFixFlow(source);
+    else if (scope.flowId === "mb-distill")
+        engine.admitDistillFlow(source);
+    else
+        engine.admitDiagnosticFlow(source, scope.flowId);
+    const manifest = engine.manifest();
+    if (typeof manifest.integrity.checksum !== "string")
+        refuse("engine_identity_missing");
+    let repairSource;
+    if (scope.flowId === "review-fix") {
+        const prior = readDiagnosticRequest(context, scope);
+        if (prior) {
+            if (hybridDigest(prior.repair_source.selection) !== hybridDigest(input.repairSelection))
+                refuse("repair_selection_changed");
+            repairSource = prior.repair_source;
+        }
+        else {
+            const prepared = prepareReviewFixSourceIntake(context, { projectRoot: scope.projectRoot, ...input.repairSelection });
+            repairSource = { selection: structuredClone(input.repairSelection), path: prepared.path, sha256: prepared.sha256, base64: prepared.bytes.toString("base64") };
+        }
+    }
+    const value = { schema_id: "dd-flow/diagnostic-request@1", project_id: project.id, scope: structuredClone(scope),
+        created_at: context.now(), objective: input.objective, selection: structuredClone(input.selection),
+        source: source.snapshot(), source_sha256: source.sha256, execution: frozen, execution_sha256: execution.sha256,
+        engine: { identity: { package_name: manifest.package_name, package_version: manifest.package_version, engine_version: manifest.engine_version,
+                integrity_checksum: manifest.integrity.checksum, snapshot_root: manifest.snapshot_root }, manifest_sha256: engine.manifestSha256 },
+        ...(repairSource ? { repair_source: repairSource } : {}) };
+    if (Buffer.byteLength(JSON.stringify(value)) > 48 * 1024 * 1024)
+        refuse("request_exceeds_bound");
+    return context.db.writeTransaction(() => {
+        const prior = readDiagnosticRequest(context, scope);
+        if (prior) {
+            if (hybridDigest({ ...value, created_at: prior.created_at }) !== hybridDigest(prior))
+                refuse("request_changed");
+            return prior;
+        }
+        if (readRunStartRequest(context, project.id, scope.requestId))
+            refuse("foreign_run_request");
+        appendAudit(context, { projectId: project.id, eventType: event, payload: value });
+        return value;
+    });
+}
+export function startDiagnosticRun(context, scope) {
+    const retained = readDiagnosticRequest(context, scope);
+    if (!retained)
+        refuse("original_request_required");
+    const project = requireProjectByRoot(context, scope.projectRoot);
+    if (readRunStartRequest(context, project.id, scope.requestId))
+        return PreparedDescriptorRunStart.restore(context, scope).apply(context);
+    const snapshot = prepareDiagnosticSnapshot(context, { projectId: project.id, projectRoot: scope.projectRoot, sourceRoot: scope.projectRoot,
+        requestId: scope.requestId, flowId: scope.flowId });
+    const source = PreparedInstalledFlowSource.restoreRetained(retained.source, retained.source_sha256);
+    const execution = FrozenGenericExecution.restore(retained.execution, retained.execution_sha256, source.resolveRegisteredFlow(), {
+        requestId: scope.requestId, projectRoot: scope.projectRoot, workspace: snapshot.root
+    });
+    const engine = AdmittedFrozenEngine.admitSelection(retained.engine.identity, retained.engine.manifest_sha256);
+    const bundle = prepareDiagnosticRunBundle(context, { source, execution, engine, boundAt: retained.created_at, requestText: retained.objective });
+    return PreparedDescriptorRunStart.prepare(context, { bundle }).apply(context);
+}

package/dist/services/diagnostic-work-batch.js

@@ -0,0 +1,34 @@
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+/** Only applicable aspects receive analytical Work. Critics receive all candidates,
+ * including candidates they may reject; no empty pseudo-Work proves coverage. */
+export function diagnosticWorkBatch(input) {
+    const review = input.stage === "review";
+    if (!review && input.stage !== (input.flow_id === "mb-audit" ? "audit" : "analyze")) {
+        throw new AppError("diagnostic_work_batch_invalid", "Diagnostic Work stage belongs to another flow", 2, { effect: "no_effect" });
+    }
+    const applicable = input.coverage.filter(value => value.applicability === "applicable");
+    const architecture = applicable.some(value => value.id ===
+        (input.flow_id === "mb-audit" ? "05" : "architecture_harmonization_review"));
+    const assignments = review
+        ? ["universal", ...(architecture ? ["architecture"] : [])].map(id => ({ id, role: "critic" }))
+        : applicable.map(value => ({ id: value.id, role: "aspect" }));
+    return { works: assignments.map((assignment, index) => {
+            const key = `${assignment.role}-${String(index + 1).padStart(3, "0")}`;
+            const packet = { schema_id: "dd-flow/diagnostic-work-input@1", flow_id: input.flow_id, run_id: input.run_id,
+                stage: input.stage, key, aspect_id: assignment.id, role: assignment.role,
+                input_sha256: input.input_sha256, snapshot_sha256: input.snapshot_sha256,
+                instruction: input.instruction, coverage: input.coverage, support: input.support ?? [],
+                candidates: review ? input.candidates : [] };
+            return { key, depends_on: [], launch_policy: "fresh_agent_required",
+                result_schema: "dd-flow/diagnostic-work-result@1",
+                task: (review
+                    ? `Independently assess every supplied candidate as the ${assignment.id} critic. Read the assigned immutable snapshot. Retain rejected findings and explain disagreement. Do not invent implementation, checks, sources or completion. Return exactly one decision per candidate using the assigned diagnostic result schema. Do not edit project files, repair findings, allocate Work or coordinate the Stage.`
+                    : `Examine only the assigned aspect ${JSON.stringify(assignment.id)} using the frozen instruction and actual snapshot sources. Distinguish implemented behavior from plans and absent evidence. Cite exact sources for material findings; retain uncertainty and active DEFs. Do not edit project files, execute project setup, repair findings, allocate Work or claim independent review. Return the assigned diagnostic Work result.`)
+                    + " Read applicable criterion files in diagnostic.support relative to run_home. They are frozen reference criteria, not executable/manual lifecycle instructions or implemented project facts. Cite snapshot sources as project evidence, not canon references."
+                    + " Every sources/evidence path must be relative to the assigned snapshot workspace root, using forward slashes (for example src/index.ts or .memory-bank/index.md), with the SHA256 of its exact snapshot bytes. Never cite absolute paths, .git, intake transport files, RUN packets or canon support as snapshot evidence; never invent a relative path for a file outside the snapshot."
+                    + " Files under .dd-flow/review-evidence are CLI-generated observations, not original project sources: do not put them in sources/evidence or infer the original repository's history or unborn state from the working copy's Git metadata. For missing linked targets cite the existing referring project document and describe the absence as a limitation, not as a source file.",
+                payload: { kind: review ? "diagnostic-critic" : "diagnostic-aspect", read_only: true,
+                    diagnostic: { ...packet, packet_sha256: hybridDigest(packet) } } };
+        }) };
+}

package/dist/services/diagnostic-work-collection.js

@@ -0,0 +1,97 @@
+import { AppError } from "../shared/errors.js";
+import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+import { readFlowRunExecutionBundle, assertPreparedRunBundleSqlAuthority } from "./runs.js";
+import { requireProjectByRoot } from "./projects.js";
+import { resolveProjectRoot } from "../storage/paths.js";
+import { readRegisteredDiagnosticGraph } from "./diagnostic-work-registration.js";
+import { diagnosticWorkBatch } from "./diagnostic-work-batch.js";
+import { validateDiagnosticWorkResult } from "./diagnostic-work-results.js";
+import { diagnosticSnapshotPaths, readDiagnosticSnapshot, readDiagnosticSnapshotCustody } from "./diagnostic-snapshot.js";
+import { readDescriptorRootWork } from "./descriptor-root-work.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+function refuse(reason) { throw new AppError("diagnostic_work_collection_invalid", "Diagnostic graph is not independently settled", 2, { reason, effect: "no_effect" }); }
+const physicalKey = (session) => `${session.harness}\0${session.provider_session_id}`;
+export function assertDiagnosticSessionIndependence(workers, excluded) {
+    const keys = workers.map(physicalKey), excludedKeys = new Set(excluded.map(physicalKey));
+    if (workers.some(value => !value.harness || !value.provider_session_id)
+        || new Set(keys).size !== keys.length || keys.some(key => excludedKeys.has(key)))
+        refuse("physical_session_reused");
+}
+export function readCompletedResearchWork(context, scope, workId) {
+    const work = context.db.get("SELECT status,result FROM works WHERE project_id=? AND run_id=? AND work_id=?", [scope.projectId, scope.runId, workId]);
+    if (work?.status !== "completed" || !work.result || Buffer.byteLength(work.result) > 1024 * 1024)
+        refuse("work_not_completed");
+    const sessions = context.db.all("SELECT ws.id,ws.session_id,ws.status,s.harness,s.provider_session_id,ws.hook_event_id FROM work_sessions ws JOIN sessions s ON s.project_id=? AND s.session_id=ws.session_id AND s.run_id=? WHERE ws.work_id=? AND ws.status IN ('running','completed') LIMIT 3", [scope.projectId, scope.runId, workId]);
+    if (sessions.length !== 1 || sessions[0].status !== "completed")
+        refuse("work_session_not_settled");
+    const session = sessions[0];
+    const hook = context.db.get("SELECT session_id,harness,provider_session_id,status FROM hook_events WHERE project_id=? AND event_key=?", [scope.projectId, session.hook_event_id]);
+    if (!hook || hook.status !== "claimed" || hook.session_id !== session.session_id
+        || physicalKey(hook) !== physicalKey(session))
+        refuse("physical_work_owner_missing");
+    return { workId, result: work.result, session };
+}
+function collectSql(context, scope, rootId) {
+    const graph = readRegisteredDiagnosticGraph(context, scope);
+    if (!graph || graph.parent_work_id !== rootId)
+        refuse("registration_required");
+    const batch = diagnosticWorkBatch(graph.input);
+    const works = batch.works.map(item => readCompletedResearchWork(context, scope, graph.work_ids[item.key]));
+    const coordinators = context.db.all("SELECT s.harness,s.provider_session_id FROM work_sessions ws JOIN sessions s ON s.project_id=? AND s.run_id=? AND s.session_id=ws.session_id WHERE ws.work_id=?", [scope.projectId, scope.runId, rootId]);
+    const authorGraph = scope.stage === "review" ? readRegisteredDiagnosticGraph(context, { ...scope, stage: graph.input.flow_id === "mb-audit" ? "audit" : "analyze" }) : null;
+    if (scope.stage === "review" && !authorGraph)
+        refuse("author_graph_missing");
+    const authors = authorGraph ? Object.values(authorGraph.work_ids).map(id => readCompletedResearchWork(context, scope, id)) : [];
+    assertDiagnosticSessionIndependence(works.map(value => value.session), [...coordinators, ...authors.map(value => value.session)]);
+    return { graph, works, authors, coordinators };
+}
+/** File/schema/evidence checks occur before settlement. assertCustody is SQL-only
+ * and keeps the selected results and physical owners stable in its writer. */
+export class PreparedDiagnosticWorkCollection {
+    #scope;
+    #rootId;
+    #sql;
+    #snapshot;
+    #results;
+    constructor(scope, rootId, sql, snapshot, results) {
+        this.#scope = scope;
+        this.#rootId = rootId;
+        this.#sql = sql;
+        this.#snapshot = snapshot;
+        this.#results = results;
+        Object.freeze(this);
+    }
+    static prepare(context, input) {
+        const bundle = readFlowRunExecutionBundle(context, input), project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+        if (!bundle || !isDiagnosticFlow(bundle.manifest.flow_id))
+            refuse("diagnostic_bundle_required");
+        const scope = { projectId: project.id, runId: input.runId, stage: input.stage };
+        const frozen = bundle.execution.snapshot().scope;
+        const snapshot = readDiagnosticSnapshot(context, { projectId: project.id, projectRoot: frozen.projectRoot,
+            sourceRoot: frozen.projectRoot, requestId: frozen.requestId, flowId: bundle.manifest.flow_id }, input.runId);
+        if (!snapshot || snapshot.root !== frozen.workspace)
+            refuse("snapshot_required");
+        const root = readDescriptorRootWork(context, scope, bundle);
+        const sql = context.db.readSnapshot(() => {
+            assertPreparedRunBundleSqlAuthority(context, scope, bundle);
+            return collectSql(context, scope, root.workId);
+        });
+        if (sql.graph.bundle_sha256 !== bundle.sha256 || sql.graph.input.snapshot_sha256 !== snapshot.source_sha256)
+            refuse("foreign_graph");
+        const batch = diagnosticWorkBatch(sql.graph.input), schema = bundle.blob("schemas/diagnostic-work-result.schema.json");
+        const results = sql.works.map((work, index) => ({ workId: work.workId,
+            result: validateDiagnosticWorkResult(Buffer.from(work.result), schema, diagnosticSnapshotPaths(context, snapshot, input.runId).root, sql.graph.input, {
+                workId: work.workId, aspectId: batch.works[index].payload.diagnostic.aspect_id,
+                role: batch.works[index].payload.diagnostic.role
+            }) }));
+        return new PreparedDiagnosticWorkCollection(scope, root.workId, sql, snapshot, results);
+    }
+    results() { return structuredClone(this.#results); }
+    assertCustody(context) {
+        const s = this.#snapshot;
+        if (hybridDigest(collectSql(context, this.#scope, this.#rootId)) !== hybridDigest(this.#sql)
+            || hybridDigest(readDiagnosticSnapshotCustody(context, { projectId: s.projectId, projectRoot: s.projectRoot,
+                sourceRoot: s.sourceRoot, requestId: s.requestId, flowId: s.flowId }, this.#scope.runId)) !== hybridDigest(s))
+            refuse("collection_changed");
+    }
+}

package/dist/services/diagnostic-work-registration.js

@@ -0,0 +1,101 @@
+import { AppError } from "../shared/errors.js";
+import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+import { requireProjectByRoot } from "./projects.js";
+import { resolveProjectRoot } from "../storage/paths.js";
+import { readFlowRunExecutionBundle, assertPreparedRunBundleSqlAuthority } from "./runs.js";
+import { readDescriptorStageInput } from "./descriptor-stage-coordinator.js";
+import { readDescriptorRootWork } from "./descriptor-root-work.js";
+import { diagnosticSnapshotPaths, readDiagnosticSnapshot, readDiagnosticSnapshotCustody } from "./diagnostic-snapshot.js";
+import { readAcceptedStageData } from "./stage-report-renderer.js";
+import { validateDiagnosticStageResult } from "./diagnostic-stage-results.js";
+import { diagnosticWorkBatch } from "./diagnostic-work-batch.js";
+import { addWorkBatch, prepareWorkBatch, readWorkBatchCustody } from "./work-registry.js";
+import { stageGraphScope } from "./stage-work-graph.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { appendAudit } from "./audit.js";
+const event = "diagnostic.work_registration";
+function refuse(reason) { throw new AppError("diagnostic_work_registration_invalid", "Diagnostic graph lacks its assigned stage authority", 2, { reason, effect: "no_effect" }); }
+/** SQL-only reader. An explicitly registered empty graph is distinct from no graph. */
+export function readRegisteredDiagnosticGraph(context, scope) {
+    const graph = stageGraphScope(context, scope.projectId, scope.runId, scope.stage);
+    const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type=? AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.stage')=? AND json_extract(payload_json,'$.attempt')=? LIMIT 2", [scope.projectId, event, scope.runId, scope.stage, graph.attempt]);
+    if (!rows.length)
+        return null;
+    if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 2 * 1024 * 1024)
+        refuse("ambiguous_registration");
+    const receipt = JSON.parse(rows[0].payload_json);
+    if (receipt.schema_id !== "dd-flow/diagnostic-work-registration@1" || receipt.run_id !== scope.runId
+        || receipt.stage !== scope.stage || receipt.attempt !== graph.attempt || !receipt.work_ids
+        || receipt.input.run_id !== scope.runId || receipt.input.stage !== scope.stage
+        || receipt.input.input_sha256 !== receipt.input_sha256)
+        refuse("foreign_registration");
+    const batch = diagnosticWorkBatch(receipt.input);
+    if (receipt.batch_sha256 !== hybridDigest(batch.works) || batch.works.length !== Object.keys(receipt.work_ids).length
+        || new Set(Object.values(receipt.work_ids)).size !== batch.works.length)
+        refuse("changed_batch");
+    for (const item of batch.works) {
+        const id = receipt.work_ids[item.key];
+        if (!id)
+            refuse("missing_work");
+        const custody = readWorkBatchCustody(context, id);
+        if (custody.item_key !== item.key || custody.batch_sha256 !== receipt.batch_sha256
+            || hybridDigest(custody.work_ids) !== hybridDigest(receipt.work_ids)
+            || hybridDigest(custody.scope) !== hybridDigest({ ...graph, stage: scope.stage,
+                parent_work_id: receipt.parent_work_id, request_key: "diagnostic-graph" }))
+            refuse("changed_work_custody");
+    }
+    return receipt;
+}
+/** The registered handler calls this only after generic Stage entry. Applicability
+ * and candidates come from the accepted predecessor, not a caller-owned batch. */
+export function registerDiagnosticStageGraph(context, input) {
+    const bundle = readFlowRunExecutionBundle(context, input), project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    if (!bundle || !isDiagnosticFlow(bundle.manifest.flow_id) || !["audit", "analyze", "review"].includes(input.stage))
+        refuse("diagnostic_stage_required");
+    const flowId = bundle.manifest.flow_id, frozen = bundle.execution.snapshot().scope;
+    const scope = { projectId: project.id, runId: input.runId, stage: input.stage };
+    const selection = readDescriptorStageInput(context, scope, bundle), root = readDescriptorRootWork(context, scope, bundle);
+    const snapshotSelection = { projectId: project.id, projectRoot: frozen.projectRoot, sourceRoot: frozen.projectRoot, requestId: frozen.requestId, flowId };
+    const snapshot = readDiagnosticSnapshot(context, snapshotSelection, input.runId);
+    if (!snapshot || snapshot.root !== frozen.workspace)
+        refuse("snapshot_required");
+    const previousStage = input.stage === "review" ? flowId === "mb-audit" ? "audit" : "analyze" : "preflight";
+    if (selection.input.predecessor?.stage !== previousStage)
+        refuse("predecessor_required");
+    const previousScope = { ...scope, stage: previousStage };
+    const accepted = readAcceptedStageData(context, previousScope), previousInput = readDescriptorStageInput(context, previousScope, bundle, true, true);
+    const previous = validateDiagnosticStageResult(accepted.bytes, bundle.descriptor.stageBlob(previousStage, "result_schema"), {
+        flowId, runId: input.runId, stage: previousStage, inputSha256: previousInput.inputSha256,
+        snapshotRoot: diagnosticSnapshotPaths(context, snapshot, input.runId).root, snapshotSha256: snapshot.source_sha256,
+        predecessors: previousInput.input.predecessor ? [{ stage: previousInput.input.predecessor.stage,
+                path: previousInput.input.predecessor.result.path, sha256: previousInput.input.predecessor.result.sha256 }] : []
+    });
+    const workInput = { flow_id: flowId, run_id: input.runId, stage: input.stage,
+        input_sha256: selection.inputSha256, snapshot_sha256: snapshot.source_sha256,
+        instruction: bundle.descriptor.stageBlob(input.stage, "instruction").toString("utf8"),
+        coverage: previous.details.coverage, candidates: input.stage === "review" ? previous.details.findings : [],
+        support: bundle.manifest.inventory.filter(ref => ref.path.startsWith("support/")).map(ref => ({ path: `execution-bundle/${ref.path}`, sha256: ref.sha256 })) };
+    const batch = diagnosticWorkBatch(workInput), batchInput = { parentWorkId: root.workId, stage: input.stage, requestKey: "diagnostic-graph", value: batch };
+    const prepared = batch.works.length ? prepareWorkBatch(context, batchInput) : [];
+    return context.db.writeTransaction(() => {
+        assertPreparedRunBundleSqlAuthority(context, scope, bundle);
+        if (hybridDigest(readDiagnosticSnapshotCustody(context, snapshotSelection, input.runId)) !== hybridDigest(snapshot)
+            || hybridDigest(readDescriptorStageInput(context, scope, bundle)) !== hybridDigest(selection)
+            || hybridDigest(readAcceptedStageData(context, previousScope)) !== hybridDigest(accepted)
+            || readDescriptorRootWork(context, scope, bundle).workId !== root.workId)
+            refuse("stage_authority_changed");
+        const expected = { schema_id: "dd-flow/diagnostic-work-registration@1", run_id: input.runId, stage: input.stage,
+            attempt: selection.attempt, parent_work_id: root.workId, bundle_sha256: bundle.sha256,
+            input_sha256: selection.inputSha256, input: workInput, batch_sha256: hybridDigest(batch.works) };
+        const prior = readRegisteredDiagnosticGraph(context, scope);
+        if (prior) {
+            if (hybridDigest({ ...prior, work_ids: undefined }) !== hybridDigest(expected))
+                refuse("registration_changed");
+            return prior;
+        }
+        const workIds = batch.works.length ? addWorkBatch(context, { ...batchInput, prepared }).work_ids : {};
+        const receipt = { ...expected, work_ids: workIds };
+        appendAudit(context, { projectId: project.id, eventType: event, payload: receipt });
+        return readRegisteredDiagnosticGraph(context, scope);
+    });
+}

package/dist/services/diagnostic-work-results.js

@@ -0,0 +1,93 @@
+import { Ajv2020 } from "ajv/dist/2020.js";
+import { verifyDiagnosticSources, verifyDiagnosticCritic } from "./diagnostic-evidence.js";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+const refuse = (reason) => {
+    throw new AppError("diagnostic_work_result_invalid", "Diagnostic Work result does not match its assigned task", 2, { reason, effect: "no_effect", ...(reason === "invalid_schema" ? { phase: "prepare", recoverable: true } : {}) });
+};
+/** Accepts semantic data only after the caller has established completed Work,
+ * immutable batch custody and physical Session independence. */
+export function validateDiagnosticWorkResult(bytes, schemaBytes, snapshotRoot, input, assignment) {
+    if (!bytes.length || bytes.length > 1024 * 1024 || schemaBytes.length > 1024 * 1024)
+        refuse("result_exceeds_bound");
+    const validate = (() => {
+        try {
+            const schema = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(schemaBytes));
+            if (schema.$id !== "dd-flow/diagnostic-work-result@1")
+                refuse("frozen_schema_invalid");
+            return new Ajv2020({ strict: false, validateFormats: false }).compile(schema);
+        }
+        catch {
+            return refuse("frozen_schema_invalid");
+        }
+    })();
+    let result;
+    try {
+        result = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    catch {
+        return refuse("invalid_schema");
+    }
+    if (!validate(result))
+        refuse("invalid_schema");
+    if (result.flow_id !== input.flow_id || result.run_id !== input.run_id || result.stage !== input.stage
+        || result.work_id !== assignment.workId || result.aspect_id !== assignment.aspectId)
+        refuse("foreign_assignment");
+    verifyDiagnosticSources(snapshotRoot, result.sources);
+    if (assignment.role === "critic") {
+        if (input.stage !== "review" || result.findings.length)
+            refuse("critic_cannot_replace_candidates");
+        verifyDiagnosticCritic(snapshotRoot, input.candidates, result.decisions);
+    }
+    else {
+        if (input.stage === "review" || result.decisions.length
+            || !input.coverage.some(value => value.id === assignment.aspectId && value.applicability === "applicable"))
+            refuse("foreign_aspect");
+        const ids = new Set();
+        for (const finding of result.findings) {
+            if (ids.has(finding.id) || finding.aspect_id !== assignment.aspectId || !finding.evidence.length)
+                refuse("foreign_or_duplicate_finding");
+            ids.add(finding.id);
+            verifyDiagnosticSources(snapshotRoot, finding.evidence);
+        }
+    }
+    return result;
+}
+/** Work-local IDs are not globally unique. Keep their origin when assigning
+ * stable report IDs, so one author's FIND-1 cannot overwrite another's. */
+export function collectDiagnosticCandidates(results) {
+    const findings = [], origins = [];
+    const seen = new Set();
+    for (const [workIndex, item] of results.entries()) {
+        if (seen.has(item.workId) || item.result.work_id !== item.workId || item.result.stage === "review")
+            refuse("duplicate_or_foreign_work");
+        seen.add(item.workId);
+        for (const [findingIndex, finding] of item.result.findings.entries()) {
+            const id = `FIND-${String(workIndex + 1).padStart(3, "0")}-${String(findingIndex + 1).padStart(3, "0")}`;
+            findings.push({ ...structuredClone(finding), id });
+            origins.push({ id, work_id: item.workId, original_id: finding.id });
+        }
+    }
+    return { findings, origins };
+}
+/** Assign CLI-owned global IDs only to an exact, ordered copy of admitted Work
+ * findings. Any other proposal still goes through the ordinary strict guards. */
+export function sealDiagnosticCandidateIds(bytes, results) {
+    if (!bytes.length || bytes.length > 1024 * 1024)
+        return bytes;
+    let value;
+    try {
+        value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    catch {
+        return bytes;
+    }
+    if (!value || !Array.isArray(value.details?.findings)
+        || hybridDigest(value.details.findings) !== hybridDigest(results.flatMap(item => item.result.findings)))
+        return bytes;
+    const canonical = collectDiagnosticCandidates(results).findings;
+    if (hybridDigest(value.details.findings) === hybridDigest(canonical))
+        return bytes;
+    value.details.findings = canonical;
+    return Buffer.from(JSON.stringify(value));
+}

package/dist/services/discovery/agy-discovery.js

@@ -0,0 +1,2 @@
+import { discoverExecutable } from "./static.js";
+export const discoverAgy = (input) => discoverExecutable("agy", ["agy"], input);

package/dist/services/discovery/codex-discovery.js

@@ -0,0 +1,2 @@
+import { discoverExecutable } from "./static.js";
+export const discoverCodex = (input) => discoverExecutable("codex", ["codex"], input);

package/dist/services/discovery/droid-discovery.js

@@ -0,0 +1,2 @@
+import { discoverExecutable } from "./static.js";
+export const discoverDroid = (input) => discoverExecutable("droid", ["droid"], input);

package/dist/services/discovery/grok-discovery.js

@@ -0,0 +1,2 @@
+import { discoverExecutable } from "./static.js";
+export const discoverGrok = (input) => discoverExecutable("grok", ["grok"], input);

package/dist/services/discovery/opencode-discovery.js

@@ -0,0 +1,2 @@
+import { discoverExecutable } from "./static.js";
+export const discoverOpenCode = (input) => discoverExecutable("opencode", ["opencode"], input);

package/dist/services/discovery/static.js

@@ -0,0 +1,31 @@
+import fs from "node:fs";
+import path from "node:path";
+import { AppError } from "../../shared/errors.js";
+/** Presence only: no child process, config/credential read, network or generative probe. */
+export function discoverExecutable(harness, names, input) {
+    const platform = input.platform ?? process.platform;
+    if (input.executable && !path.isAbsolute(input.executable))
+        throw new AppError("usage", "Explicit executable must be an absolute path", 2, { effect: "no_effect" });
+    const suffixes = platform === "win32" ? (input.env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";").filter(suffix => /^\.[A-Za-z0-9]+$/.test(suffix)) : [""];
+    const paths = input.executable ? [input.executable] : (input.env.PATH ?? "").split(platform === "win32" ? ";" : path.delimiter)
+        .filter(directory => path.isAbsolute(directory)).flatMap(directory => names.flatMap(name => suffixes.map(suffix => path.join(directory, `${name}${suffix}`))));
+    const candidates = new Map();
+    let unreadable = false;
+    for (const file of paths) {
+        try {
+            if (!fs.statSync(file).isFile())
+                continue;
+            fs.accessSync(file, platform === "win32" ? fs.constants.F_OK : fs.constants.X_OK);
+            candidates.set(fs.realpathSync(file), file);
+        }
+        catch (error) {
+            if (!["ENOENT", "ENOTDIR"].includes(error.code ?? ""))
+                unreadable = true;
+        }
+    }
+    const selected = candidates.size === 1;
+    return { harness, candidates: [...candidates.keys()].map(file => ({ path: file, version: null, selected })),
+        installed: selected ? "yes" : candidates.size > 1 || unreadable ? "unknown" : "no",
+        compatible: "unknown", protocol: "unknown", auth: "unknown", qualified: "unknown", evidence: [],
+        reason: selected ? "executable_present_no_qualification_probe" : candidates.size > 1 ? "multiple_installations_require_explicit_selection" : unreadable ? "filesystem_observation_incomplete" : "executable_not_found" };
+}

package/dist/services/discovery/zcode-discovery.js

@@ -0,0 +1,2 @@
+import { discoverExecutable } from "./static.js";
+export const discoverZcode = (input) => discoverExecutable("zcode", ["zcode"], input);